Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSDaisyCloudStealer

Also known as:@UP_DAISYCLOUD obfuscated UserInformation.txtDaisy Private cloud per-line watermark variant

What is the CSDaisyCloudStealer infostealer, and what data does it steal?

CSDaisyCloudStealer (also known as @UP_DAISYCLOUD obfuscated UserInformation.txt and Daisy Private cloud per-line watermark variant) is a CyStack research label for information-stealer traces. CSDaisyCloudStealer targets browser credentials, Host metadata: hostname, NetBIOS / domain, Windows username, OS fingerprint with build number and architecture, Hardware inventory: CPU model, GPU model, installed RAM, Victim public IP plus ISO country code, HWID and Windows MachineID and Wallpaper SHA-1 hash. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSDaisyCloudStealer is a CyStack-coined identifier for a per-line-watermarked UserInformation.txt panel distributed through the @UP_DAISYCLOUD Telegram channel. Each line in the body is prefixed with an obfuscated Daisy Private cloud banner (digit-noise injected between every letter of Daisy, Private, and cloud) plus a 4-9-character random alphabetic gibberish token before the actual Key: Value payload. The watermark digits and gibberish vary per line as an anti-leech mechanism: a single grep for the channel name fails on any individual line. After stripping the watermark the body is a canonical RedlineLike variant 3 layout (Buy-now banner plus extended-block) with the Operation System: Redline-canonical typo and the full Computer Name: / Domain Name: / MachineID: / Product Key: / extended-block field set.

Daisy Cloud has run on Telegram since October 2023 and public reporting describes it as "potentially linked to the notorious RedLine Stealer family" - those attributions hedge with "potentially" / "appears to come from", and no public analysis confirms the channel reliably resells a single named family. Family attribution is provisional pending a published threat-intel report that maps the watermark directly to a canonical builder.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
da********	Telegram	Low

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`7fbb06e...`	241	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

CSDaisyCloudStealer Infostealer Analysis: Targets & TTPs