Anatomy of a Stealer Log: Telegram KeyCloud Logs #139 by .boxed.pw Exposes 4,111

On June 16, 2025, the .boxed.pw crew released KeyCloud_Free_logs#139 to a public Telegram channel. The stealer log is compact at 4,111 records but technically rich, offering a clean window into how modern infostealer campaigns package and ship their loot.

Why the KeyCloud Logs #139 Dataset Is Dangerous

The #139 numbering shows this is just one drop in an ongoing weekly pipeline. Each log contains credential-URL pairs that map directly to login forms, making the data immediately usable in automated account takeover kits with zero preprocessing required.

What Was Exposed in the KeyCloud Logs #139 Drop

• Email addresses
• Usernames
• IP addresses (geolocating victim devices)
• Credit card numbers
• Plaintext passwords
• HomePage URLs paired with each credential
• 4,111 infected endpoint records

Why This Matters

Smaller logs like #139 get less attention than mega-dumps but are often fresher. Credentials harvested within the past seven days have the highest success rate in account takeover attempts because victims have not yet rotated passwords or been alerted by breach notification services.

How KeyCloud Logs Are Built Technically

Each record in a KeyCloud log typically follows a passwords.txt structure: URL | username | password, with an accompanying autofills.txt, cookies.txt, and system.txt describing the victim's browser, OS, and installed programs. Stealers like RedLine and Lumma compress the package into a ZIP and ship it to the operator's Telegram bot. Aggregators like .boxed.pw batch the intake into numbered releases such as #139.

Check If You Are Affected

If any password you use appears in a KeyCloud log, attackers already have the exact URL to try it against. HEROIC.com's database of over 400 billion exposed records ingests stealer log feeds so you can see if KeyCloud Logs #139 contains your credentials.