Daisy Cloud TG ArhontCorp Log Leaks 140,317 Passwords Since August

HEROIC analysts identified this stealer log, published under the name "DAISY CLOUD TG ArhontCorp uploaded by a Telegram User," circulating on Telegram on August 11, 2026. The dump contains 140,317 records made up of email addresses, plaintext passwords, and the URLs where those credentials were used.

Why This Stealer Log Is Dangerous

Because the passwords in this log were stored in plaintext, there is no encryption standing between an attacker and a working login. Anyone who obtains this file can pair each email address with its matching password and the exact URL where it was used, making it simple to log into the affected accounts directly instead of having to guess or crack anything.

What Was Exposed in the Daisy Cloud Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

Stolen credentials like these are commonly fed into credential stuffing tools that test the same email and password combination across banking, email, and shopping sites. Because many people reuse passwords across multiple accounts, a single leaked login can lead to account takeover, identity theft, and financial fraud well beyond the site tied to this log.

How This Stealer Log Was Likely Created

Stealer logs like this one come from infostealer malware that infects a victim's computer, often through a pirated download, a fake software crack, or a malicious email attachment. Once installed, the malware quietly harvests saved passwords, autofill data, and browser session details, then sends everything back to the attacker, who packages it into a file like this one and sells or shares it, in this case through a Telegram channel.

Check If You Are Affected

HEROIC's breach intelligence database holds more than 400 billion compromised records, including stealer logs like this one. Run a free scan to check whether your email address or password appears in this leak or any other breach in HEROIC's records.