The HESOYAM CLOUD Breach Gave Hackers API Keys and Cloud Access

HEROIC analysts discovered a stealer log on September 20, 2025, connected to a Telegram channel distributing files under the name CloudHesoyam. The dump contained 31,873 records tied to HESOYAM CLOUD, a cloud infrastructure platform. The exposed data wasn't limited to typical user credentials. It included internal API host information and endpoint details, the kind of data that gives attackers a map of an organization's cloud enviroment. The plaintext passwords made the situation worse, removing any barrier between the data and immediate account takeover. Our team spotted the activity while monitoring Telegram channels known for trading access credentials.

Why This Is Dangerous

Cloud infrastructure credentials are among the most valuable data an attacker can acquire. Unlike a single website login, compromised cloud access can expose storage buckets, databases, internal applications, and every service connected to the account. When API host information is included, attackers can identify specific entry points into a cloud environment and move laterally across connected systems without raising many flags. This type of breach is not about stealing one person's data. It's about gaining a foothold that can affect thousands.

What Was Exposed

• Email addresses linked to HESOYAM CLOUD accounts
• Plaintext passwords (readable by anyone with the file)
• API host URLs pointing to internal cloud infrastructure
• Endpoint data useful for network reconnaisance
• 31,873 total records scraped from compromised systems

Why This Matters

Most cloud users don't realize that a single infected developer machine can expose an entire organization's cloud environment. Stealer malware doesn't care about encryption or firewalls once it's running on a device. It captures credentials as they're typed or stored, then bundles them into log files that get sold on platforms like Telegram. The HESOYAM CLOUD breach shows that targeted stealer campaigns are increasingly aimed at cloud users, not just general internet accounts. The risk extends beyond the individual victim to every system they had access to.

How Stealer Logs Work

Stealer malware arrives on a device through a phishing link, a fake software installer, or a malicious file attachment. Once active, it silently records credentials from browsers, saved passwords, and active sessions. It can also grab clipboard contents, saved cookies, and form autofill data. The collected files are then uploaded automatically to a server or Telegram channel where they're sorted and sold. Attackers purchasing these logs often use automated tools to test every credential against popular cloud platforms within minutes of receiving the file.

Check If You Are Affected

If you use HESOYAM CLOUD or any cloud platform and your device has ever been infected, your credentials and API details may already be in circulation. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer log databases, to show you what has been exposed. Don't assume your cloud accounts are safe. Run a free scan today and see exactly what attackers may already know about you.