Quiet Leak: WATERCLOUD_NOTIFY’s 292-File Batch Held 278 Logins

On 29 July 2024, HEROIC analysts caught a fresh WATERCLOUD_NOTIFY batch, 292 individual files bundled together, holding 278 sets of plaintext passwords tied to email addresses and login URLs. Unlike its noisier siblings in this stealer log series, this batch went up on Telegram without much fanfare, which is exactly what makes it easy to miss.

Why a Small Batch Still Matters

The passwords in this WATERCLOUD_NOTIFY drop are stored in plaintext, meaning anyone who downloads the 292 files can read every password directly. A small count does not mean small risk. Whoever collected this batch pulled it straight from an infected device, so each entry represents a real login someone typed on a compromised machine.

What Was Exposed

• Email addresses: the identifiers tied to each stolen password.
• Plaintext passwords: readable the moment the file is opened, no cracking involved.
• URLs: the exact login pages malware captured, telling an attacker precisely where each password works.

What This Puts at Risk

Because the URLs are paired with working plaintext passwords, an attacker does not need to guess where to try a stolen login. Account takeover, unauthorized purchases, and further phishing built on hijacked inboxes are all realistic outcomes if any of these 278 credentials still work.

How Stealer Logs Like This Get Built

WATERCLOUD_NOTIFY is a stealer log, not the result of any single website being broken into. Malware sitting on the victim's own device silently copied saved logins as they were typed or stored, then packaged them into files like this 292-file batch for upload. The device itself is what got infected, not any one service.

Could Your Login Be in This 292-File Batch?

Scan your email to see if it shows up in this WATERCLOUD_NOTIFY drop or the wider series. If the device you use for email or banking is still infected, clean or reset it before changing anything, then update passwords starting with email and financial accounts from a device you trust is clean. Work inboxes running on infected machines are just as exposed as personal ones, so check both.