11,019 U.S. Credentials Exposed in NEW DAISYCLOUD Feb 10, 2024 New Password Log

In February 2024, DarkHive detected a stealer log file uploaded to Telegram by the DAISY CLOUD [NEW] channel under the label NEW_DAISYCLOUD 10_FEBRUARY_0419_PCS_New_Password_on_channel. The file exposed 11,019 records harvested from 419 compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. The February 10 release is one of the early February drops in the DAISYCLOUD campaign's "New Password" labeled series, which specifically markets freshly captured credentials to subscribers. The breach date was recorded as February 10, 2024.

Why This Is Dangerous

The "New Password" label in the filename signals to subscribers that these credentials were recently captured, potentially during active password reset events. At 419 infected devices contributing an average of 26.3 records each, the log exposed over eleven thousand accounts across a broad range of U.S. platforms. Attackers who aquire this log can immediately test the plaintext passwords against the specific service URLs included in the file, targeting accounts where the victim may believe they are protected by a recently changed password. This false sense of security makes the victims less likely to check their accounts promptly for unauthorized access.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The DAISYCLOUD campaign's use of "New Password" labeling demonstrates how infostealer operators compete for subscribers by differentiating thier logs based on freshness and value. Subscribers who specifically seek out new password logs are motivated to exploit the credentials quickly, before the victim detects the compromise and initiates another password reset. For security teams, this creates a very short window between compromise and active exploitation, often shorter than the time required to detect unauthorized login attempts through standard monitoring tools. Organizations that do not use hardware-based multi-factor authentication remain especially vulnerable to this attack pattern.

How Stealer Log Infections Work

Infostealer malware spreads through phishing campaigns, compromised software installers, and malicious browser extensions. Once running on a victim's device, the malware hooks into browser processes to capture credentials as they are submitted to login pages, including during password changes. The captured credentials are transmitted to the DAISY CLOUD [NEW] campaign operator who packages them into daily log files for Telegram distribution. Victims rarely recieve any indication that their credentials were stolen in real time rather than from a historical database breach.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.