ThreatPaper

#infostealer

4 cases

TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breach

A threat actor advertised ~800,000 TCS employee-directory records from a wider Azure/Entra data-theft campaign; TCS told Indian exchanges on 10 August 2026 it found no credible evidence of a breach.

Data BreachDarknet & Illicit Markets
Revolut breach: a compromised Italian government mailbox, crypto de-anonymisation trick, and two disowned ransom demands

Revolut answered a fraudulent Italian government data request and disclosed ~680 customers' KYC files and Bitcoin histories. A threat-intel firm disputes the attacker's own six-month RAT story; independent researchers found the real targeting method, an unresolved second compromised mailbox

Data BreachSocial Engineering
RedLine Infostealer Malware-as-a-Service Operation and Operation Magnus Takedown

The transition of the global cyber threat landscape from traditional network intrusions to decentralized, identity-centric attacks is exemplified by the RedLine infostealer. First identified in March...

Social EngineeringIdentity TheftMalware
Snowflake Data Theft Campaign (UNC5537): Mass Credential Stuffing Across 165+ Organizations

A financially motivated threat actor (UNC5537) compromised Snowflake customer instances across 165+ organizations by credential stuffing against accounts lacking MFA, exfiltrating terabytes of sensitive data, and conducting mass extortion — the largest cloud data warehouse compromise to date.

Data BreachExtortion & Blackmail