Dark Web Informer :verified_paw:

Website: https://darkwebinformer.com

Website Pricing (Crypto payments are fully automated): https://darkwebinformer.com/pricing

Socials: https://darkwebinformer.com/socials

API Access: https://darkwebinformer.com/api-details

About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer

X: https://x.com/DarkWebInformer

Updated: 2026-07-20

Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrvqhr5sdnf9rds8qq0l844cx64cjej76wqjcs06pw26sfpsxehqgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsvsvq4c

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

Show more details

Last Notes

2026-10-24 13:04:42 GMT

👀🚨🇫🇷 La France Insoumise, 1.2 million campaign records allegedly leaked
A 544 MB archive linked to La France Insoumise (LFI), a major left-wing political movement in France, has been released by the actor "ChimeraZ".
The files contain approximately 1.27 million entries, including 1.16 million unique records covering door-to-door canvassing, residential addresses, GPS coordinates, campaign activities, and event information.
The material also references 54,838 doors opened and 208 campaign workers involved in canvassing.
The authenticity of the data remains unconfirmed.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/496/026/320/377/125/original/c3229b920711ca07.png

2026-10-23 00:48:54 GMT

Sure they weren't graded... and sure they weren't those PSA graded Pokemon cards that were stolen last week. 🤔
Dread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/e3029f5b10828d702eba
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/487/470/671/193/820/original/5bb77b7e5f512d47.png

2026-10-21 14:07:45 GMT

🚨 Critical pre-authentication RCE research published for two PHP core vulnerabilities; CVE-2026-109618 + CVE-2026-109619
PoC: https://github.com/ikow/php2shell-poc
The flaws affect PHP's session.upload_progress handling and can be chained through session-file injection, memory corruption, or deserialization behavior to achieve remote code execution under specific application conditions.
CVSS: 9.2 Critical
Affected: PHP 5.4.0 through 8.5.11
Fixed: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12
The repository includes verification PoCs for session injection, a heap use-after-free, and handler-mismatch deserialization, along with a vulnerable Docker lab and detailed technical analysis.

2026-10-20 20:51:30 GMT

🚨 The FBI, CISA and law-enforcement agencies from the US, UK and Germany have issued a joint advisory detailing SafePay ransomware attacks.
⠀
Active since August 2024, the group has targeted businesses and critical infrastructure across North America, South America, Europe and Australia. Officials described SafePay as one of the most active ransomware groups of 2026.
⠀
Attackers gain access through stolen or guessed credentials, phishing, compromised VPN accounts and vulnerabilities in internet-facing systems.
Once inside, they obtain administrative privileges, disable security software, move across networks using tools such as PsExec, WinRM and RDP, then steal data using legitimate utilities including WinRAR, RClone, FileZilla and WinSCP.
⠀
SafePay encrypts files with the .SafePay extension and demands cryptocurrency. Victims may also receive phone calls, while stolen information is threatened with publication on the group’s leak site.
⠀
Organizations should patch internet-facing systems, enforce MFA, restrict administrative access, segment networks and maintain tested, immutable offline backups.
Source: https://www.ic3.gov/CSA/2026/261020.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/475/212/349/846/198/original/2d8b9efd816b5272.png

2026-10-20 17:38:26 GMT

👀🚨🇲🇽 Actor claims to have breached Mexican government system, exposing a MASSIVE 104.2 million records
An actor known as "GordonFreeman" claims to have compromised a major Mexican system and obtained a dataset containing 104.2 million records belonging to Mexican citizens.
The actor published a sample containing names, dates of birth, identification numbers, and residential addresses, along with a claimed 5 million-record proof-of-concept dataset.
The actor also claims the vulnerability has been exploited by others and remains unpatched. The affected system has not been identified.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/474/453/492/584/193/original/2c158bb047e636de.png

2026-10-19 23:07:31 GMT

🚨🇺🇸 WILD... PSA-graded trading cards stolen in FedEx vehicle burglary
A FedEx vehicle carrying completed PSA orders was burglarized after leaving the company’s Southern California facility, with multiple collectors reporting that their cards were stolen.
⠀
One collector said a 104-card shipment worth more than $100,000 was taken. Other reported losses include sports, Pokémon, Magic: The Gathering and Yu-Gi-Oh! cards.
⠀
PSA confirmed the theft, deactivated certification numbers linked to the stolen cards and alerted marketplaces to watch for rare and serialized items.
The company is working with FedEx and law enforcement and says affected customers will receive compensation based on fair market value, which I have attached to this post.
The total number and value of stolen cards remain unknown.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/470/084/810/365/044/original/163630359fc5301d.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/470/084/808/083/495/original/e41a1ea3b006866e.jpg

2026-10-19 21:49:51 GMT

🚨🇺🇸 nCino customer dataset containing nearly 793,000 records allegedly leaked
nCino, a U.S.-based company providing cloud banking software to financial institutions, has been named in a data breach claim involving 792,751 records.
⠀
The actor "JSON09" claims the dataset contains customer names, phone numbers, email addresses, residential addresses, postal codes, and location information.
⠀
The seller has published sample records and is offering the dataset for $250. The alleged breach and origin of the information remain unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/469/779/749/592/561/original/283b7e2b590a441f.png

2026-10-18 23:56:31 GMT

Somewhere out there, a rabbit hole is waiting to turn a simple question into a thousand more.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/464/615/499/211/983/original/500c8a27ca7749c9.png

2026-10-18 18:00:58 GMT

🚨🇫🇷 Blissim payment logs allegedly leaked, exposing 1.9 million records and payment card details
Blissim, a French beauty retailer selling skincare, makeup, and other cosmetic products, is the subject of a data leak involving nearly 2 million payment-related records.
⠀
The actor "ChimeraZ" claims to have released a partial collection of the company's payment logs, containing 1,916,599 records in a 688 MB JSON file.
⠀
The dataset reportedly includes 399,236 payment records, with 97,187 entries containing cardholder names.
⠀
A published sample shows cardholder names, card expiration dates, the last four digits of payment cards, and transaction reference numbers. The records cover 13 payment card brands and methods, including Visa, Mastercard, Carte Bancaire, American Express, Apple Pay, and Google Pay.
⠀
The actor has provided a sample and made the dataset available through a restricted download. The listing does not explain how the payment information was obtained or whether the records originated directly from Blissim's systems.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/463/217/287/547/131/original/3ba36a999c2133bc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/463/217/287/149/119/original/f7a6989a75581a2e.png

2026-10-18 17:37:04 GMT

🚨🇧🇷 $470,000 shipment of RTX 5090 graphics cards goes missing at Brazilian airport
Brazilian technology distributor Oderço says two pallets of Zotac GeForce RTX 5090 GPUs disappeared after reportedly arriving at São Paulo’s Guarulhos International Airport.
⠀
The company valued the shipment at R$2.5 million, approximately $470,000, based on its acquisition cost.
Oderço said it has sought information about the shipment but received no official explanation. The distributor described the incident as unprecedented in its 38-year history.
⠀
The number of missing graphics cards remains unknown. No arrival date, tracking information or other shipment records have been made public.
Authorities have not confirmed that the shipment was stolen, and the circumstances of its disappearance remain unclear.
Source: https://www.tomshardware.com/pc-components/gpus/nvidia-rtx-5090-shipment-worth-usd470-000-goes-missing-in-brazilian-airport-two-pallets-disappear-distributor-seeks-explanations-but-met-with-zero-answers
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/463/123/158/581/196/original/37444fd87974d531.webp

2026-10-18 16:43:06 GMT

🚨 VirusTotal Enterprise API key with 3 million monthly requests and advanced threat intelligence access advertised for sale
An actor known as "Zerrix" is advertising a VirusTotal Enterprise API key that allegedly provides access to some of the platform's highest-tier threat intelligence and malware analysis features.
⠀
The seller claims the key supports up to 3 million API requests per month and includes Retrohunt Tier 3, allowing users to search VirusTotal's historical malware collection using YARA rules.
⠀
The advertised access also includes:
• Google Threat Intelligence and Mandiant threat actor intelligence
• Advanced malware and IOC searches
• Private file scanning and analysis
• Downloads of malware samples
• Dark web monitoring and compromised credential alerts
• Threat hunting, automated workflows, and API integrations
⠀
The seller published a lengthy JSON response showing dozens of supposedly enabled permissions, including access to malware collections, threat actor profiles, vulnerability intelligence, and advanced Retrohunt capabilities.
⠀
The key is advertised as valid until March 12, 2028. The listing does not disclose how it was obtained or whether the seller is authorized to transfer it.
⠀
The API key's authenticity, permissions, and advertised monthly request allowance have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/462/910/436/004/292/original/5e1589feabc82321.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/462/910/414/110/119/original/a41c588ae99cccef.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/462/910/420/410/348/original/e03a1ded65f515dc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/462/910/414/214/176/original/e489751da1347c77.png

2026-10-18 16:00:00 GMT

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers
PoC: https://github.com/code-zm/plex2shell
A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:
• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:
• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.
Source: https://zmain.info/blog/plex2shell
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/462/741/809/088/673/original/0f9b3a873654177f.png

2026-10-16 15:39:50 GMT

🚨🇦🇷 Over 903,000 records allegedly leaked from Argentina's Municipality of Vicente López
A dataset containing approximately 903,000 records from the Municipality of Vicente López, a local government in Buenos Aires Province, has been released for free.
⠀
The actor "cantpwn" claims to have obtained around 1 GB of information spanning 2015 to 2026.
⠀
The dataset reportedly contains personal information, including:
• Full names, dates of birth, and nationalities
• National identification numbers
• Email addresses and phone numbers
• Residential locations and geographic information
• Marital status and gender
• Registration records and personal preferences
⠀
The post also names Peru as the actor's next target, although no specific organization was identified.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/451/337/770/214/561/original/60154aa9a9980d8a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/451/337/754/913/727/original/5878edffeef9c58f.png

2026-10-15 19:15:08 GMT

🚨🇺🇸 Cyberattack disrupts the Town of Bernalillo’s computer systems and public services
The New Mexico town discovered the attack after its IT director initially investigated what appeared to be a routine internet outage.
⠀
The incident disabled public-facing computer systems, preventing residents from making online water bill payments. Bernalillo’s Motor Vehicle Division office is also closed while recovery work continues.
⠀
Police, fire and other public safety services remain operational. Water service has not been affected, and officials said customers will not face late fees or disconnections during the outage.
⠀
The town contacted the FBI and New Mexico Office of Cybersecurity and hired outside cybersecurity specialists to restore its systems and data.
⠀
Officials have not disclosed whether personal or financial information was accessed, identified the attackers or provided a timeline for restoring online services.
Source: https://www.krqe.com/news/new-mexico/town-of-bernalillo-hit-with-cyberattack/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/446/521/835/036/121/original/eb3f39a1e0944918.webp

2026-10-15 18:34:22 GMT

"Pharoah" has been added to the OpSec Failures page.
Direct file: https://darkwebinformer.com/opsec-failures/#file-pharoah

2026-10-15 17:14:36 GMT

🚨🇺🇸 Over 518,000 U.S. telecom customer records and live network access offered for sale
More than half a million customer records from an unidentified U.S. telecommunications provider are being advertised alongside what the seller claims is active access to the company's network infrastructure.
⠀
The actor "Erich" claims to have obtained 518,357 records containing customer names, residential addresses, phone numbers, account statuses, and service information.
⠀
The more concerning part of the listing is the alleged network access. The seller claims they can remotely rename WiFi routers, disconnect customers, change wireless settings, and potentially disable millions of modems.
⠀
The actor says the access remains functional and is looking for a quick sale. No company name or technical evidence demonstrating control over the network was provided.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/446/048/174/739/235/original/bd842e7ed7ca11bd.png

2026-10-15 15:58:05 GMT

🚨🇨🇦 Web shell access to Canadian AI conversational platform offered for sale
An actor using the handle "Spider777" is advertising web shell access to an unidentified AI-based conversational platform operating in Canada.
⠀
The seller claims the access extends across multiple domains, potentially allowing interaction with several parts of the platform's web infrastructure.
⠀
The listing provides few technical details, with the actor asking interested buyers to make contact privately. No company name, affected domains, or asking price have been disclosed.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/445/747/317/649/438/original/83456bad13a6e566.png

2026-10-14 22:38:05 GMT

🚨 Bad ASN List: A curated blocklist of 2,200+ ASNs tied to VPNs, datacenters, hosting providers, scanners, and infrastructure commonly associated with automated abuse.
GitHub: https://github.com/bountyyfi/bad-asn-list
The list is designed to help reduce scraping, credential stuffing, bot traffic, anonymous abuse, and other unwanted activity by identifying suspicious network sources at the ASN level.
Includes categories covering:
• VPN and proxy providers
• Major and budget hosting
• Bulletproof hosting
• Known scanner infrastructure
• DDoS and abuse sources
• Infrastructure linked to ransomware and cybercrime activity
The repo currently contains 2,234 ASNs and includes implementation examples for Cloudflare Workers, Node.js, Flask, iptables, and nftables.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/441/657/552/618/920/original/857e90068da86cd0.png

2026-10-14 16:11:44 GMT

🚨🇺🇸🇪🇺 Actor Seeking VPN, RDP, and SOCKS Access to U.S. and European Networks
An actor operating under the handle "nirvana" is looking to purchase unauthorized access to corporate networks across North America and Europe.
The listing specifically targets U.S. organizations with a stated threshold of 7 million and companies in Western and Northern Europe with a threshold of 10 million, although the metric is not explicitly defined.
The actor is also offering to collaborate with other initial access brokers, proposing percentage-based profit-sharing arrangements for access provided by third parties.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/440/138/628/634/445/original/9c1b9cf5646dd04d.png

2026-10-13 20:50:32 GMT

‼️🇺🇸 An actor is offering for sale a dataset allegedly from SiriusXM containing 500,000 lines of email addresses and partial phone numbers for $300.
The actor provides a 10k sample and states the data will be publicly leaked if no buyer is found within 30 days.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/435/572/235/372/872/original/6e8eef83f9df5917.png

2026-10-13 20:09:50 GMT

Dread is currently offline due to another DDoS attack.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/435/412/561/378/640/original/435e1918cb0be00c.png

2026-10-13 19:11:01 GMT

🚨🇫🇷 Ecologic Dataset Containing 46,467 Records Leaked
Ecologic, a French government-approved nonprofit organization responsible for collecting, recycling, and managing end-of-life electrical and electronic equipment, has been named in a data leak involving 46,467 records.
The actor "Syrv4x" has released a 32 MB dataset containing contact information, business addresses, incident reports, partner details, and internal user account information.
The records also include company registration identifiers, operational details, and information related to waste collection and recycling activities. The dataset is being distributed for free.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/435/181/302/399/322/original/1c6dbf84a946f2e6.png

2026-10-13 18:13:18 GMT

🚨 Exploit for a critical Fortinet FortiClient EMS pre-authentication bypass; CVE-2026-35616
Exploit: https://github.com/Alaatk/CVE-2026-35616
The flaw affects FortiClient EMS and stems from improper access control around client-certificate authentication. An unauthenticated attacker can forge trusted certificate-related HTTP headers and access protected API functionality.
CVSS: 9.8 Critical
Affected: FortiClient EMS 7.4.5 - 7.4.6
Fixed: FortiClient EMS 7.4.7 / vendor hotfix
The exploit discovers usable certificate identities, forges the required authentication headers, tests multiple protected API endpoints, and confirms whether the authentication bypass succeeds.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/434/948/950/465/508/original/4b949ebe27fea184.png

2026-10-12 19:41:41 GMT

🚨🇫🇷 Solutions30 Dataset Containing Over 10.3 Million Records Offered for Sale
Solutions30, a European company providing technical installation, maintenance, and support services across the telecommunications, energy, and technology sectors, has been named in a major data sale.
The actor "Syrv4x" claims to have obtained a 34 GB dataset containing 10,376,950 records, including nearly 4 million distinct names, 6.8 million unique phone numbers, and 981,883 unique email addresses.
The records also contain customer addresses, service locations, and operational information linked to companies using Solutions30's field services.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/429/639/541/226/494/original/46d582ed2cf144e8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/429/639/543/639/726/original/dd6c0ca6ff672c20.png

2026-10-12 17:35:19 GMT

🚨 AnyPS5: An open-source project for automatically porting PS5 executables to Linux and Windows
GitHub: https://github.com/boykopovar/AnyPS5
AnyPS5 converts PS5 executables into formats that can run natively on supported desktop systems, while reimplementing required PS5 system libraries for dynamic linking.
Features include:
• Automatic executable relinking
• Linux and Windows support
• SPIR-V shader recompilation
• Controller support
• Configurable keyboard and mouse input
• No separate emulator runtime process
The project is focused on interoperability, preservation, research, and compatibility, with a growing list of verified games.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/429/142/669/085/101/original/af51e8c0b7b3dbfe.png

2026-10-12 16:33:12 GMT

🚨🇵🇦 MiGuayaba and MGPanel Documents Allegedly Leaked, Nearly 19,000 Files Exposed
MiGuayaba, a Panamanian marketing and web design agency, and MGPanel, a business management software platform, have been named in a data leak involving approximately 10 GB of documents.
The actor "gea" claims to have exposed 19,080 files, including 8,979 identity documents, 6,238 business operation notices, contracts, financial statements, tax records, and corporate registration documents.
The information reportedly belongs to clients across Panama, Colombia, and Venezuela. Samples showing identification cards and other sensitive documents have also been published.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/428/898/331/651/118/original/16b045474e8132c0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/428/898/328/283/123/original/395b9c31f2c725d4.png

2026-10-11 16:44:24 GMT

🚨🇰🇭 NTC Group School Management System Access Offered for Sale in Cambodia
An actor known as "DaOnlySpark" is selling access to NTC Group's school management system, covering two Sovannaphumi School campuses in Cambodia.
The affected campuses reportedly serve approximately 10,000 students combined, with 7,000 in Poipet and 3,000 in Siem Reap.
The actor claims the access allows buyers to view student records and payments, transfer or remove students, upload student photos, and modify staff signatures. Access to either campus or both is being offered to interested buyers.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/423/280/185/815/821/original/e7e4dba63e4d011b.png

2026-10-11 15:54:05 GMT

🚨🇫🇷 RGIS Recruitment Dataset Containing 30,366 Records Leaked
RGIS, an international company providing inventory, supply chain, and asset management services, has been named in a new data leak involving job applicants in France.
The actor "Syrv4x" has shared a 28 MB dataset containing 30,366 records, including applicant names, email addresses, phone numbers, job applications, recruitment statuses, and interview schedules.
The samples also contain links to candidate CVs, recruiter communications, and application histories.
Claim is currently unverified.
Infostealer data via @whiteintel_io (X)
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/423/081/951/490/853/original/5d82a0cfcfd1099d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/423/081/976/122/830/original/85483b23b467324c.png

2026-10-10 18:31:14 GMT

Pushed a couple fixes to the backend for the threat feed.
Script failed for approximately 4 hours today due to overwhelming the server with specific SOCKS5 requests. Provided an improvement on this and monitoring. No posts were missed.
Alerts now use stronger fallback logic when AI classification fails, helping correctly identify data leaks, breaches, cyber attacks, combo lists, and other threat types instead of defaulting to generic “Alert” posts.

2026-10-10 17:17:21 GMT

🚨🇫🇷 Auchan Customer Dataset With 1.29 Million Records Offered for Sale
Auchan, one of France's largest retail chains, has been named in a new data sale on a cybercrime forum.
The actor "mica" is selling a 471 MB dataset containing 1,291,037 customer records, including names, email addresses, phone numbers, home addresses, and customer card numbers.
A sample of the records has been published, with the seller accepting offers for the full dataset.
Claim is currently unverified.
Infostealer data via @whiteintel_io (X)
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/417/746/980/729/332/original/9309bb40ed749009.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/417/746/967/438/319/original/5a3d275c95224168.png

2026-10-10 16:01:53 GMT

🚨🇺🇸 Cook Counseling and Consulting Allegedly Breached, 111 GB of Mental Health Records Exposed
Cook Counseling and Consulting, a mental health provider in Columbus, Ohio, has been named in a data leak involving the records of 7,670 patients.
The actor "archivist" claims to have obtained 111 GB of data, including 23,647 therapy notes, 30,072 patient documents, treatment plans, diagnoses, insurance records, and billing information dating from 2022 to 2026.
The actor says an initial attempt to export the data was blocked, but a second compromised account allowed the extraction of the complete patient dataset. A lack of multi-factor authentication was blamed for the intrusion.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/417/450/651/013/335/original/9145be9cdc920b8e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/417/450/660/257/924/original/0dbe64b0edd755e5.png

2026-10-10 10:24:23 GMT

‼️ New Dark Web Informer Blog Post!
Title: Saudi Intelligence Officers Database Claim Includes Names, Contact Details and Operational Records
Link: https://darkwebinformer.com/saudi-intelligence-officers-database-claim-includes-names-contact-details-and-operational-records/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-10-10 10:24:12 GMT

‼️ New Dark Web Informer Blog Post!
Title: Swedish Fit Customer Dataset Offered for Sale With 253,155 Records and 253,104 Profile Images
Link: https://darkwebinformer.com/swedish-fit-customer-dataset-offered-for-sale-with-253-155-records-and-253-104-profile-images/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-10-10 10:24:10 GMT

‼️ New Dark Web Informer Blog Post!
Title: Assurimo Insurance Dataset Offered for Sale With 954,000 Records and 674,303 People
Link: https://darkwebinformer.com/assurimo-insurance-dataset-offered-for-sale-with-954-000-records-and-674-303-people/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-10-08 15:00:19 GMT

🚨🇧🇷 UNINTER Data Leak Escalates With Threat of 100 GB Releases Every 48 Hours
Kazu has published a link to what they claim is the first 100 GB of stolen data from Brazilian education group UNINTER.
The actor says the vulnerability used in the breach has since been patched, but accuses UNINTER of denying the incident and ignoring communications.
More data is threatened every 48 hours until October 20, 2026, unless UNINTER publicly acknowledges the breach and responds to the demands.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/405/876/368/175/305/original/f696d149b462b355.png

2026-10-08 14:44:50 GMT

🚨 AWS and Azure Cloud Access Sought by Forum Buyer
A forum actor is looking to purchase access to AWS and Microsoft Azure environments.
The buyer specifically mentions AWS administrator access with S3 versioning and Object Lock disabled, along with Azure credentials granting File.Read.All and User.Read.All permissions.
The listing includes examples of AWS and Azure credentials, including secret keys.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/405/823/092/022/297/original/5e5f48a8b9cbf36d.png

2026-10-07 15:01:08 GMT

🚨🇺🇸🇫🇷 US and French authorities seize websites selling stolen intimate images and CSAM
Authorities seized two domains associated with NudeLeaksTeens (NLT), a platform accused of selling hacked and stolen sexually explicit images and videos of women and girls.
⠀
Investigators found that the site also sold child sexual abuse material, despite displaying warnings that such content was prohibited.
Some collections allegedly included identifying information alongside intimate images. Authorities confirmed that some victims were minors when the material was created.
⠀
One advertised collection claimed to contain 6,200 files obtained from compromised Snapchat, Instagram, TikTok and Facebook accounts.
French authorities simultaneously arrested a 25-year-old man in northern France suspected of being the platform’s main administrator.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/400/224/575/185/599/original/9e8db3632b64fe9a.jpg

2026-10-06 20:46:07 GMT

🚨🇺🇦 Hackers hijacked the website of Ukraine’s largest grocery chain and demanded $400,000
ATB confirmed a cyberattack after its website displayed an extortion message and a two-hour countdown.
⠀
The “DataSuckers” group claimed it stole:
• Data belonging to 7.9 million customers
• Passport details of more than 127,000 employees
• Records of 11.4 million orders
• Supplier information and internal source code
⠀
The attackers demanded payment in Bitcoin or USDT and threatened to publish the purported dataset.
ATB denies that any personal or confidential information was compromised, saying such data was not stored on the affected resources.
⠀
After ATB disputed the breach, the group published alleged samples and said it would sell the purported dataset instead of releasing everything publicly.
The samples and claimed scale of the breach have not been independently verified.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/395/918/305/064/814/original/9cc76c144b511ee1.png

2026-10-06 15:12:00 GMT

🚨 New Ransomware Group: UmBra
Dark Web: http://umbra7isogjsgdcndz3uu6qvl5zftjptt6s3iiuecjlwbt4yqyvrhcid[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/394/605/312/314/483/original/7ce8ba71696ffa61.png

2026-10-02 16:18:01 GMT

🚨 🇩🇪 Founder of Archetyp Market admits running major darknet drug marketplace
A 31-year-old German man has admitted founding and operating Archetyp Market during the opening of his trial at Frankfurt Regional Court.
He described creating the platform as a major mistake and said he deeply regretted his actions.
⠀
Authorities described Archetyp Market as the world’s largest marketplace for drugs and pharmaceuticals when it was shut down in June 2025.
Prosecutors allege the platform processed approximately:
• 2.3 million orders
• €330 million in transactions
• 6.9 tonnes of drugs and other substances
• 3.2 million pills
• 2.2 million tabs
• 326 liters of liquid drugs
⠀
The marketplace reportedly had more than 600,000 customer accounts. The defendant is accused of earning approximately €20 million from the operation.
He operated under the alias "ASNT" and was arrested by Spanish police in Barcelona in June 2025.
A verdict is expected in October.
Source: https://www.berchtesgadener-anzeiger.de/startseite_artikel,-gruender-groesster-drogenhandelplattform-bereue-meine-taten-_arid,1018792.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/372/215/320/439/249/original/d1dc7032828c7bb8.webp

2026-09-28 22:57:43 GMT

citrixInspector: Passively identify Citrix ADC / NetScaler ADC & Gateway builds and check for known vulnerabilities, including CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and KEV-listed CVE-2026-88771/88772.
GitHub: https://github.com/securekomodo/citrixInspector
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/138/137/681/700/original/c8e77fc4c3397439.png

2026-09-28 22:36:07 GMT

🚨 Exodus Wallet Stealer/Grabber Source Code Shared
Source code for a Windows-focused tool targeting Exodus cryptocurrency wallets has been shared on a forum.
The post describes a C++ and Python proof of concept that allegedly uses DLL side-loading to execute a malicious payload when Exodus launches.
According to the author, the tool is designed to capture wallet PIN input and collect encrypted wallet files for later decryption.
The shared post includes portions of both the C++ payload and Python deployment code, along with claims that the tool can evade several major antivirus products.
These claims have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/052/724/271/454/original/7e9713c42171976e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/052/735/554/738/original/7cbec4363c35a87f.png

2026-09-26 19:08:36 GMT

‼️ A forum actor known as February shared scanned passports, certificates, and other documents allegedly obtained from Kenya, distributed for free. The poster indicates further leaks may follow depending on community interest.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/338/912/361/547/875/original/fda2682e26842dd1.png

2026-09-26 17:41:28 GMT

🚨 Companies are being urged to shut down their NetScaler instances immediately due to multiple unpatched Citrix NetScaler RCE vulnerabilities.
Source: https://x.com/watchtowrcyber/status/2103891689857228803

2026-09-24 19:41:58 GMT

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)
GitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/327/719/124/186/716/original/6dd8d74d612e5668.png

2026-09-24 19:31:42 GMT

A few minor updates...
- Some forums manually moderate and approve threads. When a thread appears on the feed with a creation time from a few hours earlier, that delay is outside my control. The feed picks it up as soon as possible after moderators approve it. This also affects some subdreads. I’ve added a note above the threat feed explaining this.
- Newly announced markets are not added to the Growing Markets page. I’m creating new threat surface source pages, and these markets will be added to a separate markets page.
- I’m updating the backend for the Ransomware Feed and hope to have it ready in late October. These updates should allow new claims to appear on the feed as soon as operators publish them, so near real-time.

2026-09-22 22:46:44 GMT

Lul
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/317/120/741/712/977/original/d87f078726c99c7f.jpeg

2026-09-20 19:46:32 GMT

Getting closer to releasing the OpSec Failures page. A couple things I'm working on still. Should be out next week.
Things like legal documents, when known, will eventually be added to each individual.
There will be a submission button somewhere as well... so you can submit new individuals, new info, provide updates on some things that may not be entirely correct, etc. Again, no paid subscription required.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/305/086/971/581/454/original/e2ef09225d61e748.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/305/086/966/066/792/original/da3e50c15c9ec208.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/305/086/951/173/990/original/4f38b652b4e8681f.png

2026-09-18 18:57:33 GMT

🚨🇪🇨 Ecuador healthcare dataset allegedly exposing 6.68M patient records
A forum actor using the handle "jarol1488" claims to have extracted 6,684,729 patient records from an Ecuadorian healthcare system.
Claimed exposed data includes:
⠀
• Identity data: names, national ID numbers, sex, age and marital status
• Contact data: phone numbers, mobile numbers and email addresses
• Location data: birthplace, residence, province, canton, parish and street addresses
• Demographic data: nationality and education level
• Employment data: occupation, employer and related workplace information
• Family data: relationship/kinship details and contact information
• Medical data: disability-related fields and healthcare establishment information
⠀
The actor published sample records containing personal and demographic information as purported proof of the dataset.
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/293/570/577/097/339/original/f5cfa33ac69d520b.png

2026-09-11 18:55:45 GMT

🚨🇦🇪 ECC Group database containing 52K+ records allegedly leaked by AnkaTeam
⠀
ECC Group is a Dubai-based group of companies operating across construction, engineering, fit-out, manufacturing, building materials, facilities, and real estate development.
⠀
An actor using the handle SALDIRGAN, identifying with AnkaTeam, claims to have leaked a database associated with ECC Group’s official website.
⠀
Claimed exposed data includes:
⠀
• 52,444 database records
• WordPress user accounts
• Usernames and display names
• Email addresses
• Password hashes
• User registration dates
• Account activation data
• Other WordPress database records
⠀
The actor identifies the backend as MariaDB and the affected CMS as WordPress, describing the incident as a database dump exposure. A sample administrator record was published alongside the claim.
⠀
The breach claim, record count, and full scope of the exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/927/308/408/191/original/de199087fa16b3e6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/927/300/803/548/original/3ec531a51969459b.png

2026-09-11 18:21:03 GMT

‼️ New Dark Web Informer Blog Post!
Title: Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes
Link: https://darkwebinformer.com/citya-immobilier-dataset-claim-covers-2-2m-records-and-50k-digicodes/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-09-11 17:46:08 GMT

‼️ Darknet Markets Timeline was added to show that DarkMattter Market is exit scamming. I'm in the process of updating the timeline to look and feel better as well as provide more information.
https://darkwebinformer.com/darknet-markets-timeline/

2026-09-11 17:24:17 GMT

🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure
Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.
⠀
The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.
Affected versions include:
• GitLab 18.7 through versions before 19.1.8
• GitLab 19.2 through versions before 19.2.6
• GitLab 19.3 through versions before 19.3.2
⠀
GitLab disclosed and patched the vulnerability on September 10.
Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.
⠀
Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.
GitLab.com is already patched.
Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/567/686/568/981/original/27ab2c516a268803.webp

2026-09-11 16:48:55 GMT

‼️ New Dark Web Informer Blog Post!
Title: Boulanger Dataset Claim Covers 132,230 Customer and Service Records
Link: https://darkwebinformer.com/boulanger-dataset-claim-covers-132-230-customer-and-service-records/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-09-11 16:15:33 GMT

🚨🇮🇩 Universitas Andalas dataset containing 118K+ accounts allegedly leaked
⠀
Universitas Andalas is a public university in Padang, West Sumatra, Indonesia, operating academic, administrative, and research systems including numerous online journal platforms.
⠀
A forum actor using the handle Koyot claims to have obtained data covering 118,289 user accounts across 40 academic journal instances, along with administrative accounts tied to the university’s main Joomla portal and journal systems.
⠀
Claimed exposed data includes:
⠀
• Usernames and display names
• Institutional email addresses
• bcrypt and MD5 password hashes
• Registration and last-login timestamps
• TOTP 2FA seeds and emergency recovery codes
• Active session IDs and remember-me tokens
• Names, dates of birth, phone numbers, and addresses
• Academic affiliations and ORCID identifiers
• Biographies and CV information
• Manuscript and peer-review working files
• Reviewer assignments
• Publication-fee payment records
• Institutional subscriber IP ranges
• Administrative and CMS records
⠀
The actor claims the dump was extracted in September 2026 and includes data from the university’s main portal and 40 Open Journal Systems instances. A sample of the purported records was published with the listing.
⠀
The dataset is being offered as a single sale for $200 in XMR, with escrow reportedly accepted.
⠀
The breach claim, record count, authenticity of the data, and claimed exposure of 2FA material have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/297/366/228/341/original/113b3db9b3046b0b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/297/369/500/730/original/241608a9b49bfe5c.png

2026-09-11 15:52:50 GMT

‼️ New Dark Web Informer Blog Post!
Title: Generali Insurance Bulgaria Dataset Claim Covers 1,241,432 Personal Records
Link: https://darkwebinformer.com/generali-insurance-bulgaria-dataset-claim-covers-1-241-432-personal-records/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-09-11 15:33:47 GMT

‼️ New Dark Web Informer Blog Post!
Title: Metropolis Technologies Source Code Allegedly Stolen and Leaked
Link: https://darkwebinformer.com/metropolis-technologies-source-code-allegedly-stolen-and-leaked/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-09-11 15:17:22 GMT

Kicksecure: Kicksecure is a hardened Linux operating system designed for security-sensitive computing. It includes protections against malware and exploits, stronger system isolation, hardened defaults, and physical-security features such as a panic-key emergency shutdown that can quickly power off the system if it is at risk of being physically compromised.
Link: https://www.kicksecure.com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/067/601/959/570/original/df60c8936a1a6f5a.webp

2026-09-11 14:57:16 GMT

🚨🇺🇸 Forum actor solicits U.S. tax forms for refund filing operation
⠀
U.S. tax forms such as 1040s, 1065s, 1099s, W-2s, and W-9s can contain sensitive taxpayer, income, employment, and business information used for federal tax reporting.
⠀
A forum actor using the handle Elkmann is seeking partners who can provide tax-form data from compromised targets, claiming they can process the information and file for refunds throughout the year.
⠀
Forms being requested include:
⠀
• Form 1040 individual tax returns
• Form 1065 partnership returns
• Form 1099 information returns
• W-2 wage and tax statements
• W-9 taxpayer identification forms
• W-9 records accompanied by email access
⠀
The actor states they can process as many forms as partners can provide and is actively seeking partnerships ahead of the next tax season.
⠀
Minimum quantities are reportedly discussed privately, with initial contact requested through forum messages.
⠀
The legitimacy, scale, and success of the claimed refund operation have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/252/989/646/659/155/original/bd79681e1a231a75.png

2026-09-09 14:45:22 GMT

🚨🇧🇷 Medgrupo and FUSVE patient data allegedly leaked and offered on a cybercrime forum
⠀
Medgrupo is a Brazilian medical education company, while FUSVE operates educational and healthcare institutions in Rio de Janeiro state, including Vassouras University Hospital.
⠀
A threat actor using the handle jacksenseofrejection claims to possess hundreds of thousands of sensitive and financial records associated with Medgrupo clients and students, along with 70,963 PDF medical imaging reports involving patients of Vassouras University Hospital.
⠀
Claimed exposed data includes:
⠀
• Client and student financial records
• Patient names
• Patient ages
• Referring physician information
• Medical imaging reports
• Examination dates
• Clinical indications
• Other sensitive medical information
⠀
The actor published samples and is asking approximately 1.25 BTC for the purported data, with an offer deadline of September 15, 2026.
⠀
The breach claim, origin of the data, and full scope of the exposure have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/241/618/180/785/717/original/bea29f05a0bff6c4.png

2026-09-07 23:19:03 GMT

🚨🇧🇷 Municipality of Arcos dataset allegedly leaked, 484.7 MB of data claimed
⠀
Prefeitura Municipal de Arcos, the municipal government of Arcos in Minas Gerais, Brazil, is named in a cybercrime forum post where a threat actor claims to have obtained and released data associated with the municipality’s official government portal.
⠀
Claimed exposure
⠀
• Municipal employee names
• Government email addresses
• Department and role information
• Internal contact records
• vCard-style contact data
• Approximately 484.7 MB of files
⠀
The actor published a sample containing municipal staff contact information, including names, departments and official arcos.mg.gov.br email addresses.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/232/313/477/181/257/original/548195873599b49e.png

2026-09-07 22:43:43 GMT

"whats the best wallet for xmr?"
Feather in my opinion.
Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/1eae3d3e885062f0b695
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/232/174/568/740/986/original/2742ba15a68307e5.png

2026-09-07 21:06:50 GMT

‼️ The DL sample made publicly on ShinyHunters pay or leak site is Jeffrey Epstein.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/231/793/561/537/679/original/1016c0a02432de4b.jpg

2026-09-05 22:15:04 GMT

🚨🇺🇸 Spirit Cultural Exchange allegedly breached, 170 GB of data claimed
Spirit Cultural Exchange, a U.S.-based provider of international cultural exchange and J-1 visa programs, has been named in an extortion post on a cybercrime forum.
Claimed exposure
• 170 GB of data
• 136,817 files
• Passport files and face images
• Employment verification documents
• Degree diplomas
• Host school offers
• Letters of reference
• Criminal background checks
• Additional participant documents
Extortion demand: $100,000
Deadline: September 20, 2026
The actor claims the data will be offered for sale if the ransom is not paid.
The breach claim, exposed data and scope have not been independently verified.
💥 Get the intel threat actors see when they post it.
darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/220/737/249/699/832/original/4855cb0eed12fd07.png

2026-09-05 19:06:43 GMT

⚠️ Dark Matter Market public links are currently down. Private links are working, but some are complaining that their private links aren't. Treat with caution.
Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/598f789643cae0d3f573
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/219/996/638/198/865/original/f43fbf02502b7f91.png

2026-09-05 16:31:29 GMT

🚨🇫🇷 YouFID dataset allegedly leaked on a cybercrime forum, 7.8K people claimed
⠀
YouFID, a French customer loyalty and engagement platform that helps businesses manage digital loyalty programs and rewards, is named in a cybercrime forum post where a threat actor claims to have leaked a partial dataset containing information tied to 7,880 people.
⠀
The advertised data includes:
⠀
• Full names
• Email addresses
• Phone numbers
• Associated date fields
⠀
The actor claims the dataset contains 7,880 lines of data totaling approximately 805 KB, provided in JSON format.
⠀
A sample of the allegedly exposed records was also published in the forum post.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/219/386/264/126/709/original/036109574314c747.png

2026-09-03 15:20:23 GMT

🚨🇺🇸 Motorola internal AI and GenAI infrastructure access allegedly offered for sale on a cybercrime forum
⠀
Motorola, a U.S.-based telecommunications and technology company, is allegedly affected by a significant security compromise after a threat actor claimed to have accessed internal environments supporting the company’s GenAI and AI engineering infrastructure.
⠀
The actor claims the compromised environment includes:
⠀
• Internal repositories and source code
• GenAI modules, proxies and custom agents
• Model Context Protocol (MCP) servers
• Jira MCP infrastructure
• Frog MCP infrastructure
• Bitbucket MCP infrastructure
• Enterprise integration systems
• CI/CD pipelines
• Salesforce-related pipelines
• ServiceNow-related pipelines
• Azure RAG infrastructure
• Internal documentation
• Chat transcripts
• Monitoring and reporting systems
• Additional AI engineering assets
⠀
The actor published multiple screenshots presented as proof of access and states that the compromised environment and associated assets are now being offered for sale.
⠀
No public asking price is provided, with prospective buyers directed to contact the actor privately for verification, additional details and pricing.
⠀
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/207/782/046/885/196/original/8327113beecc1b7d.png

2026-09-03 15:01:40 GMT

🚨🇮🇳 FortiGate appliance credentials tied to multiple Indian IT companies allegedly offered for sale on a cybercrime forum
⠀
Multiple small and medium-sized IT and consulting companies in India are allegedly affected after a threat actor advertised credentials associated with their FortiGate appliances.
⠀
The seller describes the affected organizations as primarily providing IT support and consulting services, with claimed annual revenues ranging from approximately $300,000 to $1.5 million.
⠀
The advertised access includes:
⠀
• FortiGate appliance credentials
• IP addresses
• Usernames
• Passwords
• FortiGate identifiers
• Access associated with IT and consulting environments
⠀
The number of affected users or appliances is not specified in the listing.
⠀
The actor is asking $5,000 or a higher offer for the alleged access and is offering proof privately to prospective buyers.
⠀
The claims and the authenticity, scope and current validity of the allegedly compromised credentials have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/207/708/414/396/887/original/4eb5a2bd17a6cf2e.png

2026-09-03 13:14:56 GMT

‼️ Security researcher Nightmare Eclipse has released a new zero-day called FalconFlank, a CrowdStrike Falcon local privilege escalation (LPE) vulnerability.
GitHub: https://github.com/MSNightmare/FalconFlank
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/207/288/708/670/012/original/29dfe47abbbcb916.png

2026-09-01 23:52:11 GMT

‼️ Everest Ransomware IP Leak:
Original credit to @nprofile…ncvn.
IP: 62.60.155.107
ASN: 203273 🇬🇧
Org: NetCrafters OU
Ports: 22, 25, 53, 80, 2525, 3306, 3389, 8080
Censys: https://platform.censys.io/hosts/62.60.155.107
FOFA: https://en.fofa.info/result?qbase64=NjIuNjAuMTU1LjEwNw==
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/198/469/784/839/218/original/1bfcda2fc4ef24b4.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/198/469/768/250/518/original/a0d5936f79e77412.png

2026-08-30 16:33:13 GMT

🚨🇫🇷 DELKO customer dataset allegedly offered for sale on a cybercrime forum, 50K+ customers claimed
⠀
DELKO, a French automotive maintenance and repair network providing vehicle servicing, mechanical repairs and tire services, is allegedly affected by a data exposure after a threat actor advertised what they claim is the company's complete customer dataset.
⠀
The actor claims the dataset contains information associated with more than 50,000 customers.
⠀
The advertised data includes:
⠀
• Customer IDs
• First and last names
• Email addresses
• Phone numbers
• Vehicle registration numbers
• Account creation dates
• Appointment dates
• Appointment types
• Mechanical service information
• Tire service information
• Vehicle inspection and maintenance records
• Service amounts and pricing fields
• Additional service and appointment details
⠀
The actor published samples of the alleged customer records along with images presented as proof of access.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/185/419/112/591/377/original/3ab60648bbdc5379.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/185/419/107/875/621/original/ae7dda3d61b2b0ab.png

2026-08-29 23:01:59 GMT

‼️ New Ransomware Group: ZaWoo
Dark Web: https://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf2nyd[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/181/285/597/273/591/original/24b713ad7685316d.png

2026-08-29 19:21:46 GMT

‼️ New RaidForums domain:
raidforums[.]im
95[.]216[.]247[.]178
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/180/419/610/231/057/original/f9d86df9ef393bd3.png

2026-08-28 17:08:41 GMT

🚨 Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices
A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.
CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:
• Access sensitive configuration data
• Modify device settings
• Disrupt device availability
Affected firmware: FW-9167-0-11
Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.
CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/174/234/049/011/292/original/01ab9025eb57f579.jpg

2026-08-28 15:47:00 GMT

🚨🇶🇦 Qatar General Retirement & Social Insurance Authority allegedly breached, internal accounts and API tokens exposed
Qatar General Retirement & Social Insurance Authority (GRSIA) is allegedly affected by a breach after a threat actor published samples claiming to originate from systems associated with the authority.
The advertised data includes:
• Internal and partner user accounts
• First and last names
• Email addresses
• User and partner account types
• Partner IDs
• Store IDs
• Account roles and permissions
• Account status information
• API names and environment identifiers
• API authentication tokens
• Token expiration dates
• Record creation and update timestamps
The samples include entries labeled API Testing and GRSIA_PROD, along with records for internal users, partner administrators and store users. Several organizations and partner accounts also appear within the sample data.
The actor additionally published what they claim is a publicly reachable system endpoint and provided a download link containing the alleged material.
The claims and the authenticity, source and scope of the allegedly exposed data and credentials have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/173/912/838/087/881/original/2626f9e5063a8e2c.png

2026-08-28 15:16:50 GMT

🚨🇫🇷 Actis Location dataset allegedly leaked on a cybercrime forum, 464GB and 666K+ files claimed
⠀
Actis Location, a French company specializing in the rental of construction, industrial and professional equipment, is allegedly affected by a data exposure after a threat actor published what they claim is company data obtained as part of the BigCloud leak series.
⠀
The actor claims the exposed material totals approximately 464 GB and contains 666,155 files, with portions of the data converted to text for publication.
⠀
The advertised data includes:
⠀
• Email communications
• Employee and customer names
• Email addresses
• Phone numbers
• Physical addresses
• Cities, postal codes and countries
• CRM records
• Customer and company account information
• Internal reference numbers
• Rental and quotation documents
• Contract-related information
• Equipment and product details
• Pricing and payment-related information
• Rental dates and durations
• Additional internal business documents
⠀
The forum post includes samples of alleged email, CRM and document data, along with download links for the material. The actor describes Actis Location as BigCloud Leak #15.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/173/794/189/200/315/original/84b52988d3fee6c7.png

2026-08-27 23:09:58 GMT

‼️ DarkForums is back up under the domain I discovered earlier today:
darkforums[.]as
https://x.com/DarkWebInformer/status/2093018895846162799?s=20
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/169/991/658/857/899/original/1eb068bdf0d51105.png

2026-08-26 16:30:45 GMT

🚨 Hinge database allegedly offered for sale on a cybercrime forum, 34M+ unique user records claimed
⠀
Hinge, a dating application operated by Match Group, is allegedly affected by a data exposure after a threat actor advertised what they claim is the platform's complete database containing more than 34 million unique user records.
⠀
The advertised data includes:
⠀
• Full names
• Email addresses
• Phone numbers
• Dates of birth and ages
• Gender and pronouns
• Sexual orientation
• Cities, states and countries
• Ethnicity and religion
• Political preferences
• Drinking and smoking information
• Marijuana and drug-use preferences
• Children and family plans
• Dating intentions and relationship preferences
• Education and employment information
• Profile prompts and answers
• Account and verification status
• Subscription and billing metadata
• Match, like and profile activity information
⠀
The actor published a sample of the alleged database containing extensive account and profile fields and is offering the dataset for $350 in cryptocurrency.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/162/760/225/471/642/original/dc8c14fa9364bc10.png

2026-08-26 16:00:32 GMT

Use the link below for anything CYBERLEEK related. This link is defanged so remove the brackets [.]
https://ju3hayvlyj4mbemqheplf3px5d6j673oszj6atv6ukta7phiy22a[.]arweave[.]net/TTZwYqvCeMCRkDkesu336Pyff26WU-BOvqKmD7zoxrQ
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/162/641/408/521/860/original/5fd1e7004432da44.png

2026-08-26 15:31:19 GMT

🚨🇲🇽 Universidad Autónoma de Sinaloa employee documents allegedly leaked on a cybercrime forum
⠀
Universidad Autónoma de Sinaloa (UAS), a public university in Sinaloa, Mexico, is allegedly affected by a data exposure after a threat actor claimed to have extracted employee information and documents from a university personnel system.
⠀
The actor claims the files were organized using employees' RFC and CURP identifiers and contain documentation associated with individual university staff members.
⠀
The advertised data includes:
⠀
• INE voter identification credentials
• Birth certificates
• CURP identifiers
• RFC tax identifiers
• Employee photographs
• Proof-of-address documents
• Tax and fiscal status certificates
• Academic diplomas
• Employment contracts and appointment letters
• Paid and unpaid leave documents
• Full names
• Dates of birth
• Gender information
• Phone numbers
• Email addresses
• SAT-related tax information
• Hire dates, seniority and employment history
⠀
The post also includes a sample of the alleged employee database and provides a download link for the claimed documents.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/162/526/529/302/531/original/30657990a9acb07c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/162/526/518/590/590/original/b640a9b091f31837.png

2026-08-25 22:36:40 GMT

🚨 Nitter development has stopped after X Corp. sent cease-and-desist letters demanding the permanent takedown of Nitter instances and the project’s repository.
The maintainer says nitter.net is now offline while legal advice is being sought. Nitter had operated for more than seven years.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/158/536/793/473/062/original/2663f6fbfb634f61.png

2026-08-25 20:10:26 GMT

Every. Day.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/157/961/735/973/902/original/1d2cb43333da4282.webp

2026-08-22 22:39:42 GMT

🚨🇯🇵 Nintendo targets more than 400 Switch emulator repositories in massive GitHub sweep
Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.
The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.
Other targets included:
• 29 Skyline repositories
• Multiple Yuzu forks and Android ports
• 17 MonoNX forks
• Yuzu Early Access mirrors
Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.
Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.
Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/141/561/730/265/006/original/25ef795a3009c525.webp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/141/561/732/647/876/original/7c3b81b97b41f238.webp

2026-08-22 17:35:03 GMT

🚨 Trezor phishing injection tool advertised on a cybercrime forum for $3,000
⠀
A forum seller is advertising AntiTrezor, a phishing injection tool designed to impersonate the Trezor Suite interface and capture cryptocurrency wallet recovery seed phrases.
⠀
The advertised features include:
⠀
• Injection directly into the Trezor Suite interface
• Phishing flow styled to resemble the legitimate application
• Seed phrase capture
• Persistence across system reboots
• Windows 10 and 11 support
• Support for multiple Trezor device models
• Fake error and troubleshooting prompts intended to pressure victims
• Ability to display captured wallet balances in an operator panel
• Administrative notifications when a victim interacts with the phishing flow
⠀
The listing claims the tool can prevent victims from moving funds after submitting their recovery phrase and is designed to operate without modifying official Trezor executables.
⠀
The source code is being advertised for $3,000.
⠀
The seller's claims and the capabilities of the tool have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/140/363/867/257/171/original/145a13ffcfaa2e57.png

2026-08-21 15:21:55 GMT

‼️ IGN is reporting via Kotaku that Take-Two is seeking information from Microsoft and Discord as investigation into GTA 6 leaker expands with federal subpoenas
CyberLeek... you sir are fucked.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/134/178/012/975/492/original/558d359e34627010.jpg

2026-08-21 15:18:31 GMT

🚨🇻🇪 Venezuela's SAIME citizen database allegedly leaked, 35M records claimed
⠀
A forum user claims to have released an updated dataset allegedly obtained from Venezuela's Administrative Service for Identification, Migration and Immigration (SAIME), containing approximately 35 million citizen and resident records.
⠀
The advertised data includes:
⠀
• National identity document numbers
• First and middle names
• Paternal and maternal surnames
• Dates of birth
• Gender information
• Record lookup timestamps
• Venezuelan and foreign resident records
⠀
The listing claims the dataset contains 32,647,087 Venezuelan records and 2,331,247 foreign resident records. The Venezuelan portion is described as approximately 2.21 GB uncompressed, while the foreign resident dataset is listed at roughly 450 MB.
⠀
Samples from both record types were published in the thread, with the data distributed in TXT and JSON formats.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/134/164/578/695/943/original/c8574802020dc47b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/134/164/565/768/717/original/c00c5209df524c37.png

2026-08-17 16:55:52 GMT

‼️ A forum user is seeking to buy Stripe and PayPal API keys in bulk on a daily basis, stating account balance is not required. The buyer claims to test keys before purchase and requests low bulk pricing.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/111/898/195/706/581/original/c7f0dac4b56642ea.png

2026-08-16 16:21:46 GMT

🚨🇰🇷 South Korea National Health Insurance Service dataset allegedly leaked on a cybercrime forum, 48M records advertised for sale
⠀
A forum seller claims to be offering a dataset allegedly containing personal and health insurance-related information from South Korea's National Health Insurance Service (NHIS). The seller says the dataset contains approximately 48 million records.
⠀
The advertised data includes:
⠀
• Names
• Resident registration numbers
• Gender and dates of birth
• Ages
• Insurance types
• Subscriber classifications
• Employer information
• Household identifiers
• Monthly income information
• Monthly insurance premiums
• Premium share information
• Number of dependents
• Regional information
• Insurance acquisition dates
• Last health checkup dates
• Long-term care grades
• Payment arrears status
• Card status
• Data export dates
⠀
The seller is asking $450 for the dataset and has published sample records in the forum listing.
⠀
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/106/101/794/663/367/original/5f61f2ba85812e7d.png

2026-08-16 01:15:19 GMT

🚨🇺🇸 McDonald’s internal employee dataset allegedly stolen from Azure tenant, 1.7M+ records advertised on a cybercrime forum
⠀
A forum seller claims to be offering an internal McDonald’s Corporation employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dump contains more than 1.7 million records.
⠀
The advertised data includes:
⠀
• Full names
• Employee IDs
• Email addresses
• Job titles
• Departments
• Phone numbers
• Physical addresses
• Employee account records
• Service account records
• Other tenant account information
⠀
The seller has published a sample containing approximately 8,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
⠀
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/102/537/513/659/943/original/d7c9d6ddde0e65ab.png

2026-08-15 17:21:24 GMT

🚨🇬🇧 Hardware wallet customer dataset advertised for sale on a cybercrime forum
⠀
A forum seller is advertising what they claim is a 2026 dataset containing customer information linked to hardware wallet purchases involving brands and services including Ledger, Arculus, Trezor and ShipMonk.
⠀
The sample records shown in the listing contain:
⠀
• Full names
• Phone numbers
• Email addresses
• Street addresses
• Postal codes
• Cities and regions
• Country information
• Order or customer reference numbers
⠀
The visible sample primarily contains records associated with individuals in the United Kingdom.
⠀
The seller's claims and the authenticity, source and scope of the advertised data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/100/673/946/550/213/original/ce5d33a58ee6da88.png

2026-08-13 15:23:01 GMT

🚨 ShinyHunters announces a "Notice of Warning" and a data leak for the company Carhartt, Inc.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/088/883/852/923/409/original/9feeb2d66df96948.png

2026-08-10 21:55:53 GMT

Starting August 2nd, all Claude models launched in the EU "will support machine-readable marking at launch. Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported."
Source: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/073/441/741/736/498/original/6650a56dcfc31630.png

2026-08-09 15:49:20 GMT

‼️🇫🇷 An actor claims to be selling access to Ameli Pro, the French health insurance system, allowing lookup of personal information tied to individuals social security numbers.
The post includes purported proof images and a Telegram contact for sale negotiations.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/066/338/088/696/064/original/416373686f022021.png

2026-08-09 15:28:43 GMT

🚨🇫🇷 CLCV consumer association database allegedly leaked
⠀
A forum actor claims to have leaked approximately 80,031 records associated with CLCV, a French national consumer and user advocacy organization.
⠀
The exposed data allegedly includes:
⠀
• Names and contact information
• Email addresses and phone numbers
• Postal addresses and cities
• Membership numbers
• Consumer request and complaint details
• Housing-related inquiries
• Mediation and intervention information
• Case status and follow-up details
• Sector and classification information
• Payment and transaction-related fields
⠀
The dataset is advertised in JSON format at roughly 109MB, with a sample published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/066/256/577/930/765/original/6a044df11cfc6780.png

2026-07-31 22:21:36 GMT

‼️🇺🇸 The Washington Post reports: "U.S. intelligence agencies have assessed that Iran was likely behind a coordinated cyberattack on more than 30 municipal water systems in Minnesota this week, according to several U.S. officials."
https://www.washingtonpost.com/national-security/2026/07/30/us-spy-agencies-suspect-iran-launched-cyberattack-minnesota-water-facilities/

2026-07-31 20:34:35 GMT

"Sleep at Night Technology" 🤡
Re: https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/016/497/808/989/444/original/baddeb9e817f6d18.png

2026-07-24 16:40:02 GMT

‼️ New Dark Web Informer Blog Post!
Title: Podomoro University Allegedly Breached, 75 Databases and Full Website Source Code Offered for $7,000
Link: https://darkwebinformer.com/podomoro-university-allegedly-breached-75-databases-and-full-website-source-code-offered-for-7-000/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-07-23 18:13:18 GMT

🚨🇷🇺 Russian state-backed hackers can steal 90 days of Zimbra emails when a victim simply views a message
A joint international advisory warns that LAUNDRY BEAR is exploiting CVE-2025-66376 against unpatched Zimbra Collaboration Suite servers.
The malicious JavaScript executes when an email is viewed in a vulnerable version of Zimbra webmail. No link click, attachment, or additional interaction is required.
The group’s Ulej tool attempts to steal:
• The victim’s last 90 days of emails
• Email addresses and organization directories
• Saved passwords
• 2FA recovery codes
• Newly created application passwords
The attackers can also enable IMAP and create an application password named “ZimbraWeb” to maintain access to compromised mailboxes.
The vulnerability was patched in Zimbra 10.0.18 and 10.1.13. Organizations running older versions should update immediately and investigate for signs of compromise.
Full details: https://www.ic3.gov/CSA/2026/260723.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/644/154/184/489/original/6ff2bff67b4f9282.png

2026-07-23 17:56:52 GMT

‼️ Robinhood CEO’s X account has been hacked.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/580/330/712/572/original/77c25ff028ca4e67.png

2026-07-23 17:46:35 GMT

🚨 NightSpire ransomware DLS IP leak 👇
154[.]29[.]74[.]158
Credit: https://x.com/DarkJstr/status/2080308644625965331