The RedX_Cloud Leak: 44,434 Stolen Logins Hit the Dark Web

44,434 Records Exposed in New Telegram Stealer Log Upload

HEROIC analysts identified a new stealer log file, labeled "RedX_Cloud - 12645 File.part2," uploaded to a Telegram channel on 24 Jul 2026. The file contained 44,434 individual records harvested directly from infected devices, including email addresses, plaintext passwords, and the URLs of the websites those credentials belong to.

Why This Is Dangerous

Unlike a typical company database leak, this file was not stolen from a corporate server. It was pulled straight off victims' own computers by malware that quietly recorded every login they typed. That means each entry in this file is a working, current username and password pair for a real account, tied to the exact website it unlocks. An attacker does not have to guess or crack anything. They can copy the credentials straight into the listed URL and log in.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because the passwords in this file are stored in plaintext and matched to specific site URLs, they are ready to use for account takeover the moment someone downloads the file. If any of the affected people reused that email and password combination anywhere else, banking apps, work email, social media, criminals can try the same login across dozens of other sites in minutes. This kind of exposure feeds directly into credential stuffing attacks, identity theft, and financial fraud.

How Stealer Log Leaks Like This Happen

Stealer logs come from information stealing malware that infects a device, often through a cracked software download, a malicious email attachment, or a fake browser update. Once installed, the malware silently reads saved passwords, browser autofill data, and session cookies, then packages everything into a file and sends it back to whoever controls it. Files like this one are frequently repackaged and shared or sold in Telegram channels and dark web forums, where anyone can download them.

Check If You Are Affected

If you think your email or login details could be part of this stealer log or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes less than a minute to see if your data has shown up in this leak or any other, and to get clear next steps for locking down your accounts.