NEW_DAISYCLOUD CHAMPIONING (17 August, #0380): 5,879 Passwords Leaked

HEROIC analysts found a stealer log labeled NEW_DAISYCLOUD CHAMPIONING (17 August, #0380) that was shared on Telegram on August 17, 2024, containing 5,879 records of email addresses, plaintext passwords, and URLs taken from infected devices. This is one entry in a running series of similarly named files posted on the same channel. Scan your email to see if your address is one of the 5,879 included here.

The danger comes from how directly usable this data is. Nothing in the file is encrypted, so an attacker can read the password, open the matching URL, and log in immediately. Because the records were pulled from infected devices rather than a single company's systems, the accounts affected can span email, shopping, gaming, and work logins all at once.

What This Telegram Upload Contained

• Email addresses: tie each stolen login to a specific person.
• Plaintext passwords: readable without any cracking required.
• URLs: show attackers which site each password opens.

What an Attacker Gains From This File

A matching email, password, and URL means an attacker can sign into an account on the first try. If that password is reused on an email account, the attacker can often reset passwords on other services from there, turning one leaked password into several compromised accounts. The series this file belongs to suggests the same source keeps producing new batches, so repeated exposure is possible.

How Series Like This One Are Produced

Files labeled this way come from malware quietly running on victims' own devices, collecting saved browser passwords, autofill data, and the URLs tied to them, then sending that information back to whoever controls the malware. The data is not stolen from a company's servers, it is harvested one infected device at a time and bundled into dated batches like this one. Those batches are then posted to channels where others can download them.

After the #0380 Upload: What to Do

Scan your email to check if your address appears in this specific batch.

Clean the affected device with a full malware scan before changing any passwords, since typing a new password on a still infected machine means it could be stolen again right away. Once the device is clean, update the password everywhere it was reused, for both personal and work email alike.