{"success":true,"data":{"id":"fake-dark-web-monitoring-credential-phish","label":"Fake dark-web credential monitoring phishing — claims the victim's passwords were found on the dark web or RaidForums, creates urgency to \"upgrade\" or \"remove\" data, and harvests credentials or payment info at a non-legitimate monitoring-service domain. ITRC 2026; Proofpoint identity-theft-lure campaign 2026.","description":"Phishing emails claiming the victim's passwords were found on the dark web or breach forums, creating urgency to \"upgrade\" a protection service or \"remove\" leaked data via a non-legitimate monitoring service, harvesting credentials or payment info. Three-part detection: (1) dark web / darkweb / breach forum / passwords-for-sale language, (2) upgrade-to-protect / free-trial-expiring / premium-plan upsell, (3) sender NOT on known legitimate monitoring domain (Aura, DeleteMe, Incogni, NordVPN, Experian), no In-Reply-To. ITRC 2026; Proofpoint identity-theft-lure campaign 2026.","tier":"danger","category":"phishing","isThin":false}}