How SunCloudNew Stealer Malware Put 15,017 Logins on Telegram

HEROIC analysts tracked down a stealer log posted to a public Telegram channel on June 10, 2025, operating under the name SunCloudNew Logs #1189 by .boxed.pw. The log contained 15,017 records pulled from infected devices, including email addresses, plaintext passwords, homepage URLs, and IP addresses. This was not a corporate database breach. It was the result of infostealer malware quietly running on real people's computers, harvesting every credential it could find and sending it back to whoever deployed it.

What the SunCloudNew Log Contains and Why IP Addresses Make It Worse

Most stealer logs include email-and-password pairs, but this one also captured IP addresses. That detail matters because an IP address ties a set of credentials to a specific network location. Attackers can use this to appear as if they are logging in from the victim's general area, bypassing location-based security alerts that some services use to flag suspicious logins. Combined with plaintext passwords that require zero effort to use, this log gives attackers an unusually clean path into victim accounts.

The homepage URLs in the log also tell attackers exactly which sites the victim was using at the time of infection. That narrows down where to try the stolen credentials first, making the attack more efficient and harder for victims to notice until damage is already done.

What Was Exposed in the SunCloudNew #1189 Log

• Email Addresses — Primary login identifiers for thousands of online accounts
• Plaintext Passwords — Unencrypted, ready-to-use credentials requiring no additional effort to exploit
• HomePage URLs — Identifies which websites and services each victim was actively using
• IP Addresses — Network location data that helps attackers evade geographic login alerts

Why This Matters: Credential Stuffing, Account Takeover, and Identity Theft

Once a log like SunCloudNew #1189 lands on Telegram, it moves fast. Other threat actors download it, feed the credentials into automated tools, and begin testing them against major platforms within hours. Because password reuse is extremly common, a single stolen email-and-password pair from one site can unlock accounts on a dozen others.

The downstream consequences range from account takeover, where the attacker changes your password and locks you out, to identity theft, where your email account becomes the recovery address they use to reset banking and government portals. Financial fraud is a near-certian outcome when payment accounts are involved. And because these logs recirculate in combolists for months, exposure does not end when the original Telegram post is taken down.

How the SunCloudNew Stealer Log Was Created

Infostealer malware, the type that produced this log, typically starts with a deceptive download. A victim clicks on what looks like a software crack, a free game mod, or a browser extension. The malware installs silently, then begins collecting data in the background: saved browser passwords, cookies, autofill entries, and active login sessions. It also records the device's IP address and basic system information.

All of that data gets packaged into a log file and transmitted to the attacker. Operators like .boxed.pw then organize and number these logs, often releasing them in batches, as the #1189 designation here sugests. The Telegram channel acts as a distribution hub where these logs are shared freely or sold to other attackers. The numbering also gives researchers a rough sense of scale: if #1189 is publicly visible, there are likely over a thousand prior batches that are not.

Verify If Your Email Was in the SunCloudNew Breach

HEROIC's free breach scanner searches over 400 billion exposed records to tell you if your email address appeared in logs like SunCloudNew #1189 or any other known breach. The scan takes less than a minute and costs nothing.

If your address shows up, update your passwords on every account that uses the same credentials. Pay particular attention to your primary email, banking apps, and any service where a password reset would let an attacker chain into other accounts. Enabling two-factor authentication on those services is the most effective step you can take right now.