Loading story…
Unknown attackers accessed payment accounts used by the Russian fundraising initiatives Davayte and You Are Not Alone through a shared Stripe-to-WooCommerce integration used for online auctions. The mid-August intrusions exposed some donor email addresses and, for certain donors, payment-card last four digits and issuing-bank information; organizers said full card numbers, cardholder names, donation details, and evidence of fraudulent transactions were not identified.
Davayte supports Ukrainian civilians affected by Russia’s invasion, while You Are Not Alone aids Russian political prisoners and their families. Stripe reportedly stopped the unauthorized access before complete donor-email databases could be downloaded, but the exposed identities create heightened danger because Russian authorities designate the organizations behind the projects as “undesirable,” potentially putting donors at risk of prosecution. The activity remains unattributed, although You Are Not Alone said involvement by Russian security services cannot be excluded.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Unknown attackers accessed payment accounts used by Davayte and You Are Not Alone through their Stripe-WooCommerce integrations, which had been used for online auctions. The attackers obtained some donor email addresses and, in some cases, card last four digits and issuing-bank information.
A threat actor using the alias Satanic posted an alleged archive containing data from 669 Stripe merchants and more than 1,000 access keys on a cybercrime forum. No confirmed connection was established between this archive and the fundraising-project breaches.
Independent Russian media organizations, including Meduza and TV Rain, launched Davayte to raise funds for Ukrainian civilians affected by Russia's invasion.
Independent Russian media and opposition groups began organizing the You Are Not Alone initiative to support Russian political prisoners and their families.
Davayte and You Are Not Alone disclosed the incidents; Stripe reportedly blocked access before complete donor-email databases were downloaded and found no evidence of fraudulent transactions. Davayte disabled third-party integrations, rotated access keys, and notified a European data-protection authority, while You Are Not Alone investigated possible attribution and issued donor-travel and payment-safety advice.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Christian crowdfunding platform **GiveSendGo** suffered a breach that exposed donor information tied to the Canadian **Freedom Convoy 2022** fundraiser and related campaigns. Reporting said attackers took the site offline, redirected visitors to **GiveSendGone.wtf**, and leaked data on more than **92,000 donors**, including names and other personal details. VICE identified Aubrey Cottle, also known as **Kirtaner**, as publicly claiming responsibility for the intrusion, saying he targeted the platform over concerns about foreign political influence in convoy fundraising; reporting also said many donors were based in the United States, while Canadian donors contributed a larger share of the money. A subsequent leak reportedly expanded the exposure to roughly **5 GB** of internal data, including a **2.5 GB MySQL database dump**, **Bitbucket** source code, customer service records, and limited payment-card information such as card last-four digits and expiration dates. The disclosures intensified scrutiny of GiveSendGo’s security after earlier reports of exposed identity documents on its servers, an unresolved researcher warning dating back to 2018, and a separate 2021 donor-data leak linked to fundraising for people involved in the January 6 Capitol riot. GiveSendGo CEO Jacob Wells condemned the breach as illegal and said law enforcement was expected to investigate, while Cottle said he received death threats after claiming involvement.
Jun 29, 2026
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
A sophisticated spearphishing campaign, identified as PhantomCaptcha, targeted key organizations involved in Ukraine's war relief efforts, including the International Committee of the Red Cross (ICRC), UNICEF, the Norwegian Refugee Council, and various Ukrainian regional government administrations. The attackers impersonated the Ukrainian President’s Office, sending emails with weaponized PDF attachments designed to lure recipients into clicking malicious links. These links led to a fake Cloudflare captcha page, which was actually a 'ClickFix'-style decoy, ultimately delivering a multi-stage WebSocket-based remote access trojan (RAT). The infrastructure supporting this campaign was hosted on Russian-owned servers and was only active for a single day, indicating a high level of operational security and planning, with evidence suggesting at least six months of preparation. The campaign’s technical sophistication included the use of a convincing eight-page document and a redirection to a domain masquerading as a legitimate Zoom website, further enhancing the credibility of the phishing attempt. Once the RAT was deployed, it enabled the attackers to execute arbitrary remote commands, exfiltrate sensitive data, and potentially deploy additional malware on compromised systems. Investigators also discovered a mobile attack vector, with fake Android applications designed to harvest geolocation data, contacts, media files, and other sensitive information from targeted devices. The selection of targets suggests the attackers were seeking intelligence on humanitarian operations, reconstruction planning, and international coordination related to Ukraine. Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions were specifically named among the targets. The campaign’s rapid disappearance after a single day of activity points to a deliberate effort to avoid detection and forensic analysis. SentinelLabs, in collaboration with the Digital Security Lab of Ukraine, led the investigation and public disclosure of the campaign. The use of Russian infrastructure and the focus on Ukrainian and international relief organizations suggest a possible geopolitical motivation, though attribution remains unconfirmed. The attack chain was designed to bypass traditional security controls by exploiting trust in official communications and leveraging multi-stage payload delivery. The campaign highlights the ongoing threat to humanitarian and governmental organizations operating in conflict zones, particularly those involved in Ukraine. Security researchers emphasize the need for heightened vigilance and advanced detection capabilities to counter such highly targeted and transient threats. The incident underscores the importance of cross-organizational intelligence sharing and rapid response to emerging spearphishing campaigns. Organizations are advised to review their email security protocols, educate staff on phishing risks, and monitor for indicators of compromise associated with the PhantomCaptcha infrastructure.
Jun 29, 2026