KeyCloud Logs #132 Put 6,096 Cloud Account Passwords on the Dark Web

HEROIC analysts spotted KeyCloud Free Logs #132 being distributed across a public Telegram channel on June 9, 2025. The log, published by the .boxed.pw operator, contained 6,096 records extracted from devices infected with infostealer malware. Each entry included an email address, a plaintext password, and a homepage URL pointing to the specific cloud-based or online services the victim was using at the time of compromise. The KeyCloud label used by this operator suggests a focus on accounts associated with cloud storage platforms and online productivity services, making this a pointed threat to users of those tools.

Why Cloud Account Credentials From KeyCloud Logs #132 Are High-Value Targets

Cloud accounts hold far more than most people realize. A compromised cloud storage login can expose years of personal documents, business files, tax returns, and photos. A compromised email account connected to cloud services gives an attacker access to shared drives, calendar data, and contacts. Credentials tied to cloud-based work platforms can open the door to an entire organization's internal communications and file repositories. The homepage URLs in this log confirm which cloud services each victim was actively using, making it simple for an attacker to focus effort on the highest-value accounts rather than wasting time on less productive targets.

What Was Exposed in the KeyCloud Logs #132 Telegram Dump

• Email addresses (login identifiers for cloud and online service accounts)
• Plaintext passwords (immediately usable, zero barriers to exploitation)
• HomePage URLs (identifies the exact cloud and web services each victim relies on)

Why This Matters: From Cloud Access to Corporate Infiltration and Identity Theft

Once a criminal has access to a cloud account, the attack surface expands rapidly. Shared folders reveal confidential business data. Connected app integrations expose third-party platforms. Synced devices become visible, sometimes allowing remote access. For individuals, the risk is personal identity theft, financial fraud through linked payment accounts, and loss of irreplaceable personal data. For professionals using cloud platforms for work, one compromised login can give an outsider access to client data, contracts, and intenal communications that would otherwise require months of sustained network intrusion to obtain. Credential stuffing tools can test all 6,096 pairs from this log against major cloud platforms simultaneously, within hours of the dump going live on Telegrem.

How KeyCloud-Style Stealer Log Operations Work

The KeyCloud Logs series is the named output of an ongoing stealer malware distribution operation. The operator .boxed.pw runs a Telegram channel where batches of harvested credentials are released regularly, each labeled with a number to indicate which installment it is. The underlying data comes from infostealer malware running on real users' devices, typically installed through software cracks, phishing downloads, or malicious browser extensions. The malware silently extracts saved passwords, active session tokens, and autofill data from the device's browsers, packages it all into a log file, and sends it to the attacker's infrastructure. The operator then bundles logs from multiple infected machines, strips them into clean record sets, and publishes them to Telegram for distribution to other criminals or buyers.

Check If Your Cloud Accounts Were Exposed in KeyCloud Logs #132

HEROIC's free breach scanner searches across more than 400 billion exposed records, including Telegram stealer logs like the KeyCloud series. If your email address and password appeared in the #132 dump, HEROIC will identify it and show you which breach it came from. Check for free now and make sure your cloud accounts are not already compromised.