Our Analysts Found the STARLINKCLOUD6 Dump Circulating on Telegram

While monitoring Telegram channels that regularly host stolen credential files, HEROIC analysts encountered the STARLINKCLOUD6 stealer log in late October 2023. The file had been uploaded by an anonymous user and contained 28,797 records, making it notably larger than many of the targeted cloud-focused logs we see. What immediately caught our attention was the composition of the data: email addresses paired with plaintext passwords and URLs that included API hostnames and internal endpoint addresses. This was not a generic credential dump collected from random infections. The specificity of the URLs suggested the malware that generated this log had been running on machines with legitimate access to cloud infrastructure systems.

Why the STARLINKCLOUD6 Data Is Especially Risky

Twenty-eight thousand records is a meaningful number, but the real danger with STARLINKCLOUD6 is in the type of data, not just the quantity. API endpoint URLs and hostnames reveal the internal structure of a cloud environment. Combined with working email and password pairs, an attacker does not just get account access, they get a roadmap. They can identify which services are running, probe for unpatched endpoints, attempt privilege escalation, and potentially move laterally through connected systems. Because the passwords were stored in plaintext, every record in this dump is immediately actionable with no technical preparation required.

What Was Exposed in the STARLINKCLOUD6 Dump

• Email adresses associated with cloud infrastructure accounts
• Plaintext passwords with no hashing or obfuscation
• URLs pointing to cloud service endpoints and login portals
• API host informaton that outlines internal system architecture

Why This Matters for Anyone Whose Data Appeared

When credentials tied to cloud infrastructure appear in a public stealer log, the consequences extend far beyond the individual whose account was exposed. A compromised cloud account can be used to deploy malware to other users on the same platform, exfiltrate customer databases, or run unauthorized compute jobs that rack up massive bills. For individuals, the downstream risks include credential stuffing across email and financial accounts, identity theft using personal data stored in cloud files, and account takeover that can be difficult to reverse once an attacker has established persistence inside the account.

How Stealer Logs End Up on Telegram

Stealer log malware is built to do one thing efficiently: harvest everything a browser or device has saved and transmit it to the attacker. The infection usually starts with something that looks harmless, a job application attachment, a free software installer, or a browser plugin promising useful features. Once installed, the malware copies saved passwords, session cookies, and locally stored configuration files in seconds. The resulting log file is small and easy to move, so it gets posted to a private Telegram channel almost immediately. Sometimes the uploader sells access to the logs, sometimes they post them freely to build reputation in the community. The STARLINKCLOUD6 file followed this exact path before HEROIC analysts flagged it during monitorring of these channels.

Check If Your Email Was in the STARLINKCLOUD6 Leak

HEROIC's breach scanner covers over 400 billion exposed records, including the STARLINKCLOUD6 dataset. Enter your email address and HEROIC will tell you instantly whether your data appeared in this breach or any of the thousands of other incidents in its database. The scan is completely free and takes just a few seconds.