If You Use Gmail or Hotmail, the PIXELSCLOUD Leak Should Worry You

HEROIC analysts identified a stealer log uploaded to a Telegram channel on June 3, 2025, labeled by its uploader as "LOGSYNC_PIXELSCLOUD_VALID_COOKIE_GMAIL_HOTMAIL_YOUTUBE." The file contained 2,357 records, each pairing an email address with a plaintext password and a related URL. The label itself points to Gmail, Hotmail, and YouTube accounts as the likely targets, consistent with infostealer malware built to grab saved logins and session data from those specific services.

Why This Leak Targets What You Use Every Day

Gmail and Hotmail are not just email inboxes, they are often the recovery address for banking, shopping, and social media accounts. If an attacker gets into one of those accounts using a leaked password, they can reset passwords on almost everything else tied to it. Because the passwords in this log are stored in plaintext, no cracking is required, an attacker can try them the moment they get the file.

What Was Exposed in the PIXELSCLOUD Log

• Email addresses, including Gmail and Hotmail accounts
• Plaintext passwords
• URLs of the associated login pages or services, including YouTube

In total, 2,357 records were included in the file.

Why This Matters

Stolen email and password pairs like these are the raw material for credential stuffing, where attackers automate login attempts against other sites using the same combination. Because email accounts are often the key to resetting passwords elsewhere, a compromised Gmail or Hotmail login can lead directly to account takeover across multiple services, and from there to financial fraud or identity theft if the account holds any personal or payment information.

How a Stealer Log Like This Gets Built

Infostealer malware infects a device and quietly copies saved browser passwords and session details, then sends everything back to whoever controls the malware. The label on this file suggests it was built specifically to pull working logins for major webmail and video platforms, then packaged and shared under a name like PIXELSCLOUD. Logs like this are routinely traded or sold in Telegram channels and dark web forums, extending their reach well past the original infection.

Check If You Are Affected

If your Gmail or Hotmail address could be part of this leak, you want to know now, not after someone else logs in first. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can see what has been exposed and change any reused passwords right away.