SunCloudNew Stealer Logs Expose 70,101 Passwords, Emails

In July 2026, HEROIC analysts spotted a stealer log file named "SunCloudNew 1272 - 8850 LogsFile.part1" being shared on a Telegram channel. The file contains 70,101 records, each linking an email address to a plaintext password and the specific login URL the credential unlocks.

Why This SunCloudNew Leak Is Dangerous

The numbering and ".part1" label point to a large, organized collection of stolen logins, not a one-off leak. Rather than being stolen from a company's servers, this data was harvested straight from infected computers by information-stealing malware, which quietly copies saved browser passwords before sending them to whoever runs the operation. Because every record already pairs a live website with a working email and password, an attacker can log straight in without having to guess or crack anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact site tied to each set of credentials)

Why This Matters

With 70,101 plaintext, ready-to-use logins now circulating, this file is a direct feed for credential stuffing and account takeover attacks. Anyone whose details appear here risks losing access to email, banking, or shopping accounts, especially if the same password protects more than one account elsewhere.

How Stealer Log Files Like This Get Made

Stealer logs are built from malware infections rather than hacked databases. A victim downloads a cracked program, clicks a phishing link, or installs a fake update, and hidden malware begins quietly collecting every saved username, password, cookie, and autofill entry from the browser. The stolen data from many infected machines gets bundled into a single file, often broken into numbered parts as more victims are added, then shared or sold on Telegram channels and dark web marketplaces exactly like this one.

Check If You Are Affected

With over 70,000 credential pairs in this file alone, taking a minute to check your exposure is worth it. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can quickly see if your email or passwords have been exposed and lock down your accounts before someone else uses them.