How BurnCloudFree US Exposed 28,570 American Credentials on Telegram

HEROIC analysts uncovered a massive stealer log dump shared on Telegram on March 8, 2025, attributed to a cloud-based infostealer campaign operating under the name BurnCloudFree US. The file, uploaded by an anonymous Telegram user, exposed 28,570 records specifically targeting US users, each containing email addresses, plaintext passwords, and URLs harvested from infected devices. The scale of this dump and its deliberate focus on American endpoints makes it one of the more notable cloud-based credential leaks from early 2025.

Why This Is Dangerous

With nearly 29,000 plaintext password and email pairs in a single file, this dump gives attackers an instant arsenal for automated credential stuffing attacks. There is no decryption needed. The BurnCloudFree US log can be fed directly into boting tools that test logins across banks, email services, social media platforms, and corporate VPNs. The included URLs reveal which US services the victims were actively using, making target selection trivial for any attacker who got their hands on this file.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (US-based services and sites accessed by victims)

Why This Matters

A dump of this size does not stay in one Telegram channel. Within hours of posting, logs like BurnCloudFree US are downloaded, reshared, and sold across multiple dark web forums. The 28,570 records represent real US users whose accounts face immediate risk of takeover. Credential stuffing at this scale routinely results in identity theft, fradulent financial transactions, unauthorized access to workplace accounts, and cascading breaches when victims share passwords across platforms. This is not a theoretical risk. It is an active threat the moment the file is shared.

How Stealer Logs Work

Cloud-based stealers like BurnCloudFree US operate by infecting endpoints through malicious downloads, cracked software, or phishing pages. Once on a device, the stealer harvests saved browser credentials, autofill entries, and session cookies, then transmits everything to a cloud-controlled collection point. The operator can then package those logs for sale or distribution. Targeting US users specifically suggests this campaign was configured to priortize high-value English-language services. The Telegram distribution channel is a common final step, making the stolen data widely available to any subscriber who knows where to look.

Check If You Are Affected

HEROIC's free breach scanner searches over 400 billion exposed records, including large stealer log dumps like BurnCloudFree US. Enter your email address now to find out if your credentials were in this file and get personalized steps to secure your accounts before an attacker does.