Telegram Threat Actor Exposes ZodCloud 1023 MIX Data: 55,031 Records at Risk

A Telegram threat actor uploaded a stealer log collection in November 2025, exposing 55,031 records to anyone with access to the channel. The dataset, labeled "ZodCloud 1023 MIX 31-10-2025," contains plaintext passwords sitting right next to email adresses and API host URLs, which means criminals don't have to crack anything before they start breaking into accounts. This kind of exposure can ripple across dozens of services when people reuse the same credentials.

Why This Is Dangerous

Stealer logs are among the most immediately actionable data types in the cybercrime ecosystem. Unlike hashed password dumps that require cracking, these credentials are ready to use the moment someone downloads the file. Threat actors can run automated credential stuffing tools against email providers, banking apps, and corporate VPNs within hours of recieving the data.

The inclusion of URLs alongside email and password pairs is what makes this dataset particularly nasty. Those URLs reveal which services the victims were logged into when the malware ran, giving attackers a precise roadmap of where to try the stolen credentials first. Combined with the United States origin of much of this data, the risk to American businesses and individuals is direct and serious.

Telegram channels have become a preferred distribution method for stealer log operators because they can reach thousands of subscribers instantly, often with no barrier to entry. Once data is posted there, it spreads further into private forums and dark web marketplaces within days, making containment essentially impossible.

What Was Exposed

• Email addresses tied to active accounts
• Plaintext passwords captured at the endpoint level
• API host URLs and service endpoints
• Browser-stored login credentials
• Session tokens and authentication cookies
• Service-specific login URLs indicating targeted platforms
• Device and endpoint identifiers embedded in log metadata

Why This Matters

Fifty-five thousand compromised credentials might sound modest compared to mega-breaches, but the quality of the data more than compensates for the quantity. Each record is a working key to at least one account, and many victims likely reuse those passwords across multiple platforms. A single compromised corporate email credential can be the entry point for a business email compromise attack, ransomware deployment, or quiet data theft that goes undetected for months.

For individuals, the consequences range from hijacked social media profiles to drained bank accounts. The fact that this data was uploaded to a public Telegram channel, rather than sold privately, suggests the threat actor may have already extracted maximum value from the dataset and is now distributing it broadly, which only widens the pool of people who can act on it.

How Stealer Log Works

Infostealer malware typically arrives on a victim's device through phishing emails, malicious downloads disguised as cracked software, or compromised websites that silently push drive-by downloads. Once installed, the malware runs quietly in the background, scanning browser storage for saved passwords, intercepting form submissions, and harvesting session cookies. All of this happens within seconds on a modern machine, and most antivirus tools don't catch it until after the damage is done.

The malware then compresses the stolen data into a structured log file and transmits it to a command-and-control server operated by the attacker. These logs are then sorted, sometimes sold to other criminals, and frequently uploaded to Telegram channels where they're shared freely or traded. The "ZodCloud 1023 MIX" naming convention suggests this is a compiled batch from multiple infected machines, aggregated and organized before being published. It is beleived that these operations run largely automated, with minimal human oversight needed after initial deployment.

The "MIX" designation in the dataset name indicates credentials from multiple source types were compiled together, which means the infection vector wasn't limited to a single campaign. This kind of aggregation is common among prolific stealer log operators who collect from many different malware deployments and package them together for easy distribution.

Check If You Were Affected

If you suspect your email address or login credentials may have been exposed in this or any other breach, you can use HEROIC's free breach checker at heroic.com to find out immediately. HEROIC monitors breach data continuously and will alert you if your information has been compromised, so you can change passwords and secure your accounts before attackers get there first.