BREAKING: PegasusCloud Exposes 47,936 Records in Stealer Log Incident

In November 2025, a Telegram user uploaded a stealer log tied to PegasusCloud, exposing 47,936 records that include plaintext passwords, email adresses, and API host URLs. This is a substantially larger dataset than typical single-upload stealer logs, and the fact it was posted publicly on Telegram means tens of thousands of real user credentials are now in open circulation.

Why This Is Dangerous

With nearly 48,000 records, this is not a small, contained exposure. Stealer logs at this volume are immediately useful for large-scale credential stuffing operations where automated tools cycle through thousands of username and password combinations against popular login portals. Every record in this dataset represents a real person whose account security has already been compromised.

The plaintext nature of the passwords removes any technical barrier to exploitation. Attackers do not need to run any cracking tools or reverse any hashes. The passwords are ready to use exactly as captured, meaning the window between exposure and active exploitation is measured in hours, not weeks.

API host URLs included alongside the credentials add an extra layer of risk for businesses and developers. These URLs indicate specific services or platforms the credentials authenticate against, allowing attackers to prioritize high-value targets like cloud infrastructure, payment systems, or internal developer tools rather than guessing where to focus their efforts.

What Was Exposed

• Email addresses linked to compromised accounts
• Plaintext passwords captured from infected endpoint devices
• API host URLs and cloud service endpoints
• Browser-saved login credentials and autofill data
• Session tokens and active authentication cookies
• Developer and service account credentials
• Application configuration data containing embedded secrets
• Endpoint device connection information

Why This Matters

Nearly 48,000 records from users in the United States being freely available on Telegram is the kind of data dump that fuels months of follow-on criminal activity. Credential stuffing, account takeovers, and spear phishing campaigns are all made easier when attackers have a verified list of real email and password combinations to work from. Many of the people in this dataset may have already had accounts accessed before they were even aware of the breach.

The scale of this particular upload also suggests the stealer malware responsible was deployed widely, possibly through a campaign targeting a large segment of users associated with PegasusCloud services. Anyone who beleives their account was safe simply because they did not recieve any suspicious activity notices should verify their exposure, as many account takeovers go undetected for extended periods.

How Stealer Log Works

Infostealer malware is built to operate invisibly on infected devices, harvesting credentials continuously without alerting the user. These programs are distributed through phishing campaigns, trojanized software downloads, malicious browser extensions, and compromised websites. Once installed, they scan the device for every credential they can find, including browser-saved passwords, cookies, and application config files.

The harvested data is packaged into a structured log and exfiltrated to the attacker's infrastructure, where it is either sold on dark web marketplaces or, as occured here, distributed freely on Telegram channels. Public channels like the one used in this upload can have hundreds or thousands of subscribers, meaning the audience for this data was enormous from the moment of upload.

What makes these infections particularly hard to detect is that they do not behave like traditional malware that causes visible damage. There are no slowdowns, no ransom notes, no obvious signs that anything unusual hapened. The device continues to function normally while credentials are quietly being siphoned out and shared with strangers online.

Check If You Were Affected

With nearly 48,000 records exposed in this PegasusCloud stealer log, there is a real chance your credentials are in this dataset. Check your email address right now at heroic.com using HEROIC's free breach checker to find out if your data was included in this or any other known breach, and get clear steps on what to do to secure your accounts immediately.