9,384 U.S. Credentials Exposed in NEW DAISYCLOUD Feb 15, 2024 Stealer Log

In February 2024, DarkHive detected a stealer log file uploaded to Telegram by the DAISY CLOUD [NEW] channel under the label NEW_DAISYCLOUD-15_FEBRUARY_0420_PCS_PASSWORD_ON_CHANNEL. The file exposed 9,384 records harvested from 420 compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. The February 15 release falls in the mid-February stretch of the DAISYCLOUD campaign's daily log schedule. At 420 infected devices this is one of the lower-volume releases in the series, but each device still contributed an average of 22.3 credential records to the leaked dataset. The breach date was recorded as February 15, 2024.

Why This Is Dangerous

Even lower-volume DAISYCLOUD releases like the February 15 drop carry significant risk because each credential record is immediately usable without any cracking or processing. The 420 compromised devices represent 420 distinct individuals or organizations whose saved browser passwords were silently extracted and distributed to Telegram subscribers. Attackers who aquire this log can test all 9,384 credential pairs against the specific service URLs also included in the file, targeting real accounts at real platforms within minutes of downloading the log.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The DAISYCLOUD campaign's consistent daily release pattern means that even on lower-volume days, fresh credentials continue flowing to subscribers who build cumulative databases of compromised accounts. Over the course of the campaign's run, these daily drops aggregate into a comprehensive dataset covering a wide range of U.S. internet users. For security teams, the challenge is that there is no central notification mechanism for individuals whose credentials appear in these Telegram-distributed stealer logs, leaving victims unaware until unauthorized access is detected on thier accounts.

How Stealer Log Infections Work

Infostealer malware is deployed through phishing emails, fake software update prompts, and malicious browser extensions. Once active on a victim's device, the malware scans browser storage for saved login credentials, captures autofill data, and extracts session cookies before transmitting the collected records to the campaign operator. The DAISY CLOUD [NEW] operator packages these records into daily log files labeled with the harvest date and device count, creating a recognizable brand within the Telegram stealer log ecosystem. Victims typicaly do not realize their credentials were stolen until they notice suspicious account activity or use a breach monitoring service.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.