NEW DAISYCLOUD Mar 10 Stealer Log: 23,428 U.S. Credentials from 961 Devices

HEROIC's DarkHive system discovered the NEW DAISYCLOUD Mar 10 stealer log, exposing 23,428 records on March 10, 2024. A Telegram user uploaded this infostealer malware log harvested from 961 compromised U.S. endpoints — the highest device count in the entire March 2024 DAISYCLOUD series — containing email addresses, plaintext passwords, and service URLs.

Why This Is Dangerous

At 961 infected devices, this release reached more compromised endpoints than any other single day in the March 2024 DAISYCLOUD series, meaning credentials from over 960 distinct U.S. users were silently extracted and distributed to Telegram subscribers. Each endpoint yielded an average of 24.4 stored credentials spanning email, banking, retail, and workplace platforms. Plaintext passwords require no cracking, allowing subscribers to begin testing credentials against the specific service URLs captured in the log within minutes of download. The scale and daily cadence of the DAISYCLOUD campaign compress the window between harvest and exploitation.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

Credential stuffing and account takeover attacks powered by stealer logs like this one target email platforms, online banking, e-commerce sites, and corporate VPNs simultaneously. Victims who reuse passwords across services face cascading account compromises from a single endpoint infection. The DAISYCLOUD channel's free Telegram distribution model means these credentials reached an uncontrolled number of subscribers with no cost barrier, making broad exploitation by opportunistic attackers highly likely within the first day of the release.

How Stealer Log Works

Infostealer malware spreads through phishing campaigns, cracked software installers, and malicious browser extensions. Once active on a victim's machine, the malware hooks into browser processes to extract saved passwords, session cookies, and login URLs from browser storage. These records are transmitted to an attacker-controlled aggregation point and packaged into daily log files. The DAISY CLOUD [NEW] operator releases the packages on Telegram labeled with the harvest date and device count, signaling freshness to subscribers who compete to exploit credentials before other attackers test them first.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the NEW DAISYCLOUD Mar 10 stealer log. Visit heroic.com to check if your information was exposed.