RedX Cloud Stealer Log Exposes 80,564 Login Credentials.

On August 6, 2026, a stealer log labeled "RedX Cloud TG ArhontCorp.part2" surfaced on Telegram. HEROIC identified 80,564 records inside, each pairing an email address with a plaintext password and a URL.

Why This Is Dangerous

Eighty thousand plaintext credentials in one file is a large enough dataset to run effective, automated attacks at scale. No cracking is needed, the passwords work exactly as written, which means the barrier between finding this file and using it is nearly zero.

What Was Exposed in the RedX Cloud Stealer Log

• Email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters

A dataset this size gives attackers enough volume to automate credential stuffing across major websites, testing all 80,564 pairs against banking, email, and shopping logins. Even a small success rate translates into thousands of compromised accounts, and from there, financial fraud and identity theft become real possibilities.

How Stealer Logs Work

Stealer logs are produced by malware that infects individual devices and quietly copies saved browser passwords, autofill entries, and session data. The ".part2" in this file's name indicates it's one segment of a larger collection, likely split up to make distribution and sale easier across the ArhontCorp Telegram channel.

Check If You Are Affected

With a file this large, the odds of your information being included are worth taking seriously. HEROIC's free breach scanner checks your email against more than 400 billion leaked records in seconds, so you can confirm your exposure and act fast.