How the BONUS SNATCH_CLOUD2 Stealer Log Led to 13,005 Stolen Logins

We noticed a recent upload to a public Telegram channel containing a stealer log file, dated October 6, 2021. What struck us immediately was the straightforward nature of the data and its potential for immediate exploitation. The log file, identified as originating from a "BONUS SNATCH_CLOUD2" instance, contained a relatively small but highly sensitive dataset. The ease with which this information was disseminated underscores the persistent threat posed by credential harvesting malware and the subsequent public sharing of such illicitly obtained data.

The breach, discovered on October 6, 2021, involved a stealer log file uploaded by an anonymous Telegram user. This particular log, attributed to a tool named "BONUS SNATCH_CLOUD2," compromised 13,005 records. The exposed data types are particularly concerning: email addresses, plaintext passwords, and associated URLs. This combination is a potent cocktail for attackers, enabling direct account takeovers and further reconnaissance. The source structure indicates a typical stealer log, capturing browser credentials and potentially other sensitive information from infected endpoints. The leak location, a public Telegram channel, signifies a deliberate act of data distribution, likely intended to be accessed by a broad audience of malicious actors.

While this specific incident may not have garnered widespread mainstream news coverage, the underlying threat of credential stealer malware is a constant feature in cybersecurity reporting. Numerous reports from security firms like Mandiant and CrowdStrike regularly detail the proliferation of such tools and the impact of compromised credentials on enterprise security. The methodology of data exfiltration via stealer logs and subsequent dissemination on platforms like Telegram is a well-documented tactic employed by various threat actor groups, often serving as a precursor to more sophisticated attacks or as a direct means of financial gain through account hijacking and credential stuffing.