Researchers Trace the Worg_cloud Leak to 29,839 Stolen Passwords

Researchers Trace a Stealer Log Called Worg_cloud Back to a Telegram Upload

HEROIC analysts identified a stealer log file labeled "worg_cloud 441count" uploaded to a public Telegram channel on June 10, 2025. The file contained 29,839 records, each one made up of an email address, a plaintext password, and the URL of the service that login belongs to. This is a sizable log, and its scale reflects how many individual devices were infected and drained of saved credentials before this file was ever assembled and shared.

Why This Is Dangerous

Every password in the worg_cloud file was stored in plaintext, meaning an attacker does not have to crack or decrypt anything to use it. Each record also lists the exact URL the credential belongs to, so there's no trial and error involved either. With nearly 30,000 ready-to-use logins in one file, an attacker has everything needed to start logging into real accounts immediately, at scale.

What Was Exposed in the Worg_cloud File

• Email addresses tied to compromised accounts
• Plaintext passwords with no hashing or encryption
• URLs identifying the exact service each login belongs to

Why This Matters for 29,839 People

A file this size means tens of thousands of people now have at least one exposed login in criminal hands. Because so many people reuse passwords across multiple accounts, attackers run large stealer logs like this one through automated credential stuffing tools, testing each email and password pair against banks, email providers, and social media platforms. Anyone whose credentials appear in the worg_cloud file and reused that password elsewhere is at real risk of account takeover, financial fraud, or identity theft.

How a Stealer Log This Large Gets Built

Stealer malware spreads through fake downloads, cracked software, and malicious attachments, then silently harvests saved passwords, autofill data, and session details from every infected device. A log of nearly 30,000 records like worg_cloud typically represents the combined output of many infections collected over time, bundled into one file and shared or sold through Telegram channels where stolen data changes hands. The "441count" label reflects how these files are batched for distribution, not a reference to any single company's breach.

Check If You Are Affected

If you want to know whether your email address is part of the worg_cloud file or any other stealer log, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a free scan, and if your information turns up, change that password immediately and enable two-factor authentication wherever it's available.