BabaCloudLogs 350 Cloud Logs 17.11.2025 uploaded by a Telegram User

We've observed a concerning uptick in compromised cloud infrastructure credentials appearing on Telegram channels, often originating from stealer logs. What caught our attention wasn't simply the volume of these dumps, but the increasing specificity of the targets and the potential for immediate exploitation. The latest example involves credentials linked to BabaCloudLogs, a collection of cloud endpoint records, API keys and passwords that appeared on November 17, 2025. The data had been circulating quietly, but we noticed a user posted this in a public channel.

BabaCloudLogs: 6.5K Cloud Endpoint Records, API Keys and Passwords Exposed Via Telegram

A Telegram user uploaded a stealer log file containing 6,508 records associated with various cloud endpoints. The data includes email addresses, plaintext passwords, and URLs, creating a direct pathway for attackers to compromise cloud-based systems. The appearance of plaintext passwords is particularly alarming, suggesting that affected services either lack proper hashing algorithms or that the stealer targeted systems where passwords were being stored insecurely. This represents a significant risk for enterprises relying on cloud services.

Breach Stats:
* **Total records exposed:** 6,508
* **Types of data included:** Email Addresses, Plaintext Passwords, URLs, API Host
* **Sensitive content types:** Cloud endpoint records, plaintext passwords
* **Source structure:** Stealer Log
* **Leak location(s):** Telegram channel

This incident aligns with a broader trend of stealer logs acting as initial access points for cloud infrastructure breaches. Threat actors are increasingly leveraging readily available stealer logs to identify and exploit vulnerable cloud environments, bypassing traditional perimeter defenses. As reported by BleepingComputer, the use of stealer logs to gain initial access has become a common tactic, leading to ransomware attacks and data exfiltration.