71 Million Unique Emails Found in Naz.api Cybercrime Dump

The appearance of Naz.api – a massive collection of online credentials harvested by information-stealing malware that contains 71 million unique email addresses – illustrates the scale at which such data is being collected, shared and sold, security experts warn.

See Also: OnDemand | Integrating Splunk and Panther for Real-Time Alerting and Custom Dashboarding

Australian developer Troy Hunt, who runs the free Have I Been Pwned breach notification service, on Thursday reported adding those 71 million email addresses to the service after receiving a copy of the so-called Naz.api data collection.

“Here’s the back story: this week I was contacted by a well-known tech company that had received a bug bounty submission based on a credential stuffing list posted to a popular hacking forum,” Hunt wrote in a Thursday blog post.

Any email owner can register their email addresses with Have I Been Pwned to be alerted whenever that email appears in a leak or data dump alongside a password. The risk is that an attacker will reuse the exposed email and password combination to log into the victim’s accounts at online sites and services, in what’s known as a credential stuffing attack.

Hunt said the Naz.api data he received comprises 319 files totaling 104 gigabytes in size and containing 71 million unique email addresses, which affect more than 427,000 registered Have I Been Pwned subscribers.

A copy of the Naz.api data supposedly appeared online in a Sept. 20, 2023, post to BreachForums with the subject line “Full Naz.api dataset” by forum user 0x64. “This database was created by extracting data from stealer logs,” 0x64 wrote. “It contains data about saved logins and passwords in users’ browsers. It contains 1B+ unique records.”

On Nov. 2, BreachForums removed that post, saying “this was originally on uploads.xkey.info but was taken down because it is supposedly not the real naz.api lol.”

Regardless, the actual collection of stolen data may have been assembled by a cybercriminal who uses the handle “Naz.” For ease of use, the data could likely be queried by others via a public-facing API, which appears to be how someone apparently grabbed a full copy of everything being stored, tweeted Dmitry Smilyanets, a security researcher at threat intelligence firm Recorded Future.

Leaked Data Collections Abound

Many collections of stolen or leaked credential information have scant value. Email and password combination lists compiled from breached data and circulated via cybercrime forums are often just repackaged from previously leaked sets of data, meaning the data has long been in circulation.

By contrast, Hunt said, he found only 65% of the unique email addresses in the Naz.api leak had already been in Have I Been Pwned.

“That last number was the real kicker; when a third of the email addresses have never been seen before, that’s statistically significant,” he said. “This isn’t just the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing; it’s a significant volume of new data.”

That freshness appears to be the result of the data being gathered via information-stealing malware.

Hunt said the data contained in Naz.api may trace to it being hosted by the Illicit Services – search.illicit.services – website, run by an anonymous developer who uses the handle “Miyako Yakota” and who described the service as an open-source intelligence tool for researchers. The site enables the searching of leaked data, including the Naz.api data collection, as well as data obtained from an old BreachForums content delivery network server.

In July, Yakota announced via the Illicit Services’ Telegram channel that it was shutting the site down due to it being illicitly used – ironically – by bad actors, including the “doxing and SIM-swapping community,” HackRead reported. On Thursday, chatter on the Hacker News forums suggested the site had been relaunched under the name 0t.rocks. A forum user with the handle “miyakoyako” responded: “0t is a collection of many leaks not just Naz.api.”

Focusing just on the Naz.api data, Recorded Future’s Smilyanets described it as being “significant” but said the collection “lost most of its value with time and after the cookies were parsed out.”

Many types of information-stealing malware target cryptocurrency wallet information, so attackers can steal people’s crypto as well as their chat and web browser data. Cybersecurity firm Trend Micro described the latter as being “a treasure trove of sensitive information, including authentication cookies, stored credit cards, credentials, passwords and navigation history” (see: Info-Stealing Malware Now Includes Google Session Hijacking).

Naz is just one of hundreds of cybercriminals who works with or shares such data, and the high volume of credentials and other useful information being stolen by info stealers appears to remain steady, Smilyanets said. “In reality, info stealers compromise more than 10 million credentials per day which are super fresh, super actionable and can enable criminal actors to bypass MFA” by using “cookies and additional metadata” contained in the browser data, he said.

Repeat Recommendation: Password Managers

Hunt said there’ is no risk to users whose information is contained in the Naz.api leak, provided they’re already using a password manager to generate and store unique, reasonably complex passwords for every different site or service they use and always activate two-factor authentication whenever available.

Of course, “password reuse remain rampant,” he said.

Not just individuals but any site for which users have reused their password also is at risk from credential stuffing. When an attacker breaches a user’s account in this manner, the business often gets the blame, which has led many organizations to tighten their reviews of leaked data and alert users if their password appears elsewhere. Many also use Have I Been Pwned’s open-source Pwned Passwords service to help users pick passwords that have never appeared in a data dump.

Sometimes, attackers can use credential stuffing to access more than just the account of someone who reused their password. Last October, genetics testing firm 23andMe reported that about 140,000 of its users had fallen victim to credential stuffing. After gaining access to those accounts, an attacker successfully scraped profile information for half of the site’s 14 million users, which they then offered for sale (see: 23andMe Says Hackers Stole Ancestry Data of 6.9M Users).