DAISY_CLOUD Leaked More Logins Than Some Small US Towns Have People

HEROIC analysts identified a stealer log uploaded to a public Telegram channel on December 21, 2022, tied to a source labeled DAISY_CLOUD. The file contained 14,197 compromised records tied to devices in the United States, each including an email address, a plaintext password, and the URL of the login page the credentials were used on.

Why This Is Dangerous

Because the passwords in this log were captured and stored in plaintext, there is no encryption for an attacker to break through. Each of the 14,197 records pairs a working email address with its exact password and the site it unlocks, which means anyone who obtains this file can attempt to log directly into thousands of accounts without guessing or cracking anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A leak of this size gives attackers a ready-made list for credential stuffing, where stolen email and password pairs are automatically tested against banking sites, email providers, and social media platforms. Because the passwords here are already in plaintext, the only thing standing between an attacker and account takeover is whether a victim reused that same password elsewhere. For the people in this log, that risk extends to identity theft and financial fraud if the exposed accounts touch banking or payment information.

How This Stealer Log Was Built

Logs like the one uploaded by DAISY_CLOUD come from information-stealing malware that infects a device, often through a pirated download, cracked software, or a malicious link. Once running, the malware pulls saved credentials directly out of the browser, along with the URL of every site those credentials belong to, and sends the collected data back to the attacker in a single file. The result is exactly what was found here: a large, organized list of usernames, passwords, and login URLs ready to be used or resold.

Check If You Are Affected

Stealer logs like this one are one of the fastest-growing sources of account takeover because the credentials inside them are current and unencrypted. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like the DAISY_CLOUD upload, so you can find out quickly whether your information is part of this exposure.