Researchers Link LOGSYNC’s KeyCloud Dump to 19,118 Stolen Logins

HEROIC analysts traced a stealer log file uploaded to a public Telegram channel on May 28, 2025, under the label "Upload by LOGSYNC - KeyCloud_Free_logs120." The file contained 19,118 records, each pairing an email address with a plaintext password and the URL of the account that password unlocks, all harvested directly from malware-infected devices.

Why This Is Dangerous

Analysts flag files like this one because they remove every barrier between an attacker and a working login. There is no encryption to defeat, no password to guess, just a ready-to-use list of accounts organized by the exact site each one opens. That makes the data immediately usable the moment it is downloaded.

What Was Exposed in the LOGSYNC KeyCloud Dump

• Email addresses tied to infected devices
• Plaintext passwords stored and leaked with no encryption
• URLs identifying the exact service each login accesses

Why This Matters

Researchers tracking these Telegram uploads consistently see the same pattern play out: leaked credentials get run through automated tools within days of surfacing. Anyone among these 19,118 records who reused a password on another account faces credential stuffing, account takeover, and the financial fraud or identity theft that tends to follow.

How a LOGSYNC-Style Stealer Log Gets Built

Stealer logs like this one are the output of infostealer malware that infects a device through a cracked download, a fake update, or a malicious attachment. Once running, it copies saved browser passwords, autofill entries, and active sessions into a text file and sends it back to whoever controls the malware, who then packages and uploads it under labels like LOGSYNC to channels dedicated to trading this kind of data.

Check If You Are Affected

If your email could be one of the 19,118 records in this dump, find out before an attacker does. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, and tells you instantly if you have been exposed. Run a free scan and change any password it flags.