US Users Hit Hardest by the DaisyCloud 1.5M ULP Stealer Log

HEROIC found 110,270 unique records in the BreachForums DaisyCloud 1.5M ULP by NEW_DAISYCLOUD leak on March 18, 2025, exposing email addresses, plaintext passwords, and homepage URLs pulled from stealer malware logs. The file posted on BreachForums advertised roughly 1.5 million total lines of credential material and leans heavily on English language victims in the United States.

Why This Stealer Log Is Dangerous

DaisyCloud leans into the markets most targeted by infostealers, especially English-speaking users in the US where browser-saved logins protect banking, cloud, and workplace accounts. The dump pairs every email with a live plaintext password and the exact site that owns the login, giving attackers verified credentials for American banks, cloud providers, and retailers in one bundle.

What Was Exposed in the DaisyCloud 1.5M ULP

• 110,270 unique email addresses
• Matching plaintext passwords
• Homepage URLs pinning each credential to a specific site
• URL:LOGIN:PASS lines formatted for automated tools

Why This Matters

Plaintext credentials feed credential stuffing, account takeover on email and banking, identity theft from reused passwords, and fraud on cloud storage and retailer accounts. For US users the exposure also includes payroll portals, tax services, and healthcare logins, turning the breach into a compound risk that can surface months after the initial infection.

How a Stealer Log Dump Works

Stealer malware such as RedLine, Lumma, Vidar, and StealC spreads through cracked software, fake installers, and phishing attachments. Once on a machine, it reads saved browser credentials, cookies, autofill data, and crypto wallet files, then sends everything back to an operator. Operators package thousands of victim logs into ULP files and list them on forums like BreachForums, where resellers distribute them to fraudsters and initial access brokers.

Check If You Are Affected

Rotate any password you saved in a browser, enable multi-factor authentication on banking, email, and work accounts, and scan your device for infostealer activity. You can search the HEROIC scanner, which indexes more than 400 billion breached records, to see whether your email appears in the DaisyCloud 1.5M ULP or related stealer dumps.