CrakolCloud Dumped 10.4M Stolen Logins on Telegram Overnight

HEROIC Cybersecurity analysts recovered 2,131,228 unique accounts from the Telegram CrakolCloud 10.4M ULP by crakol stealer log, distributed on February 2, 2025. The archive, titled 10 400 000 URL:LOGIN:PASS, contained roughly 10.4 million lines of raw URL, email, and plaintext password data pulled from infected devices and aggregated by the CrakolCloud operator.

Why This Stealer Log Is Dangerous

Attackers did not need to breach a service to build this list. They harvested credentials directly from victim machines and dropped them onto a public Telegram channel. Each line contains a login URL, an email address, and the exact plaintext password that was saved in the user's browser. There is no cryptographic work left for buyers to do, the log is immediately usable.

What Was Exposed in Telegram CrakolCloud 10.4M ULP by crakol

• 2,131,228 unique email addresses
• Plaintext passwords tied to each address
• Homepage URLs showing the login target for each credential
• Approximately 10.4 million total lines of stealer log data

Why This Matters

URL, email, and password triples are the core fuel for credential stuffing, and the CrakolCloud log delivers all three in a clean format. Anyone reusing a password across webmail, banking, or retail now faces immediate account takeover risk. Email addresses are also valuable for phishing, identity theft, and fraudulent account recovery attempts against more valuable services.

How the CrakolCloud Operation Works

The CrakolCloud brand refers to an operator who aggregates infostealer output from multiple infections, typically malware such as RedLine, Raccoon, or Lumma delivered through cracked software, fake installers, or malicious ads. The operator compiles the harvested credentials into large, sequentially released bundles and publishes them through Telegram channels that function as distribution markets. The 10.4M release is one in a long series attributed to the same crakol handle.

Check If You Are Affected

HEROIC's DarkHive scanner searches more than 400 billion exposed records, including the full CrakolCloud 10.4M dataset. Enter your email to see if your credentials were captured, then rotate any passwords that might be reused elsewhere and enable multi-factor authentication on every account that matters.