Inside RedLine Cl0ud4: How Malware Harvested 4.72M Passwords

"FRESH ULPP Redline_Cl0ud4" Stealer Log Exposes 4,722,391 Records

HEROIC analysts identified another large stealer log file labeled "FRESH ULPP 22-07-2026 Redline_Cl0ud4" that surfaced on a Telegram channel on July 22, 2026. The file contained 4,722,391 records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. The name references RedLine Stealer, one of the most widely used pieces of credential-stealing malware, and appears to be a follow-up batch to an earlier "Redline_Cl0ud4" file uploaded two days prior.

Why This Is Dangerous

RedLine Stealer works by quietly pulling saved usernames, passwords, and autofill data directly out of a victim's browser, which is why the passwords in this file appear in plaintext rather than hashed. Paired with the matching URL for each account, an attacker has 4.72 million ready-made logins, each one already sorted by the exact site it unlocks.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters

At a scale of nearly 4.72 million records, it is highly likely that a large share of these people reused their passwords elsewhere. Attackers exploit that habit through credential stuffing, automatically testing leaked logins against banking, email, and social media platforms. That process can lead directly to account takeover, identity theft, and financial fraud for a large number of victims at once.

How Stealer Logs Work

RedLine Stealer typically spreads through cracked software, fake downloads, and malicious email attachments. Once it infects a device, it silently harvests everything saved in the browser: usernames, passwords, autofill entries, and browsing history, then sends that data back to whoever controls the malware. Individual infections are combined into large "fresh" batches like this one and uploaded to Telegram channels for others to use.

Check If You Are Affected

Given the scale of this leak, checking your email is worth doing now. HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records, including large RedLine dumps like this one.