Fortuna Cloud uploaded by a Telegram User

We've been tracking an uptick in stealer logs appearing on Telegram channels, but the recent Fortuna Cloud leak stood out due to its targeted nature and the sensitive information it contained. What really struck us wasn't the volume of records—around 12,590—but the specific combination of data points exposed. The data had been circulating quietly, but we noticed its potential impact on enterprise security, particularly concerning cloud infrastructure and API access. The setup here felt different because the stealer log contained not just credentials, but also detailed endpoint information, potentially enabling lateral movement within compromised environments.

Fortuna Cloud leak exposes 12,590 records via Telegram stealer log

A stealer log surfaced on Telegram on January 16, 2024, revealing 12,590 records associated with Fortuna Cloud. The data included a mix of email addresses, plaintext passwords, and URLs, presenting a significant risk to users and organizations relying on the service.

The breach was discovered when a Telegram user uploaded the stealer log file to a public channel. The combination of plaintext passwords and specific URLs caught our attention, as it significantly lowers the barrier for attackers to gain unauthorized access to user accounts and potentially sensitive data. We noticed this because of the specific file naming conventions used in stealer logs, combined with the presence of cloud-related URLs.

This leak matters to enterprises because it underscores the persistent threat posed by stealer logs and the importance of robust credential management. Even if Fortuna Cloud itself maintains strong security, compromised user credentials can bypass these protections. This incident highlights the broader threat theme of credential harvesting via malware and the subsequent exploitation of those credentials across various online services.

• Total records exposed: 12,590
• Types of data included: Email Addresses, Plaintext Passwords, URLs
• Sensitive content types: Potentially sensitive data accessible via leaked URLs
• Source structure: Stealer log file
• Leak location(s): Telegram
• Date of first appearance: January 16, 2024

Recent reporting by BleepingComputer has highlighted the increasing prevalence of stealer logs being traded and sold on Telegram and dark web forums, making it easier for threat actors to acquire and exploit compromised credentials. One Telegram post claimed the files were "collected from devs testing an AI project," though this has not been confirmed. This incident also aligns with broader trends in automated attacks, where compromised credentials are used to rapidly compromise accounts and systems.