Analysts Discover 3,109 Leaked Aliyun.com Account Logins

Analysts Uncover a Combo List Targeting Aliyun Accounts

While monitoring Telegram breach channels, HEROIC analysts discovered a file titled "aliyun.com" uploaded on June 2, 2026. Closer inspection revealed 3,109 records, each pairing an Aliyun.com email address with a plaintext password and the URL the login was used on.

Why This Is Dangerous

Aliyun.com accounts are linked to Alibaba Cloud services, which can include cloud storage, business tools, and account management features. Analysts note that because the passwords in this file are stored in readable plaintext and already matched to the correct login page, anyone who finds the file can access these accounts immediately.

What Was Exposed

• Aliyun.com email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

With over 3,000 confirmed logins, analysts point to two main risks: direct account takeover of the Aliyun accounts themselves, and credential stuffing against other services if the same password was reused elsewhere. Cloud service accounts in particular can expose additional connected data if compromised.

How Analysts Traced This Data Back to Stealer Logs

Investigating the file's structure, analysts found the pattern typical of information-stealing malware logs, saved browser credentials harvested from infected devices, later sorted by email domain into a focused list like this one. Sellers often specialize in specific platforms, in this case Aliyun.com, to attract buyers interested in that particular target.

Check If You Are Affected

If you use an Aliyun.com account, it is worth checking whether your login was part of this discovery. HEROIC's free breach scanner searches more than 400 billion leaked records, including platform-specific combo lists like this one.