[xpl0itrs]

[HEADING=2]

Nuvidio - KYC, biometrics, access creds, video agreements, private keys- 6.3GB 40k Files

[/HEADING]

[HEADING=2]

This is NOT a leak. The reason for the large number of files is due to how many different data types there are and how much there is, so we have provided samples for all we can. Samples upon request. Scroll to bottom for contact

[/HEADING]

this breach is huge, to start

• Production credentials for every major service (MongoDB, PostgreSQL, AWS IAM keys, Twilio, Redis, RabbitMQ, OpenSearch, Microsoft Cognitive Services, and 30+ more)
• 192 unique Brazilian citizens' identity documents (RG/CNH) with CPF numbers in filenames - these include scanned government IDs which display fingerprints, photos, full names, and addresses
• SSL and mTLS private keys including keys for Banco Pan mutual TLS integration
• ~3.1 GB of video call recordings from customers of multiple financial institutions (BMG Money, Banco Pan, Bradesco, Ailos, iCred, Plusoft, TeleHelp, VNS, Pipe, and a company called "3rn")
• ~417 MB of speaker diarization audio (customer voice biometric data)
• Complete AWS infrastructure topology via Terraform state, CloudFormation, AWS Config, CloudTrail
• Grafana backup with 7 employee accounts (names/emails), encrypted AWS CloudWatch credentials for prod+staging, and monitoring configuration for "perbank-cashapp" client
• 765 user-uploaded chat files (likely identity documents and contracts shared during video calls)

[HEADING=1]

Breakdowns:

[/HEADING]

Bank API impersonation

• 3 mTLS private keys with certificates
• 2 keys for Banco Pan (one valid through Dec 2026) - can authenticate to their internal API as this company
• 1 Cloudflare mTLS key - bypass their WAF/origin protection

[HEADING=1]

192 Brazilian citizen identity documents:

[/HEADING]

• High-res scans of RG (national ID) and CNH (driver license)
• All files named with the person's CPF number
• Fingerprints visible on the scans
• Multiple states: SP, BA, PI, PE, RN, others
• Perfect for KYC bypass, account opening, SIM swap

[HEADING=1]

3GB+ customer video recordings:

[/HEADING]

• Video calls from customers of BMG, Plusoft, TeleHelp, Ailos, iCred, VNS, Pipe, and others
• Faces, voices, financial conversations
• Video agreement/consent recordings (customers agreeing to financial terms on camera)
• 417MB of speaker diarization audio (voice biometric WAV files)
• Dates from 2021 to May 2025
• Samples:
• https://files.offshore.cat/api/file/2807...39f0b2770f
• https://files.offshore.cat/api/file/b5b2...f91eeca8dc
• https://files.offshore.cat/api/file/cabf...26fb2ad10b
• https://files.offshore.cat/api/file/dbdd...f468287758

[HEADING=1]

Deepfake bypass kit:

[/HEADING]

• XceptionNet model weights trained specifically for their deepfake detection (PyTorch, v1.3 + v1.4)
• 236MB training dataset
• Combined with the customer face recordings = you can train fakes and test against their exact detection model#

[HEADING=1]

Complete infrastructure map:

[/HEADING]

• Terraform state (all Lambda functions, API Gateway, SQS queues, IAM roles)
• CloudFormation templates (VPC, subnets, security groups, ECS clusters)
• 15k CloudTrail log files (2024-2026, every API call)
• 12k AWS Config snapshots (every resource change)
• VPC flow logs + ALB access logs
• Grafana backup with dashboards, 7 employee accounts, encrypted CloudWatch creds

765 user-uploaded chat files - documents customers shared during video verification (likely more IDs, contracts, proof of address)

Web app source - all frontend builds + source maps for reverse engineering

[HEADING=1]

mTLS certificates/private keys:

[/HEADING]

• 2 RSA private keys (both verified valid)
• Matching certificates issued by Banco PAN Internal Issuing CA and PANROOT-CA
• CA certificate chain
• The newer cert (CN=ca-prod-nuvidio, O=Banco Pan S.A.) expires December 2026
• These authenticate to Banco Pan's production API
• Samples:
• https://files.offshore.cat/api/file/1492...8112d71049
• https://files.offshore.cat/api/file/edae...ed4e678425

[HEADING=1]

Bonus: intelligence for further exploitation

[/HEADING]

• 15,485 CloudTrail log files showing every API call pattern
• 12,221 AWS Config snapshots showing every resource
• CloudFormation templates with VPC IDs, subnet IDs, security group IDs
• ECS cluster scaling schedules (you know exactly when services scale down at night = smaller attack surface monitoring)
• Full list of Lambda functions and their environment variables

Also included: full production AWS environment for the fintech itself

[HEADING=1]

Identity Docs (KYC)

[/HEADING]

- 192 unique individuals, 250 files total (some people have front+back)

- Document types: RG (Registro Geral) and CNH (Carteira Nacional de Habilitacao)

- Every file is named with the person's CPF: XXX.XXX.XXX-XX RG SP 2024.jpg

- States covered: Sao Paulo, Bahia, Piaui, Pernambuco, Rio Grande do Norte, more

- Years on documents range from 2013 to 2025

- HIGH RESOLUTION - fingerprints clearly visible on RG scans

- Photos clearly visible, full legal names, parents names, date of birth, address on CNH

Samples:

https://files.offshore.cat/api/file/a407...4d24f05031

https://files.offshore.cat/api/file/be1e...c44e8ecd5d

https://files.offshore.cat/api/file/a143...5f5ecaa5a2

https://files.offshore.cat/api/file/c54b...a9717a89b8

https://files.offshore.cat/api/file/50d4...3fbc9bbd16

https://files.offshore.cat/api/file/aedf...2e8d74d4ff

https://files.offshore.cat/api/file/9b7e...ec6a89efe5









List of Clients:

Banco Pan

• BMG Money
• BMG
• Bradesco
• Banco Mercantil
• Ailos
• iCred
• Plusoft
• TeleHelp
• VNS
• Pipe
• 3rn
• PerBank CashApp
• Claro
• C6 Bank
• Caixa
• Agibank
• Qualicorp
• Equatorial
• Sabemi
• Facta
• MyTech
• Grupo Mytec

ref

https://files.offshore.cat/api/file/878432e9-c6bb-401b-ba4f-db69820b3d0f

[HEADING=2]

Price: $12K

[/HEADING]
[HEADING=2]

Purchase

[/HEADING]
[HEADING=2]

Tox: 300B2D5FD09996D9DCFD714A3E7C0059EF70825AF78ED544880DC9990EBF9859B798CC8F2B03

[/HEADING]

Session: 05c8ae06e40a63cfd94d3307a3461ca668aa88bb18686083d6927e969249501075