HEROIC Found the UP_DaisyCloud 4k Log With 75,000 Stolen Passwords on Telegram

HEROIC analysts found the UP_DaisyCloud 4k Logs June 10 by .boxed.pw circulating on a public Telegram channel on June 10, 2025. The log contained 75,595 records harvested from infected devices, each entry pairing an email address with a plaintext password and the homepage URL of the site the victim was logged into when the malware ran. At nearly 76,000 records, this is one of the larger single-batch stealer logs we have tracked from this distribution network.

Why 75,000 Plaintext Passwords in One Log Is a Serious Problem

Scale matters with stealer logs. A small batch affects a limited pool of victims. But when a single log contains more than 75,000 email-and-password pairs, all in plaintext, it becomes a high-value asset that gets traded and reused across multiple threat actor communities. The .boxed.pw network has distributed similar logs repeatedly, meaning this data will not stay in one place for long.

Because the passwords are plaintext, there is no barrier between a downloader and full account access. Attackers do not need to run password-cracking software or wait. They can begin testing credentials against popular services the same hour the log is posted. Homepage URLs included in the log tell them exactly where to start.

What the UP_DaisyCloud 4k Log Exposed

• Email Addresses — The login identity for virtually every online service the victim used
• Plaintext Passwords — Unencrypted and immediately usable without any additional tools
• HomePage URLs — Reveals exactly which platforms and services each victim was actively signed into

Why This Matters: Account Takeover, Credential Stuffing, and Financial Fraud

A log this size feeds directly into credential stuffing operations. Automated tools cycle through the 75,000 email-password pairs against banking apps, e-commerce sites, streaming platforms, and email providers. The success rate is predictably high because most people reuse passwords across severel accounts.

When an attacker gains access to a primary email account, the consequences compound quickly. They can trigger password resets on every linked service, locking the victim out completely. Financial accounts tied to that email become accessable. In some cases, attackers pivot to identity theft by using the email account to impersonate the victim with other services, including government portals and credit institutions.

How the UP_DaisyCloud Stealer Log Was Assembled

The "4k" in this log's name refers to the approximate number of logs compiled in this batch, not just the record count. Infostealer malware operators collect logs from infected machines continuously, bundle them periodically, and release them on Telegram under branded names to build distribution credibility.

The infection chain typically starts with a malicious download, a fake utility, a cracked application, or a trojanized browser extension. Once installed, the stealer silently reads stored browser credentials, active session cookies, and autofill data. It packages everything neatly and transmits it to the attacker's collection server. The .boxed.pw label identifies the specific broker or distributor who compiled and released this particular bundle.

Scan Free to See If Your Email Was in the UP_DaisyCloud Breach

HEROIC's breach scanner cross-references your email address against more than 400 billion exposed records, including the UP_DaisyCloud log and thousands of other stealer logs and database dumps. The scan is free and takes under a minute.

If your email appears, start by changing passwords on your primary email and any financial accounts. Do not reuse any password that was active at the time of the breach. Enable two-factor authentication on every account that supports it, particularly email, banking, and social media platforms.