Researchers Flag GODELESS CLOUD: 8,253 Stolen Credentials Exposed

HEROIC's DarkHive monitoring system identified and indexed a second GODELESS CLOUD stealer log dataset on June 8, 2023 -- one day after the operator's 8,246-record June 7 release. The follow-up drop contains 8,253 stolen credential records: email addresses, plaintext passwords, and the URLs of the compromised services, harvested by infostealer malware from infected devices worldwide. Back-to-back daily releases at near-identical volume indicate that GODELESS CLOUD operates a continuous high-throughput malware pipeline -- not a one-time event. The combined two-day total reaches 16,499 stolen credential records distributed to every subscriber of the GODELESS CLOUD Telegram channel.

Why This Is Dangerous

GODELESS CLOUD's June 8 release is dangerous for the same reason its June 7 release was: every password is stored in plaintext. There is no encryption layer, no hashing, no processing step between the stolen credential and a working account login. Attackers can load the entire 8,253-record dataset into credential stuffing tools within minutes of download. The accompanying URL field identifies exactly which service each credential belongs to, allowing attackers to prioritize high-value targets -- banking, email, and e-commerce accounts -- over lower-value ones. Back-to-back releases also signal to the underground market that this operator is reliable and high-volume, attracting more buyers and widening the distribution of these credentials.

What Was Exposed

• Email Addresses: 8,253 victim email addressses extracted from browser saved credential stores on compromised devices, collected in the June 8, 2023 campaign window.
• Plaintext Passwords: Unencrypted passwords captured by infostealer malware, no cracking required, immediately deployable for credential stuffing across thousands of online services.
• URLs: Login page URLs identifying the exact services breached on each infected device, enabling attackers to target accounts at email providers, banks, SaaS platforms, and e-commerce sites.

Why This Matters

Together, GODELESS CLOUD's June 7 and June 8, 2023 releases exposed 16,499 stolen credential records in a 48-hour window. For victims whose credentials appear in either release, the combined distribution means their data was shared with every subscriber of the GODELESS CLOUD Telegram channel -- a potentially large audience of threat actors seeking ready-made credential stuffing payloads. Anyone who has not changed passwords on the services exposed in this dataset since June 2023 should treat their accounts as potentialy comprommised and act accordingly, regardless of whether they have seen any suspicious activity.

How Stealer Log Breaches Work

The consistency of GODELESS CLOUD's daily output indicates reliance on an affiliate-based infostealer distribution model: multiple malware operators run independent campaigns using tools like RedLine, Vidar, and Lumma Stealer, then pipe their log file output to the GODELESS CLOUD operator as a centralized aggregator and distributor. This model decouples infection volume from any single campaign -- as long as affiliates keep delivering logs, the operator can sustain daily releases. The June 8 drop's near-identical volume to the June 7 release suggests stable affiliate throughput at approximately 8,000 to 8,500 credentials per day during this period.

Check If You Are Affected

HEROIC's free breach scanner indexes more than 400 billion compromised records, including both the June 7 and June 8 GODELESS CLOUD releases and thousands of other Telegram infostealer log drops tracked by DarkHive. Enter your email address to instantly check whether your credentials appear in either GODELESS CLOUD release or any other dataset in HEROIC's comprehensive breach database.