Your Logins May Be Compromised. SunCloudNew Leak Exposed 27,397.

On July 30, 2026, HEROIC analysts identified a stealer log file named "SunCloudNew 1280 - 5950 LogsFile.part2" uploaded by a Telegram user just one day after it was created. The file contains 27,397 records made up of endpoints, email addresses, API hosts, and plaintext passwords pulled directly from infected devices.

Why This Is Dangerous

Because this data comes from malware running on victims' own computers rather than an old database breach, the credentials are recent and often still active. An attacker working from this file can log into accounts before the owners even realize their device was infected.

What Was Exposed in the SunCloudNew Stealer Log

• Email addresses
• Plaintext passwords
• URLs and API host endpoints tied to each credential

Why This Matters

With over 27,000 records in a single file, this leak has the scale to fuel widespread credential stuffing and account takeover attempts. Anyone whose device was infected around the time this log was created should assume their saved passwords are compromised, not just for one site but for every account stored in their browser.

How Stealer Logs Work

Stealer malware quietly infects a device, then harvests saved browser passwords, autofill details, and session data before sending it all back to the attacker as a packaged "log". These logs are split into parts, like this one labeled "part2", and traded on Telegram channels within days of being collected, making them especially dangerous while the stolen credentials are still fresh.

Check If You Are Affected

Run a free scan with HEROIC to check your email against more than 400 billion exposed records, including this SunCloudNew stealer log. If you are affected, change every password stored in your browser and scan your device for malware immediately.