DaisyCloud Foxbaseworld Breach Exposes 226,613 Credentials

HEROIC's dark web surveillance identified a large-scale stealer log known as DaisyCloud Foxbaseworld being traded on underground platforms. With 226,613 compromised records, this breach represents a significant cache of stolen credentials harvested through infostealer malware campaigns targeting users worldwide.

Plaintext Passwords Amplify the Scale of This Breach

All 226,613 passwords in the DaisyCloud Foxbaseworld collection were stored in unencrypted plaintext. At this scale, the damage potential is enormous: attackers have immediate access to over two hundred thousand working credential pairs without needing any password-cracking tools. Each plaintext password is a direct key to someone's account, and with this many records, the chances of finding high-value targets among them are substantial.

What Was Exposed

• Email Addresses — over 226,000 unique identifiers linking to personal and professional accounts
• Plaintext Passwords — unencrypted credentials providing immediate unauthorized access
• URLs — targeted websites and applications revealing which services victims used

Large-Scale Credential Stuffing from Massive Data Sets

A breach of this magnitude is a goldmine for credential stuffing operations. Attackers load all 226,613 credential pairs into automated botnets that systematically probe login portals across the internet. Financial services, healthcare portals, government systems, and corporate VPNs are all targets. The sheer volume of credentials virtually guarantees thousands of successful account takeovers, especially where users have reused passwords across multiple services.

Inside the Infostealer Malware Supply Chain

The DaisyCloud Foxbaseworld data set was produced through a coordinated infostealer malware operation. Victims were infected through various vectors including fake software downloads, malvertising campaigns, and trojanized applications. Once installed, the malware systematically extracted browser-saved passwords, cryptocurrency wallet keys, session tokens, and autofill data from each compromised device, feeding it all into centralized stealer log repositories for resale.

Check If Your Credentials Were Exposed

With more than 400 billion records in its database, HEROIC provides the most extensive breach monitoring service available. Search HEROIC's free breach scanner now to check whether your email or password was captured in the DaisyCloud Foxbaseworld stealer log or in any of the thousands of other breaches HEROIC tracks.