Everlasting_Cloud Gave Attackers 35,487 Sets of Login Credentials

We noticed a concerning data leak surfacing on April 14, 2025, originating from a Telegram user who published a stealer log file. This particular incident involved the exposure of a substantial number of records, specifically 35,487, detailing endpoint information alongside credentials. What struck us immediately was the presence of plaintext passwords, a critical vulnerability that significantly elevates the risk profile for affected individuals and organizations. The nature of the data suggests a sophisticated compromise, likely through malware designed to exfiltrate sensitive authentication details.

The breach, identified as a stealer log, contained 35,487 records, primarily consisting of email addresses and plaintext passwords. Accompanying these were associated URLs, likely representing the compromised endpoints or services. The source structure indicates a direct exfiltration from infected systems, bypassing typical encryption layers. The leak locations were predominantly within Telegram channels, a common vector for disseminating stolen data. The inclusion of plaintext passwords is a critical threat theme, as it directly enables unauthorized access to other systems where these credentials might be reused. This highlights the pervasive issue of password reuse across different platforms, making a single compromise a gateway to multiple accounts.

While this specific incident may not have garnered widespread mainstream news coverage, the underlying methodology aligns with a persistent trend in cybercrime. Threat intelligence reports from various cybersecurity firms, such as Mandiant and CrowdStrike, frequently detail the use of infostealers and the subsequent dissemination of their logs via platforms like Telegram. OSINT analysis of Telegram channels dedicated to data leaks often reveals similar patterns of credential harvesting and distribution. Research into the efficacy of credential stuffing attacks, which leverage leaked username-password pairs, further contextualizes the severe implications of such breaches, demonstrating how easily attackers can pivot from a single data dump to widespread account takeovers.