SunCloudNew Strikes Again: 20,688 More Accounts Exposed

SunCloudNew is back in the stealer log conversation: a second file, labeled 1742 - 1000 LogsFile, appeared on Telegram on May 30, 2026, this time carrying 20,688 records. Whether this is the same criminal operation recycling a brand name or a coincidence of naming, the effect on the people involved is identical either way.

Why This Is Dangerous

Repeated leaks from the same labeled source suggest an ongoing operation rather than a single unlucky incident. That means the malware campaign behind SunCloudNew may still be active, actively infecting new devices and generating fresh batches of stolen credentials on a rolling basis.

What Was Exposed

• Email addresses from 20,688 separate accounts
• Plaintext passwords with no encryption whatsoever
• URLs marking the exact login pages tied to each record

Why This Matters

When the same source name keeps producing new dumps, it usually means the malware distribution channel hasn't been shut down, wich means more victims are likely being added even as you read this. People caught up in this particular batch should asume their information is already being tested against other services.

How These Recurring Leaks Happen

Stealer log operations often number their output files, as seen with this batch's 1742 - 1000 label, to track different infection waves or malware versions. Each numbered file represents a fresh export of stolen browser credentials, meaning the operator behind SunCloudNew is treating this like an ongoing production line rather than a one time event.

Check If You Are Affected

With HEROIC's database covering more than 400 billion leaked records, checking your email takes under a minute, and it's worth doing given how often names like SunCloudNew keep resurfacing. A free scan now could save you from repeating this same worry the next time a new batch appears.