Hudson Rock Says Infostealer Credentials Likely Enabled AFA Breach
Summary
Hudson Rock says an infostealer infection on an AFA developer’s computer likely exposed administrative credentials later used to access databases and send emails from AFA systems. Its analysis cites telemetry, recovered logs and leaked samples.
Key points
- Hudson Rock says its telemetry detected an infostealer infection on September 8, 2025, and added the compromised machine to its database the next day.
- Researchers linked the machine to a person identified through public social accounts as an AFA software developer; the article describes this link and the infection’s role as likely.
- Recovered logs reportedly contained saved administrative credentials for phpMyAdmin panels, potentially enabling database access at afa05-new[.]afa[.]org[.]ar and acreditaciones[.]afa[.]com[.]ar.
- The logs reportedly included credentials for other AFA portals, and the investigation found a weak, guessable password reused across several systems.
- A database sample attributed to the threat actor reportedly contained staff, club and media-partner records, including contact details, user roles and password data; some passwords were reportedly in plaintext.
- The article says the actor reportedly posted a database sample, offered AFA subdomain access for sale, and likely used credentials for afasistemas[.]com[.]ar to send mass emails from legitimate AFA servers.
- Hudson Rock argues that monitoring for exposed employee credentials could have enabled password resets before the credentials were used; the article does not present independent confirmation of every incident detail.
Article Details
- Attack Vectors
- An infostealer infection on an AFA developer’s computer exposed credentials saved in the browser.
- The attacker reportedly used the stolen credentials for administrative access to phpMyAdmin and other AFA systems, then exported database records.
- Compromised access to afasistemas.com.ar was reportedly used to send mass emails from legitimate AFA servers.
- Defensive Notes
- Monitor threat-intelligence feeds for compromised employee credentials.
- Force password resets when employee credentials are identified as compromised.
MITRE ATT&CK
T1078 · Valid AccountsThe attacker reportedly used stolen credentials to access phpMyAdmin and other AFA systems as an administrator.T1213 · Data from Information RepositoriesThe attacker reportedly accessed AFA databases and exported records, including staff, club, and media-partner data.T1555.003 · Credentials from Web BrowsersThe infostealer recovered credentials saved in the developer’s browser.