InfoSecBulletin Cybersecurity for mankind
A threat actor named “Chucky_BF” has advertised on a cybercrime forum that they are selling a “Global PayPal Credential Dump 2025” with over 15.8 million email and plaintext password pairs.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
The 1.16GB dataset in plain text reportedly contains sensitive credentials from PayPal accounts worldwide, indicating a significant breach.
According to Hackmanac’s post on X, the leaked credentials reportedly contain:
Login Emails: Common domains such as @gmail.com, @yahoo.com, @hotmail.com as well as TLD-specific and country-centric addresses.
Plaintext Passwords: Both unique and frequently reused strings, many exhibiting strong complexity, raising concerns about password reuse across platforms.
Associated URLs: Direct PayPal endpoints, including URIs for /signin, /signup, /connect, and Android mobile APIs.
Variants: Credentials embedded in regular PayPal links, country-specific domain formats, and mobile integrations.
The threat actor mentions a leak date of May 6, 2025, and claims the dump is useful for phishing campaigns and security testing by malicious parties.
TroyHunt added that “Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim.”
SOCRadar Dark Web Team also detected the advertisement for an alleged Global PayPal Credential Dump 2025, claiming to contain more than 15.8 million email and password pairs in plaintext, with a reported dump size of 1.1 GB. The listing describes the dataset as including login emails, plaintext passwords, and associated PayPal-related URLs across multiple domains and countries.
The claim raises questions, as large credential dumps offered on underground forums are often compiled from multiple sources rather than originating from a single platform. The presence of plaintext passwords may indicate that the data was harvested through infostealer malware, phishing kits, or previous credential leaks repackaged as a PayPal-specific breach. Even if the dataset is not directly sourced from PayPal, it could still be used in credential stuffing, fraud attempts, and phishing campaigns against PayPal users worldwide.
Security Measures for PayPal Users:
Cybersecurity experts have not confirmed the full authenticity or extent of the dump, but industry sources and threat intelligence are monitoring related indicators.
“Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim” 🤔 https://t.co/xmDyRaFbhL
— Troy Hunt (@troyhunt) August 16, 2025
If confirmed, such a breach would pose severe risks where attackers can automate login attempts across PayPal and other web services, exploiting reused credentials.
The leak allows for targeted social engineering using real emails and password hints. This could lead to unauthorized transactions, banking fraud, and identity theft.
Immediate action for all PayPal account holders includes resetting passwords on PayPal (and associated accounts), especially if reused elsewhere.
Enable multi-factor authentication (MFA), monitor your account for suspicious activity, and be cautious of phishing attempts with compromised email addresses.
Security analysts urge the importance of strong password practices and multi-factor authentication (MFA) for financial and online services. Organizations should quickly update breach detection rules for related emails and URLs. Users must avoid reusing passwords for important accounts.
