Skip to content
brandefense.io
Request A Demo
CybercrimeFinancialIndividual operator

cobraEgyLeaks

cobraEgyLeaks is a cybercrime syndicate with a financial motive, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

About cobraEgyLeaks.

cobraEgyLeaks is a low-sophistication individual / small-team threat actor active on dark-web forums and Telegram channels since late 2024-early 2025, focused on the bulk sale and free leaking of credential combolists and personal-data dumps. Reported activity includes the January 2025 release of approximately 156,000 Mexican email/password combinations affecting government (.gob.mx), educational, and corporate accounts, and a separate leak of around 205,000 Dutch accounts. The actor is described in regional reporting as operating from the Middle East / North Africa region with an 'MVP User' reputation on its primary forum. Data is sourced from infostealer logs and prior breaches rather than original intrusions; sophistication and operational security are low.

Last updated Jun 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.