The BabaCloudLogs Leak Means Attackers Have Your Cloud Passwords

HEROIC analysts found a stealer log file named BabaCloudLogs uploaded to a public Telegram channel on May 13, 2025. The file contained 16,895 records, including email addresses, plaintext passwords, and the API host URLs those credentials connect to, meaning the data points directly at cloud service logins rather than ordinary websites.

Why This Cloud Credential Leak Is Dangerous

Because the passwords in this log are stored in plaintext and paired with the exact API host each one belongs to, an attacker does not need to guess or crack anything. They can plug the email, password, and endpoint straight into the matching cloud service and log in as if they were the real account owner. If that account controls cloud infrastructure, file storage, or business applications, the impact reaches well past one person's inbox.

What Was Exposed in the BabaCloudLogs File

• Email addresses
• Plaintext passwords
• API host URLs for the connected cloud services

Why This Matters for the 16,895 Accounts Involved

Credentials tied to cloud API hosts are especially valuable to attackers because they often unlock more than a single login screen, they can open the door to stored files, business data, and connected systems. Anyone whose email and password appear in this log faces a real risk of account takeover, and if that password was reused anywhere else, the exposure extends to banking, email, and social accounts through credential stuffing.

How a Stealer Log Like BabaCloudLogs Gets Built

Stealer logs are produced by infostealer malware that infects a device, usually through a phishing link or a malicious download, and then quietly copies saved passwords, autofill entries, and the web addresses tied to them. The malware packages everything into a single log file and sends it back to whoever controls it. In this case, that operator uploaded the finished log directly to a Telegram channel, giving anyone in that channel immediate access to the raw credentials.

Check If Your Login Was in the BabaCloudLogs Leak

If you use any cloud service tied to the credentials in this leak, it is worth checking rather than assuming you are unaffected. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like BabaCloudLogs, so you can find out right away if a password needs to change.