The STARLINKCLOUD5 Leak Exposed 138,620 US-Based Accounts on Telegram

HEROIC analysts flagged a large stealer log shared on Telegram on October 24, 2023 under the label STARLINKCLOUD5. The file contained 138,620 records targeting users in the United States, making it one of the more significant US-focused stealer log releases identified around that time. The exposed data included email addresses, plaintext passwords, and URLs that appeared to point to cloud service endpoints and API infrastructure. The platform name in the log title and the structured URL data suggested the victims were users of a cloud service, and the scale of the dump pointed to an operator who had been running an infostealer campaign for some time.

Why This Is Dangerous

Over 138,000 plaintext passwords sitting in a Telegram channel is a significant threat. Each one represents a real person's login, and each login is a potential entry point into that person's broader digital life. Because the log also contained URLs connected to cloud infrastructure, attackers who obtained this data did not just get login credentials. They also got a map showing which cloud services, endpoints, and internal tools each victim had been accessing. That kind of intelligence makes targeted attacks far easier to execute, because the attacker already knows where to look and what to try.

What Was Exposed in the STARLINKCLOUD5 Leak

• Email addresses (primary login identifiers for cloud and online services)
• Plaintext passwords (usable without any decryption or technical tools)
• URLs including cloud API endpoints and service infrastructure links
• 138,620 total records, primarily affecting United States-based users

Why This Matters

The United States is the most targeted country for credential theft operations, and a dump of this size from a single US-focused campaign is far from trivial. Attackers who download logs like STARLINKCLOUD5 can automate credential stuffing attacks at scale, testing each email and password pair against banking sites, government portals, workplace tools, and e-commerce platforms. A person whose credentials appear in this log and who has not changed their password since 2023 is potentially still exposed right now. Financial fraud, tax identity theft, and unauthorized access to employer systems are all credible downstream risks. The victims will almost certainly never recieve a notification warning them their data was in this log.

How the STARLINKCLOUD5 Stealer Log Was Built

Infostealer malware gets onto a victim's device through a variety of delivery methods: phishing emails with malicious attachments, fake software installers downloaded from unofficial sites, or browser extensions that secretly harvest credentials. Once running on the device, the malware captures saved passwords, session cookies, and any credentials the user types in. The output is a structured log file that the malware operator then collects. Large collections like STARLINKCLOUD5 represent weeks or months of harvesting across many infected devices. The inclusion of cloud endpoint URLs suggests the malware was targeting cloud service users specifically, or that the victims happened to be professionals whose devices carried particuarly valuable infrastructure credentials.

Check If You Are Affected

HEROIC operates a free breach scanner with a database covering over 400 billion compromised records. If your email address appeared in the STARLINKCLOUD5 stealer log or in any of thousands of other known breaches, HEROIC can surface that information for you instantly. Enter your email in HEROIC's breach checker to get a complete picture of your exposure. If your credentials show up, change your passwords immediately and enable two-factor authentication on every account that supports it.