What We Know About WATERCLOUD_INFO Piece 0396’s 1,599 Logins

Every password in a newly reviewed stealer batch sits in plain, readable text, no cracking, no guessing. HEROIC analysts logged this file, tagged WATERCLOUD_INFO piece 0396 and dated August 16, 2026, holding 1,599 records of emails, passwords, and the login URLs they unlock, distinct from a separate PIECE-labeled batch from the same day.

Why This Is Dangerous

Because every password here is stored as plaintext, an attacker doesn't need any special tools or time to use them. The 1,599 entries are effectively a list of working logins, ready the moment the file is opened.

What Was Exposed

• Email addresses: identify the account holder behind each entry.
• Plaintext passwords: readable and usable without delay.
• Login URLs: point straight to the page each password opens.

Why This Matters

Plaintext passwords carry more immediate risk than hashed ones because there's no delay between exposure and misuse. Anyone whose credential sits in this file should treat it as already compromised, not merely at risk, and act accordingly rather than waiting for confirmation of misuse elsewhere.

What Sets Piece 0396 Apart

A separate stealer batch dated the same day carried the plainer label PIECE, with a different record count. The numbering here points to a larger, ongoing series being released piece by piece rather than as one single file.

How Stealer Logs Work

Info-stealing malware on an infected device grabs whatever passwords are saved in the browser, along with autofill details and session data, then reports back to whoever runs the campaign. Numbered pieces like 0396 suggest this file is one entry in a larger, ongoing series distributed under the same WATERCLOUD_INFO label.

Confirm Your Password Isn't One of the 1,599

Scan your email to check against this piece and every other file HEROIC has reviewed. A match means an immediate password change, on this account and any other, personal or work, where the same password is still in use, followed by a unique replacement for each.