SunCloudNew ULP Dump Exposes 269,530 Plaintext Login Records

SunCloudNew 1728, a stealer log uploaded to Telegram on 07-May-2026, contains 269,530 records. The password field is not hashed. The email field is not masked. Everything sits in plain, readable text.

Why This Is Dangerous

Plaintext passwords remove the single biggest obstacle an attacker normally faces. There is no cracking, no brute forcing, no waiting. The theft occured on an infected device, and now the resulting file is sitting in a Telegram channel where anyone with access can download it and start testing logins immediately.

What Was Exposed

• 269,530 records
• Email Addresses
• Plaintext Password
• URLs

This is definately one of the more straightforward leaks to describe. Email, password, URL, in plain text, packaged together for reuse.

Why This Matters

A password leaked in one place rarely stays a problem seperate from your other accounts. People reuse credentials across email, banking, shopping, and work logins constantly. A single row in this file could unlock several accounts belonging to the same person, not just the one it was originally captured from.

How Stealer Logs Work

Malware infects a device, reads the browser's saved password store, and copies the data out into a text file. That file becomes the "log." Once uploaded to Telegram, it can be sold, traded, or given away, and from there it spreads far beyond the original infection. SunCloudNew appears to be one name among several used to brand and distribute these files.

Check If You Are Affected

Check your email against HEROIC's free breach scanner. It searches more than 400 billion compromised records and tells you plainly whether your information is part of this leak or any other.