Dark Web Intel: 74k Credentials From the Pegasus Cloud Telegram Dump

HEROIC's dark web monitoring team flagged this credential dump while scanning Telegram channels known for trading stolen access packages. On September 1, 2025, a file labeled Pegasus Cloud PegasusCloud appeared in one of these channels, containing 74,316 records with email addresses, plaintext passwords, and URLs pointing to cloud services and API endpoints. The naming convention used by the uploader was clearly designed to attract buyers interested in cloud infrastructure access, and the contents delivered on that promise. This was not a simple list of consumer logins. The data included active endpoint references, suggesting the information was freshly harvested from infected machines.

Why This Is Dangerous

Telegram has become one of the primary distribution platforms for stolen credential packages. When a dump of this size appears with cloud API URLs embedded alongside plaintext passwords, it immediately attracts attention from ransomware operators and access brokers. These buyers do not need to do any additional hacking. They simply import the file, run automated login scripts, and identify which accounts are still active. The 74,316 records in this dump represent a significant pool of potentialy active cloud access points that could be monetized within hours of the original upload.

What Was Exposed

• 74,316 records harvested from endpoints by stealer malware
• Email addresses used as login identifiers
• Plaintext passwords stored without any encryption
• URLs including cloud API endpoints and management console addresses
• Data posted to a Telegram channel on September 1, 2025

Why This Matters

The Pegasus Cloud dump is part of a broader pattern HEROIC analysts have documented across dozens of similar Telegram channels. Access brokers sort these files by service type and resell cloud-specific credentials to criminal groups for prices ranging from a few dollars to hundreds depending on the target. For the victims included in this dump, the risk is not limited to having their accounts accessed once. Once credentials appear in a Telegram channel, they are copied, reshared, and reused across multiple criminal networks. The data can circulate for months or even years after the initial upload, meaning exposure is ongoing and not a one-time event.

How Stealer Log Dumps Get Traded on Telegram

Threat actors who operate credential marketplaces on Telegram work with a straightforward model. Stealer malware infections produce log files containing all saved data from a compromised device. These logs are aggregated, filtered by category, and uploaded to Telegram channels either for direct sale or free distribution to build reputation. Channels dedicated to cloud credentials are particuarly active because cloud access is extremely valueable to ransomware groups. A single successful cloud account takeover can give attackers access to backups, file storage, customer data, and internal communications. The Pegasus Cloud file fits this profile exactly, with its mix of cloud URLs and working plaintext passwords.

Check If You Are Affected

HEROIC's breach intelligence platform monitors dark web channels, Telegram dumps, and hacking forums in real time. The database behind HEROIC's free scanner contains more than 400 billion exposed records, including credentials from stealer log dumps like this one. If your email appeared in the Pegasus Cloud Telegram file or any other breach, HEROIC will find it. Check your exposure now for free and find out whether your passwords need to be changed before someone else uses them.