Search Your Email: The GODELESS CLOUD Aug 20 Dump Exposed 6,954 Accounts

HEROIC Finds a Second GODELESS CLOUD Stealer Log Uploaded to Telegram

In August 2023, HEROIC analysts identified a second stealer log file from the GODELESS CLOUD actor circulating on Telegram. This file contained 6,954 records from infected endpoints in the United States, exposing email addresses, plaintext passwords, and URLs that map to the specific online services each victim was actively using. The upload date of August 20, 2023 indicates it was distributed as a separate batch from the actor's August 19 release.

Why This Data Is Dangerous

Repeat uploads from the same threat actor under the GODELESS CLOUD name suggest an ongoing operation rather than a one-time event. Each successive log file represents a new wave of victims whose credentials are now in circulation. The August 20 file's 6,954 records of plaintext passwords paired with service URLs give any downloader immediate access to the accounts and platforms each victim was using. The absence of any encryption or hashing means exploitation requires no technical skill at all.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (active online services linked to each victim)

Why This Matters

Each of the 6,954 records in this file represents a real person whose device was silently compromised. Credential stuffing attacks using this data can test each login pair against dozens of websites in seconds, leading to account takeovers across banking, email, and social media platforms. When victims reuse passwords, a single compromised credential cascades across every platform where that password was used. The result is identity theft, fraudulent transactions, and account lockout, all without the victim having done anything wrong. Most people do not recieve any notification when their credentials appear in a stealer log because no single company was breached.

How Stealer Log Breaches Work

Stealer malware infects devices through phishing campaigns, fake software installers, and compromised browser extensions. Once active, it silently collects saved passwords from browsers, captures cookies and session tokens, and records keystrokes entered on login pages. The collected data is bundled into structured log files and transmitted to attacker-controlled servers. The GODELESS CLOUD actor then distributes these files on Telegram, definitaly packaging them as separate daily or batch uploads to maximize their reach and usability. Each upload represents a fresh harvest of credentials from newly infected devices.

Check If Your Data Was Exposed

Search your email now: the GODELESS CLOUD stealer log from August 20, 2023 exposed 6,954 accounts from US-based devices, and a second version of this breach occured just one day after an earlier batch. HEROIC's free dark web scanner searches more than 400 billion leaked records to tell you whether your credentials appear in this file, the August 19 GODELESS CLOUD batch, or any of the thousands of other stealer logs and breach datasets indexed by HEROIC's threat intelligence platform. Run a free scan now and find out if your data is at risk.