8,245 GODELESS CLOUD Credentials Exposed

Our threat intelligence platform flagged an unusual data dump originating from a Telegram channel, identified as "GODELESS CLOUD REBORN." This discovery on September 26, 2024, revealed a substantial collection of compromised endpoint data. What struck us as particularly concerning was the inclusion of plaintext passwords alongside email addresses and API host URLs, indicating a direct compromise of user credentials and potentially further access vectors.

The breach, classified as a stealer log compromise, originated from a single Telegram user who uploaded the compromized data. Analysis of the log file revealed 8,245 records, each containing a user's email address, a plaintext password, and associated API host URLs. This suggests the threat actor utilized infostealer malware to exfiltrate credentials from compromised endpoints. The presence of plaintext passwords is a critical vulnerability, as it bypasses the need for brute-forcing or credential stuffing attacks, offering immediate access to associated accounts and services.

While this specific incident does not appear to have garnered widespread media attention, the methodology aligns with a broader trend of infostealer malware proliferation observed in recent cybersecurity reports. Research from organizations like Mandiant and CrowdStrike consistently highlights the increasing sophistication and distribution of stealer logs on dark web marketplaces and private Telegram channels. The direct exposure of API host URLs further amplifies the risk, potentially enabling attackers to target backend infrastruture or pivot to other services authenticated via those APIs.