SunCloudNew Leak Exposes 63,218 US Login Credentials

SunCloudNew Stealer Log Exposes 63,218 US Login Records

HEROIC analysts found a stealer log file named "SunCloudNew 1325 - 359 K ULP" uploaded to Telegram in November 2025. The file holds 63,218 records taken from infected devices located primarily in the United States, including email addresses, plaintext passwords, and the URLs of the accounts they open.

Why This Is Dangerous

Every record in this leak is a complete login kit. An attacker gets the email, the password in plain readable text, and the exact site it belongs to, all in one line. There is no cracking or guessing involved, just copy, paste, and log in. That makes this kind of data especialy valuable to criminals working fast.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs for each account

A Closer Look at the US Exposure

This particular file skews heavily toward United States accounts, meaning the majority of the 63,218 people affected are likely US residents. Stealer logs with a regional concentration like this often trace back to malware campaigns that spread through pirated software, gaming cheats, or phishing emails aimed at a specific audience, in this case one that is largely American.

Why This Matters

Leaked plaintext passwords fuel credential stuffing, where attackers automatically try the same email and password combo across dozens of other sites. Because so many people reuse passwords, a single leaked record can lead to account takeover on banking or email services, opening the door to identity theft and financial fraud well beyond the original stealer log.

How Stealer Logs Work

Stealer logs are the output of info-stealer malware, a type of program built to quietly harvest saved passwords, autofill fields, and browser cookies from an infected computer. Once the malware finishes collecting, it packages everything, usernames, passwords, and site addresses, into a text file that gets shared or sold, often with almost no delay between infection and exposure.

Check If You Are Affected

If you are a US-based internet user, its especially worth checking your exposure given how this file is concentrated. HEROIC's free breach scanner checks your email and passwords against a database of more than 400 billion exposed records, so you can find out in seconds and take action if needed.