U.S. Users Targeted: wrtcloud Leak Exposes 996,638 Passwords

HEROIC discovered a stealer log titled FREE ULP FRESH wrtcloud that was posted on Telegram in May 2026. The dataset holds 996,638 compromised records, with a concentration of U.S.-based users. Each entry contains an email address, a plaintext password, and the URL of the service from which the credential was stolen, providing everything an attacker needs to attempt account takeovers.

Why Plaintext Passwords Demand Immediate Action

The passwords in this leak are entirely unencrypted. They appear in readable form, meaning any person who downloads the file can use them directly. There is no decryption step, no hash to reverse. This makes the wrtcloud dataset an off-the-shelf attack resource for anyone with malicious intent.

What Was Exposed

• Email addresses tied to personal and professional accounts
• Plaintext passwords that can be used without any technical skill
• URLs identifying the exact online services where logins were captured

Credential Stuffing Turns One Breach Into Many

Attackers use stolen credentials to run credential stuffing attacks, where automated tools test each email-password pair across dozens of popular websites. When someone uses the same password for their email, bank, and shopping accounts, one leaked entry can compromise them all. With nearly a million records in this leak, the scope of potential damage is staggering.

How Infostealer Malware Powers These Leaks

Stealer logs like wrtcloud are produced by infostealer malware that runs silently on infected computers. These programs target stored browser passwords, session tokens, and autofill data, then transmit everything to the attacker. The stolen credentials are compiled into files and distributed through Telegram channels and dark web forums, where they are accessed by thousands of cybercriminals.

Check If Your Credentials Were Exposed

If you are a U.S.-based user or have accounts on American platforms, the wrtcloud leak may contain your data. HEROIC's breach scanner covers more than 400 billion compromised records, making it one of the most comprehensive tools available for checking your exposure. Search your email address today and take steps to protect your accounts.