SunCloudNew stealer log leak exposed 19,971 plaintext passwords.

SunCloudNew Stealer Log Exposes 19,971 Records

HEROIC analysts identified a stealer log dataset labeled "SunCloudNew" uploaded to Telegram on November 19, 2025. The dataset contains 19,971 records taken from malware-infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials belong to.

Why This Is Dangerous

Unlike a typical company data breach, a stealer log is harvested directly from an infected device. The malware records every username and password a person types and pairs it with the exact website or app it belongs to. That pairing is what makes this leak dangerous: an attacker does not need to guess where a password works, they already have the login and the site lined up together.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Because the passwords in this leak are stored in plaintext, no cracking or decryption is required before they can be used. Anyone who obtains this dataset can immediately attempt to log in to the paired accounts, run the credentials through other popular sites in a credential stuffing attack, or use the email and password pair to impersonate the victim in an account takeover. Reused passwords put victims at risk well beyond the original account.

How Stealer Log Malware Works

Stealer logs come from infostealer malware, malicious software typically delivered through a fake download, phishing link, or pirated software installer. Once it infects a device, it quietly scans the browser and system for saved passwords, autofill data, and active login sessions, then bundles everything into a single file. These files are then sold or shared for free on Telegram channels and dark web forums, exactly how the SunCloudNew dataset surfaced.

Check If You Are Affected

If you are concerned your credentials may be part of this or another leak, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan today to find out if your information has been exposed.