NEW_DAISYCLOUD 02_JANUARY_0283_PCS_New_Password_on_channel uploaded by DAISY CLOUD [NEW]

We've been tracking a notable uptick in stealer logs appearing on Telegram channels dedicated to credential stuffing and account takeover. What really struck us wasn't the volume of these logs – they're a constant stream – but the increasing specificity of the targeted services and the inclusion of API keys alongside username/password pairs. The recent appearance of a log file attributed to "DAISY CLOUD [NEW]" stood out due to its clear targeting of cloud infrastructure credentials. The data had been circulating quietly, but we noticed the clear naming convention, which seemed to indicate a targeted credential harvesting campaign.

The “NEW_DAISYCLOUD” Stealer Log: 4.9K Records Exposing Cloud Credentials

A stealer log file, uploaded to Telegram on January 2, 2024, and labeled "NEW_DAISYCLOUD 02_JANUARY_0283_PCS_New_Password_on_channel uploaded by DAISY CLOUD [NEW]", exposed 4,941 records containing a mix of email addresses, plaintext passwords, and URLs. The file appears to be a collection of credentials harvested from compromised endpoints, specifically targeting services related to cloud infrastructure management. The clear naming convention indicates a targeted credential harvesting campaign.

What caught our attention was the plaintext password storage, a practice that significantly amplifies the risk associated with stealer log exposure. While the number of records isn't massive compared to some breaches, the potential impact of compromised cloud infrastructure credentials makes this leak particularly concerning for enterprises. Compromised cloud credentials can provide attackers with direct access to sensitive data, systems, and services, potentially leading to data breaches, financial losses, and reputational damage. This incident underscores the ongoing threat posed by stealer logs and the need for robust endpoint security and credential management practices. The data had been circulating quietly, but we noticed the clear naming convention, which seemed to indicate a targeted credential harvesting campaign.

Breach Stats:
* Total records exposed: **4,941**
* Types of data included: **Email Addresses, Plaintext Passwords, URLs, API Host**
* Source structure: **Stealer Log**
* Leak location: **Telegram channel**
* Date of first appearance: **January 2, 2024**

The appearance of this stealer log aligns with a broader trend of attackers leveraging readily available malware to harvest credentials and target cloud infrastructure. As BleepingComputer has reported extensively, stealer logs are a common commodity on underground forums and Telegram channels, providing attackers with a low-cost, high-reward avenue for gaining access to valuable data and systems. The use of Telegram for sharing these logs highlights the challenges in tracking and mitigating these threats, as these channels often operate with minimal oversight.