Malware log
CastleRAT
179 745 addresses collected by malware, in a log dated 2026-11-12: not accounts taken from a breached service.
Breached2026-11-12Added to HIBP2026-11-13 UTCUpdated by HIBP2026-11-13 UTCAddresses179 745Domain—
VerifiedMalware
What happened in Have I Been Pwned’s words
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers. The passwords are now searchable via Pwned Passwords.
Exposed data as HIBP classifies it
- Email addresses
- Passwords
How HIBP qualifies it
- HIBP verified that the data came from this service.
- Collected by malware rather than taken from the service.
HIBP names no domain for this breach.
Source: Have I Been Pwned (CC BY 4.0)
Copied from HIBP 2026-11-14 03:50 UTC