The TXT Cloud Stealer Log Dropped in November. The Passwords Are Still Live.

HEROIC analysts identified a stealer log upload on November 6, 2025, shared publicly by a Telegram user under the label "TXT Cloud - LOGS_900PCS". The dataset contains 29,053 records exposing email addresses, plaintext passwords, and associated URLs. Unlike breaches where passwords are hashed and require cracking, this log delivered credentials in fully readable form, making them imediately usable by anyone who downloaded the file. The upload was spotted through routine monitoring of public data leak channels where stealer log dumps are increasingly common.

Why This Is Dangerous

When passwords are stored as plaintext, there is no extra step standing between an attacker and your accounts. Whoever downloaded this log can take an email address and its matching password and attempt to log into Gmail, banking apps, social media, and anywhere else that account holder might have reused the same credentials. With 29,053 records in a single file, attackers can automate this process and run thousands of login attempts within minutes. The URLs included in the data point directly to the sites and services the victims were using, giving attackers a ready-made target list.

What Was Exposed

The stealer log contained the following data types for each of the 29,053 records:

• Email Addresses
• Plaintext Passwords
• URLs (login pages and API endpoints)

Why This Matters

Stealer log dumps like this one fuel a practise known as credential stuffing, where stolen username and password pairs are tested across dozens of popular websites at once. Because many people reuse the same password across multiple services, a single compromised account can quickly snowball into account takeovers on banking platforms, email providers, and e-commerce sites. Identity theft and finantial fraud often follow. The fact that these credentials were shared openly on Telegram, rather than sold on a private forum, means they reached a much wider audience of potential bad actors.

How Stealer Logs Work

A stealer log starts with malware quietly installed on a victim's computer, often through a fake software download, a phishing email attachment, or a malicious browser extension. Once running, the malware scans the device for saved passwords in browsers and apps, then packages everything into a neat text file. That file, the stealer log, gets sent back to whoever deployed the malware. From there it may be sold, traded, or, as happened here, dumped publicly on a platform like Telegram. The victim usually has no idea their credentials were harvested untill they notice unusual account activity.

Check If You Are Affected

If you have ever saved passwords in a browser or used any of the services referenced in this log, your credentials may have been captured. HEROIC offers a free scanner that checks your email address against more than 400 billion exposed records, including stealer log data like this file. Run a free scan now to see whether your information was part of this or any other known breach, and take action before someone else does.