The fbig Apple Cloud Breach Put 17,821 Stolen Email and Password Pairs Online in October 2023

HEROIC analysts traced a stealer log file uploaded to a public Telegram channel on October 28, 2023. The file, listed as fbig Apple Cloud, held 17,821 records collected from devices infected with infostealer malware. Each record contained an email address paired with a plaintext password, along with API host URLs and website addresses showing exactly which services those credentials belonged to. The data was made freely available in the channel, meaning any person with access to that Telegram group could download and begin using these credentials without any additional effort.

Why fbig Apple Cloud Credentials Are Ready to Use Against You

Plaintext passwords require no processing before an attacker can use them. Unlike hashed passwords, which require cracking tools and time, the passwords in this dataset are immediately readable. An attacker can copy an email and its matching password, open a browser, and try it against any online account the victim owns. If that person uses the same password for their email account, cloud storage, or banking app, those accounts are all at risk from a single stolen credential. The inclusion of specific service URLs in the log tells attackers exactly which platforms to target first, removing even the guesswork from the attack.

What Was Exposed in the fbig Apple Cloud File

• Email addresses linked to personal and professional accounts
• Plaintext passwords, readable without any decryption tools
• API host URLs revealing which services were accessed
• Website URLs pointing to the specific platforms targeted by the malware

Why 17,821 Records Creates Serious Risk for Real Users

Each of the 17,821 records in this file represents a real person whose device was infected and whose login information was taken without their knowledge. Credential stuffing attacks, where attackers test stolen passwords across multiple services automatically, are among the most frecuent causes of account takeover worldwide. When an attacker succeeds, the consequences range from spam sent from a hacked email account to unauthorised purchases made with saved payment details. In more serious cases, access to one account leads to access to others through password reset flows, turning a single stolen credential into a full account compromise across multiple platforms. This kind of data also feeds identity theft schemes, where personal details are combined and sold to fraudsters operating in different markets.

How the fbig Apple Cloud Stealer Log Was Created

Infostealer malware lands on a device through everyday actions: clicking a link in a phishing email, downloading what appears to be a legitimate software update, or installing a browser extension that turns out to be malicious. Once running on the device, the malware accesses saved browser passwords, reads session cookies, and logs every site the user visits and every credential they use. It gathers this information silently without affecting the device's normal performance, which is why victims rarely notice anything is wrong. The collected data gets transmitted to the attacker's server and eventually sorted into log files, which are then shared or sold. The fbig Apple Cloud file is one such log, a snapshot of real browsing and login activity stripped from compromised machines and handed over to anyone willing to take it.

Check If the fbig Apple Cloud Breach Has Your Credentials

HEROIC provides a free breach scanner backed by a database of more than 400 billion compromised records. That database includes stealer logs like the fbig Apple Cloud file, as well as thousands of other known breaches. Enter your email address to find out if your credentials have been exposed. If they have, you will recieve a clear alert telling you which breaches contain your data, so you can change your passwords and secure your accounts before any damage is done. The scan is free and takes less than a minute.