Wako_Cloud_2 Passwords Were Stored in Plain Text, Not Hashed

Every password inside the Wako_Cloud_2 stealer log sits in plain, readable text, with nothing hiding it behind hashing of any kind. HEROIC analysts confirmed 21,232 records in this file, dated August 26, 2026, each pairing an email address with a password and the URL it was captured from. The only way to know if you're affected is to scan your email.

Why a Plaintext Password Skips the Hard Part

Normally, a hashed password forces an attacker to spend time and computing resources trying to crack it. A plaintext password removes that obstacle completely, it can be read and tried on the matching site within seconds of the file being opened.

What Was Exposed in the Wako_Cloud_2 File

• Email Addresses: identifies the account tied to each captured login, usable for phishing or direct access.
• Plaintext Password: stored in readable form, ready to use without any cracking.
• URLs: shows which site or service each stolen credential was captured from.

Why Readable Passwords Create Wider Risk

Because so many people reuse passwords across accounts, a single readable password from this file can open far more than the site it was captured from, including email, banking, or social media logins sharing the same credential.

How a Stealer Log Like This Gets Created

Infostealer malware running quietly on an infected device pulls saved browser passwords and the pages they're used on, then bundles the results into a log file for distribution. HEROIC analysts see files in the Wako_Cloud series uploaded and refreshed regularly on Telegram.

What to Do About the Wako_Cloud_2 Leak

Clean or reset any device you suspect is infected before changing passwords, since a new password typed on a still-infected machine can be captured again immediately. Once it's clean, scan your email and update every password tied to that device. This applies to personal and work email alike.