9,407 Stolen Logins From DVDCLOUDFREE Now Circulating

HEROIC's security research team identified a stealer log collection called DVDCLOUDFREE that was distributed on a Telegram channel in February 2024. The dataset contains 9,407 records of stolen login credentials, offered at no cost to anyone on the channel. The free distribution model ensures maximum exposure and makes this data accessible to even the most unsophisticated threat actors.

Plaintext Passwords Require No Skill to Exploit

The credentials in DVDCLOUDFREE are stored entirely in plaintext, requiring absolutely no technical expertise to use. Any individual who downloads this dataset gains immediate access to working username-password pairs. This low barrier to entry means the threat extends beyond professional cybercriminals to include amateur hackers, scammers, and anyone with malicious intent who happens to find the data on Telegram.

What Was Exposed

• Email addresses serving as account credentials for online services
• Plaintext passwords directly readable without any decryption
• URLs revealing the websites and applications where credentials were stolen

Free Credential Dumps Fuel Mass Credential Stuffing

When stolen credentials are distributed for free, as with DVDCLOUDFREE, the volume of credential stuffing attempts increases dramatically. Every person who downloads the dataset becomes a potential attacker. The 9,407 email-password pairs are tested across thousands of websites by multiple independent actors, compounding the risk for each affected user. Services that lack rate limiting or account lockout protections are especially vulnerable to these distributed attacks.

The Free Distribution Model of Stealer Logs

Collections like DVDCLOUDFREE are often distributed for free as a marketing tactic by threat actors who sell premium data sets on the side. The free logs demonstrate the quality and freshness of the stolen data, attracting buyers for larger, more exclusive collections. The underlying malware — typically an infostealer trojan — infects devices through social engineering, malicious downloads, or exploit kits. It harvests browser credentials, cookies, and form data, then uploads everything to the attacker's infrastructure for sorting and distribution.

Check If Your Credentials Were Exposed

With free stealer log dumps circulating widely, the odds of your data being in the wrong hands are higher than you might expect. HEROIC's breach scanner provides coverage of over 400 billion records from data breaches, stealer log collections, and dark web sources. Search your email address to check if your credentials were included in DVDCLOUDFREE or any other compromised dataset, and immediately change any exposed passwords.