Researchers Link PrimoCloud to 21,021 Stolen Login Credentials

21,021 Login Credentials Traced to the PrimoCloud Upload

HEROIC researchers identified a stealer log file, labeled "PrimoCloud - 25 JULY - 3000PCS MIXED - ON PUBLIC CHANNEL," posted to a public Telegram channel on 25 Jul 2026. Analysis linked the file to 21,021 exposed records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials open.

Why This Is Dangerous

Unlike private or paid stealer log listings, this file was shared on a public channel, meaning anyone with a Telegram account could download it without paying or requesting access. The data was assembled from individual infections on victims' own devices, where malware quietly recorded every login typed into a browser. Each record pairs a live password with the exact site it unlocks, so an attacker can log straight in without needing to crack or guess a single credential.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

With 21,021 plaintext credentials sitting on a public channel, attackers of any skill level have a large, ready-to-use list for automated login attempts across banking sites, webmail, and social media accounts. Anyone who reused a password from an account in this file elsewhere faces real exposure to credential stuffing, account takeover, identity theft, and financial fraud.

How Stealer Log Archives Like This Are Built

Stealer logs like this one come from information stealing malware that infects a device through cracked software, malicious attachments, or fake update prompts. The malware quietly copies saved browser passwords, autofill data, and session details, then reports back to whoever controls it. Large mixed collections like this one, labeled "3000PCS MIXED," combine logs from many infected devices before being posted to public Telegram channels for wide, unrestricted access.

Check If You Are Affected

To see whether your email or passwords appear in this leak or any other, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes less than a minute to check your exposure and get clear next steps to secure your accounts.