AnubisCloud_bot – 400 FILES 26.05 uploaded by a Telegram User

We noticed a concerning upload on the AnubisCloud_bot platform on May 26th, 2024, originating from a Telegram user. This stealer log file contained a significant number of endpoint credentials, specifically 5,678 records. What struck us was the inclusion of plaintext passwords alongside email addresses and API host information, indicating a direct compromise of user authentication mechanisms rather than a more sophisticated credential stuffing attack. The sheer volume and direct exposure of sensitive access details warrant immediate attention.

The AnubisCloud_bot incident, discovered on May 26th, 2024, involved a stealer log file uploaded by an anonymous Telegram user. This file exposed 5,678 records, primarily consisting of email addresses and their associated plaintext passwords. Additionally, URLs and API host information were present, suggesting the compromised endpoints were actively interacting with external services. The source structure of the leak points to a successful execution of malware designed to exfiltrate credentials directly from user sessions or local storage on affected endpoints. The leak location, a public stealer log repository, amplifies the risk of widespread credential reuse and further exploitation.

While specific news coverage directly referencing this particular AnubisCloud_bot upload is not yet prominent, the broader threat landscape is rife with similar incidents. Threat intelligence reports from various cybersecurity firms consistently highlight the proliferation of infostealer malware, such as those that generate these stealer logs. OSINT investigations into Telegram channels frequently reveal the trading and sale of such compromised data. Research into the tactics, techniques, and procedures (TTPs) associated with infostealers confirms the methodology observed here: initial endpoint compromise leading to the direct exfiltration of credentials, often in plaintext, for subsequent monetization or further attacks.