InfoSecBulletin Cybersecurity for mankind
A threat actor named “Chucky_BF” has advertised on a cybercrime forum that they are selling a “Global PayPal Credential Dump 2025” with over 15.8 million email and plaintext password pairs.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
The 1.16GB dataset in plain text reportedly contains sensitive credentials from PayPal accounts worldwide, indicating a significant breach.
According to Hackmanac’s post on X, the leaked credentials reportedly contain:
Login Emails: Common domains such as @gmail.com, @yahoo.com, @hotmail.com as well as TLD-specific and country-centric addresses.
Plaintext Passwords: Both unique and frequently reused strings, many exhibiting strong complexity, raising concerns about password reuse across platforms.
Associated URLs: Direct PayPal endpoints, including URIs for /signin, /signup, /connect, and Android mobile APIs.
Variants: Credentials embedded in regular PayPal links, country-specific domain formats, and mobile integrations.
The threat actor mentions a leak date of May 6, 2025, and claims the dump is useful for phishing campaigns and security testing by malicious parties.
TroyHunt added that “Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim.”
SOCRadar Dark Web Team also detected the advertisement for an alleged Global PayPal Credential Dump 2025, claiming to contain more than 15.8 million email and password pairs in plaintext, with a reported dump size of 1.1 GB. The listing describes the dataset as including login emails, plaintext passwords, and associated PayPal-related URLs across multiple domains and countries.
The claim raises questions, as large credential dumps offered on underground forums are often compiled from multiple sources rather than originating from a single platform. The presence of plaintext passwords may indicate that the data was harvested through infostealer malware, phishing kits, or previous credential leaks repackaged as a PayPal-specific breach. Even if the dataset is not directly sourced from PayPal, it could still be used in credential stuffing, fraud attempts, and phishing campaigns against PayPal users worldwide.
Security Measures for PayPal Users:
Cybersecurity experts have not confirmed the full authenticity or extent of the dump, but industry sources and threat intelligence are monitoring related indicators.
“Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (info stealer, credential stuffing) or there’s another explanation for this claim” 🤔 https://t.co/xmDyRaFbhL
— Troy Hunt (@troyhunt) August 16, 2025
If confirmed, such a breach would pose severe risks where attackers can automate login attempts across PayPal and other web services, exploiting reused credentials.
The leak allows for targeted social engineering using real emails and password hints. This could lead to unauthorized transactions, banking fraud, and identity theft.
Immediate action for all PayPal account holders includes resetting passwords on PayPal (and associated accounts), especially if reused elsewhere.
Enable multi-factor authentication (MFA), monitor your account for suspicious activity, and be cautious of phishing attempts with compromised email addresses.
Security analysts urge the importance of strong password practices and multi-factor authentication (MFA) for financial and online services. Organizations should quickly update breach detection rules for related emails and URLs. Users must avoid reusing passwords for important accounts.
