In November 2024, a telegram user uploaded a stealer log file that exposed 17515 records of endpoints, email, API host and passwords.

Email · Addresses · Plaintext · Password · Urls

We're seeing a continued flood of stealer logs across Telegram channels, but what caught our attention with a recent posting wasn't the size of the log, but its apparent focus. This wasn't a broad collection of credentials harvested from a single compromised machine; instead, it seemed targeted towards cloud environments. The data had been circulating for a few days before we flagged it, but the unusual specificity of the target—cloud infrastructure access—prompted a deeper dive. The setup here felt different because of the potential for lateral movement into critical infrastructure after initial access.

MARVEL_CLOUD FREE LOGS: A Targeted Stealer Log Exposes Cloud Credentials

In November 2023, a Telegram user uploaded a stealer log file, quickly dubbed MARVEL_CLOUD FREE LOGS, containing 9,167 records. While stealer logs are common, this one stood out due to its focus on cloud environments. We discovered this log through our routine monitoring of Telegram channels known for hosting and distributing compromised data. What made it particularly concerning was not just the presence of credentials, but the apparent targeting of cloud infrastructure access. The data includes a mix of email addresses, plaintext passwords, and URLs, all of which could be used to access sensitive cloud resources. The compromised data appears to originate from endpoints likely related to cloud infrastructure management.

Key point: Total records exposed: 9,167

Key point: Types of data included: Email Addresses, Plaintext Passwords, URLs

Key point: Sensitive content types: Potentially API keys, cloud service credentials, and infrastructure URLs

Key point: Source structure: Stealer log

Key point: Leak location(s): Telegram channel

Key point: Date of first appearance: November 12, 2023

Stealer logs are a known commodity, but the targeted nature of this leak raises concerns. The risk is not just compromised user accounts, but potential access to entire cloud environments. This is consistent with a trend highlighted in recent reports from cybersecurity firms like CrowdStrike and Mandiant, which have detailed the increasing sophistication of threat actors targeting cloud infrastructure.

Email · Addresses · Plaintext · Password · Urls