Daisy Private Cloud Stealer Log Uncovered With 4,494 Logins Exposed

HEROIC analysts found a stealer log tied to Daisy Private Cloud (1,150 PCs, August 29) uploaded to Telegram on August 30, 2026. The file contains 4,494 records of endpoints, email addresses, API hosts, and passwords pulled from infected devices. Scan your email to check if your address is among them.

These credentials were not stolen from a company's servers; they were lifted straight off victims' own computers while they were logged in, which means the passwords are current and tied to accounts people are actively using right now. That makes them unusually reliable for an attacker.

What Was Pulled From These Devices

• Email Addresses: identifies whose accounts were harvested.
• Plaintext Password: readable and usable immediately.
• URLs: shows exactly which site or API host each password unlocks.

One Infection, Many Exposed Accounts

Malware on a single device typically grabs every password saved in the browser, not just one. That means each of the 1,150 infected PCs behind this file likely represents several accounts for the same person, from email to shopping to work logins, all captured in one sweep. Session cookies taken the same way can sometimes let an attacker into an account without even needing the password at all.

Inside a Stealer Log Operation

Malware quietly running on a victim's device collects saved passwords, session details, and the sites they belong to, then sends everything back to whoever controls the infection. The result is bundled into a dated, numbered log like this one and passed along from there.

Recovering From the Daisy Private Cloud Infection

Scan your email to see if you are affected. If you are, assume the infected device is still compromised: clean or reimage it first, then change your passwords from that clean device so new credentials are not captured again. Do this for work accounts as well as personal ones if they were used on the same machine.