One File. 91,809 Logins. The RedX_Cloud Part 3 Leak Landed.

91,809 Logins Exposed in the RedX_Cloud Part 3 Upload

HEROIC analysts found a stealer log file, labeled "Telegram RedX_Cloud - 12645 File.part3," uploaded to a Telegram channel on 24 Jul 2026. This third file in the RedX_Cloud series contained 91,809 records taken directly from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those logins open.

Why This Is Dangerous

This data was not stolen from one company's servers. It was gathered from individual infected computers, then compiled into a multi-part archive under the RedX_Cloud name. Because the passwords are stored in plaintext and matched to specific site URLs, anyone who downloads this file can log straight into the accounts listed without cracking or guessing a single password.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

With over 91,000 plaintext credentials in this file alone, attackers have a large, ready-to-use list for automated login attempts across banking sites, email accounts, and social media platforms. Anyone who reused their password from an account in this file elsewhere faces real exposure to credential stuffing, account takeover, identity theft, and financial fraud.

How Stealer Log Archives Like This Are Built

Files like this one are built from information stealing malware that infects victims through cracked software, malicious email attachments, or fake update prompts. The malware quietly copies saved browser passwords, autofill data, and session details, then reports back to whoever controls it. Operators often combine logs from many infections into a single archive, splitting it into multiple parts like this part3 file, before distributing them through Telegram channels and dark web marketplaces.

Check If You Are Affected

To see whether your email or passwords appear in this leak or any other, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes less than a minute to check your exposure and get clear next steps to secure your accounts.