BabaCloudLogs Exposed 14,162 Cloud Service Passwords and Emails

HEROIC analysts identified a stealer log file named BabaCloudLogs that was uploaded to a Telegram channel on August 7, 2025. The file contains 14,162 records pulled from infected devices, including email addresses, plaintext passwords, and the URLs of the cloud services and accounts those credentials unlock.

Why This Is Dangerous

Every one of these 14,162 records pairs a plaintext password directly with the email address and cloud service URL it belongs to. There is no encryption to break and no cracking required. Because many of these credentials are tied to cloud service logins, a working password can hand an attacker access to backend systems and stored data, not just a single personal account.

What Was Exposed in the BabaCloudLogs File

• Email addresses
• Plaintext passwords
• URLs of the associated cloud services and accounts

Why This Matters

With 14,162 plaintext password and email pairs now exposed, anyone who reused a password on other accounts becomes a target for credential stuffing against banking, email, or cloud service logins. That kind of overlap is often all it takes to lead to account takeover, identity theft, or financial fraud.

How This Stealer Log Was Created

A stealer log like BabaCloudLogs comes from malware that runs quietly on an infected device, collecting saved browser passwords, autofill data, and the web addresses tied to each login, including cloud service endpoints. The malware sends this information back to whoever controls it, and logs like this one are then commonly packaged and shared on Telegram channels, exactly where HEROIC analysts found this file on August 7, 2025.

Check If You Are Affected

If you think your email or password could be part of the BabaCloudLogs leak or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a scan to see whether your credentials have been exposed.