Inside the zet_cloud Stealer Log: How 6,710 Passwords Got Exposed

What HEROIC Analysts Found

On March 4, 2023, HEROIC threat analysts identified a stealer log uploaded to a public Telegram channel under the label "zet_cloud." The file contained 6,710 records pulled directly from infected devices, including email addresses, plaintext passwords, and the URLs those credentials were used on. Rather than coming from a hacked company database, this data was harvested straight from victims' own computers by malware designed to steal saved login information.

Why the zet_cloud Leak Is Dangerous

Because the passwords in this log are stored in plaintext, they are ready to use the moment someone downloads the file. There is no need to crack a hash or break encryption: an attacker can copy an email and password pair straight from the log and log in wherever it was captured. Pairing each credential with its matching URL makes the process even faster, pointing attackers directly at the sites and services tied to each victim.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the accounts and services each credential was used on

Why This Matters

Plaintext credentials like these are prime material for credential stuffing, where attackers run the same email and password pair against dozens of other popular websites hoping the victim reused it. If a password from this leak was reused on a banking, email, or shopping account, the door to account takeover is already open. From there it is a short step to identity theft or direct financial fraud, especially if the compromised email account is used to reset passwords elsewhere.

How Stealer Log Breaches Like This One Work

Stealer logs come from infostealer malware, programs that infect a device, usually through a pirated download, cracked software, or a malicious attachment, and then quietly harvest saved browser passwords, autofill data, and active login sessions. Everything collected is packaged into a log file and sent back to whoever controls the malware. From there, logs like "zet_cloud" are often shared or sold in bulk, sometimes ending up posted for free on Telegram channels where anyone can access them. Because the theft happens on the infected device itself, simply changing a password is not enough unless the underlying malware is also removed.

Check If You Are Affected

If you want to know whether your credentials are part of the zet_cloud leak or any other stealer log, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records. Run a scan to see if your information has been exposed, and update any passwords you may have reused.