qoo10.sg Domain Breach Exposure Report

The domain qoo10.sg experienced a significant number of events, with over 50,000 total occurrences. The vast majority of these events, approximately 91.4%, are classified as historical data breaches, while 8.6% are active infostealer logs. A substantial portion of the data breaches, 46,399 events, originated from "Combolist sources," indicating a high likelihood of credential stuffing attacks. The timeline shows a notable increase in employee-related events starting in January 2026, with 120 occurrences, and continuing through March and April 2026. Malware families associated with these events include LummaC2, Redline, and Rhadamanthys, all known for their credential-stealing capabilities. The targeted services are primarily login pages for qoo10.sg, suggesting direct attacks on user authentication mechanisms. The primary geography of affected users is Singapore, followed by South Korea and Malaysia. Given the high volume of historical data breaches linked to credential stuffing and the recent surge in employee-related events coinciding with active infostealer activity, this exposure presents a critical risk. The prevalence of LummaC2, Redline, and Rhadamanthys malware indicates a sophisticated threat actor targeting user credentials. Remediation efforts should focus on immediate credential reset campaigns for all affected users, enhanced monitoring of login activity for suspicious patterns, and a review of authentication security controls to prevent future credential stuffing and infostealer compromises. The primary focus should be on protecting client data and employee accounts from further unauthorized access.