9,690 Cloud Credentials Stolen in BabaCloudLogs 176 Leak

HEROIC analysts discovered a stealer log upload on a public Telegram channel on June 1, 2025. The file, labeled "BabaCloudLogs 176 Cloud Logs," contained 9,690 records pulled from infected endpoints. Each record exposed an email adress, a plaintext password, and an associated URL or API host, indicating that infostealer malware had been actively harvesting credentials from real users before the data was dumped publicly online.

Why This Is Dangerous

When passwords are stored and leaked in plaintext, there is nothing standing between a criminal and full account access. The attacker does not need to crack or guess anything. Combined with the API host URLs found in this log, attackers may be able to access cloud platforms, developer environments, or business applications directly, turning a simple credential leak into a full network intrusion.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (including API host endpoints)

Why This Matters

Even 9,690 records represents thousands of real people whose accounts are now at risk. Criminals use credential stuffing tools to automatically test stolen logins across banking, email, shopping, and workplace platforms. Victims who reuse paswords face account takeovers on multiple services at once. Beyond account access, exposed email addresses become targets for phishing, and stolen API credentials can enable identity theft and financial fraud.

How Stealer Logs Work

Infostealer malware is a category of malicious software designed to quietly collect credentials from the device it infects. It reads saved passwords from browsers, captures keystrokes, copies stored session cookies, and records logins as they happen. All of this is packaged into a log file and transmitted to whoever controls the malware. Those logs are then sold or posted publicly, as happened here on Telegram. The people whose credentials appear in these logs often have no warning that their devices were ever compromised.

Check If You Are Affected

Your credentials may be part of this leak or one of hundreds of others in HEROIC's database. Run a free search across more than 400 billion exposed records with HEROIC's breach scanner and find out if your email or passwords have been compromised. Check now and protect yourself before an attacker does it first.