CRPx0 Escalates Extortion Tactics by Selling Stolen Data After Deadlines Expire

The threat actor CRPx0 previously used a tactic of offering free OnlyFans accounts to lure victims into deploying its malware. Since August 7, 2026, CRPx0 launched a leak site on both the clearnet and dark web, listing 47 victims that failed to pay its extortion demands. The group has now escalated by putting the stolen data up for sale after the victims’ payment deadlines expired. No specific malware strain, technical indicators, or CVE IDs were mentioned in the report. The impacted sectors include organizations whose data was exfiltrated and publicly exposed.