Inside DVDCLOUDFree Stealer Logs: 3,212 Passwords Harvested

In February 2024, HEROIC identified another stealer log release from DVDCLOUDFree on Telegram containing 3,212 compromised records. This dataset, one of several attributed to the same threat actor, includes email addresses, plaintext passwords, and the URLs of services where each credential was used. The technical structure of the logs reveals they were generated by browser-hooking infostealer malware deployed against U.S.-based targets.

Plaintext Storage Eliminates All Security Barriers

The 3,212 passwords in this dataset are stored without any form of cryptographic protection. No salt, no hash, no encryption wrapper. From a technical standpoint, each entry is a ready-to-use credential that requires zero computational effort to exploit. The password appears in the same form it was typed into the browser's login field, captured by the infostealer's keystroke and form-data interception capabilities.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of compromised websites and services

Automated Credential Stuffing at Industrial Scale

Datasets like this one are fed directly into credential stuffing frameworks such as OpenBullet or SentryMBA. These tools accept the email and password pairs and systematically test them against configurable lists of target websites. With 3,212 credential pairs, an attacker can generate tens of thousands of login attempts across dozens of services in a matter of minutes. Any account where the victim reused their password becomes an easy target, and successful matches are flagged for manual exploitation or resale.

Technical Profile of a DVDCLOUDFree Stealer Log

The DVDCLOUDFree operation uses infostealer malware variants that hook into browser processes to intercept credential submission in real time. The malware targets Chromium-based and Firefox browsers, extracting data from the browser's credential storage, cookie databases, and autofill caches. Each infected device produces a structured log file containing the captured URLs, email addresses, and passwords organized in a format optimized for automated processing. These logs are then aggregated across multiple infected devices and released as batched datasets on Telegram channels.

Check If Your Credentials Were Exposed

HEROIC indexes over 400 billion compromised records, including multiple DVDCLOUDFree releases. Search for your email address in the HEROIC breach scanner to determine whether your credentials were captured in this 3,212-record dataset or any other stealer log in the database. Prompt detection and password changes are the most effective defense against credential-based attacks.