Emirates_Cloud 267 Breach: 91,410 Passwords Leaked on Telegram

HEROIC analysts identified a stealer log published to a public Telegram channel on June 11, 2024, containing credentials harvested from compromised devices. Distributed under the name Emirates_Cloud 267 by the threat actor known as .boxed.pw, this log exposed 91,410 records consisting of email addresses, plaintext passwords, and homepage URLs. This release is part of a coordinated Emirates_Cloud series — the following installment, Telegram Emirates_Cloud 268 by .boxed.pw, was published the next day and exposed an additional 183,931 records.

Why This Is Dangerous

Plaintext passwords are the most dangerous form of credential exposure because they require zero additional effort to weaponize. The moment Emirates_Cloud 267 was shared on Telegram, over 91,000 working email-and-password combinations became available to everyone following that channel. Victims who reuse passwords across multiple services face immediate, automated account takeover risk. Because infostealers capture credentials at the moment of entry — not from a single breached database — the passwords in this log were valid and active when stolen, increasing the likelihood they still work on secondary services.

What Was Exposed

• Email Address
• Plaintext Password
• HomePage URL

Why This Matters

Stealer log credentials feed directly into credential stuffing operations, where automated tools attempt the stolen username-password pairs across dozens or hundreds of platforms simultaneously. Account takeover (ATO) on email accounts is especially damaging — it unlocks password reset flows for banking, shopping, and workplace platforms. Homepage URLs included in this log reveal the specific services victims use, allowing attackers to prioritize targets with the highest financial return. Downstream consequences include identity theft, unauthorized financial transactions, and the sale of compromised accounts on criminal marketplaces.

How Stealer Logs Work

Infostealer malware operates silently on a victim's device after being delivered through phishing emails, trojanized software downloads, or malicious browser extensions. Once installed, it harvests passwords saved in browsers, captures keystrokes, extracts session cookies, and records system details. All harvested data is packaged into a log file and sent to the attacker's infrastructure. Operators like .boxed.pw then bundle these logs and distribute them via Telegram — sometimes for profit, sometimes freely — to build credibility within criminal communities and attract buyers for more exclusive data. The numbered series format (267, 268...) indicates an ongoing, systematic harvesting operation.

Check If You Are Affected

Your email address and password may be sitting in this stealer log right now. HEROIC's free breach scanner cross-references your email against a database of over 400 billion exposed records. Scan for free at heroic.com — and if you find a match, update your passwords on every service immediately.

Related Parts of This Breach

• Telegram Emirates_Cloud 268 by .boxed.pw — 183,931 records, leaked June 12, 2024