Wrtcloud Stealer Log Leak: 6.1M Passwords Exposed in June 2026

On June 3, 2026, a Telegram user uploaded a fresh stealer log dump labeled "ULP FRESH wrtcloud," containing 6,111,207 records pulled from malware-infected devices. The file includes email addresses, plaintext passwords, and the URLs of the login pages those credentials unlock, all harvested straight from victims' browsers rather than from a single company's servers.

Why the "Fresh" Label Matters

Dark web sellers and Telegram channels tag stealer logs as "fresh" when the credentials were harvested recently and have not yet been rotated, resold, or picked apart by other criminals. A fresh dump like this one is more dangerous than an old recycled list, because the passwords inside it are more likely to still be active. Every day this file keeps circulating on Telegram, the odds that a given password still works go up for criminals and down for the people whose data is in it.

What Was Exposed in This Stealer Log

• Email addresses tied to each infected device
• Plaintext passwords, stored and shared with zero encryption
• URLs showing exactly which login pages each credential pair unlocks

Because the passwords were captured in plaintext, whoever downloads this file can use every credential immediately. No cracking, no guessing, no delay.

Why This Matters

A leak like this feeds directly into credential stuffing attacks, where automated tools try each stolen email-and-password pair against banking sites, email providers, and social media platforms. If you reused a password that shows up in this file, an attacker does not need to guess anything to take over that account. From there, account takeover can escalate quickly into identity theft or financial fraud, especially if the same login was used for email, which is often the key to resetting every other password you own.

How Stealer Logs Like This One Are Built

Stealer logs come from info-stealer malware, malicious software that quietly runs on an infected computer and copies saved browser passwords, autofill data, and session details before sending everything back to whoever controls the malware. The stolen data is then packaged into a "ULP" file, short for URL, login, and password, and dropped into Telegram channels like the one behind this leak, often within days of infection. That is what makes the timing of a fresh log so important: the shorter the gap between infection and exposure, the more of the stolen passwords are still in active use.

Check If You Are Affected

You do not need to know whether your exact email address is in this specific file to be at risk. Stealer logs like this one are one small piece of a much larger picture. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs, combolists, and verified corporate breaches, so you can see your real exposure in seconds and get clear next steps for locking down any account that has been compromised.