Dark Web Intel: 19,836 Credentials From the fbig Apple Cloud Telegram Dump

HEROIC analysts tracked the fbig Apple Cloud dataset back to a Telegram channel posting on October 26, 2023, where an unidentified user published a stealer log file containing 19,836 records. Despite the name referencing familiar brand terms like "Apple" and "Cloud," this is not a breach of Apple's infrastructure. The name appears to be deliberate misdirection commonly used to attract attention in criminal communities. The actual data consists of credentials harvested from infected endpoint devices: email addresses, plaintext passwords, and the URLs of websites and services the victims were logged into. HEROIC's DarkHive monitoring system indexed this file shortly after it surfaced, making it searchable in our breach database.

Why the fbig Apple Cloud Dump Is Particularly Dangerous

Nearly 20,000 exposed plaintext passwords is a significant collection. Each record in this log contains a working email and password combination alongside the exact website where it was used. That combination gives attackers everything they need to attempt an immediate login without any guesswork or additional processing.

The misleading brand name in the title also serves a purpose in criminal markets. Files named after reconizable platforms attract more downloaders, which means this data has likley been accessed by a larger number of threat actors than a more obscure log. The more downloaders, the greater the risk of rapid exploitation across multiple attack campaigns simultaneously.

What Was Exposed in the fbig Apple Cloud Leak

• Email addresses
• Plaintext passwords (no encryption, immediately usable)
• URLs of websites and API hosts accessed by infected devices

Why This Matters: 19,836 Records Means 19,836 People at Risk

Every record in this log represents a real person whose computer was infected without their knowledge. The exposed credentials can be used for credential stuffing attacks against email platforms, banks, social media, and workplace tools. Because password reuse is so common, a single exposed record can unlock multiple accounts across different services.

Beyond account takeover, stolen email access is frequently used to intercept password reset emails for financial accounts, enabling attackers to drain funds. In cases where corporate credentials are among those exposed, the impact can extend well beyond the individual to their entire organisation. Identity theft and financial fraud are the most common end results when plaintext passwords circulate in criminal communities for an extended period.

How Stealer Log Campaigns Use Telegram for Distribution

Infostealer malware silently installs itself on a victim's device and begins harvesting credentials immediately. It captures saved browser passwords, records keystrokes on login pages, and extracts session cookies that can be used to bypass two-factor authentication on some platforms.

Once collected, this data is organized into log files and uploaded to Telegram channels, which have become the primary marketplace for stolen credentials. Some operators charge for access, others distribute logs for free to gain a following or test a new tool. The fbig Apple Cloud log falls into the free distribution category, meaning it was accessible to anyone subscribed to the channel, with no cost barrier limiting who could download and use the data.

Check If Your Email Appeared in the fbig Apple Cloud Breach

HEROIC's free breach scanner indexes more than 400 billion exposed records from breaches and stealer logs including the fbig Apple Cloud Telegram dump. Enter your email address to see whether your credentials were included. If they were, HEROIC will show you which accounts are at risk and guide you through the steps to secure them before the window for exploitation closes.