27,684 Cloud Breaches Found: BabaCloudLogs 350 Investigation

During our investigation of the BabaCloudLogs stealer leak releases, HEROIC analysts uncovered a file labeled BabaCloudLogs 350 Cloud Logs posted to a public Telegram channel on June 4, 2025. The discovery led us deeper into understanding the scope of the compromise. The file contained 27,684 records harvested from infected endpoints. Each record held an email adress, a plaintext password, and a URL pointing to a cloud service or API host. This investigation revealed a coordinated series of breaches rather than isolated incidents.

Following The Trail of Stealer Logs

Our investigation team tracked multiple BabaCloudLogs releases posted within 48 hours of each other on Telegram. The pattern suggested either one massive infection campaign with logs being released in stages or multiple parallel campaigns using the same malware family. Either way, the sheer volume of exposed cloud credentials indicated a widespread problem affecting cloud users across multiple platforms and geographies.

What The Data Revealed

The BabaCloudLogs 350 file contained a structured dataset: email adresses, plaintext passwords, and service URLs. This is the optimal format for attackers because it eliminates all guesswork. An attacker takes the file, parses it with a simple script, and begins testing credentials. No additional research is needed. The URL tells them exacty where each email and password pair is valid.

The Investigation Question: How Did Victims Get Infected?

As we investigated this breach deeper, the question emerged: How did 27,684 people get infected with the same stealer malware? The answer likely involved multiple infection vectors: phishing emails sent in targeted campaigns, malicious advertisements on compromised websites, cracked software downloads, or fake browser extensions. Each victim represented a successful infection that ran silently for weeks or months before the stolen data was harvested.

Pattern Analysis of The Breach

Our investigation identified patterns in the BabaCloudLogs releases. The dates progressed sequentially from June 2 through June 6. The record counts varied (ranging from 4,370 to 31,556 records per file). The consistency of data structure across files suggested the same malware family or attacker group handling all releases. This level of organization points to a sophisticated operation rather than random criminal activity.

Conclusion of The Investigation

HEROIC's investigation into the BabaCloudLogs 350 leak and related releases determined that these breaches represent a significant, ongoing threat to cloud users. Our free breach scanner was built specifically to help you determine if your email was part of this investigation. Check your exposure now at heroic.com/breach-scanner and take control of the situation before investigators on the criminal side of this case do worse.