Darknet Listings Expose Credentials and Accounts for E-Learning Services
Summary
DarkOwl found exposed credentials and account-sale listings for five e-learning services. Its data included plaintext passwords and stealer logs, though the article says the findings do not establish the value or validity of every account.
Key points
- DarkOwl’s indexed data included 2,058 Coursera email addresses, 811 unique addresses, and nine associated with plaintext passwords; the article says the data may result from a breach.
- The analysis found 18 plaintext passwords among 202 unique Skillshare email addresses, which DarkOwl said could pose a risk to corporate networks.
- Listings offered Skillshare credentials harvested by Redline stealer; the article cautions that the value of the accounts was not guaranteed.
- DarkOwl found more than 1,000 unique email addresses and nearly as many plaintext passwords associated with LinkedIn, alongside offers for premium accounts.
- Udacity results included more than 700 unique email addresses but only one plaintext password; Telegram posts also shared account credentials.
- The article describes Codecademy credential-checking tools that could test login combinations and identify account types.
Article Details
- Publisher
- DarkOwl
- Report Period
- March 21, 2023
- Scope
- Dark web exposure of credentials and illicit account offers associated with Coursera, Skillshare, LinkedIn Learning, Udacity, and Codecademy.
- Key Statistics
- Coursera: 2,058 email addresses indexed, including 811 unique addresses; 9 were associated with plaintext passwords.
- Skillshare: 202 unique email addresses detected; 18 included plaintext passwords.
- LinkedIn: over 1,000 unique email addresses and nearly as many plaintext passwords were reported; exact counts were not provided.
- Udacity: over 700 unique email addresses detected; 1 was associated with a plaintext password.
- Codecademy: 508 email addresses indexed, including 167 unique addresses; 8 were associated with plaintext passwords.
Malware
Products
CodecademyThere were numerous advertisements on Tor that advertised a variety of Codecademy accounts and hacking tools that could help exploit them.CourseraDarkOwl Vision has indexed a high quantity of email addresses with the domain coursera.org in recent years – likely as the result of a data breach.DarkOwl Visionof several popular companies in this industry using our industry leading darknet data platform, DarkOwl Vision.LinkedIn LearningIn the example below, a recent result from Telegram advertises to have a variety of premium LinkedIn accounts for sale, including LinkedIn Learning premium.SkillshareWhile Skillshare has a relatively smaller darknet footprint to Coursera by way of quantity, their results in DarkOwl Vision return a higher number of passwords associated with leaked emails with a Skillshare domain.UdacitySearch results for udacity.com email domain mentions in DarkOwl Vision returned over 700 unique email addresses, which is considerably more than its peers.