How the Everlasting_Cloud_3 Stealer Log Led to 16,667 Stolen Logins

We noticed a significant influx of credential stuffing attempts targeting our federated identity provider shortly after the reported leak date. What struck us was the unusual volume and the specific pattern of compromised accounts, all originating from a single, previously unflagged Telegram channel. The associated data dump, identified as a stealer log, contained a surprisingly high proportion of plaintext passwords, a configuration often indicative of less sophisticated malware or user negligence. This discovery immediately raised concerns about the potential for lateral movement and further compromise within our network, especially given the nature of the exposed data.

The breach originated from a stealer log file, uploaded to Telegram by an anonymous user on May 4th, 2025. This log contained 16,667 records, primarily comprising email addresses and associated plaintext passwords. Additionally, the data included URLs, likely representing visited sites or API endpoints, which could provide valuable context for attacker reconnaissance. The source structure of the log suggests it was exfiltrated directly from endpoint malware, bypassing typical network defenses. The immediate impact was observed through a surge in credential stuffing attacks, indicating the attacker's intent to leverage these credentials for unauthorized access. The leak location on Telegram, while ephemeral, was captured and analyzed, confirming the authenticity and scope of the compromised data. The presence of plaintext passwords is a critical vulnerability, as it bypasses the need for brute-forcing or exploitation of hashing algorithms.

While this specific leak did not generate widespread public news coverage, it aligns with a broader trend of credential harvesting via stealer malware, a persistent threat documented by various cybersecurity research firms. For instance, recent reports from Mandiant and CrowdStrike have highlighted the increasing sophistication and prevalence of infostealers capable of exfiltrating a wide range of sensitive data, including credentials and session tokens. The ease with which such logs are disseminated on platforms like Telegram underscores the challenges in containing these leaks and the need for proactive credential hygiene and monitoring strategies.