DaisyCloud Stealer Log: 2,548 Credentials (Jun 2024)

The Campaign's Quietest Day: 2,548 Records Near the June Tail

The DaisyCloud June cluster ran for more than ten days -- from June 18 through June 30, 2024 -- but not every upload was equal. On June 28, the channel posted just 2,548 U.S. endpoint credentials, the smallest single upload in the entire multi-month DaisyCloud campaign. Smaller even than July 10's 3,783-record low. The "0230_ON_CHANNEL" file identifier suggests this was the 230th individual log file released on the channel -- context that places this modest batch within a much larger, continuously operating distribution infrastructure. A low-volume day doesn't mean the campaign was faltering. It means the pipeline delivered what was ready.

DaisyCloud (June 28, 2024): Breach Summary

• Records Exposed: 2,548
• Data Types: Plaintext credentials (usernames, passwords, endpoint URLs)
• Breach Type: Stealer log
• Country Affected: United States
• Date Leaked: June 28, 2024

Volume Variation as a Campaign Intelligence Signal

The DaisyCloud campaign's upload volumes ranged from 2,548 records (this June 28 batch) to 132,246 (the July 21 mega-release) -- a range of roughly 52 to 1. This variance is itself informative. Large single-day volumes tend to reflect either aggregated batches released strategically, or the peak of a fresh infection wave delivering maximum log throughput. Small volumes like June 28 often represent the tail of a prior infection wave -- victims infected days earlier whose logs are arriving in small final trickles before the pipeline refills. For threat intelligence teams, tracking both high and low volume days helps reconstruct the underlying infection campaign's intensity curve.

What 2,548 Plaintext Records Means for Individual Victims

For security researchers, a 2,548-record batch is modest. For any of the 2,548 individuals in this upload, the exposure is total. Each record contains the email address, plaintext password, and URL for every saved credential the malware found on their infected device. An attacker with this data doesn't need to guess passwords or services -- they have the exact credential-to-URL mapping for each victim's browser-stored authentication. Even the smallest stealer log batches carry this individual-level risk. The upload size affects only the statistical likelihood of any given person appearing -- not the severity of exposure if they do.

Late June, Early July: The Campaign's Extended Range

June 28 is one of the later June dates in the DaisyCloud campaign timeline -- coming after the initial Jun 18-26 cluster and followed by Jun 30, then the July 4 resumtion. The extended June tail (Jun 27, Jun 28, Jun 30) indicates the campaign was winding down one infection wave while potentially preparing the next. The subsequent surge to 12,000+ daily records on July 6-7 suggests that whatever the operators did between June 28 and July 4 -- distributing new malware droppers, targeting new victim populations, or waiting for previously deployed payloads to mature -- the results were dramatic. This June 28 upload is part of the story that makes that surge intelligible.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including every documented DaisyCloud upload from mid-June through late July 2024. If your credentials appeared in this or any other release, HEROIC can tell you. Run a free scan at HEROIC.com.