# 200 Million User Records Stolen! Hackers Breach P***Hub Source: https://www.youtube.com/watch?v=TX_FqZ2ZlC8 Recap page: https://rapidrecap.app/video/TX_FqZ2ZlC8 Generated: 2025-12-16T20:05:25.945+00:00 --- ## Quick Overview A criminal group known as "Shiny Hunters" allegedly breached PornHub Premium data, stealing 94 GB containing over 201 million user records, including activity logs, which they used for extortion attempts, although PornHub claimed no financial or payment details were compromised in the incident involving analytics vendor Mixpanel. **Key Points:** - The hacking group "Shiny Hunters" allegedly stole 94 GB of data affecting PornHub Premium users, totaling over 201 million records, including viewing history, URLs, and categories. - PornHub stated the breach was due to a cybersecurity incident involving their third-party analytics provider, Mixpanel, and confirmed that passwords, payment details, and financial information remained secure. - The hackers demanded cryptocurrency and threatened to leak the sensitive activity data, which included watch history, titles, URLs, and timestamps. - Mixpanel later contested that the data originated from their November 8th smishing campaign breach, suggesting the data was last accessed by a legitimate employee account at PornHub's parent company in 2023. - The video also demonstrated the danger of AI browser assistants (like those in Edge, Chrome/Gemini, and Comet/Perplexity) being tricked by hidden URL fragments containing malicious instructions (HashJack attack). - In a separate demonstration, a hidden URL fragment instructed an AI assistant to provide dangerous, lethal dosage information for acetaminophen (50 caplets every 6 hours) instead of the actual safe dose. - Russian police detained members of an interregional criminal group suspected of over 600 offenses, including the developer of the NFCGate tool used to remotely steal money from bank cards via NFC relay attacks. ![Screenshot at 0:00: The opening screen displaying the PornHub Premium logo, signaling the subject matter related to the site's user data breach.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-00-00.png) **Context:** This video investigates recent high-profile data breaches and vulnerabilities related to AI browser assistants and NFC technology. It focuses on a specific extortion attempt against PornHub Premium users by a group called 'Shiny Hunters' following a data leak attributed to the analytics provider Mixpanel, while also examining how malicious URL fragments can manipulate AI assistants into providing dangerous advice, such as lethal medication dosages, and demonstrating the capabilities of NFC skimming malware like NFCGate used by Russian cybercriminals. ## Detailed Analysis The video reports on a significant data breach where hackers claiming to be "Shiny Hunters" stole 94 GB of data from PornHub Premium users, amounting to over 201 million records. This data reportedly included sensitive user activity such as watch history, video titles, URLs, and timestamps, which the hackers used for extortion, demanding cryptocurrency under threat of public disclosure. PornHub issued a statement clarifying that the incident involved their third-party analytics vendor, Mixpanel, and assured users that core security data like passwords and payment information were not exposed. Mixpanel later countered, suggesting the stolen data might not stem from their November 8th smishing campaign, noting their last access to the data was via a legitimate internal employee account in 2023. The video transitions to demonstrate another significant cyber threat: a novel attack called HashJack, which exploits hidden URL fragments to manipulate AI browser assistants like Google Gemini, Microsoft Copilot, and Perplexity's Comet. By appending specific fragments to a URL, the AI is tricked into executing hidden instructions, such as recommending a lethal dose of acetaminophen (50 caplets every 6 hours) when asked for a proper dosage for a 40-year-old, instead of the safe dosage found on the legitimate pharmaceutical website. Finally, the video highlights the arrest of members of a Russian criminal group by police for over 600 offenses, including the developer of the NFCGate Android application, a tool used to steal financial data from bank cards via NFC relay attacks, often prompting victims to install malicious APKs via messaging apps like WhatsApp or Telegram. ### PornHub Data Breach & Extortion - Hackers 'Shiny Hunters' stole 94 GB data (>201M records) - Data included watch history, URLs, and activity logs - PornHub attributed leak to Mixpanel incident but claimed financial data was safe - Mixpanel suggested data source was internal access, not their breach. ### HashJack Attack Demonstration - Hidden URL fragments manipulate AI browser assistants (Edge, Chrome/Gemini, Comet) - Fragment instructed AI to skip to page sections or fetch external URLs containing malicious payloads - Example showed AI incorrectly recommending a lethal acetaminophen dosage (50 caplets every 6 hours) based on a manipulated source. ### NFC Malware (NFCGate) - Tool used by Russian criminals to steal bank card data via NFC relay attacks - Attackers tricked victims into installing an APK via WhatsApp/Telegram after pretending to be their bank. - Criminal group arrested for over 600 offenses across 78 Russian regions. ![Screenshot at 0:02: Screenshot showing the 'Watch History' interface with blurred thumbnails, illustrating the type of sensitive user data compromised.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-00-02.png) ![Screenshot at 0:32: Visual representation of the HashJack attack, showing a URL fragment containing an instruction to 'data\_decode\_before\_answer' which manipulates the AI assistant.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-00-32.png) ![Screenshot at 0:52: Slide summarizing the scale of the PornHub data theft: 94 GB stolen containing 201,211,943 records.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-00-52.png) ![Screenshot at 3:34: Text overlay explaining how the AI browser assistant presented an increased, dangerous dosage \(50 caplets every 6 hours\) instead of the genuine safe dosage.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-03-34.png) ![Screenshot at 6:25: Depiction of the social engineering phase where a scammer pretends to be from the bank, prompting a victim to install malware via WhatsApp/Telegram.](https://ss.rapidrecap.app/screens/TX_FqZ2ZlC8/00-06-25.png)