Since April 2026, SunCloudNew 1715’s 320,332 Logins Are Live

Months after SunCloudNew 1328 made the rounds, the same naming series resurfaced with SunCloudNew 1715 - 580 K ULP on 21 April 2026, this time carrying 320,332 records.

Why This Is Dangerous

A returning series like this shows the operation behind it hasn't slowed down at all. If anything, the record count climbing from one release to the next suggests the group is only getting better at harvesting credentials.

What Was Exposed

• 320,332 individual records confirmed in this release
• Working email addresses gathered from compromised devices
• Passwords stored as plain, unencrypted text
• Website addresses matched directly to each stolen login

Why This Matters

Anyone caught in an earlier SunCloudNew release should pay close attention here too, since operators frequently reuse the same pool of infected machines across multiple numbered drops.

It would be neccessary for repeat victims to check every release in a series like this, not just the one closest to their original exposure. Whatever compromise occured on the infected device likely continues feeding new data into future SunCloudNew uploads.

A Series That Keeps Growing

Consistent naming and steadily increasing volumes point to an infostealer operation running on autopilot: infect devices, collect the harvest, package it under the same brand, and release it again once enough new data piles up.

The malware itself doesn't change much between releases. It still relies on tricking someone into running an infected file, then quietly reading whatever the browser has stored.

Check If You Are Affected

HEROIC tracks more than 400 billion (400B+) compromised records overall, and both SunCloudNew releases are part of that total. The free scanner checks your email against the whole database in one pass.

If either release includes you, don't stop at one password change, review every account tied to that address and enable two-factor authentication across the board.