Inside DAISYCLOUD: How a Stealer Log Harvested 198,767 Passwords

HEROIC analysts identified a large stealer log labeled "LOGSYNC_UP_DAISYCLOUD_CHAMPIONING_02_JUNE_5323_ON" uploaded to a Telegram channel on June 2, 2025. The file contained 198,767 records, each pairing an email address with a plaintext password and a related URL, the signature of infostealer malware pulling saved credentials directly off large numbers of infected devices.

Why a Log of Nearly 200,000 Records Is Dangerous

Almost 200,000 complete login records were exposed with the passwords stored in plaintext, so an attacker does not need to crack or guess anything to use them. Because each record also lists the URL the credentials belonged to, an attacker can move straight from the log to a working login. A dataset of this scale is highly valuable to criminals, who trade and redistribute it across dark web marketplaces and other Telegram channels well beyond the original upload.

What Was Exposed in the DAISYCLOUD Leak

• Email addresses
• Plaintext passwords
• URLs of the associated login pages or services

In total, 198,767 records were included in the file.

Why This Matters

A log approaching 200,000 records is exactly the kind of large-scale raw material used in credential stuffing campaigns, where automated tools test stolen email and password pairs against thousands of sites at once. Because each record already ties a password to the exact service it opened, it also speeds up account takeover for anyone who reused that password elsewhere, extending the risk to financial fraud and identity theft.

Inside a Stealer Log: How Malware Harvested 198,767 Passwords

A stealer log is the direct output of infostealer malware, a type of program that quietly infects a device and copies every saved browser password, autofill entry, and the URL it belongs to, then sends that file back to whoever controls the malware. A single infection typically yields a handful of records, so a file with almost 200,000 entries points to credentials pulled from a very large number of infected machines, compiled and packaged before being distributed under a label like DAISYCLOUD. Logs of this scale are routinely bought, sold, and traded in underground Telegram channels and dark web forums.

Check If You Are Affected

With almost 200,000 accounts in this single log, the odds that your information is included are meaningfully higher than with a smaller leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can see what has been exposed and change any reused passwords before someone else does.