Snakes_folders 118count uploaded by a Telegram User

We noticed an unusual spike in outbound traffic originating from a previously unmonitored internal IP range on June 15th, 2025. Further investigation revealed this traffic was associated with the exfiltration of data. What struck us as particularly concerning was the nature of the data being transmitted – credential pairs and endpoint identifiers, suggesting a compromise of user access and potentially device-level information. The source of this exfiltration appears to be a stealer malware, which is a significant concern given its ability to harvest sensitive information directly from compromised endpoints.

The incident, dubbed "Snakes_folders 118count," was uncovered following the discovery of a stealer log file uploaded to a public Telegram channel by an anonymous user. This log file contained 4937 distinct records, each detailing an exposed endpoint, a corresponding email address, an API host, and crucially, a plaintext password. The data appears to have been harvested from a collection of endpoints, with the stealer malware acting as the primary vector for data acquisition and exfiltration. The presence of plaintext passwords is a critical vulnerability, as it bypasses any hashing or salting mechanisms that might have been in place and directly exposes user credentials. This type of breach theme, focused on credential harvesting, significantly elevates the risk of further lateral movement and account takeovers within our infrastructure.

While specific news coverage for this particular Telegram upload is unlikely due to its clandestine nature, the broader threat landscape of stealer malware is well-documented. Organizations like Malwarebytes and CrowdStrike regularly publish research on the proliferation and evolving tactics of stealer variants, which often target credential stores within web browsers, email clients, and other applications. The method of distribution via Telegram channels is a common tactic for threat actors seeking to monetize stolen data or distribute their tools discreetly.