The Everlasting_Cloud Leak Exposed 4,771 US User Accounts

We noticed a recent upload on a popular Telegram channel on April 16th, 2025, containing a stealer log file. What struck us immediately was the relatively small but potent dataset, comprising 4,771 records. The presence of plaintext passwords alongside email addresses and associated URLs is a significant concern, suggesting a direct compromise of user credentials rather than a more complex data exfiltration strategy. This type of incident, while not massive in scale, often represents a low-hanging fruit for attackers seeking to gain initial access to other systems or services.

The breach, attributed to a stealer log uploaded by a Telegram user, appears to have occurred prior to the April 16th, 2025, leak date. The log file contained 4,771 records, each detailing compromised endpoint information, associated email addresses, and crucially, plaintext passwords. Additionally, URLs were present, likely indicating the websites or services targeted by the stealer malware. The source structure of the data suggests a direct capture of login credentials from infected endpoints. The leak locations are primarily within private Telegram channels, making attribution and takedown efforts challenging. The immediate implication is the high likelihood of credential stuffing attacks and unauthorized access to other accounts using these leaked credentials.

While this specific incident hasn't garnered widespread media attention, the underlying threat of stealer malware remains a persistent and growing concern. Numerous cybersecurity research firms have documented the increasing sophistication and prevalence of these tools, which are readily available on dark web forums and Telegram channels. For example, reports from Mandiant and CrowdStrike have consistently highlighted stealer logs as a primary vector for initial compromise in many targeted attacks, often leading to ransomware deployment or further lateral movement within enterprise networks. The ease with which such logs are shared underscores the need for robust endpoint security and user education regarding phishing and malware threats.