The KeyCloud Logs #131 Leak Exposed 5,195 US-Based Accounts on Telegram

HEROIC analysts identified 5,195 records in the Telegram KeyCloud Logs #131 by .boxed.pw on June 8, 2025. The dump contains email addresses, usernames, IP addresses, credit card details, plaintext passwords, and homepage URLs primarily tied to United States users and pulled from machines infected by infostealer malware.

Why the KeyCloud Logs #131 Leak Is Dangerous

Stealer logs focused on US users are a priority target for fraud rings running account takeovers against American banks, retailers, and payroll providers. With plaintext passwords and card data in the same record, attackers skip cracking entirely and pivot straight to charging cards and hijacking accounts.

What Was Exposed in the KeyCloud Logs #131 Dump

• Email addresses
• Usernames
• IP addresses
• Credit card details
• Plaintext passwords
• HomePage URLs tied to each credential

Why This Matters

Plaintext credentials paired with card data speed up credential stuffing, account takeover, identity theft, and unauthorized purchases. US victims often see fraud on banks, mobile carriers, retail accounts, and tax filings in the weeks after a log like this surfaces. Reused passwords make the damage worse.

How Stealer Logs Are Collected

Infostealer malware spreads through cracked software, fake installers, phishing attachments, and malicious ads. Once running, it scrapes saved browser credentials, autofill data, cookies, and card numbers, then uploads the bundle to its operator. Operators package the loot into numbered logs and post them to Telegram channels like .boxed.pw, where affiliates pick them up for credential stuffing and fraud.

Check If You Are Affected

Run your email through HEROIC's breach scanner, which indexes more than 400 billion records including stealer dumps from Telegram. Rotate reused passwords, cancel any potentially compromised cards, and turn on multi-factor authentication across banking and email accounts.