Researchers Link the Cloud_Rolex Dump to 5,719 Stolen Credentials

Researchers Link the Cloud_Rolex Dump to 5,719 Stolen Credentials

HEROIC analysts identified a stealer log uploaded to a public Telegram channel on September 17, 2025. Labeled Cloud_Rolex, the file contains 5,719 records tied to United States based accounts, made up of email addresses, plaintext passwords, and the URLs each credential was captured from.

Why This Is Dangerous

These passwords were captured in plaintext directly from infected devices, so there is no encryption for an attacker to break. Each email address is already paired with its real password and the exact site it opens, meaning anyone who obtains this file can log in immediately without any extra effort.

What Was Exposed in the Cloud_Rolex Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

Plaintext passwords mapped to specific web addresses are exactly what powers credential stuffing, where attackers automatically test stolen email and password pairs against banks, email providers, and shopping sites. Anyone among the 5,719 exposed accounts who reused a password elsewhere faces real risk of account takeover, identity theft, and financial fraud tracing back to this single file.

How Stealer Log Breaches Work

A stealer log is produced by infostealer malware that infects a device through a malicious download, cracked software, or a phishing link. Once installed, it reads saved usernames, passwords, and the web addresses tied to them directly from the browser, then bundles it all into a single file. That file is then uploaded to Telegram channels and underground marketplaces, exactly where HEROIC analysts found this Cloud_Rolex dump.

Check If You Are Affected

Find out whether your email address is one of the 5,719 exposed in the Cloud_Rolex leak, or in any other breach, with HEROIC's free scanner. It checks your information against a database of more than 400 billion leaked records, so you can act before your credentials are misused.