Picture 814 Logins Sitting in a WATERCLOUD_NOTIFY Stealer Set

Picture a stealer log sitting on a Telegram channel labeled WATERCLOUD_NOTIFY, its file name boasting 111 individual capture files bundled together. HEROIC's analysts dated the batch to 2 August 2024 and counted 814 records inside, each one a plaintext password paired with an email address and the URL it unlocks. See whether one of those 814 is yours with a free scan your email.

Why this is dangerous

Every password in the set is stored in plaintext, so there's no cracking delay between the file being downloaded and the credentials being tested elsewhere. A batch this size is also small enough that an attacker can review it by hand rather than relying only on automation.

What was exposed

• Email addresses, tied to each captured login.
• Plaintext passwords, harvested directly from an infected device.
• Login URLs, showing which service each credential pair belongs to.

Why this matters

Stealer log batches like this one often get shared repeatedly across channels once uploaded, so a small file doesn't stay contained to one audience for long. The passwords inside are also likely to still be active, since they were captured recently rather than pulled from an old, already changed leak.

How this breach type works

A stealer log is produced when malware runs on a victim's device and copies saved browser credentials before sending them to whoever controls the infection. This particular batch, labeled WATERCLOUD_NOTIFY with a note thanking channel subscribers, was then shared as one of many similar drops on the same Telegram channel.

Is one of these 814 records tied to your email?

A free scan your email will tell you in under a minute. If it's a match, change that password and check the device you normally use for that login, since malware may still be active on it. This matters equally for a personal inbox and a work login accessed from the same machine.