UP_DAISYCLOUD-CHAMPIONING – 09_JULY_5133_ON_CHANNEL uploaded by a Telegram User

We've been tracking a steady increase in stealer log volume across Telegram channels, but what caught our attention this week wasn't just the number of compromised accounts, but the specific targeting and data exfiltration methods observed in a log file related to a cloud services platform. The setup here felt different because it wasn't a broad, indiscriminate dump of credentials. Instead, the log seemed to focus on a particular set of users and API endpoints associated with a platform named **UP_DAISYCLOUD-CHAMPIONING**. The data had been circulating quietly since early July, but we noticed an uptick in mentions across several cybersecurity-focused Telegram groups, prompting a deeper dive.

The DaisyCloud Leak: 198k Endpoints, Emails, and Passwords Exposed

A Telegram user uploaded a stealer log file on **July 9, 2025**, exposing **198,994** records associated with endpoints, email addresses, API hosts and plaintext passwords linked to a platform named **UP_DAISYCLOUD-CHAMPIONING**. This breach appears to stem from a stealer log, indicating a compromise of user devices rather than a direct breach of DaisyCloud's infrastructure. The significance lies in the plaintext passwords, a dangerous practice that amplifies the risk of credential stuffing attacks across other platforms.

The breach was discovered on **July 11th** by our team while monitoring Telegram channels known for hosting and sharing stealer logs. What really struck us wasn't volume—it was detail. The log contained a high proportion of API host URLs alongside email and plaintext password combinations, suggesting a potential focus on compromising automated processes or integrations leveraging the DaisyCloud platform. This matters to enterprises now because exposed API keys and plaintext passwords can be easily exploited to gain unauthorized access to sensitive data, systems, and services. Given the rise of automated attacks, this type of data is particularly dangerous. This incident ties into broader threat themes we're seeing, particularly the proliferation of stealer logs on Telegram marketplaces and the continued use of plaintext passwords by some services, despite well-known security risks.

• Total records exposed: 198,994
• Types of data included: Email Addresses, Plaintext Passwords, URLs (API hosts)
• Sensitive content types: API keys are highly likely to be derived from the exposed URLs.
• Source structure: Stealer Log file
• Leak location(s): Telegram channel
• Date of first appearance: July 9, 2025

External Context & Supporting Evidence

Stealer logs continue to be a major source of enterprise breaches, as highlighted by a recent report from CrowdStrike, which noted a 400% increase in stealer log availability on underground forums in the past year. The practice of storing passwords in plaintext is a known security vulnerability that has been repeatedly exploited, despite widespread awareness of the risks. Security researcher Troy Hunt has long advocated against this practice, emphasizing the dangers of credential stuffing attacks when plaintext passwords are leaked. This incident reflects a continued failure to implement basic security measures, which enables attackers to easily compromise user accounts and gain access to sensitive data.