The STARLINKCLOUD Dump Put 293,103 Cloud Account Logins on Telegram

HEROIC analysts identified a stealer log dataset called STARLINKCLOUD, uploaded to a Telegram channel with data leaked on 6 January 2024. This is a large-scale exposure, containing 293,103 records taken from infected devices, including email addresses, plaintext passwords, and the URLs of the cloud services and websites those credentials unlock. Because the passwords are stored in plaintext, anyone who obtains this file can use them immediately.

Why This Is Dangerous

Every one of the 293,103 records in this leak pairs a working email and password directly with the URL it belongs to. That means an attacker does not need to guess where a stolen credential might work. They can pull any record from this file and log in immediately, and with a dataset this size, automated tools can attempt logins across the entire list in a short amount of time.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages and cloud services

Why This Matters

A leak of this scale significantly raises the odds that many of the 293,103 affected people reused a password somewhere else. Attackers rely on exactly that habit for credential stuffing, taking stolen email and password pairs and testing them against banking, email, and shopping accounts. Once one account falls, especially an email account, it can be used to reset passwords elsewhere, opening the door to financial fraud and identity theft.

How Stealer Log Breaches Work

A stealer log does not come from a company's servers being hacked. It comes from malware quietly installed on individual devices, which harvests saved browser passwords, autofill data, and session details before compiling everything into a log file sent back to the attacker. Datasets like STARLINKCLOUD are commonly distributed through Telegram channels, where large logs like this one can circulate quickly among buyers. Because the data is captured directly from the infected device, it tends to be accurate and usable at the time it surfaces.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion breached records, including large leaks like STARLINKCLOUD, in seconds. If your information turns up in a scan, change the exposed password right away, and anywhere else you reused it.