Telegram KeyCloud Logs #137 by .boxed.pw Spills 6,173 Browser Credentials and Card Numbers

On June 14, 2025, a stealer log titled KeyCloud_Free_logs#137 hit a public Telegram channel under the .boxed.pw banner. The drop contains 6,173 records drawn from infostealer-infected endpoints, including browser-saved credentials and payment card data.

Why the KeyCloud Logs #137 Leak Is Dangerous

Every record includes a plaintext password, the exact URL it unlocks, and in many cases a credit card autofill entry from the same browser profile. That is everything an attacker needs to take over an account or charge a card without any additional reconnaissance.

What Was Exposed in the KeyCloud Logs #137 Drop

• Email addresses
• Usernames
• IP addresses
• Credit card numbers
• Plaintext passwords
• HomePage URLs tied to each credential
• 6,173 infected endpoint records

Why This Matters

Repeating numbered drops like KeyCloud Logs #137 show an industrial cadence. Actors like .boxed.pw push weekly or daily dumps, meaning the volume of plaintext credentials circulating on Telegram grows continuously. Password reuse lets a single leak spread across dozens of a victim's accounts.

How KeyCloud Logs #137 Data Was Harvested

Infostealer malware on victim devices pulls saved passwords, cookies, and card autofill from Chrome, Edge, Firefox, and Opera. The data is shipped to an actor's Telegram bot, repackaged by .boxed.pw, and released as a numbered KeyCloud drop. The entire capture-to-distribution pipeline can complete within 24 hours of infection.

Check If You Are Affected

HEROIC.com's database of over 400 billion exposed records includes feeds from Telegram stealer drops, so you can quickly confirm if your email or credentials leaked through KeyCloud Logs #137 or any related .boxed.pw release.