DAISY CLOUD Hack: Emails and Passwords of 12,147 Users Leaked

HEROIC's DarkHive system discovered the DAISY CLOUD stealer log breach, exposing 12,147 records on January 17, 2024. The log contained email addresses, plaintext passwords, and URLs harvested from infected U.S. endpoints and distributed via the DAISY CLOUD [NEW] Telegram channel as part of a sustained daily credential release operation.

Why This Is Dangerous

Plaintext passwords captured by infostealer malware require no additional work before exploitation. Every credential pair in this 12,147-record dataset can be tested against email providers, financial portals, and corporate login systems the moment an attacker acquires the log. The inclusion of API host URLs indicates the compromised devices had active browser sessions on organizational or cloud infrastructure, meaning attackers can target not just personal accounts but also workplace systems accessed from infected machines.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs and API host references from infected browser sessions

Why This Matters

DAISY CLOUD released stealer log batches on consecutive days throughout January 2024, indicating an organized criminal operation processing and distributing stolen credentials at scale. Credential stuffing campaigns using these logs are automated, meaning all 12,147 records can be tested across hundreds of services within a short window. The widespread habit of password reuse across personal and professional accounts amplifies the blast radius of each exposed credential far beyond the original compromised service.

How Stealer Logs Work

Stealer malware typically infects devices through phishing emails, drive-by downloads, or trojanized software. Once running, it silently harvests passwords stored in browsers, active session cookies, and URLs the user has credentials saved for. This data is bundled into a log file and sent to the attacker's servers, then packaged and uploaded to Telegram channels where buyers pay for access. The structured, searchable format of stealer logs makes them especially useful for automated credential stuffing campaigns targeting specific platforms or industries.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the DAISY CLOUD stealer log breach. Visit heroic.com to check if your information was exposed and change affected passwords immediately.