Global Exposure: Telegram CuckooLogsPublic 6-13-25 by .boxed.pw Spills 1,143 US Records

On June 13, 2025, the .boxed.pw threat actor released Telegram CuckooLogsPublic 6-13-25, a stealer log covering 1,143 US-based infected endpoints. The drop, tagged CuckooLogsPublic-20250613, is part of .boxed.pw's rolling free-tier distribution on Telegram.

Why the CuckooLogsPublic 6-13-25 Regional Dump Is Dangerous

Geography matters in stealer logs. A drop weighted toward US endpoints means the exposed passwords, credit cards, and session data map directly to American banks, retailers, payroll systems, and SaaS providers. Fraud crews can convert this data into payment fraud and account takeover faster when targets share the same financial infrastructure.

What Was Exposed in the CuckooLogsPublic 6-13-25 Leak

• Email addresses
• Usernames
• IP addresses (primarily US geolocated)
• Credit card numbers
• Plaintext passwords
• HomePage URLs tied to each credential
• 1,143 infected endpoint records

Why This Matters

Although 1,143 records is smaller than some .boxed.pw drops, concentrated US exposure gives attackers a focused target pool. Credit card data paired with billing addresses and passwords enables card-not-present fraud against US retailers and synthetic identity schemes against US credit bureaus.

How the CuckooLogsPublic Stealer Log Operation Works

CuckooLogsPublic is .boxed.pw's public-tier feed, distinct from paid channels that may contain fresher or higher-value logs. The free tier builds reputation and funnels buyers to premium offerings. Every public drop widens the attacker base because anyone on Telegram can pull the file.

Check If You Are Affected

If you live in the US and have had any malware warning, browser reset, or unexpected login on a personal device recently, assume your credentials could be in this drop. Search HEROIC.com's database of more than 400 billion exposed records to see whether your email or passwords appear in Telegram CuckooLogsPublic 6-13-25 or any other .boxed.pw release.