SunCloudNew Part01 Quietly Leaks Exactly 33,676 Logins Total

The very first file in the SunCloudNew series, part01, appeared on Telegram June 9, 2026, kicking off a run of at least ten numbered releases with 33,676 stolen logins.

Why This Is Dangerous

As the starting point of a multi-part campaign, part01 likely represents some of the earliest victims collected by this malware operation. Every password here sits in plain text, unprotected, wich means it's definately usable the moment someone opens the file.

What Was Exposed

• Email addresses (33,676 unique accounts)
• Plaintext passwords with no encryption
• URLs tied to each compromised service

Why This Matters

Now that parts 01 through 10 have all surfaced, the SunCloudNew campaign totals hundreds of thousands of stolen records combined. Checking against just one part isn't enough, your email could show up in any single numbered file from this same campaign.

How Stealer Logs Work

Malware operators running long campaigns like this one often number their releases in the order data was collected, meaning part01 could hold some of the oldest infections in the set. Each part still carries the same risk, plaintext passwords ready for immediate use by anyone who downloads the file.

Check If You Are Affected

HEROIC's free scanner checks your email against more than 400 billion (400B+) leaked records, covering every part of the SunCloudNew series from part01 to part10. Run the check now, and don't asume you're safe just because your email wasn't in one part, check them all.