What we're seeing
- Sellers on BreachForums clones list “corporate dossiers” with HRIS exports, payroll data, and internal chat archives.
- Credential harvesting stems from MFA fatigue and browser token theft via info-stealer malware.
- Listings bundle verified recruiter inboxes that accelerate social engineering of executives and finance staff.
Impact assessment
Exposure of HR platforms gives adversaries the ability to map workforce hierarchies, identify privileged users, and source pretext material. Boutique brokers differentiate by curating records for high-value industries, making this trend a cross-over between insider recruitment and business email compromise operations.