BabaCloudLogs 369 Leaked in July. 29,992 Records Now Exposed.

A Stealer Log Surfaced on Telegram, Exposing 29,992 Records

HEROIC analysts identified a stealer log file, labeled "BabaCloudLogs 369," circulating on a Telegram channel on July 24, 2025. The file contained 29,992 records pulled directly from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

Because the passwords in this log are stored in plaintext, not hashed, anyone who obtains the file can use them immediately. Paired with the matching email address and account URL, an attacker has everything needed to log into that account without guessing, cracking, or phishing. There is no extra step between having this file and having access.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

Stealer logs like this one are a direct pipeline to account takeover. Because most people reuse passwords across multiple sites, a single exposed plaintext password can unlock email, banking, and social media accounts far beyond the one it was originally tied to. Attackers use these logs for credential stuffing, running the exposed email and password pairs against other popular services to see what else opens. From there, the risk escalates quickly to financial fraud, identity theft, and further account compromise.

How Stealer Logs Work

A stealer log is the output of infostealer malware, a type of malicious software that runs quietly on an infected computer and copies saved passwords, autofill data, and browser session details before sending them back to whoever controls the malware. These logs are then packaged and distributed, often through Telegram channels like the one where this file appeared, where they are shared or sold to other threat actors. Because the malware captures credentials directly from the device rather than from a breached company database, this kind of exposure can affect accounts across many unrelated websites and services at once.

Check If You Are Affected

If you believe your email address may be part of this or any other stealer log, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records, including stealer logs like this one. Run a scan to see if your credentials have been exposed and get guidance on securing your accounts.