Pegasus Cloud TG Leak: 29,606 Passwords Exposed Online

HEROIC analysts discovered a stealer log file circulating on Telegram, uploaded by a user under the name "Pegasus Cloud TG." The file, added to our database on 20 June 2026, contained 29,606 individual records harvested directly from infected devices. Each record links a website endpoint, an email address, and a plaintext password, giving anyone who downloads the file an instant set of working logins.

Why This Is Dangerous: Ready-Made Logins, No Cracking Required

Unlike a typical database leak where passwords are hashed and need to be cracked, stealer logs hand attackers the credentials in plain, readable text. There is no encryption to break and no guesswork involved. An attacker can simply copy an email and password pair from this file and try logging into the matching website immediately.

Because the malware also captured the exact URL where each password was used, criminals know precisely which site each login belongs to. This dramatically speeds up account takeover compared to a random breach dump.

What Was Exposed

• Email addresses
• Plaintext passwords
• Website URLs (login endpoints tied to each credential)

Why This Matters: From One Password to Many Accounts

Most people reuse passwords across several accounts. If your email and password from this leak match credentials you use on banking, shopping, or social media sites, attackers can attempt credential stuffing, automatically testing the same combo across hundreds of other services.

A successful match can lead to account takeover, financial fraud, or identitiy theft, especially if the compromised account is linked to email recovery or payment information.

How Stealer Logs Work

Stealer logs come from malware, often disguised as cracked software, game cheats, or fake browser updates, that quietly infects a victim's computer. Once installed, the malware scans saved browser passwords, autofill data, and session cookies, then bundles everything into a single log file. These logs are frequently sold or dumped for free in Telegram channels like the one behind this incident, where anyone can grab them in seconds.

Check If You Are Affected

You do not have to guess whether your information is sitting in a file like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs just like the Pegasus Cloud TG upload. Run a free scan today and find out if it is time to change your passwords.