The Baba_Cloud Leak Gave Hackers 65,168 Passwords to Exploit

HEROIC analysts identified a stealer log file, labeled Baba_Cloud 756 Cloud Logs, uploaded to a public Telegram channel on May 10, 2025. The file contained 65,168 records taken from infected devices, including email addresses, plaintext passwords, and the API host URLs those credentials connect to.

What Attackers Can Do With the Baba_Cloud Data

With 65,168 plaintext password and API host pairs in hand, an attacker has everything needed to log straight into cloud accounts without cracking or guessing a thing. Each record tells them exactly which service a credential opens, so instead of blindly testing stolen logins, they can target cloud storage, business applications, and any connected systems with precision.

What Was Exposed in the Baba_Cloud Log

• Email addresses
• Plaintext passwords
• API host URLs tied to each set of credentials

Why This Matters for the 65,168 Accounts Involved

Credentials linked to cloud API hosts are a favorite target because they often open access to far more than one login screen, they can reach stored files, connected apps, and business systems. Anyone whose email and password appear in this log faces a real risk of account takeover, and if that password was reused elsewhere, the exposure widens into identity theft and financial fraud on other accounts too.

How a Stealer Log Like Baba_Cloud Gets Built

Stealer logs are the product of infostealer malware that infects a device, usually through a phishing email or a malicious download, and then quietly copies saved passwords, autofill data, and the web addresses tied to them. The malware bundles everything into a single log file and sends it back to the operator running it. Here, that operator uploaded the finished log directly to a Telegram channel, giving anyone in that channel immediate access to all 65,168 records.

Check If Your Login Was in the Baba_Cloud Leak

If you use cloud services and are unsure whether your credentials were part of this leak, it is worth checking now rather than after an account is compromised. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like Baba_Cloud, so you can find out right away if a password needs to change.