Inside the SNATCH_CLOUD6 Data Leak That Put 15,258 Accounts at Risk

We noticed the emergence of a stealer log file on a public Telegram channel on September 30, 2021, which has since been identified as 28 SEPT SNATCH_CLOUD6. This particular upload contained a concerning volume of compromised endpoint data, specifically impacting 15,258 unique records. What struck us was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs, indicating a significant compromise of user credentials and potentially further access vectors.

The breach breakdown reveals a stealer log file, uploaded by an anonymous Telegram user, detailing the exfiltration of 15,258 records. The compromised data types include email addresses, plaintext passwords, and URLs, likely representing API hosts or other critical web resources. This type of log file typically originates from malware deployed on user endpoints, designed to harvest credentials and sensitive information. The direct exposure of plaintext passwords is a critical vulnerability, as it allows for immediate credential stuffing attacks and unauthorized access to associated accounts and services. The inclusion of API host URLs suggests that attackers may have gained insights into the infrastructure and services targeted by the compromised users, potentially enabling more sophisticated follow-on attacks.

While specific news coverage for this particular stealer log upload is limited, the broader trend of credential harvesting via stealer malware is well-documented. Numerous cybersecurity research firms, including Mandiant and CrowdStrike, have published extensive reports on the proliferation and evolving tactics of stealer malware families. These reports consistently highlight the significant risk posed by plaintext password exposure, which often facilitates widespread account takeover campaigns and supply chain attacks. OSINT investigations into similar Telegram channels frequently reveal marketplaces for stolen credentials, underscoring the commercial incentive behind such data exfiltration.