hackread.com August 18, 2025 - A seller named Chucky_BF is offering 15.8M PayPal logins with emails, passwords, and URLs. The data may come from infostealer malware logs.
A threat actor using the name Chucky_BF on a cybercrime and hacker forum is advertising what they claim to be a massive PayPal data dump. The post describes a trove labeled “Global PayPal Credential Dump 2025,” allegedly containing more than 15.8 million records of email and plaintext password pairs.
The size of the dataset is said to be 1.1GB, and according to the seller, the leak covers accounts from many email providers and users in different parts of the world. What makes this claim threatening is not just the number of exposed accounts but also the type of data said to be included. Other than the email and password combinations, the seller mentions that many records come with URLs directly linked to PayPal services.
Endpoints like /signin, /signup, /connect, and Android-specific URIs are also referenced in the listing. These details suggest that the dump is structured in a way that could make it easier for criminals to automate logins or abuse services.
The description provided by Chucky_BF describes the dataset as a goldmine for cybercriminals. The threat actor claims the records are “raw email:password:url entries across global domains,” warning that this could lead to credential stuffing, phishing schemes, and fraud operations.
A closer look by Hackread.com at the samples posted in the forum shows Gmail addresses paired with passwords and linked directly to PayPal’s login pages, while another features a user account appearing in both web and mobile formats, showing that the same account details were found in different versions of PayPal’s services, both web and mobile.
The way the data is put together is also important. It seems to include a mix of real accounts and test or fake ones, which is often the case with stolen or old databases. The seller claims most of the passwords look strong and unique, but also admits many are reused. That means people who used the same password on other websites could be at risk well outside PayPal.
As for pricing, Chucky_BF is asking for 750 US dollars for full access to the 1.1GB dump. That figure positions it in line with other credential dumps of similar size sold in cybercrime markets, which often find buyers among groups looking to monetize stolen accounts through fraud or resale.
If the claims are accurate, this would represent one of the larger PayPal-focused leaks of recent years, with millions of users across Gmail, Yahoo, Hotmail, and country-specific domains implicated.
Infostealer Logs as the Likely Source
PayPal has never suffered a direct data breach in which attackers broke into its systems or stole millions of user records. Past incidents, including the one that involved 35,000 users, linked to the company have usually been the result of credential stuffing or data harvested elsewhere.
This makes it possible that the newly advertised dataset is not the product of a PayPal system breach at all, but rather the result of infostealer malware collecting login details from infected devices and bundling them together.
The structure of the dataset shown in the samples shared by the threat actor suggests it may have been collected through infostealer malware logs. Infostealers infect personal devices and steal saved login details, browser data, and website activity, which later appear in bulk on cybercrime markets.
The presence of PayPal login URLs and mobile URIs in this dump makes it possible that the information was gathered from infected users worldwide, then compiled to be sold as a single PayPal-focused leak.
Infostealer malware infecting devices worldwide is hardly surprising. In May, cybersecurity researcher Jeremiah Fowler discovered a misconfigured cloud server containing 184 million login credentials, including unique usernames, email addresses, and passwords, which he believes were likely collected using infostealer malware.
According to Hudson Rock, a cybercrime intelligence company, infostealer malware is easily and cheaply available on the dark web. The company’s research also revealed the scale at which these tools have successfully targeted critical infrastructure, including in the United States.
Researchers found that employees at key US defense entities such as the Pentagon, major contractors like Lockheed Martin and Honeywell, military branches, and federal agencies, including the FBI, have also fallen victim to infostealer malware.
As for PayPal, the company itself has not confirmed any such incident, and it is not yet clear whether the dataset is entirely authentic, a mix of real and fabricated records, or a repackaging of older leaks.
Hackread.com has also not been able to verify whether the data is genuine, and only PayPal can confirm or deny the claims. The company has been contacted for comment, and this article will be updated accordingly.
numerama.com - Depuis le 23 juillet 2025, un cybercriminel prétend avoir en sa possession des documents secret défense appartenant à Naval Group. À moins de 24 heures de l’échéance fixée par le corbeau virtuel, le leader européen du naval de défense confirme avoir détecté un potentiel incident, mais précise qu’une enquête est en cours afin d’évaluer précisément la menace.
Coup de bluff ou réelle menace ? Depuis le 23 juillet 2025, un hacker dissémine au compte-goutte ce qu’il assure être des extraits de documents top-secrets appartenant à Naval Group. Échanges confidentiels, accès à des machines virtuelles, documents techniques, le cybercriminel assure détenir une mine d’or de données, couvrant principalement la période 2019-2024.
Sur un célèbre forum du Dark Web, le maitre-chanteur fanfaronne : les données ne sont pas à vendre, il souhaite être contacté directement par Naval Group avant le 26 juillet 2025. Si sa demande reste pour morte, il diffusera l’ensemble des documents gratuitement sur la plateforme.
Contacté par nos confrères de La Tribune, Naval Group confirme qu’un potentiel incident a été détecté par leurs équipes techniques mais que, pour l’heure, l’ampleur réel de la menace reste à déterminer.
Un chantage aux enjeux majeurs
Il demeure difficile d’évaluer avec précision le niveau de risque posé par ce chantage. Un premier lot de données d’environ 13 Go a été publié le 23 juillet 2025 à titre de preuve. Certains fichiers, comme des vidéos provenant d’un système de surveillance sous-marin datant de 2003, n’ont rien de décisif en matière de sécurité. Leur but semble avant tout de rendre crédible la menace, en montrant que le hacker détient bien des documents internes de Naval Group.
Si la véracité de la fuite se confirme, cet incident constituerait un risque majeur non seulement pour Naval Group, mais aussi pour la sécurité nationale française.
L’exposition du code source du CMS, le système informatique central pilotant les opérations des bâtiments militaires, ouvrirait la voie à des vulnérabilités critiques exploitables par des États ou groupes hostiles. De tels incidents obligeraient notamment à la mise en place de contre-mesures pour limiter les risques d’exploitation.
Enquête en cours et mobilisation des autorités
Le géant français semble en tout cas prendre la menace au sérieux et annonce travailler directement avec les autorités françaises pour lever le voile sur cette affaire. Une enquête est en cours.
Naval Group, joue un rôle stratégique majeur dans l’industrie de défense française et européenne. Il conçoit notamment les sous-marins nucléaires, frégates de combat et le porte-avions Charles de Gaulle.
A person has been arrested in Switzerland as part of a ccordinated raid on 270 dark web sites in ten countries.
The international raid, dubbed “RapTor”, dismantled networks trafficking drugs, weapons and counterfeit goods. The suspects were identified during the dismantling of the dark web markets Nemesis, Tor2Door, Bohemia and Kingdom Markets.
Many of them made thousands of sales on illegal markets using encryption tools and cryptocurrencies to cover their tracks.
Officers seized more than 180 firearms, over two tonnes of drugs and €184 million in cash and cryptocurrencies during the operation, which included arrests in ten countries, including Germany, France, Austria, Britain and the United States.
A threat actor claims to offer a zero-day exploit for an unauthenticated remote code execution vulnerability in Fortinet firewalls.
Luis S. est un Genevois qui recueille des données d'intérêt public sur le darknet pour les fournir aux médias romands. Dans le cadre de cette activité, il a été perquisitionné en 2023 par la police fédérale, puis blanchi. Mais entretemps, des documents ont disparu dans les supports informatiques saisis, notamment des échanges avec des journalistes.
Cyble observes how Dark Web forums reveal ServiceNow users falling victim to a Remote Code Execution vulnerability, which exposes sensitive data & escalates risks across sectors.
La Croix-Rouge italienne touchée par une fuite massive de données, le CICR enquête
Un volume très important de données a été volé à la Croix-Rouge italienne. En 2022 déjà, des informations sensibles avaient été subtilisées au CICR. Lors de sa grande conférence d’octobre, l’organisation humanitaire va insister sur l'importance de protéger les données humanitaires
We searched the dark web for politicians’ official email addresses, and roughly 40% of them appeared, along with other sensitive information. This is a scandal waiting to happen.
The online criminal bazaar BreachForums has been resurrected merely two weeks after a U.S.-led coordinated law enforcement action dismantled and seized control of its infrastructure.
Cybersecurity researchers and dark web trackers Brett Callow, Dark Web Informer, and FalconFeeds revealed the site's online return at breachforums[.]st – one of the dismantled sites – by a user named ShinyHunters, who has since offered for sale a 1.3 TB database containing details of allegedly 560 million Ticketmaster customers for $500,000.
Cheap ransomware is being sold for one-time use on dark web forums, allowing inexperienced freelancers to get into cybercrime without any interaction with affiliates.
Researchers at the intelligence unit at the cybersecurity firm Sophos found 19 ransomware varieties being offered for sale or advertised as under development on four forums from June 2023 to February 2024.
Telecom company AT&T(T.N), opens new tab said on Saturday that it is investigating a data set released on the "dark web" about two weeks ago, and said that its preliminary analysis shows it has impacted approximately 7.6 million current account holders and 65.4 million former account holders.
The company said the data set appears to be from 2019 or earlier. AT&T said it does not have evidence of unauthorized access to its systems resulting from the incident.
...Among these, russian-speaking dark web forums hold a unique position due to their extensive user base and the intricate of their operations.
Resecurity identified bad actors offering a significant number of AnyDesk customer credentials for sale on the Dark Web.
Following a recent and highly disruptive cyberattack on telecom carrier Orange España the cybersecurity community needs to rethink its approach to safeguarding the digital identity of staff involved in network engineering and IT infrastructure management. Orange España is the second-largest mobile operator in Spain. In early January, an attacker going by the alias ‘Snow’ hijacked Orange España’s RIPE Network Coordination Centre (NCC) account. RIPE is Europe’s regional Internet registry. After this initial breach, Snow sabotaged the telecommunications firm’s border gateway protocol (BGP) and resource public key infrastructure (RPKI) configurations.
Hundreds of compromised credentials of customers of RIPE, APNIC, AFRINIC, and LACNIC available on the dark web, Resecurity warns.
Even as the New Year approached and the world celebrated the festive Christmas season, the cybercriminal community did not pause their activities. Instead, they marked the holiday season in their unique way. On Christmas Eve, Resecurity observed multiple actors on the Dark Web releasing substantial data dumps. These were the result of data breaches and network intrusions to a variety of companies and government agencies. Numerous leaks disseminated in the underground cyber world were tagged with 'Free Leaksmas,' indicating that these significant leaks were shared freely among various cybercriminals as a form of mutual gratitude.
German law enforcement takes down dark web giant "Kingdom Market," specializing in narcotics and malware sales to tens of thousands of users.
A new strain of ransomware called MadCat has been linked by security researchers to suspected scammers who pretend to sell passport details on the dark web so they can rip off their fellow crooks.
Différentes données ultra sensibles pour la sécurité de la Suisse font partie des données volées au prestataire Xpl
Google announced the opening of the dark web monitoring report security feature to all Gmail users in the United States. Google is going to offer dark web monitoring to all U.S. Gmail users, the feature allows them to search for their email addresses on the dark web. Dark web scans for Gmail address was previously […]
