Who Is Targeted in the Cloud_Rolex_3 Leak of 1,071 Logins?

In July 2026, HEROIC analysts identified a third stealer log file in the Cloud_Rolex series, "Cloud_Rolex_3," posted to a Telegram channel. This batch contains 1,071 records, each pairing an email address with a plaintext password and the login URL the credential was captured from.

Who Is Targeted in the Cloud_Rolex_3 Leak

The people caught up in this leak are not chosen individually. They are simply whoever happened to have their device infected by the malware behind the Cloud_Rolex operation, whether through a cracked download, a phishing email, or a fake software update. Once infected, the malware does not discriminate. It copies every saved email, password, and login URL from the browser regardless of who the victim is, which is why this data was not stolen from a company's servers but harvested directly from individual, unrelated devices.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact site each credential unlocks)

Why This Matters

Because the passwords in this file are plaintext and already matched to their websites, they are immediately usable for credential stuffing and account takeover. Anyone in this batch risks losing access to email, shopping, or financial accounts, especially if they have reused the same password anywhere else.

How the Cloud_Rolex Series Keeps Growing

Stealer logs like Cloud_Rolex_3 come from ongoing malware infections rather than a single database hack. As new victims are infected, the operator behind the campaign collects the harvested usernames, passwords, cookies, and autofill data, then bundles the results into numbered releases, like this third file, and shares or sells them on Telegram channels and dark web forums.

Check If You Are Affected

With 1,071 credential pairs in this batch, checking your exposure takes only a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your email or passwords have been exposed and secure your accounts before someone else uses them.