DaisyCloud-Championing Telegram Leak: 28,455 U.S. Credentials (May 5, 2024)

Third Day Running: DaisyCloud-Championing Releases 28,455 U.S. Credentials on May 5

On May 5, 2024, the NEW_DAISYCLOUD-CHAMPIONING Telegram channel released 28,455 sets of U.S. infostealer credentials -- the third consecutive daily release in a documented 18-day run spanning May 3 through May 20. At 28,455 records, May 5 is among the larger releases in the campaign's opening week, and represents a bounce back from the comparativly lower May 4 total of 16,238. The May 5 release confirms the campaign's early-series baseline was in the high-20,000s range -- a strong daily output that would persist, with variation, through the May 10 peak of 54,210 and beyond.

DaisyCloud-Championing May 5, 2024: Breach Summary

• Records Exposed: 28,455
• Data Types: Email addresses, plaintext passwords, target login URLs
• Breach Type: Infostealer malware log
• Country Affected: United States
• Date Leaked: May 5, 2024

Scale From the Start

The first five days of the documented NEW_DAISYCLOUD-CHAMPIONING campaign -- May 3 through May 7 -- produced a combined total exceeding 122,000 U.S. credential sets. Even before the 54,210-record peak on May 10, the operator was distributig at a pace that made this one of the more prolific infostealer campaigns in the documented dataset. The May 5 release of 28,455 records sits comfortably within this pattern: high enough to signal operational scale, consistent enough to confirm daily distribution discipline, and part of a broader campaign that would extend through the end of May and into June without significent interruption.

The Infostealer Economy on Telegram

For every day the NEW_DAISYCLOUD-CHAMPIONING operator released a batch of logs, there were Telegram subscribers on the receiving end -- threat actors who downloaded the files and sorted through the credentials looking for valuable targets. Accounts with access to corporate email, banking systems, or cloud infrastructure are typicaly prioritized; the rest may end up in credential stuffing attacks targeting any account the email-password combination might unlock. The 28,455 records released on May 5 entered this economy the moment they were posted. Even weeks or months later, those credentials remain accessible to anyone who saved the original file -- and some threat actors specificaly archive Telegram releases for long-term exploitation.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including infostealer logs from Telegram channels like NEW_DAISYCLOUD-CHAMPIONING. If your email address or passwords appeared in this or any related release, HEROIC can alert you and help you take action before attackers do.