BRIEFLeakhighP55
1M URL:LOG:PASS stealer-log credentials leaked
Detected15 September 2026 · 13:12 UTC
A fresh private dump of roughly 1 million URL:LOG:PASS stealer-log entries has been published, aggregated from infostealer infections. The set is large and current, so it enables credential-stuffing and session hijacking against enterprise and consumer services. Security teams should hunt for exposed credentials in their domains and force resets where matches appear.
CategoryLeak
Severityhigh
Priority score55
Detected15 September 2026 · 13:12 UTC
Leak● 30
Base de 1,8 millones de ciudadanos mexicanos de 2023 a la ventaThe DarkForums thread 'Mexican Citizen Database 1.8 Millions 2023' advertises a large Mexican citizen PII set, but the dataset is explicitly dated 2023 and appears reposted today rather than freshly breached. Names, addresses and identifiers of this size are valuable for identity fraud and voter- or benefit-related scams, yet prior circulation and staleness reduce its operational weight. Treat it as background context for Mexican data exposure, not as a new incident alert.Leak● 44
Filtración de 689.000 registros de PajEmploi (urssaf.fr)A DarkForums post advertises 689k records tied to PajEmploi and urssaf.fr, the French public bodies that handle payroll declarations and social contributions. Such records typically carry identifiers, employer details and salary information, which are prime material for tax fraud, business-email compromise and convincing phishing against employers and workers. The volume and public-sector nature justify tracking the dataset and comparing it with known URSSAF-related incidents.Leak● 47
Venta de 20 GB de DNI, pasaportes y documentación robadaA DarkForums seller is offering roughly 20 GB of 'DNI's, passports and stolen documentation', a bulk identity-document trove rather than a single-victim breach. The post does not state issuing countries, but the Spanish-language term 'DNI' suggests Latin American sources among the material. Such collections enable account-opening fraud, KYC bypass and impersonation, so banks and identity-verification teams in the region should expect document-forgery attempts.Leak● 55
Volcado de base de datos de Binance 2026 difundido en DarkForumsA DarkForums user posted a 'Binance DB dump 2026 – latest archive', claiming a fresh export of exchange data dated today. Binance has suffered multiple scrapes and resold datasets, so authenticity and freshness are unproven, but genuine records (emails, KYC fragments, balance hints) feed phishing, SIM-swap and account-takeover campaigns against crypto holders. Analysts should hash the file and compare it with previously circulating Binance samples before issuing a customer alert.Leak● 60
Filtración de facturas del IMOVEQROO, Quintana Roo (México)The DarkForums thread 'Facturas del Instituto de Movilidad del Estado de Quintana Roo (IMOVEQROO)' shares what appear to be invoice records from this Mexican state mobility agency, posted by a newly registered account. Invoices usually carry taxpayer IDs, names, amounts and banking or address data of government suppliers and of citizens paying mobility fees, enabling invoice fraud, payment redirection and targeted phishing against the agency and its providers. Even a limited set from a state body merits verification of the source system and notification of affected suppliers.Leak● 82
Filtración de bases de datos y documentos de la policía mexicanaA DarkForums post published on 30 October 2026 offers 'Mexican police' databases and documents as a package, without naming the specific corporation or agency. If authentic, such material exposes officer rosters, identities and investigation records, creating extortion and physical-risk scenarios for personnel — a recurring problem for Mexican security forces. Confirming the source agency, format and record count should be the priority before any external communication.