Stolen credentials · Dark web · first seen 9 Oct
CriticalLikelyOpenTunde Martinsfix by 16 Oct, 2 days late
Fix by 16 Oct · with Tunde
Tunde's own logins: someone else should reset them and end the session.
One problem in one place, found by dark web.
1 source · 1 place
Dark web
A Telegram channel that gives away stealer logs to advertise its paid feed
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
7th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
76 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The post · a telegram channel that gives away stealer logs to advertise its paid feed · Fri 9 Oct, 04:20
Open its dark web caseLumma · DESKTOP-7QK2M · Windows 10 Home · Abuja, NG Infected: 2026-10-06 22:41 · Browser: Firefox login.microsoftonline.com tunde@tessellatepay.com Ab••••••••24 vpn.tessellatepay.com tmartins Ab••••••••24 app.tessellatepay.com cookie sa_session (Admin) expires 2026-10-21 … 38 more, personal
Why it matters here
Stealer logs are where most broken-into companies start now: no exploit, just a login that works. The dashboard cookie skips the password and the sign-in code entirely, and it works until 21 Oct. The VPN login in this log is very likely what's being sold.
How sure we are
The work address and the VPN username follow your directory's format, and the cookie is for your own dashboard.
What to do
What happened, and what was said
1 event · 0 comments · oldest first