14,413 U.S. Credentials Leaked in NEW DAISYCLOUD Feb 20, 2024 Stealer Log

In February 2024, DarkHive identified a stealer log file uploaded to Telegram by the DAISY CLOUD [NEW] channel under the label NEW_DAISYCLOUD-20_FEBRUARY_0526_PCS_PASSWORD_ON_CHANNEL. The file exposed 14,413 records harvested from 526 compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. The February 20 release is among the earlier drops in the DAISYCLOUD series, representing the campaign's activity during the third week of February 2024. The breach date was recorded as February 20, 2024.

Why This Is Dangerous

At 526 infected devices contributing an average of 27.4 records each, the February 20 DAISYCLOUD log exposed a wide variety of account types spanning the full range of websites visited by affected users. The plaintext nature of the passwords means attackers can immediately test every credential in the file against major platforms without any preprocessing. Service URLs included in the log allow attackers to identify which specific platforms each victim accessed, enabling targeted account takeover attempts rather than broad spray-and-pray credential stuffing. For any victim whose corporate email or workplace system credentials appear in this log, the exposure risk extends to their employer's internal systems and data.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The DAISYCLOUD February series demonstrates that credential theft campaigns can sustain daily releases over extended periods, continually expanding the total pool of compromised accounts available to attackers. Each release builds on the previous, and subscribers who collect multiple daily logs accumulate databases of tens of thousands of credentials harvested across weeks of activity. The free Telegram distribution model means these aggregated datasets circulate widely with no cost barrier, making them accessible to opportunistic attackers alongside more sophisticated threat actors. Victims who seperate thier work and personal accounts, and who use unique passwords, reduce but do not eliminate thier risk from these types of campaigns.

How Stealer Log Infections Work

Infostealer malware is distributed through phishing emails, drive-by downloads, and malicious browser extensions. Once executing on a victim's device, the malware extracts saved credentials from browsers and applications before transmitting the data to an attacker-controlled aggregation server. The DAISY CLOUD [NEW] campaign operator packages the collected records into daily log files labeled with the harvest date and device count, then releases them on Telegram. The labeling scheme signals freshness to subscribers, who prize recently harvested credentials as more likely to be active and untested by other attackers.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.