BabaCloudLogs Dumped 29,776 Cloud Passwords Openly on Telegram

HEROIC analysts found a stealer log collection posted to a public Telegram channel on May 28, 2025. The dataset, called "BabaCloudLogs 400 Cloud Logs," exposed 29,776 records containing email addresses, plaintext passwords, and URLs tied to cloud services and API endpoints. This is the second BabaCloudLogs release on the same date, indicating an ongoing and deliberate campaign to distribute harvested credentials broadly and openly.

Why This Is Dangerous

At nearly 30,000 records with plaintext passwords, this dataset hands attackers a ready-to-use toolkit for account takeover. There is no decryption step needed -- every password is immediately usable. The cloud service URLs tell attackers which platforms were compromised, so they can target those services directly rather than guessing. Anyone whose credentials appear here faces imminent risk the moment an attacker runs a credential stuffing script against their accounts.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (cloud service and API endpoints)

Why This Matters

Stolen cloud credentails don't stay unused for long. Once available on Telegram, they circulate quickly through criminal networks where automated tools test them across email providers, cloud storage platforms, business apps, and financial services. A single compromised credential can cascade into full identity theft if the email account is accessed -- giving an attacker the ability to reset passwords on other accounts and lock the real owner out. For businesses, exposed API keys in the leaked URLs can mean unauthorized cloud infrastructure usage and data theft.

How Stealer Log Breaches Work

Stealer malware is a category of malicious software designed specifically to harvest saved credentials. It typically infects a device through a phishing email, a fake software installer, or a compromised website. Once running, it silently pulls saved usernames and passwords from web browsers and apps, captures session tokens, and records any URLs associated with those logins. Everything gets compiled into a log file and sent to the attacker. Collections like BabaCloudLogs are often assembled from hundres of individual infected machines and then shared publicly or sold.

Check If You Are Affected

With 29,776 records now in circulation, your email may be part of this dataset without any warning. HEROIC's free breach scanner checks your email address against a database of over 400 billion exposed records, including stealer log collections like BabaCloudLogs. Run a free search now to find out if your credentials have been exposed and get guidance on what to do next.