Passwords Leaked: WRT-CLOUD – Good_cPanel uploaded by a Telegram User

A Stealer Log Tied to WRT-CLOUD Surfaces on Telegram

In late December 2025, HEROIC analysts identified a stealer log labeled "WRT-CLOUD - Good_cPanel" that had been uploaded by a Telegram user. The log contained 5 records made up of email addresses, plaintext passwords, and the URLs those credentials belong to. It is a small file, but every one of the five records is immediately usable by anyone who downloads it.

Why This Is Dangerous

Stealer logs are different from a typical hacked database. The passwords inside are not scrambled or encrypted, they are stored in plaintext exactly as they were typed by the victim. Paired with the URL of the login page, an attacker does not need to guess which site a password belongs to or attempt to crack anything. They can copy the email, password, and URL directly into a browser and be logged in within seconds.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (including hosting control panel endpoints)

Why This Matters

Because the URLs point to hosting and server management logins, a compromised set of credentials here can mean more than one stolen account. If a password was reused across email, banking, or social accounts, the same combination can fuel credential stuffing attacks well beyond the original site. Anyone whose details appear in a log like this faces a real risk of account takeover, and if the login belongs to a business panel, the fallout can extend to every website or client hosted through it.

How Stealer Logs Work

Stealer logs come from infostealer malware, a type of infection that quietly runs on a victim's computer and harvests whatever is saved in the browser: stored passwords, autofill data, cookies, and the addresses of the sites they belong to. Once collected, this information is packaged into a "log" and shared or sold, often through Telegram channels like the one where this file was found. Because the data is pulled straight from the victim's own machine, it tends to be accurate and immediately exploitable, which is what makes stealer logs especially valuable to criminals compared to older, stale database leaks.

Check If You Are Affected

Even a small leak like this one can expose credentials that unlock much bigger accounts. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly if your information has been exposed and take action before someone else uses it.