23784 Records: TXT Cloud Stealer Logs

On October 27, 2025, a Telegram user uploaded a stealer log named TXT Cloud - LOGS_900PCS - 28 October 2025 to a public channel. The file exposes 23,784 records harvested from compromised US endpoints, including email addresses, plaintext passwords, and the URLs tied to each account.

Why This Is Dangerous

The 23,784 passwords in this leak were stored and stolen in plaintext, meaning there's no decryption step standing between an attacker and a working login. Every record lists the exact URL a password unlocks, removing any guesswork.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to the affected accounts

Why This Matters

This kind of data feeds directly into credential stuffing attacks, where the same email and password combination gets tried across dozens of unrelated sites. Anyone who reused a password captured here risks account takeover, identity theft, or financial fraud.

How Stealer Logs Work

This kind of leak starts with infostealer malware running silently on an infected device, harvesting saved credentials and the URLs they belong to before sending them to whoever controls the malware. The resulting file is then traded or given away on Telegram, exactly where this TXT Cloud log surfaced.

Check If You Are Affected

Use HEROIC's free breach scanner to check your email against more than 400 billion leaked records, including stealer logs like this one, and update any password you've reused elsewhere.