9,132 U.S. Credentials Exposed in NEW DAISYCLOUD Feb 2, 2024 New Password Stealer Log

DarkHive detected a breach from the DAISY CLOUD [NEW] Telegram channel on February 2, 2024. The stealer log release, labeled 02_FEBRUARY_0626_PCS_New_Password, was harvested from 626 compromised U.S. endpoints and exposed 9,132 records. The leaked data includes plaintext passwords, email addresses, and service and API host URLs captured at the time of infection. The breach date is recorded as February 2, 2024.

Why This Is Dangerous

With 626 infected devices contributing to this log, the February 2 DAISYCLOUD release covers a broad cross-section of U.S. online accounts and services. As part of the New Password series, the credentials captured here may reflect recently changed passwords, meaning victims who updated thier accounts around this time remain at risk. Threat actors can aquire this data and immediately attempt logins against the specific service URLs included in the log, enabling targeted account takeover without credential stuffing across random platforms.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The DAISY CLOUD [NEW] campaign began releasing daily stealer log archives in late January 2024, with the February 2 drop representing one of the early entries in the sustained campaign. Each successive release compounds the total exposure, and victims appearing in the Feb 2 log may also recieve additional exposure in seperate drops from earlier or later dates. The consistency and frequency of these releases reflects a highly organized operation with a reliable pipeline of infostealer infections targeting U.S. users.

How Stealer Log Infections Work

Infostealer malware is deployed through phishing emails, fake software downloads, and malicious browser extensions. Once active on a device, it silently captures browser-stored credentials and transmits them to the operator. The DAISY CLOUD [NEW] operator archives thier collected records into dated log files labeled with device counts and releases them on Telegram. Victims typicaly do not know their credentials were stolen until a breach monitoring service flags their email address in a stealer log database.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.