Someone Has Your Password: 8,573 AnubisCloud Credentials

HEROIC's dark web intelligence systems flagged a stealer log file titled "AnubisCloud_bot - 400 FILES 08.03" being shared on Telegram in March 2024. The dataset contains 8,573 compromised credential records extracted from 400 individual malware log files, all produced by the AnubisCloud bot operation. This Telegram-based bot automates the collection and distribution of stolen credentials, making it a persistent threat to users whose devices have been compromised.

8,573 Plaintext Passwords With No Time to Waste

Every password in this dataset is stored in plaintext, meaning each one is immediately readable and usable. The AnubisCloud operation does not encrypt or obfuscate its stolen data. The 8,573 credentials were harvested from real devices and are shared openly on Telegram, where any attacker can download and use them within seconds. If your password is in this file, someone already has it in its exact form, and they do not need any tools to decode it.

What Was Exposed

• Email Addresses — personal and work accounts from victims across multiple countries and services
• Plaintext Passwords — exact, unencrypted passwords as saved in victims' browsers
• URLs — the specific websites and applications where each set of credentials was stolen

From 400 Infected Devices to Thousands of Vulnerable Accounts

Credential stuffing attacks powered by 8,573 email-password pairs from the AnubisCloud dump will probe every major online service. Attackers use automated tools to test each credential against email providers, social media platforms, financial services, and cloud storage systems. The URL data in this dump tells attackers exactly which services each victim uses, enabling precision-targeted attacks rather than broad guessing. If any victim reuses their password, the damage extends well beyond the originally compromised site.

AnubisCloud: A Telegram Bot Automating Credential Theft

AnubisCloud operates as a Telegram bot that automates the distribution of infostealer malware and the collection of stolen credentials. Subscribers deploy the AnubisCloud payload through phishing links, fake software installers, and malicious documents. The malware infects victim devices and begins harvesting saved browser passwords, intercepting login forms, and stealing session cookies. All data is automatically transmitted back to the AnubisCloud bot, which packages it into downloadable log files. The "400 FILES" designation means this particular release compiled data from 400 separate infected machines into a single archive containing 8,573 unique credential records.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence database indexes over 400 billion records from data breaches, stealer logs, and dark web sources. Use the HEROIC breach scanner to check whether your email address or password appears in the AnubisCloud dump or any other known breach. If your credentials are found, change them immediately across all services where they were used and enable multi-factor authentication to prevent future unauthorized access.