Search Your Email: Everlasting_Cloud Leak Exposed 27,555 Passwords

HEROIC analysts found a stealer log file uploaded to a public Telegram channel on July 7, 2025, tied to a source labeled Everlasting_Cloud. The file contained 27,555 records, each pairing an email address with a plaintext password and the URL of the site or service that login unlocks.

Why This Is Dangerous

This data was not stolen from a company's servers. It was harvested directly off infected devices by malware built to capture whatever a person types and saves in their browser. That means every password in this file sits in plain, readable text, with no encryption for an attacker to work around. Anyone who obtains the file can begin testing logins immediately, using the URL next to each record to know exactly where to try it.

What Was Exposed in the Everlasting_Cloud Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

With over 27,000 working logins in one file, attackers have plenty of material for credential stuffing, testing the same email and password against banking sites, email providers, and online stores to see where else it works. Anyone who reused a password from this leak faces a real risk of account takeover, and that risk can quickly escalate to financial fraud or identity theft.

How a Stealer Log Like This Gets Created

Stealer logs come from information-stealing malware that infects a device through fake downloads, cracked software, or phishing emails. Once installed, it quietly copies saved browser passwords, autofill data, and the web addresses tied to them, then packages everything into a single file. That file is then uploaded to channels like the one where this Everlasting_Cloud data surfaced.

Check If You Are Affected

The fastest way to know if your email is part of this leak is to search it directly. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly and secure any accounts that may be at risk.