WATERCLOUD_NOTIFY-30.07.2024-400 FILES-THANKS FOR SUB: 3,894 Leaked

Every one of the 3,894 passwords in the WATERCLOUD_NOTIFY-30.07.2024-400 FILES-THANKS FOR SUB file, dated July 2024 and found by HEROIC analysts, sits in plaintext, readable the instant someone opens the file. There is no hashing standing between that password and whoever downloads it. The only way to know if you're affected is to scan your email.

400 Files, One Shared Weakness

Spread across 400 individual files, every password in this batch shares the same flaw: it was saved in plain text and copied straight off the device it came from. Size does not change how easily it can be used.

What Each of the 400 Files Contains

• Email Addresses: the starting point for phishing messages, spam, and looking up what else that address is tied to.
• Plaintext Password: visible exactly as typed, meaning anyone holding the file can try it on other accounts right away.
• URLs: shows exactly which site or service each password belongs to, turning a guess into a targeted login attempt.

3,894 Logins Pulled From Infected Devices

Each entry ties an email to a password and the service it unlocks, giving an attacker a direct path into whatever that login protects, personal email, a shopping site, or a work account.

Why This Came in 400 Separate Files

Stealer malware typically exports one file per infected session or device, which is why a single release can bundle hundreds of smaller files, like the 400 seen here, into one combined upload.

Could Your Device Be One of These 400 Files?

Start by taking a moment to scan your email and see whether this file, or any other, included your address. If it did, clean or reset the device first, then change passwords only from a clean device, and use a unique password for every account going forward. This applies whether the address involved is a personal inbox or a work email, since either one can open the door to the other.