How Malware Led to 6,222 Stolen Logins in DVDCLOUDFree

In March 2024, HEROIC tracked another stealer log from DVDCLOUDFree appearing on Telegram. This release contains 6,222 records stolen through infostealer malware deployed against U.S. internet users. The path from infection to exposure follows a well-documented pattern: malware quietly harvests browser credentials, packages them into logs, and the threat actor distributes them on Telegram. Each record in this dataset tells the story of an individual whose device was compromised, containing their email address, plaintext password, and the URL of the service they were using.

The Stark Reality of Plaintext Password Exposure

Passwords captured by infostealer malware are never hashed or encrypted. The malware intercepts them at the point of use or extracts them from browser password storage, where they are protected only by the operating system's credential manager. Once exfiltrated, these 6,222 passwords exist in their raw form, ready for immediate exploitation. Any attacker who obtains this dataset can attempt to log into the associated accounts without any additional technical work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of accessed websites and services

From Stolen Credentials to Full Account Takeover

The journey from stolen credential to compromised account typically takes minutes. Automated credential stuffing tools ingest the email and password pairs from this dataset and systematically test them against popular login pages. When the same password works on multiple sites, attackers gain access to a portfolio of accounts belonging to the same victim. From there, the damage can include financial fraud, identity theft, corporate espionage if work accounts are affected, and social engineering attacks launched from the victim's compromised email or social media profiles.

Tracing the DVDCLOUDFree Malware Campaign

This March 2024 release is part of an ongoing series of stealer log distributions by DVDCLOUDFree. The threat actor's malware campaign starts with infection vectors designed to trick users into installing malicious software, often disguised as legitimate utilities, browser extensions, or media players. The infostealer activates silently, scanning all installed browsers for saved passwords and active sessions. It captures form submissions in real time, recording credentials as users log into their accounts. The stolen data is exfiltrated to remote servers, compiled into the structured log format, and published on Telegram within days of collection.

Check If Your Credentials Were Exposed

HEROIC's breach detection platform covers over 400 billion records from data breaches and stealer logs. Enter your email address in the HEROIC breach scanner to find out if your credentials appear in this DVDCLOUDFree release or any other known compromise. If your credentials were captured by this malware campaign, updating your passwords and scanning your device for malware should be your immediate priorities.