NEW DAISYCLOUD Feb 27 Stealer Log Exposes 13,324 U.S. Credentials from 500 Devices

In February 2024, DarkHive detected a stealer log file uploaded to Telegram by the DAISY CLOUD [NEW] channel under the label NEW_DAISYCLOUD-27_FEBRUARY_0500_PCS_PASSWORD_ON_CHANNEL. The file exposed 13,324 records harvested from 500 compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. This release is part of the DAISYCLOUD campaign's daily log series, with the February 27 drop representing one of several consecutive releases in the days leading up to the leap day on February 29. The breach date was recorded as February 27, 2024.

Why This Is Dangerous

Each daily DAISYCLOUD release adds a fresh batch of credentials to the pool available to Telegram subscribers, and the February 27 drop was no exception. At 500 compromised devices contributing an average of 26.6 records each, the data captures a broad cross-section of U.S. internet users across many different websites and services. Attackers who aquire these logs test the credentials against email platforms, online banking, e-commerce sites, and workplace systems, exploiting any account where the victim reused the same password. Plaintext passwords mean no cracking delay between download and active exploitation.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The DAISYCLOUD campaign's consistent daily release schedule creates a compounding exposure effect. Subscribers who follow the channel build up large pools of fresh credentials that span weeks of harvesting activity. For organizations, this means that employee accounts compromised on any single day during the campaign's run may have been tested and potentially taken over within hours of the credential appearing in a DAISYCLOUD log. The campaign also demonstrates how Telegram channels have replaced traditional dark web forums as the primary distribution point for stolen credentials, lowering the barrier to entry for less technically sophisticated attackers.

How Stealer Log Infections Work

Infostealer malware infects devices through phishing emails, malicious software downloads, and compromised browser extensions. Once active, the malware silently captures credentials stored in browsers, password managers, and application sessions before transmitting the data to the campaign operator. The DAISY CLOUD [NEW] operator aggregates these records, organizes them by harvest date and device count, and releases them as daily log files on Telegram. Victims typicaly remain unaware that thier credentials were stolen until they discover unauthorized account activity or receive a breach notification from a monitoring service.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.