SOCRADAR’S Dark Web Team reported a string of new underground posts this week, including alleged data listings tied to FNATH and AT&T, a claimed free leak involving Rapikom Venezuela, and credential-focused listings referencing Canva and Canadian leads. The posts claim a 6.5 million-record Canadian leads dataset is for sale at $3,500, with fields such as client names, phone numbers, mobile numbers, email addresses, and country values.
Canva accounts are alleged to number 155,807, described as a CSV with username, password, user_agent, date, last_login, country, and phone fields, while a Rapikom Venezuela dataset is described as containing records for 5,000 companies with contact details, plan information, payment references, a usr_clave password field, bank account information, and precise location data.
FNATH is said to have a database with 45,428 records in a file named fnath_clean.json, plus a 197GB archive, and AT&T is listed as 73,481,539 lines, with breakdowns of lines containing SSN and DOB. A new Windows bot rental offering is also advertised for $5,000 per month, boasting AV/EDR bypass and capabilities such as keylogging and reverse shell.
According to SOCRadar Dark Web Team, these posts illustrate the breadth of leaked data and illicit tooling circulating on dark web forums as the week closes on 9 March 2026.