6,645 API Passwords and Emails Stolen in Crypton Logs 301

On May 21, 2025, a Telegram user posted CRYPTON_LOGS 301PCS, a stealer malware dump containing 6,645 records of compromised credentials, and it included something worse than usual: API host URLs alongside passwords. This means attackers didn't just get access to individual user accounts, they also got directions to internal company systems. Here's the breakdown.

The Real Danger: This isn't a typical credential breach where only consumer email accounts are at risk. The inclusion of API host URLs suggests attackers could potentially use stolen credentials to access backend systems, databases, or cloud infrastructure. If a compromised credential belonged to a developer or admin with elevated access, the damage multiplies instantly. The 6,645 records are a direct dump from infected machines, meaning the data is raw and immediately exploitable.

What Happened: A development workstation or server got infected with malware that stolen credentials and system configation information. The malware scraped emails, passwords, and details about what systems were running on the network. That data was exfiltrated and posted on Telegram where it's publicly searchable. No fancy encryption, no negotiations, just a dump.

Why It Matters: API keys and endpoint information combined with stolen passwords create a perfect storm for attackers. They can use the credentials to gain initial access and then pivot to the APIs to move laterally through a network. This is how breaches turn from isolated incidents into systemic compromise.

What Organizations Should Do: If you use any of these credentials in your environment, assume they're compromised. Rotate all API keys and secrets immediately. Review access logs for any suspicious activity dating back to May. Run endpoint detection and response scans across your network for signs of infostealer malware. Train employees on how to spot phishing emails that deliver malware. Consider segmenting developer networks from production systems so a single compromise doesn't take evrything down.