NEW DAISYCLOUD Feb 16 Stealer Log Leaks 14,018 U.S. Credentials from 616 Devices

In February 2024, DarkHive detected a stealer log file uploaded to Telegram by the DAISY CLOUD [NEW] channel under the label NEW_DAISYCLOUD-16_FEBRUARY_0616_PCS_PASSWORD_ON_CHANNEL. The file exposed 14,018 records harvested from 616 compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. The February 16 release is part of the DAISYCLOUD campaign's sustained daily release schedule during the second half of February 2024. The breach date was recorded as February 16, 2024.

Why This Is Dangerous

At 616 infected devices contributing an average of 22.8 records each, the February 16 DAISYCLOUD log exposed a broad range of account credentials across countless websites and services visited by affected U.S. users. The DAISYCLOUD campaign's free Telegram distribution model means that any subscriber can aquire and immediately use these credentials for account takeover attacks without paying for access or possessing any technical capability beyond downloading a file. Plaintext passwords allow direct login attempts against the specific service URLs also included in the log, enabling precise targeted attacks rather than broad scanning.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The 616-device harvest on February 16 represents a typical day in the DAISYCLOUD campaign's operation. Multiplied across dozens of daily releases spanning several weeks, the aggregate exposure reaches into the hundreds of thousands of records. For organizations, the sustained nature of this campaign means that employee devices compromised during any day of the campaign's run contributed credentials to a publicly accessible Telegram channel. Individuals who recieve no notification about the inclusion of thier credentials in these logs have no prompt to change their passwords or enable additional account protections.

How Stealer Log Infections Work

Infostealer malware spreads through phishing emails, malicious browser extensions, and trojanized software downloads. Once installed, the malware extracts saved credentials from browsers, password managers, and application sessions before transmitting the data to the campaign operator. The DAISY CLOUD [NEW] channel operator then packages the collected records by date and device count and releases them on Telegram as daily log files. The naming convention signals freshness to subscribers, encouraging rapid download and exploitation of the contained credentials before competing attackers test them first.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.