AnubisCloud Stealer Log Exposes 6,621 Plaintext Passwords

HEROIC analysts identified a stealer log package labeled "AnubisCloud_bot - 500 FILES 13.06 uploaded by a Telegram User" after it surfaced on June 13, 2024. The dataset contains 6,621 records, each combining an email address, a plaintext password, and a related URL, information originally harvested straight from infected devices.

Why This AnubisCloud Stealer Log Is Dangerous

Stealer logs like this one are pulled directly from a victim's browser or device, so the passwords are captured exactly as the person typed them, in plaintext, with the exact website URL attached. That combination hands an attacker a direct login path: the site, the username or email, and the password, all in one line, with no guessing involved.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

Because each record ties a password to the specific site it unlocks, this data is immediately usable for account takeover, no credential stuffing across random sites required. Anyone whose information appears in this log faces a direct risk to that account, and if the same password was reused elsewhere, the risk extends to email, banking, and social accounts too, opening the door to identity theft and financial fraud.

How Stealer Logs Work

A stealer log is the output of infostealer malware that runs quietly on an infected computer, pulling saved passwords, autofill data, and browsing details straight out of the browser, then packaging everything into files like the "500 FILES 13.06" batch in this leak. Unlike a company database breach, a stealer log is built from many individual infected machines, which is why it can mix logins for dozens of unrelated sites into a single upload.

Check If You Are Affected

If your device was ever infected with information-stealing malware, your credentials could be sitting in a log exactly like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs, combolists, and database dumps, so you can find out fast and reset any passwords that are still exposed.