BRIEFLeakhighP55
3.9M stealer logs (LUPIN ULP) offered worldwide
Detected5 October 2026 · 06:55 UTC
A VIP-sourced leak of about 3.9 million stealer (ULP) logs is being distributed worldwide, dated 2026-10-05. Although it is not region-specific, this is a fresh, large credential dump that defenders should ingest for password-reuse and account-takeover detection.
CategoryLeak
Severityhigh
Priority score55
Detected5 October 2026 · 06:55 UTC
Leak● 40
Combolist masiva de 656 millones de credenciales USA/FR/DE/UK a la ventaA seller is offering a 656-million-line email:password combolist covering US, French, German and UK accounts, replicated across multiple forums. It is a generic credential-stuffing corpus rather than a targeted breach of a named org, but its scale fuels widespread account-takeover campaigns. Defenders should confirm breach-password blocking and credential-stuffing controls are active.Leak● 74
Venta de base de datos de la universidad UNINTER (7,34TB)Threat actors are selling a 7.34TB dataset from UNINTER, a large Brazilian distance-learning university. This is a high-volume exposure of student and staff personal data and documents from a Latin American education provider, with significant fraud, phishing and LGPD regulatory impact.Leak● 30
Filtración de datos de adulttoys.com.br en BrasilA seller is offering a 22K-record database from adulttoys.com.br, a Brazilian adult-products retailer. The volume is modest, but it is a fresh early-October leak of a real Latin American e-commerce site, useful for fraud and credential-stuffing monitoring.Leak● 48
Base de datos de 32baar.com (India) a la ventaA threat actor is selling a database attributed to the Indian site 32baar.com, consisting of ~1.8GB of documents plus a 430K-row CSV. It is not Latin American, but the scale and the sale of a real company's records make it relevant for brand monitoring and credential-reuse tracking.Leak● 52
Base de datos de una empresa nicaragüense a la ventaA threat actor posted a Nicaraguan company's database on DarkForums just minutes ago, offering it for distribution or sale. The specific company, sector and record volume are not yet disclosed, so exposure of credentials or personal data cannot be ruled out. It matters because fresh LATAM corporate data feeds credential stuffing, fraud and extortion, and Central American defenders should verify whether their data is included.Leak● 55
Filtración masiva de base de datos de 60 millones de ciudadanos egipciosA database reportedly holding around 60 million records of Egyptian citizens is being advertised as a fresh leak on DarkForums. At this scale the data can fuel identity fraud, SIM-swap, phishing and account-takeover campaigns, and such dumps are typically mirrored across multiple forums within hours. Egyptian and regional defenders should watch for credential and PII reuse against public and private services.