InfoSecBulletin Cybersecurity for mankind
A threat actor named “Chucky_BF” has advertised on a cybercrime forum that they are selling a “Global PayPal Credential Dump 2025” with over 15.8 million email and plaintext password pairs.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
The 1.16GB dataset in plain text reportedly contains sensitive credentials from PayPal accounts worldwide, indicating a significant breach.
According to Hackmanac’s post on X, the leaked credentials reportedly contain:
Login Emails: Common domains such as @gmail.com, @yahoo.com, @hotmail.com as well as TLD-specific and country-centric addresses.
Plaintext Passwords: Both unique and frequently reused strings, many exhibiting strong complexity, raising concerns about password reuse across platforms.
Associated URLs: Direct PayPal endpoints, including URIs for /signin, /signup, /connect, and Android mobile APIs.
Variants: Credentials embedded in regular PayPal links, country-specific domain formats, and mobile integrations.
The threat actor mentions a leak date of May 6, 2025, and claims the dump is useful for phishing campaigns and security testing by malicious parties.
TroyHunt added that “Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim.”
SOCRadar Dark Web Team also detected the advertisement for an alleged Global PayPal Credential Dump 2025, claiming to contain more than 15.8 million email and password pairs in plaintext, with a reported dump size of 1.1 GB. The listing describes the dataset as including login emails, plaintext passwords, and associated PayPal-related URLs across multiple domains and countries.
The claim raises questions, as large credential dumps offered on underground forums are often compiled from multiple sources rather than originating from a single platform. The presence of plaintext passwords may indicate that the data was harvested through infostealer malware, phishing kits, or previous credential leaks repackaged as a PayPal-specific breach. Even if the dataset is not directly sourced from PayPal, it could still be used in credential stuffing, fraud attempts, and phishing campaigns against PayPal users worldwide.
Security Measures for PayPal Users:
Cybersecurity experts have not confirmed the full authenticity or extent of the dump, but industry sources and threat intelligence are monitoring related indicators.
“Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim” 🤔 https://t.co/xmDyRaFbhL
— Troy Hunt (@troyhunt) August 16, 2025
If confirmed, such a breach would pose severe risks where attackers can automate login attempts across PayPal and other web services, exploiting reused credentials.
The leak allows for targeted social engineering using real emails and password hints. This could lead to unauthorized transactions, banking fraud, and identity theft.
Immediate action for all PayPal account holders includes resetting passwords on PayPal (and associated accounts), especially if reused elsewhere.
Enable multi-factor authentication (MFA), monitor your account for suspicious activity, and be cautious of phishing attempts with compromised email addresses.
Security analysts urge the importance of strong password practices and multi-factor authentication (MFA) for financial and online services. Organizations should quickly update breach detection rules for related emails and URLs. Users must avoid reusing passwords for important accounts.
