The KeyCloud_Free_logs125 Leak: 19,847 Records Surfaced in June 2025

HEROIC analysts identified a stealer log labeled "LOGSYNC - KeyCloud_Free_logs125" uploaded to a Telegram channel on June 2, 2025. The file contained 19,847 records, each pairing an email address with a plaintext password and a related API host URL, the signature of infostealer malware pulling saved credentials directly off infected devices rather than a breach of a company's own servers.

Why the KeyCloud_Free_logs125 Leak Is Dangerous

Nearly 20,000 complete login records were exposed with the passwords stored in plaintext, so an attacker does not need to crack or guess anything to use them. Because each record also includes the API host URL the credentials belonged to, an attacker can move straight from the log to a working login. A dataset this size is valuable enough to be traded, resold, or redistributed further across dark web forums and other Telegram channels long after it first surfaced.

What Was Exposed in the KeyCloud_Free_logs125 Leak

• Email addresses
• Plaintext passwords
• Associated API host URLs

In total, 19,847 records were included in the file.

Why This Matters

A log of this size is exactly the kind of data used in credential stuffing campaigns, where stolen email and password pairs are tested automatically across thousands of other sites. Because each record already ties a password to the exact service it opened, it also speeds up account takeover for anyone who reused that password elsewhere, extending the risk to financial fraud and identity theft.

How a Stealer Log Like This Gets Built

Infostealer malware infects a device and quietly copies saved browser passwords and the API endpoints tied to them before sending everything back to whoever controls the malware. A log of nearly 20,000 records, packaged and shared by an uploader identifying as LOGSYNC, suggests credentials were gathered from a large number of infected machines over time before being compiled and distributed. Logs like this are routinely traded or resold in underground Telegram channels, which is why the danger from a leak like this does not fade once the initial upload is old news.

Check If You Are Affected

With almost 20,000 accounts in this single log, the odds that your information is included are real, whether the leak happened last week or months ago. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can see what has been exposed and change any reused passwords before someone else does.