Inside the SNATCH_CLOUD2 Stealer log That Exposed 7,382 Passwords

We noticed a recent upload to a public Telegram channel on December 22, 2021, containing a stealer log file. This particular log, identified as SNATCH_CLOUD2, contained a concerning volume of sensitive endpoint and credential data. What struck us was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs, suggesting a compromise of user authentication mechanisms rather than a simple credential stuffing attack. The relatively contained pwned count of 7382 records doesn't diminish the potential impact, as the nature of the exposed data points to a sophisticated compromise.

The breach, originating from a stealer log file uploaded by an anonymous Telegram user, exposed 7382 records. The data types include email addresses, plaintext passwords, and associated API host URLs. This indicates a compromise of endpoint devices where the SNATCH malware was active, exfiltrating credentials and browsing data. The structure of the data suggests that the stealer logged active sessions and saved credentials from various applications and websites, including those with API access. The leak location being a public Telegram channel amplifies the risk of further dissemination and exploitation by malicious actors.

While this specific incident hasn't garnered widespread media attention, the underlying threat of stealer malware is a persistent concern within the cybersecurity landscape. Research from various cybersecurity firms, including Mandiant and CrowdStrike, consistently highlights the prevalence and evolving sophistication of infostealers. These tools are often distributed through phishing campaigns, malicious advertisements, or compromised software, making them a constant threat vector for credential theft and subsequent unauthorized access to corporate resources. The exposure of API host URLs alongside credentials is particularly noteworthy, as it could facilitate direct access to backend services or cloud infrastructure, bypassing traditional perimeter defenses.