Global Stealer Log Redline_Cl0ud4 Leak: 9,711,135 Logins Exposed

HEROIC analysts uncovered a massive stealer log dump labeled FRESH ULPP 02-06-2026 Redline_Cl0ud4, uploaded to Telegram on 2 June 2026. The file contains 9,711,135 records of email addresses, plaintext passwords, and login URLs, making it one of the largest single stealer log uploads HEROIC has tracked, and one advertised by its uploader as "fresh," meaning the credentials were likely still active at the time of posting.

Why the Redline_Cl0ud4 Leak Is Dangerous

A dataset of nearly 10 million plaintext credential pairs, spread across countless websites and services worldwide, gives attackers an enormous global attack surface in a single download. Because the file was marketed as fresh, the passwords inside are more likely to still be valid, unlike older leaks where many accounts have since changed credentials. Combined with the included URLs pointing to each login's exact source, this file is essentially plug-and-play for account takeover at scale.

What Was Exposed in Redline_Cl0ud4

• Email addresses
• Plaintext passwords
• URLs of the sites where credentials were entered

Why This Matters for Millions of Accounts Worldwide

A leak of this size touches victims across countless countries and industries at once, not one region or one company. Every one of the 9,711,135 exposed records is raw material for credential stuffing, where automated tools test stolen logins against banking, email, and shopping sites globally. Reused passwords turn a single leaked credential into account takeover, identity theft, and financial fraud far beyond the original login it was tied to.

How a Fresh ULPP Stealer Log Like This Gets Made

ULPP files (URL, Login, Password, Password-related metadata) are produced by infostealer malware that silently harvests saved credentials from infected devices around the world, then bundles them by infection batch or malware variant, in this case tagged Redline_Cl0ud4. Sellers label logs as "fresh" when they come from recent infections, since recently stolen passwords are more valuable and more likely to still work than older, previously circulated data.

Check If You Are Affected

With close to 10 million records in this single file, the odds that your email address is included are real. HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records, giving you a fast, clear answer so you can change any reused passwords before someone else uses them first.