Cloud Service Users Targeted in the BabaCloudLogs 35,795 Record Leak

HEROIC analysts found a stealer log file, labeled BabaCloudLogs 666 Cloud Logs, uploaded to a public Telegram channel on May 11, 2025. The file contained 35,795 records taken from infected devices, including email addresses, plaintext passwords, and the API host URLs those credentials connect to.

Why Cloud Service Users Are the Real Target Here

This log was not built from a single hacked website, it was assembled from individual devices infected with credential-stealing malware, which means the people affected are ordinary cloud service users rather than customers of one breached company. Because each password is stored in plaintext and matched to its exact API host, an attacker can log straight into a victim's cloud account with no cracking or guesswork required.

What Was Exposed in the BabaCloudLogs 666 File

• Email addresses
• Plaintext passwords
• API host URLs tied to each set of credentials

Why This Matters for the 35,795 Records Involved

Anyone whose cloud login appears in this log is exposed to immediate account takeover, and because plaintext passwords are so often reused across multiple sites, the risk does not stop at one account. Attackers routinely run these credential pairs through automated credential stuffing tools, testing them against banking, email, and social media platforms, which is how a single leaked password turns into identity theft or financial fraud.

How a Stealer Log Like BabaCloudLogs 666 Gets Made

Stealer logs come from infostealer malware that infects a device, often through a phishing email or a malicious download, and then quietly copies saved browser passwords, autofill data, and the sites they belong to. The malware bundles all of it into a log file and sends it back to the operator running it. In this case, that operator uploaded the finished log directly to a Telegram channel, putting all 35,795 records into the hands of anyone in that channel.

Check If You Are One of the 35,795 Affected

If you use cloud services and are unsure whether your credentials showed up in a leak like this one, it is worth checking before an attacker gets there first. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like BabaCloudLogs, so you know right away if a password needs to change.