DaisyCloud-Championing May 13 2024: 10,364 U.S. Credentials, Campaign Opening Day

HEROIC's DarkHive intelligence system detected the NEW_DAISYCLOUD-CHAMPIONING May 13, 2024 release, exposing 10,364 U.S. credential records on Telegram. May 13 is the opening day of the documented eight-day consecutive run spanning May 13 through May 20 -- the earliest confirmed date in the recorded campaign timeline. From this starting point, the operator released U.S. infostealer credentials every single day for eight days without interruption, with volume escalating sharply over the first four days from 10,364 on May 13 up to the series peak of 23,800 on May 16. The May 13 release establishes the floor of what became one of the most sustained infostealer distribution runs in the documented dataset. The exposed data includes email addresses, plaintext passwords, and login URLs harvested from infected U.S. devices.

Why This Is Dangerous

The 10,364 victims in this release had their credentials posted to the NEW_DAISYCLOUD-CHAMPIONING Telegram channel and distributed simultaneously to every subscriber. Plaintext passwords require no cracking -- anyone recieving this data can attempt account logins against the associated URLs immediately. Thier combination of email address, exact password, and specific login URL makes these records immediately actionable for account takeover. The fact that this was day one of an eight-day run indicates the operator had already built a functional distribution pipeline and a sufficiently large harvest of U.S. device credentials to sustain daily releases at scale. Infostealer malware operates silently, and virtually none of the 10,364 individuals in this release would have known their credentials had been captured.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Login URLs

Why This Matters

Credentials from this May 13, 2024 release have been available to threat actors for over a year. Secondary markets for infostealer data remain active long after initial Telegram distribution, and new actors acquire and test these batches against live services well after the original release date. Individuals who reuse the same password across seperate platforms remain exposed on every account where those credentials appear, not only the specific service captured in the original device infection. Anyone whose email address appears in this release should immediatly change all passwords tied to that address and review active sessions across linked accounts for any signs of unauthorized access.

How Stealer Logs Work

Stealer logs are produced by infostealer malware distributed through phishing campaigns, malicious downloads, and compromised browser extensions. Once installed on a victim's device, the malware runs silently, harvesting credentials from browsers and applications before transmitting them to attacker-controlled servers. NEW_DAISYCLOUD-CHAMPIONING operators accumulated harvested U.S. device records and began releasing them in daily batches starting May 13, 2024, continuing through May and into June. The May 13 release -- the documented opening of the campaign's eight-day consecutive run -- reflects an operation that had already established a consistent and growing supply of U.S. infostealer logs ready for daily distribution.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like NEW_DAISYCLOUD-CHAMPIONING. Visit heroic.com to scan your email address and find out if your information was exposed in this May 2024 stealer log release.