Tokyo Cloud Stealer Log Hits Cloud Service Users: 5,282 Exposed

Inside the "Tokyo Cloud Free109" Stealer Log

On July 20, 2024, a Telegram user uploaded a stealer log labeled "TOKYO CLOUD FREE109." HEROIC's analysts confirmed the file contains 5,282 records, each pairing an email address with a plaintext password and the URL of the account it unlocks, all pulled from malware-infected computers.

Why the Tokyo Cloud Leak Is Dangerous

"Cloud" in the file's name refers to the cloud storage and file-sharing services this particular batch of malware targeted on infected machines. That means many of the accounts in this file are tied to services people use to store documents, photos, and backups, giving an attacker access to far more than just a login screen.

What Was Exposed

• Email addresses linked to real cloud and online accounts.
• Plaintext passwords saved directly from the victim's browser, unencrypted.
• URLs identifying which cloud or online service each credential opens.

Why This Matters

Access to a cloud storage account can expose personal files, backed-up photos, tax documents, or business records, well beyond what a typical password leak reveals. If the password in this file is reused on other accounts, which is common, attackers can also pivot into email or banking logins, turning a single stolen credential into identity theft or financial loss.

How Stealer Logs Work

Stealer malware infects a device, usually through a fake download or cracked application, then scans the browser for saved logins and autofill data before packaging everything into a log file. The "FREE109" label suggests this particular batch, drawn from around 109 infected machines, was given away for free on Telegram rather than sold, making it available to virtually anyone who wants it.

Check If You Are Affected

If you store files in the cloud, it's worth checking whether your login is part of this leak. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this stealer log, so you can act quickly if your credentials show up.