How Stealer Malware Led to the SNATCH_CLOUD Leak of 18,561 Logins

HEROIC analysts identified a stealer log labeled "21.07 TEST SNATCH_CLOUD 4.3K.part2," uploaded to a Telegram channel on July 24, 2026. The file contains 18,561 records made up of endpoints, email addresses, API hosts, and plaintext passwords.

Why This Is Dangerous

Stealer logs like this one come straight from infected devices, meaning the credentials inside were captured as people actually typed them. Because each entry pairs a password with the exact endpoint or API host it belongs to, an attacker does not need to guess where a login works, the log tells them.

What Was Exposed

• Email addresses
• Plaintext passwords
• Endpoint and API host URLs

Why This Matters

Because stealer logs capture live, working sessions and credentials, they tend to be more immediately dangerous than older leaked databases. Anyone whose device was infected before this log was created could have accounts, from email to cloud storage to financial logins, sitting exposed and ready to use.

How Stealer Logs Work

Stealer malware infects a device, often through a malicious download or cracked software, then quietly harvests saved passwords, browser cookies, and autofill data before sending it back to the attacker. The results are packaged into a "log" and sold or shared, sometimes within hours of the infection.

Check If You Are Affected

HEROIC's database holds more than 400 billion records pulled from stealer logs, combolists, and confirmed breaches. Run a free scan to see if your email or credentials show up in this SNATCH_CLOUD log or any other exposure, and get clear guidance on securing your accounts.