WATERCLOUD_INFO Leak Hits Cloud and SaaS Logins, 14,704 Exposed

In August 2025, HEROIC analysts uncovered a stealer log posted to Telegram under the name WATERCLOUD_INFO, titled "408 FILES 29.06.2025 - THANKS FOR SUB." The file contained 14,704 records, each combining an email address, a plaintext password, and the login URL where the credentials were used.

Cloud and SaaS Accounts in the WATERCLOUD_INFO Leak

Based on the naming and structure of this log, a large share of the captured login URLs point toward cloud storage and software-as-a-service platforms, the kinds of tools remote workers, freelancers, and small businesses rely on every day to store files and run their operations.

That makes this leak especially relevant to anyone working in tech, marketing, design, or any other industry that leans heavily on cloud-based tools. A single compromised cloud login can expose client files, business documents, and internal communications, not just personal data.

Why This Is Dangerous

All of the passwords in this leak are plaintext, meaning attackers do not need to crack or decode anything. They can log directly into the cloud accounts listed in the file the moment they get their hands on it.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

For businesses that rely on cloud platforms, a single stolen login can lead to account takeover of shared drives, client records, and business email. Attackers frequently attempt credential stuffing against related services too, since employees often reuse the same password across multiple work tools, which can snowball into identity theft or financial fraud if payment systems are connected.

How Stealer Logs Work

Stealer malware infects a device silently, often bundled with pirated software or a fake update. Once running, it extracts saved passwords, cookies, and autofill fields directly from the browser, including credentials used for cloud services and business apps.

Everything collected gets compiled into a structured log file and uploaded to Telegram, where it is downloaded and reused by other attackers. Because cloud accounts often act as a hub connecting many other tools, logs like this one carry outsized risk for buisnesses specifically.

Check If You Are Affected

If your business relies on cloud tools, it is worth checking your exposure now. HEROIC's free breach scanner searches a database of more than 400 billion exposed records, including stealer logs like this one, so you can see your risk in seconds.