Pegasus Cloud TG PegasusCloud: 18,372 Logins Found Online

HEROIC analysts identified a stealer log file named Pegasus Cloud TG PegasusCloud on 31-Aug-2026, containing 18,372 records of email addresses, plaintext passwords, and the URLs attached to each one. The file was compiled from malware-infected devices and shared on Telegram. With over 18,000 records in circulation, scanning your email is the fastest way to check whether you're affected.

What an attacker gains from this leak

Each of the 18,372 records hands over a complete login: a verified email, a readable password, and the exact page it opens. That combination removes any guesswork, letting an attacker sign in directly, without needing to crack a hash or break any security measure first.

What the Pegasus Cloud Stealer Log Contained

• Email Addresses: reveal the accounts and identities tied to each login.
• Plaintext Password: stored as plain text, ready to use without cracking.
• URLs: show exactly which site each credential pair unlocks.

Real-world consequences

At over 18,000 working logins, account takeover is a realistic threat for anyone in this file, and reused passwords extend that risk to email, banking, and other linked accounts. Large files like this are often tested automatically across many sites, so exposure can turn into an actual break-in within hours of release.

How this stealer log was assembled

Credential-stealing malware on infected devices quietly collects saved logins and browsing data, sending it back to whoever controls the infection. That person then compiles the results into a single file, as happened here, and shares it further with little effort or cost.

Scan your email to check this file

Scan your email to see if you're one of the 18,372 records exposed here. If you find a match, change that password immediately and avoid reusing it elsewhere.

Scan your work email too, since personal and work logins are frequently mixed together in files like this.