119,374 Passwords From the SunCloudNew Dump Just Surfaced on the Dark Web

In June 2025, a Telegram user uploaded a stealer log file designated as part of the SunCloudNew series, instantly placing 119,374 sets of login credentials into circulation on dark web channels. The dump contained plaintext passwords, email adresses, and URLs harvested from compromised devices by infostealer malware. At over 119,000 records, this is a large-scale exfiltration event that gives attackers a substantial and immediately actionable pool of verified credentials to exploit.

Why This Is Dangerous

The SunCloudNew dump is dangerous precisely because of its scale and the nature of the data it contains. Plaintext passwords require no decryption -- attackers can begin credential stuffing operations against email providers, cloud platforms, and financial services the moment they obtain the file. The inclusion of URLs means each set of credentials comes with a targetting guide, telling attackers which specific services a victim uses. With 119,374 records, even a low success rate on automated login attempts can yield thousands of compromised accounts within hours.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (sites the victim had active credentials for)

Why This Matters

Large stealer log dumps like SunCloudNew do not fade quickly. After the initial Telegram upload, the data is scraped, repackaged, and absorbed into massive credential compalations that circulate for years. Victims whose records appear in dumps of this size are exposed not just to immediate account takeover attempts, but to repeated targeting as their credentials resurface in new compilations. Anyone who was active online in mid-2025 and has not changed their passwords since should treat this breach as a direct personal risk.

How Stealer Log Breaches Work

The SunCloudNew logs were generated by infostealer malware -- a category of tools that includes RedLine, Lumma, Vidar, and Raccoon Stealer. These programs are distributed through phishing campaigns, malicous software downloads, and drive-by browser exploits. Once installed on a victim's device, they silently harvest all stored browser passwords, session cookies, URL histories, and API credentials. The collected data is packaged into structured log files and transmitted to attacker-controlled servers, where it is sorted and sold through Telegram channels or dark web shops.

Check If You Are Affected

HEROIC's free dark web scanner searches over 400 billion exposed records, including large-scale stealer log dumps like SunCloudNew. If your email address appears in this breach or any other, you will receive an immediate alert with details on what was exposed and what to do next. With 119,374 records now in circulation, do not wait to find out. Run your free scan now and get ahead of potential account takeovers before attackers act.