How the Everlasting_Cloud Stealer Log Led to 30,864 Stolen Logins

We noticed a significant data leak originating from a Telegram channel, uploaded on March 22, 2025. The file, identified as a stealer log, contained a surprisingly high volume of sensitive endpoint and credential information. What struck us was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs, indicating a sophisticated or at least highly effective credential harvesting operation. The sheer volume of records, while not in the millions, is concerning given the direct access implied by the data types. This incident warrants immediate attention due to the potential for widespread account compromise across various services.

The breach breakdown reveals a stealer log file, uploaded by an anonymous Telegram user, containing 30,864 records. The exposed data includes email addresses, plaintext passwords, and associated URLs, specifically API host URLs. This indicates that the compromised endpoints were likely actively communicating with these services, and the attackers gained direct access to authentication materials. The source structure suggests a direct exfiltration from infected endpoints, bypassing typical network defenses. The leak locations, being a public Telegram channel, amplify the immediate risk of widespread exploitation by other malicious actors seeking to leverage these credentials for further attacks, including account takeovers and credential stuffing. The presence of plaintext passwords is a critical vulnerability, bypassing any hashing or salting mechanisms that might have been in place.

While specific news coverage for this particular Telegram upload is limited, the broader trend of stealer logs circulating on illicit forums and messaging platforms is well-documented. Cybersecurity research consistently highlights the efficacy of stealer malware in exfiltrating credentials from endpoint devices. For instance, reports from [mention a hypothetical cybersecurity firm or research group, e.g., Mandiant, CrowdStrike] have detailed the proliferation of infostealers like RedLine and Raccoon Stealer, which are often responsible for generating such logs. The OSINT landscape frequently reveals discussions and marketplaces where these logs are traded, underscoring the immediate danger posed by this leak.