WATERCLOUD_NOTIFY’s 178-File Drop Held 118 Exposed Logins

Analysts came across a small but complete stealer log package labeled WATERCLOUD_NOTIFY-01.08.2024, uploaded to Telegram on August 1, 2024, bundled as 178 individual files. Inside, those files broke down into 118 records pairing email addresses with plaintext passwords and the login URLs malware captured from infected machines. Checking whether an address appears in that batch takes a quick scan.

Why a Small Batch Still Matters

A lower record count does not mean lower risk for the people in it. Every one of the 118 entries includes a plaintext password sitting next to its matching email, so an attacker who downloads this batch can attempt a login immediately, with no cracking or guessing required.

What Was Exposed

• Email addresses: used to identify and target the account owner directly.
• Plaintext passwords: fully readable, so they work the moment they are copied.
• URLs: shows exactly which site or service each stolen login unlocks.

Why It Matters

Anyone whose password shows up here and who reused it elsewhere faces account takeover on any service sharing that password. From there, a single compromised email can be used to reset other accounts, opening the door to financial fraud or identity theft.

How This File Was Built

This is not data pulled from a company's own systems. It was harvested by malware already running on the victims' devices, logging saved and typed browser credentials before the operator packaged it into these 178 files and posted them to Telegram.

Were You in This WATERCLOUD_NOTIFY File Batch?

Start with a free scan your email against HEROIC's records. If your address turns up, treat the source device as infected first: run a malware scan or reset it, then change your passwords from a separate, clean device, beginning with email and any financial logins. The same applies whether the account in question is personal or work-related.