NEW DAISYCLOUD Jan 30 New Password Stealer Log Leaks 12,479 U.S. Credentials from 363 Devices

DarkHive detected a breach from the DAISY CLOUD [NEW] Telegram channel on January 30, 2024. The stealer log release, labeled 30_JANUARY_0363_PCS_New_Password, was harvested from 363 compromised U.S. endpoints and exposed 12,479 records. The leaked data includes plaintext passwords, email addresses, and service and API host URLs captured at the time of infection. The breach date is recorded as January 30, 2024.

Why This Is Dangerous

The January 30 DAISYCLOUD release exposed 12,479 records from 363 infected devices, yielding an unusually high average of approximately 34 records per device. This elevated per-device record count suggests the compromised endpoints held stored credentials for a large number of online accounts. As part of the New Password series, victims who recently changed thier passwords around this date may still find their new credentials included in the exposed data. Threat actors who aquire this log can target the specific service URLs embedded in each record for immediate account takeover attempts.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

The January 30 release is one of the earliest known entries in the DAISY CLOUD [NEW] campaign's daily release series. Each drop from this point forward compounds the total exposure for U.S. victims, many of whom may recieve repeated credential leaks across seperate daily releases without knowing their data has been compromised. The campaign's launch in late January 2024 and immediate high-volume output signals a well-prepared operation with infrastructure already in place to harvest and distribute credentials at scale.

How Stealer Log Infections Work

Infostealer malware is deployed through phishing campaigns, trojanized software, and malicious browser extensions. Once running on a victim's device, it captures credentials from browser storage and active login sessions and transmits them to the operator. The DAISY CLOUD [NEW] operator packages thier collected logs into dated archive files labeled with the device count and releases them on Telegram. Victims typicaly have no indication their credentials have been captured and may only discover the exposure through a breach monitoring alert weeks or months later.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like NEW DAISYCLOUD. Visit heroic.com to scan your email address and find out if your information was exposed.