Researchers Found SunCloudNew 1122 Logs With 2,933,512 Records

Threat monitoring teams flagged a fresh upload on February 24, 2026, tucked into a Telegram channel under the name SunCloudNew 1122 - 4.13 M ULP. Once opened, the file turned out to hold 2,933,512 usable records, each one pairing an email, a plaintext password, and the exact site it belonged to.

Why This Is Dangerous

Nearly 3 million records puts this file in the same league as breaches that make national news, except this one came from an infostealer quietly working in the background on infected machines, not a single company getting hacked. That distinction matters less to the victims than the fact that their passwords are now sitting in a public channel.

What Was Exposed

• Email addresses linked to each compromised device
• Plaintext passwords with zero encryption applied
• URLs showing exactly which accounts and services were logged into

Why This Matters

A file this size doesn't stay contained to one Telegram channel for long. It gets copied, reposted, and folded into bigger collections within days, meaning the real number of people who end up seeing these 2,933,512 records is almost certainly higher than the original upload count, wich is why acting quickly is neccessary.

How Stealer Logs Work

Infostealer malware infects a device through things like cracked software, fake installers, or malicious email attachments, then sits quietly harvesting saved browser passwords, autofill entries, and session cookies. Once it has gathered enough, it ships everything back to the attacker, who bundles it into a "ULP" file, short for username, login, password, and posts it for other criminals to use or resell.

Check If You Are Affected

You don't have to guess whether you're one of the 2,933,512 people affected. HEROIC's free scanner checks your details against more than 400 billion breached and leaked records, including stealer logs like SunCloudNew 1122, so you can find out in seconds and secure your accounts.