The Daisy Private Cloud Stealer Log Exposed 77,930 Stolen Logins

HEROIC analysts identified a stealer log titled "Daisy Private Cloud 9 TG ArhontCorp.part1," uploaded to Telegram in July 2026, containing 77,930 records of email addresses, plaintext passwords, and associated login URLs harvested from infected devices.

Why This Is Dangerous

Nearly 78,000 working login pairs are now in circulation from a single stealer log. That's tens of thousands of real accounts an attacker can log into directly, with no cracking or guessing required, since the malware captured the passwords exactly as victims typed them.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for each corresponding login

Why This Matters

A stealer log this large fuels large-scale credential stuffing, where attackers automate login attempts across banking, email, and shopping sites using every pair in the file. The "part1" in the file's name also suggests additional installments may exist, meaning this batch could be only a fraction of the total data taken.

How Stealer Logs Work

Stealer logs are generated by malware that infects a device, often through pirated software or malicious downloads, then silently copies saved browser passwords, autofill entries, and session cookies before sending them to the attacker. Large logs like "Daisy Private Cloud" are frequently split into numbered parts and distributed across private Telegram groups tied to specific malware operations, in this case one referencing "ArhontCorp."

Check If You Are Affected

Run your email address through HEROIC's free breach scanner, which checks against more than 400 billion compromised records, to see whether your credentials are part of this stealer log or any other exposure.