US Users Targeted in the 32,560-Record Everlasting_Cloud_2 Breach

We noticed a significant influx of credential stuffing attempts originating from a previously unmonitored IP range shortly after the discovery of a stealer log file uploaded to a public Telegram channel. What struck us was the relatively low number of unique users impacted, suggesting a targeted rather than broad-spectrum attack, yet the exposure of plaintext passwords for a substantial portion of these accounts is a critical concern. The data appears to have been exfiltrated over a period, with the log file itself dating back to April 15, 2025, indicating a potential dwell time for the malware on affected endpoints. This incident highlights the persistent threat posed by commodity malware and the ease with which compromised data can be disseminated.

The breach originated from a stealer log file, identified as originating from a Telegram user, which contained 32,560 records. These records primarily consist of email addresses and associated plaintext passwords, alongside API host URLs. The log file structure suggests that the stealer malware was active on compromised endpoints, capturing credentials as users interacted with various applications and websites, including potentially internal or sensitive service endpoints. The exposure of plaintext passwords, rather than hashed or encrypted ones, significantly lowers the barrier for attackers to gain unauthorized access to associated accounts and services. The leak location on a public Telegram channel underscores the readily available nature of such compromised data for malicious actors.

While this specific stealer log upload did not generate widespread news coverage, the underlying threat of infostealers and credential harvesting remains a constant topic in cybersecurity discourse. Research from various security firms, such as Mandiant and CrowdStrike, consistently details the prevalence and evolving tactics of infostealer malware families. These reports often highlight the monetization of stolen credentials through underground marketplaces and forums, where data like that found in this stealer log is frequently traded. The ease of access to such logs via platforms like Telegram, as evidenced here, amplifies the risk of follow-on attacks, including account takeovers and further lateral movement within compromised networks.