PegasusCloud Stealer Log: 31,912 Cloud Credentials Leaked (2025)

Cloud Credential Targeting Has Become a Primary Focus for Information Stealer Campaigns in 2025

The PegasusCloud stealer log from June 23, 2025 -- containing 31,912 plaintext credentials distributed via Telegram -- reflects a significant shift in what information stealer malware operators are prioritizing. Where earlier campaigns focused on general-purpose credential harvesting, the PegasusCloud log's naming and content suggest deliberate targeting of cloud platform credentials: the API keys, OAuth tokens, and service account credentials that grant access to cloud infrustructure, storage, and compute resources.

PegasusCloud Stealer Log (June 2025): Breach Summary

• Records Exposed: 31,912
• Data Types: Email addresses, plaintext credentials, endpoint URLs, API hosts
• Breach Type: Stealer log
• Country Affected: United States
• Date Leaked: June 23, 2025

Why Cloud Credentials Are the High-Value Target in 2025

The shift toward cloud credential targeting represents a maturation of the stealer ecosystem. Early information stealers focused primarily on banking credentials and social media logins. As organizations migrated workloads to cloud platforms, threat actors followed the value -- recognizing that a single set of cloud platform credentials can provide access to entire infrastructure environments, stored customer data, and business-critical services.

A compromised AWS or Azure credential set can translate to compute resource hijacking for cryptomining, data exfiltration from cloud storage buckets, lateral movement into connected services, and in the worst cases, complete infrastructure takeover. The 31,912 records in the PegasusCloud log represent a pool of potentially high-value cloud access credentials that attackers can systematicly test for active access to production environments.

Stealer Logs in 2025: The Evolving Telegram Distribution Ecosystem

The PegasusCloud log's distribution via Telegram follows the same model that made DaisyCloud and similar campaigns effective in 2024. By 2025, Telegram-based stealer log distribution had become highly organized -- with channels offering subscription tiers, sorted log archives by credential type, and even search functionality for specific domains or platforms. This commoditization of stolen credentials has lowered the barrier to entry for less sophisticated threat actors while increasing the volume of credential abuse.

The 31,912 PegasusCloud records likely appeared across multiple Telegram channels simultaneously, reaching thousands of potential threat actors within hours of the June 23 upload. For security teams monitoring Telegram-based threat intelligence, cloud-focused stealer logs like this one represent a high-priority alert category.

From Endpoint to Exploit: The Stealer Log Attack Chain

Understanding why 31,912 records constitutes a serious risk requires tracing the full attack chain. Stealer malware on an infected endpoint silently harvests credentials, packages them into a log archive, and transmits them to the operator. The operator sorts and batches the logs, then distributes them via Telegram either freely or for payment. Subscribers download the logs, parse them for target-specific credentials, and begin testing those credentials against live services. The entire chain from initial infection to first unauthorized access attempt can complete within 24-48 hours of endpoint compromise.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including cloud-focused stealer logs like PegasusCloud distributed via Telegram. If your email or credentials appear in any monitored breach, you'll receive an immediate alert with remediation guidance. Protect your cloud access -- check your exposure for free at HEROIC.com.