InfoSecBulletin Cybersecurity for mankind
A threat actor named “Chucky_BF” has advertised on a cybercrime forum that they are selling a “Global PayPal Credential Dump 2025” with over 15.8 million email and plaintext password pairs.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The 1.16GB dataset in plain text reportedly contains sensitive credentials from PayPal accounts worldwide, indicating a significant breach.
According to Hackmanac’s post on X, the leaked credentials reportedly contain:
Login Emails: Common domains such as @gmail.com, @yahoo.com, @hotmail.com as well as TLD-specific and country-centric addresses.
Plaintext Passwords: Both unique and frequently reused strings, many exhibiting strong complexity, raising concerns about password reuse across platforms.
Associated URLs: Direct PayPal endpoints, including URIs for /signin, /signup, /connect, and Android mobile APIs.
Variants: Credentials embedded in regular PayPal links, country-specific domain formats, and mobile integrations.
The threat actor mentions a leak date of May 6, 2025, and claims the dump is useful for phishing campaigns and security testing by malicious parties.
TroyHunt added that “Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim.”
SOCRadar Dark Web Team also detected the advertisement for an alleged Global PayPal Credential Dump 2025, claiming to contain more than 15.8 million email and password pairs in plaintext, with a reported dump size of 1.1 GB. The listing describes the dataset as including login emails, plaintext passwords, and associated PayPal-related URLs across multiple domains and countries.
The claim raises questions, as large credential dumps offered on underground forums are often compiled from multiple sources rather than originating from a single platform. The presence of plaintext passwords may indicate that the data was harvested through infostealer malware, phishing kits, or previous credential leaks repackaged as a PayPal-specific breach. Even if the dataset is not directly sourced from PayPal, it could still be used in credential stuffing, fraud attempts, and phishing campaigns against PayPal users worldwide.
Security Measures for PayPal Users:
Cybersecurity experts have not confirmed the full authenticity or extent of the dump, but industry sources and threat intelligence are monitoring related indicators.
“Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim” 🤔 https://t.co/xmDyRaFbhL
— Troy Hunt (@troyhunt) August 16, 2025
If confirmed, such a breach would pose severe risks where attackers can automate login attempts across PayPal and other web services, exploiting reused credentials.
The leak allows for targeted social engineering using real emails and password hints. This could lead to unauthorized transactions, banking fraud, and identity theft.
Immediate action for all PayPal account holders includes resetting passwords on PayPal (and associated accounts), especially if reused elsewhere.
Enable multi-factor authentication (MFA), monitor your account for suspicious activity, and be cautious of phishing attempts with compromised email addresses.
Security analysts urge the importance of strong password practices and multi-factor authentication (MFA) for financial and online services. Organizations should quickly update breach detection rules for related emails and URLs. Users must avoid reusing passwords for important accounts.
