SunCloudNew 1335 – 650 LogsFile uploaded by a Telegram User

We've been tracking a steady increase in stealer log dumps appearing on Telegram channels, often targeting specific industries or geographic regions. We first noticed this particular dump due to its unusual structure; it wasn't a simple collection of usernames and passwords, but rather a detailed snapshot of endpoint configurations and API access points. What really struck us wasn't the volume – around 23,000 records – but the potential for immediate and significant impact on targeted organizations. The data had been circulating for a few days before we flagged it, highlighting the speed at which these compromised credentials can be weaponized.

SunCloudNew 1335: The Stealer Log Exposing 23k+ Endpoints and Credentials

In November 2025, a Telegram user uploaded a stealer log file, dubbed "SunCloudNew 1335", containing 23,276 records. This wasn't just another password dump; the file exposed a range of sensitive data, including endpoint configurations, email addresses, API host information, and plaintext passwords. The nature of the data suggests a targeted campaign aimed at gaining deeper access to specific systems rather than a broad, opportunistic sweep.

Our team discovered the leak on November 17, 2025, shortly after it was posted within a relatively small Telegram channel known for sharing stealer logs. The file's unusual structure – a detailed breakdown of endpoint configurations alongside credentials – immediately raised a red flag. This level of detail suggests the attackers were not just harvesting credentials, but actively mapping out potential attack vectors within compromised environments. This matters to enterprises now because it represents a shift toward more sophisticated and targeted credential theft. Threat actors are increasingly using stealer logs to gain a comprehensive understanding of their victims' infrastructure, enabling them to launch more effective and damaging attacks.

• Total records exposed: 23,276
• Types of data included: Email Addresses, Plaintext Passwords, URLs, Endpoint Configurations, API Host Information
• Sensitive content types: Credentials, potentially sensitive configuration details
• Source structure: Stealer log file
• Leak location(s): Telegram channel
• Date of first appearance: November 17, 2025

This incident aligns with a broader trend we're observing: the increasing sophistication and accessibility of stealer malware. As reported by BleepingComputer, various "infostealer" malware families are becoming more prevalent, often distributed through malicious advertising or software cracks. These tools are designed to extract a wide range of data from infected systems, including credentials, cookies, and even cryptocurrency wallets. The data is then packaged into stealer logs and sold or traded on underground forums and Telegram channels, fueling further malicious activity.

One Telegram post regarding similar log files claimed the files are "collected from devs testing an AI project" which further increases concern of AI-related breaches becoming more common. While the origin of the "SunCloudNew 1335" log remains unconfirmed, the incident underscores the importance of robust endpoint security measures and proactive monitoring for compromised credentials.