U.S. Users Targeted: Everlasting_Cloud Exposes 16,602 Passwords

HEROIC discovered a stealer log collection identified as Everlasting_Cloud circulating on Telegram in July 2026. The dump contains 16,602 records harvested from infected devices, including email addresses, plaintext passwords, and associated URLs that reveal exactly which services each victim used.

Why Plaintext Passwords Make This Breach Especially Dangerous

Every password in the Everlasting_Cloud dump is stored in plaintext, meaning there is no encryption or hashing protecting them. Attackers do not need to crack anything. They can copy a password directly from the leak and use it to log into your accounts within seconds. This eliminates the typical time buffer that hashed passwords provide and puts victims at immediate risk.

What Was Exposed

• Email Addresses — used as login identifiers across many online services
• Plaintext Passwords — fully readable credentials requiring no decryption
• URLs — specific website addresses tied to each set of stolen credentials

The Real Danger of Password Reuse

When attackers obtain your email and password from one service, the first thing they do is test that same combination on dozens of other platforms. This technique, known as credential stuffing, is automated and highly effective. If you use the same password for your email, banking, or social media accounts, a single leak like Everlasting_Cloud can cascade into multiple compromised accounts across your digital life.

How Stealer Logs Capture Your Data

Stealer logs are produced by infostealer malware that silently infects computers and mobile devices. Once installed, the malware monitors your activity and records every credential you type or that your browser has saved. It then bundles this data and sends it to the attacker. The Everlasting_Cloud collection represents the output of this kind of malware campaign, with each record corresponding to a real person whose device was compromised without their knowledge.

Check If Your Credentials Were Exposed

Your email and password may be sitting in this dump right now. Use the HEROIC data breach scanner to search across more than 400 billion compromised records and find out if your credentials have been exposed in the Everlasting_Cloud leak or any other breach. Taking action now, by changing compromised passwords and enabling two-factor authentication, is the fastest way to protect yourself.