Two active campaigns affect no single vendor product but create broad cross-organizational credential risk. The LeakBase takedown (SCC-CAM-2026-0102) dismantled a 142,000-member credential marketplace; organizations should immediately audit credential exposure via HIBP and identity monitoring services, force resets on exposed accounts, and validate MFA coverage across all externally accessible services. Torg Grabber (SCC-CAM-2026-0103) is a rapidly iterating infostealer using ClickFix clipboard-hijacking to bypass Chrome App-Bound Encryption and harvest credentials from 728 crypto wallet extensions, 103 password managers, and 2FA tools — behavioral detection via PowerShell script block logging and EDR clipboard-to-execution chain correlation is the primary defensive posture given the absence of confirmed public IOCs.