Nostr notes by Dark Web Informer :verified_paw:

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and ...

2026-09-24T19:41:58Z

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)

GitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/

A few minor updates... - Some forums manually moderate and ...

2026-09-24T19:31:42Z

A few minor updates...

- Some forums manually moderate and approve threads. When a thread appears on the feed with a creation time from a few hours earlier, that delay is outside my control. The feed picks it up as soon as possible after moderators approve it. This also affects some subdreads. I’ve added a note above the threat feed explaining this.

- Newly announced markets are not added to the Growing Markets page. I’m creating new threat surface source pages, and these markets will be added to a separate markets page.

- I’m updating the backend for the Ransomware Feed and hope to have it ready in late October. These updates should allow new claims to appear on the feed as soon as operators publish them, so near real-time.

🚨🇦🇪 ECC Group database containing 52K+ records allegedly ...

2026-09-11T18:55:45Z

🚨🇦🇪 ECC Group database containing 52K+ records allegedly leaked by AnkaTeam
⠀
ECC Group is a Dubai-based group of companies operating across construction, engineering, fit-out, manufacturing, building materials, facilities, and real estate development.
⠀
An actor using the handle SALDIRGAN, identifying with AnkaTeam, claims to have leaked a database associated with ECC Group’s official website.
⠀
Claimed exposed data includes:
⠀
• 52,444 database records
• WordPress user accounts
• Usernames and display names
• Email addresses
• Password hashes
• User registration dates
• Account activation data
• Other WordPress database records
⠀
The actor identifies the backend as MariaDB and the affected CMS as WordPress, describing the incident as a database dump exposure. A sample administrator record was published alongside the claim.
⠀
The breach claim, record count, and full scope of the exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Citya Immobilier ...

2026-09-11T18:21:03Z

‼️ New Dark Web Informer Blog Post!

Title: Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes

Link: https://darkwebinformer.com/citya-immobilier-dataset-claim-covers-2-2m-records-and-50k-digicodes/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

‼️ Darknet Markets Timeline was added to show that ...

2026-09-11T17:46:08Z

‼️ Darknet Markets Timeline was added to show that DarkMattter Market is exit scamming. I'm in the process of updating the timeline to look and feel better as well as provide more information.

https://darkwebinformer.com/darknet-markets-timeline/

🚨 GitLab CVSS 10 vulnerability exploited just one day after ...

2026-09-11T17:24:17Z

🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure

Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.
⠀
The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.

Affected versions include:

• GitLab 18.7 through versions before 19.1.8
• GitLab 19.2 through versions before 19.2.6
• GitLab 19.3 through versions before 19.3.2
⠀
GitLab disclosed and patched the vulnerability on September 10.

Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.
⠀
Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.

GitLab.com is already patched.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

‼️ New Dark Web Informer Blog Post! Title: Boulanger Dataset ...

2026-09-11T16:48:55Z

‼️ New Dark Web Informer Blog Post!

Title: Boulanger Dataset Claim Covers 132,230 Customer and Service Records

Link: https://darkwebinformer.com/boulanger-dataset-claim-covers-132-230-customer-and-service-records/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇮🇩 Universitas Andalas dataset containing 118K+ ...

2026-09-11T16:15:33Z

🚨🇮🇩 Universitas Andalas dataset containing 118K+ accounts allegedly leaked
⠀
Universitas Andalas is a public university in Padang, West Sumatra, Indonesia, operating academic, administrative, and research systems including numerous online journal platforms.
⠀
A forum actor using the handle Koyot claims to have obtained data covering 118,289 user accounts across 40 academic journal instances, along with administrative accounts tied to the university’s main Joomla portal and journal systems.
⠀
Claimed exposed data includes:
⠀
• Usernames and display names
• Institutional email addresses
• bcrypt and MD5 password hashes
• Registration and last-login timestamps
• TOTP 2FA seeds and emergency recovery codes
• Active session IDs and remember-me tokens
• Names, dates of birth, phone numbers, and addresses
• Academic affiliations and ORCID identifiers
• Biographies and CV information
• Manuscript and peer-review working files
• Reviewer assignments
• Publication-fee payment records
• Institutional subscriber IP ranges
• Administrative and CMS records
⠀
The actor claims the dump was extracted in September 2026 and includes data from the university’s main portal and 40 Open Journal Systems instances. A sample of the purported records was published with the listing.
⠀
The dataset is being offered as a single sale for $200 in XMR, with escrow reportedly accepted.
⠀
The breach claim, record count, authenticity of the data, and claimed exposure of 2FA material have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Generali Insurance ...

2026-09-11T15:52:50Z

‼️ New Dark Web Informer Blog Post!

Title: Generali Insurance Bulgaria Dataset Claim Covers 1,241,432 Personal Records

Link: https://darkwebinformer.com/generali-insurance-bulgaria-dataset-claim-covers-1-241-432-personal-records/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Metropolis ...

2026-09-11T15:33:47Z

‼️ New Dark Web Informer Blog Post!

Title: Metropolis Technologies Source Code Allegedly Stolen and Leaked

Link: https://darkwebinformer.com/metropolis-technologies-source-code-allegedly-stolen-and-leaked/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Kicksecure: Kicksecure is a hardened Linux operating system ...

2026-09-11T15:17:22Z

Kicksecure: Kicksecure is a hardened Linux operating system designed for security-sensitive computing. It includes protections against malware and exploits, stronger system isolation, hardened defaults, and physical-security features such as a panic-key emergency shutdown that can quickly power off the system if it is at risk of being physically compromised.

Link: https://www.kicksecure.com/

🚨🇺🇸 Forum actor solicits U.S. tax forms for refund ...

2026-09-11T14:57:16Z

🚨🇺🇸 Forum actor solicits U.S. tax forms for refund filing operation
⠀
U.S. tax forms such as 1040s, 1065s, 1099s, W-2s, and W-9s can contain sensitive taxpayer, income, employment, and business information used for federal tax reporting.
⠀
A forum actor using the handle Elkmann is seeking partners who can provide tax-form data from compromised targets, claiming they can process the information and file for refunds throughout the year.
⠀
Forms being requested include:
⠀
• Form 1040 individual tax returns
• Form 1065 partnership returns
• Form 1099 information returns
• W-2 wage and tax statements
• W-9 taxpayer identification forms
• W-9 records accompanied by email access
⠀
The actor states they can process as many forms as partners can provide and is actively seeking partnerships ahead of the next tax season.
⠀
Minimum quantities are reportedly discussed privately, with initial contact requested through forum messages.
⠀
The legitimacy, scale, and success of the claimed refund operation have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇧🇷 Municipality of Arcos dataset allegedly leaked, ...

2026-09-07T23:19:03Z

🚨🇧🇷 Municipality of Arcos dataset allegedly leaked, 484.7 MB of data claimed
⠀
Prefeitura Municipal de Arcos, the municipal government of Arcos in Minas Gerais, Brazil, is named in a cybercrime forum post where a threat actor claims to have obtained and released data associated with the municipality’s official government portal.
⠀
Claimed exposure
⠀
• Municipal employee names
• Government email addresses
• Department and role information
• Internal contact records
• vCard-style contact data
• Approximately 484.7 MB of files
⠀
The actor published a sample containing municipal staff contact information, including names, departments and official arcos.mg.gov.br email addresses.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"whats the best wallet for xmr?" Feather in my opinion. ...

2026-09-07T22:43:43Z

"whats the best wallet for xmr?"

Feather in my opinion.

Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/1eae3d3e885062f0b695

‼️ The DL sample made publicly on ShinyHunters pay or leak ...

2026-09-07T21:06:50Z

‼️ The DL sample made publicly on ShinyHunters pay or leak site is Jeffrey Epstein.

🚨🇺🇸 Spirit Cultural Exchange allegedly breached, 170 GB ...

2026-09-05T22:15:04Z

🚨🇺🇸 Spirit Cultural Exchange allegedly breached, 170 GB of data claimed

Spirit Cultural Exchange, a U.S.-based provider of international cultural exchange and J-1 visa programs, has been named in an extortion post on a cybercrime forum.

Claimed exposure

• 170 GB of data
• 136,817 files
• Passport files and face images
• Employment verification documents
• Degree diplomas
• Host school offers
• Letters of reference
• Criminal background checks
• Additional participant documents

Extortion demand: $100,000
Deadline: September 20, 2026

The actor claims the data will be offered for sale if the ransom is not paid.

The breach claim, exposed data and scope have not been independently verified.

💥 Get the intel threat actors see when they post it.
darkwebinformer.com/pricing

⚠️ Dark Matter Market public links are currently down. ...

2026-09-05T19:06:43Z

⚠️ Dark Matter Market public links are currently down. Private links are working, but some are complaining that their private links aren't. Treat with caution.

Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/598f789643cae0d3f573

🚨🇫🇷 YouFID dataset allegedly leaked on a cybercrime ...

2026-09-05T16:31:29Z

🚨🇫🇷 YouFID dataset allegedly leaked on a cybercrime forum, 7.8K people claimed
⠀
YouFID, a French customer loyalty and engagement platform that helps businesses manage digital loyalty programs and rewards, is named in a cybercrime forum post where a threat actor claims to have leaked a partial dataset containing information tied to 7,880 people.
⠀
The advertised data includes:
⠀
• Full names
• Email addresses
• Phone numbers
• Associated date fields
⠀
The actor claims the dataset contains 7,880 lines of data totaling approximately 805 KB, provided in JSON format.
⠀
A sample of the allegedly exposed records was also published in the forum post.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Motorola internal AI and GenAI infrastructure access ...

2026-09-03T15:20:23Z

🚨🇺🇸 Motorola internal AI and GenAI infrastructure access allegedly offered for sale on a cybercrime forum
⠀
Motorola, a U.S.-based telecommunications and technology company, is allegedly affected by a significant security compromise after a threat actor claimed to have accessed internal environments supporting the company’s GenAI and AI engineering infrastructure.
⠀
The actor claims the compromised environment includes:
⠀
• Internal repositories and source code
• GenAI modules, proxies and custom agents
• Model Context Protocol (MCP) servers
• Jira MCP infrastructure
• Frog MCP infrastructure
• Bitbucket MCP infrastructure
• Enterprise integration systems
• CI/CD pipelines
• Salesforce-related pipelines
• ServiceNow-related pipelines
• Azure RAG infrastructure
• Internal documentation
• Chat transcripts
• Monitoring and reporting systems
• Additional AI engineering assets
⠀
The actor published multiple screenshots presented as proof of access and states that the compromised environment and associated assets are now being offered for sale.
⠀
No public asking price is provided, with prospective buyers directed to contact the actor privately for verification, additional details and pricing.
⠀
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇮🇳 FortiGate appliance credentials tied to multiple ...

2026-09-03T15:01:40Z

🚨🇮🇳 FortiGate appliance credentials tied to multiple Indian IT companies allegedly offered for sale on a cybercrime forum
⠀
Multiple small and medium-sized IT and consulting companies in India are allegedly affected after a threat actor advertised credentials associated with their FortiGate appliances.
⠀
The seller describes the affected organizations as primarily providing IT support and consulting services, with claimed annual revenues ranging from approximately $300,000 to $1.5 million.
⠀
The advertised access includes:
⠀
• FortiGate appliance credentials
• IP addresses
• Usernames
• Passwords
• FortiGate identifiers
• Access associated with IT and consulting environments
⠀
The number of affected users or appliances is not specified in the listing.
⠀
The actor is asking $5,000 or a higher offer for the alleged access and is offering proof privately to prospective buyers.
⠀
The claims and the authenticity, scope and current validity of the allegedly compromised credentials have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ Security researcher Nightmare Eclipse has released a new ...

2026-09-03T13:14:56Z

‼️ Security researcher Nightmare Eclipse has released a new zero-day called FalconFlank, a CrowdStrike Falcon local privilege escalation (LPE) vulnerability.

GitHub: https://github.com/MSNightmare/FalconFlank

‼️ Everest Ransomware IP Leak: Original credit to ...

2026-09-01T23:52:11Z

‼️ Everest Ransomware IP Leak:

Original credit to nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqpwvaszf6w3hndeqpv3urp37vhca2xhex43ueatgr6ql694h95sqsc9ncvn (nprofile…ncvn).

IP: 62.60.155.107

ASN: 203273 🇬🇧
Org: NetCrafters OU

Ports: 22, 25, 53, 80, 2525, 3306, 3389, 8080

Censys: https://platform.censys.io/hosts/62.60.155.107

FOFA: https://en.fofa.info/result?qbase64=NjIuNjAuMTU1LjEwNw==

🚨🇫🇷 DELKO customer dataset allegedly offered for sale on ...

2026-08-30T16:33:13Z

🚨🇫🇷 DELKO customer dataset allegedly offered for sale on a cybercrime forum, 50K+ customers claimed
⠀
DELKO, a French automotive maintenance and repair network providing vehicle servicing, mechanical repairs and tire services, is allegedly affected by a data exposure after a threat actor advertised what they claim is the company's complete customer dataset.
⠀
The actor claims the dataset contains information associated with more than 50,000 customers.
⠀
The advertised data includes:
⠀
• Customer IDs
• First and last names
• Email addresses
• Phone numbers
• Vehicle registration numbers
• Account creation dates
• Appointment dates
• Appointment types
• Mechanical service information
• Tire service information
• Vehicle inspection and maintenance records
• Service amounts and pricing fields
• Additional service and appointment details
⠀
The actor published samples of the alleged customer records along with images presented as proof of access.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Ransomware Group: ZaWoo Dark Web: ...

2026-08-29T23:01:59Z

‼️ New Ransomware Group: ZaWoo

Dark Web: https://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf2nyd[.]onion

‼️ New RaidForums domain: raidforums[.]im ...

2026-08-29T19:21:46Z

‼️ New RaidForums domain:

raidforums[.]im

95[.]216[.]247[.]178

🚨 Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices A ...

2026-08-28T17:08:41Z

🚨 Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices

A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.

CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:

• Access sensitive configuration data
• Modify device settings
• Disrupt device availability

Affected firmware: FW-9167-0-11

Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.

CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06

🚨🇶🇦 Qatar General Retirement & Social Insurance ...

2026-08-28T15:47:00Z

🚨🇶🇦 Qatar General Retirement & Social Insurance Authority allegedly breached, internal accounts and API tokens exposed

Qatar General Retirement & Social Insurance Authority (GRSIA) is allegedly affected by a breach after a threat actor published samples claiming to originate from systems associated with the authority.

The advertised data includes:

• Internal and partner user accounts
• First and last names
• Email addresses
• User and partner account types
• Partner IDs
• Store IDs
• Account roles and permissions
• Account status information
• API names and environment identifiers
• API authentication tokens
• Token expiration dates
• Record creation and update timestamps

The samples include entries labeled API Testing and GRSIA_PROD, along with records for internal users, partner administrators and store users. Several organizations and partner accounts also appear within the sample data.

The actor additionally published what they claim is a publicly reachable system endpoint and provided a download link containing the alleged material.

The claims and the authenticity, source and scope of the allegedly exposed data and credentials have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Actis Location dataset allegedly leaked on a ...

2026-08-28T15:16:50Z

🚨🇫🇷 Actis Location dataset allegedly leaked on a cybercrime forum, 464GB and 666K+ files claimed
⠀
Actis Location, a French company specializing in the rental of construction, industrial and professional equipment, is allegedly affected by a data exposure after a threat actor published what they claim is company data obtained as part of the BigCloud leak series.
⠀
The actor claims the exposed material totals approximately 464 GB and contains 666,155 files, with portions of the data converted to text for publication.
⠀
The advertised data includes:
⠀
• Email communications
• Employee and customer names
• Email addresses
• Phone numbers
• Physical addresses
• Cities, postal codes and countries
• CRM records
• Customer and company account information
• Internal reference numbers
• Rental and quotation documents
• Contract-related information
• Equipment and product details
• Pricing and payment-related information
• Rental dates and durations
• Additional internal business documents
⠀
The forum post includes samples of alleged email, CRM and document data, along with download links for the material. The actor describes Actis Location as BigCloud Leak #15.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ DarkForums is back up under the domain I discovered ...

2026-08-27T23:09:58Z

‼️ DarkForums is back up under the domain I discovered earlier today:

darkforums[.]as

https://x.com/DarkWebInformer/status/2093018895846162799?s=20

🚨 Hinge database allegedly offered for sale on a cybercrime ...

2026-08-26T16:30:45Z

🚨 Hinge database allegedly offered for sale on a cybercrime forum, 34M+ unique user records claimed
⠀
Hinge, a dating application operated by Match Group, is allegedly affected by a data exposure after a threat actor advertised what they claim is the platform's complete database containing more than 34 million unique user records.
⠀
The advertised data includes:
⠀
• Full names
• Email addresses
• Phone numbers
• Dates of birth and ages
• Gender and pronouns
• Sexual orientation
• Cities, states and countries
• Ethnicity and religion
• Political preferences
• Drinking and smoking information
• Marijuana and drug-use preferences
• Children and family plans
• Dating intentions and relationship preferences
• Education and employment information
• Profile prompts and answers
• Account and verification status
• Subscription and billing metadata
• Match, like and profile activity information
⠀
The actor published a sample of the alleged database containing extensive account and profile fields and is offering the dataset for $350 in cryptocurrency.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Use the link below for anything CYBERLEEK related. This link is ...

2026-08-26T16:00:32Z

Use the link below for anything CYBERLEEK related. This link is defanged so remove the brackets [.]

https://ju3hayvlyj4mbemqheplf3px5d6j673oszj6atv6ukta7phiy22a[.]arweave[.]net/TTZwYqvCeMCRkDkesu336Pyff26WU-BOvqKmD7zoxrQ

🚨🇲🇽 Universidad Autónoma de Sinaloa employee documents ...

2026-08-26T15:31:19Z

🚨🇲🇽 Universidad Autónoma de Sinaloa employee documents allegedly leaked on a cybercrime forum
⠀
Universidad Autónoma de Sinaloa (UAS), a public university in Sinaloa, Mexico, is allegedly affected by a data exposure after a threat actor claimed to have extracted employee information and documents from a university personnel system.
⠀
The actor claims the files were organized using employees' RFC and CURP identifiers and contain documentation associated with individual university staff members.
⠀
The advertised data includes:
⠀
• INE voter identification credentials
• Birth certificates
• CURP identifiers
• RFC tax identifiers
• Employee photographs
• Proof-of-address documents
• Tax and fiscal status certificates
• Academic diplomas
• Employment contracts and appointment letters
• Paid and unpaid leave documents
• Full names
• Dates of birth
• Gender information
• Phone numbers
• Email addresses
• SAT-related tax information
• Hire dates, seniority and employment history
⠀
The post also includes a sample of the alleged employee database and provides a download link for the claimed documents.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Nitter development has stopped after X Corp. sent ...

2026-08-25T22:36:40Z

🚨 Nitter development has stopped after X Corp. sent cease-and-desist letters demanding the permanent takedown of Nitter instances and the project’s repository.

The maintainer says nitter.net is now offline while legal advice is being sought. Nitter had operated for more than seven years.

Every. Day. ...

2026-08-25T20:10:26Z

Every. Day.

🚨🇯🇵 Nintendo targets more than 400 Switch emulator ...

2026-08-22T22:39:42Z

🚨🇯🇵 Nintendo targets more than 400 Switch emulator repositories in massive GitHub sweep

Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.

The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.

Other targets included:

• 29 Skyline repositories
• Multiple Yuzu forks and Android ports
• 17 MonoNX forks
• Yuzu Early Access mirrors

Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.

Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.

Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/

🚨 Trezor phishing injection tool advertised on a cybercrime ...

2026-08-22T17:35:03Z

🚨 Trezor phishing injection tool advertised on a cybercrime forum for $3,000
⠀
A forum seller is advertising AntiTrezor, a phishing injection tool designed to impersonate the Trezor Suite interface and capture cryptocurrency wallet recovery seed phrases.
⠀
The advertised features include:
⠀
• Injection directly into the Trezor Suite interface
• Phishing flow styled to resemble the legitimate application
• Seed phrase capture
• Persistence across system reboots
• Windows 10 and 11 support
• Support for multiple Trezor device models
• Fake error and troubleshooting prompts intended to pressure victims
• Ability to display captured wallet balances in an operator panel
• Administrative notifications when a victim interacts with the phishing flow
⠀
The listing claims the tool can prevent victims from moving funds after submitting their recovery phrase and is designed to operate without modifying official Trezor executables.
⠀
The source code is being advertised for $3,000.
⠀
The seller's claims and the capabilities of the tool have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇻🇪 Venezuela's SAIME citizen database allegedly ...

2026-08-21T15:18:31Z

🚨🇻🇪 Venezuela's SAIME citizen database allegedly leaked, 35M records claimed
⠀
A forum user claims to have released an updated dataset allegedly obtained from Venezuela's Administrative Service for Identification, Migration and Immigration (SAIME), containing approximately 35 million citizen and resident records.
⠀
The advertised data includes:
⠀
• National identity document numbers
• First and middle names
• Paternal and maternal surnames
• Dates of birth
• Gender information
• Record lookup timestamps
• Venezuelan and foreign resident records
⠀
The listing claims the dataset contains 32,647,087 Venezuelan records and 2,331,247 foreign resident records. The Venezuelan portion is described as approximately 2.21 GB uncompressed, while the foreign resident dataset is listed at roughly 450 MB.
⠀
Samples from both record types were published in the thread, with the data distributed in TXT and JSON formats.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ A forum user is seeking to buy Stripe and PayPal API keys ...

2026-08-17T16:55:52Z

‼️ A forum user is seeking to buy Stripe and PayPal API keys in bulk on a daily basis, stating account balance is not required. The buyer claims to test keys before purchase and requests low bulk pricing.

🚨🇰🇷 South Korea National Health Insurance Service ...

2026-08-16T16:21:46Z

🚨🇰🇷 South Korea National Health Insurance Service dataset allegedly leaked on a cybercrime forum, 48M records advertised for sale
⠀
A forum seller claims to be offering a dataset allegedly containing personal and health insurance-related information from South Korea's National Health Insurance Service (NHIS). The seller says the dataset contains approximately 48 million records.
⠀
The advertised data includes:
⠀
• Names
• Resident registration numbers
• Gender and dates of birth
• Ages
• Insurance types
• Subscriber classifications
• Employer information
• Household identifiers
• Monthly income information
• Monthly insurance premiums
• Premium share information
• Number of dependents
• Regional information
• Insurance acquisition dates
• Last health checkup dates
• Long-term care grades
• Payment arrears status
• Card status
• Data export dates
⠀
The seller is asking $450 for the dataset and has published sample records in the forum listing.
⠀
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 McDonald’s internal employee dataset allegedly ...

2026-08-16T01:15:19Z

🚨🇺🇸 McDonald’s internal employee dataset allegedly stolen from Azure tenant, 1.7M+ records advertised on a cybercrime forum
⠀
A forum seller claims to be offering an internal McDonald’s Corporation employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dump contains more than 1.7 million records.
⠀
The advertised data includes:
⠀
• Full names
• Employee IDs
• Email addresses
• Job titles
• Departments
• Phone numbers
• Physical addresses
• Employee account records
• Service account records
• Other tenant account information
⠀
The seller has published a sample containing approximately 8,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
⠀
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇬🇧 Hardware wallet customer dataset advertised for sale ...

2026-08-15T17:21:24Z

🚨🇬🇧 Hardware wallet customer dataset advertised for sale on a cybercrime forum
⠀
A forum seller is advertising what they claim is a 2026 dataset containing customer information linked to hardware wallet purchases involving brands and services including Ledger, Arculus, Trezor and ShipMonk.
⠀
The sample records shown in the listing contain:
⠀
• Full names
• Phone numbers
• Email addresses
• Street addresses
• Postal codes
• Cities and regions
• Country information
• Order or customer reference numbers
⠀
The visible sample primarily contains records associated with individuals in the United Kingdom.
⠀
The seller's claims and the authenticity, source and scope of the advertised data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 ShinyHunters announces a "Notice of Warning" and a ...

2026-08-13T15:23:01Z

🚨 ShinyHunters announces a "Notice of Warning" and a data leak for the company Carhartt, Inc.

Starting August 2nd, all Claude models launched in the EU ...

2026-08-10T21:55:53Z

Starting August 2nd, all Claude models launched in the EU "will support machine-readable marking at launch. Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported."

Source: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

‼️🇫🇷 An actor claims to be selling access to Ameli Pro, ...

2026-08-09T15:49:20Z

‼️🇫🇷 An actor claims to be selling access to Ameli Pro, the French health insurance system, allowing lookup of personal information tied to individuals social security numbers.

The post includes purported proof images and a Telegram contact for sale negotiations.

🚨🇫🇷 CLCV consumer association database allegedly leaked ...

2026-08-09T15:28:43Z

🚨🇫🇷 CLCV consumer association database allegedly leaked
⠀
A forum actor claims to have leaked approximately 80,031 records associated with CLCV, a French national consumer and user advocacy organization.
⠀
The exposed data allegedly includes:
⠀
• Names and contact information
• Email addresses and phone numbers
• Postal addresses and cities
• Membership numbers
• Consumer request and complaint details
• Housing-related inquiries
• Mediation and intervention information
• Case status and follow-up details
• Sector and classification information
• Payment and transaction-related fields
⠀
The dataset is advertised in JSON format at roughly 109MB, with a sample published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇺🇸 The Washington Post reports: "U.S. ...

2026-07-31T22:21:36Z

‼️🇺🇸 The Washington Post reports: "U.S. intelligence agencies have assessed that Iran was likely behind a coordinated cyberattack on more than 30 municipal water systems in Minnesota this week, according to several U.S. officials."

https://www.washingtonpost.com/national-security/2026/07/30/us-spy-agencies-suspect-iran-launched-cyberattack-minnesota-water-facilities/

"Sleep at Night Technology" 🤡 Re: ...

2026-07-31T20:34:35Z

"Sleep at Night Technology" 🤡

Re: https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep

‼️ New Dark Web Informer Blog Post! Title: Podomoro ...

2026-07-24T16:40:02Z

‼️ New Dark Web Informer Blog Post!

Title: Podomoro University Allegedly Breached, 75 Databases and Full Website Source Code Offered for $7,000

Link: https://darkwebinformer.com/podomoro-university-allegedly-breached-75-databases-and-full-website-source-code-offered-for-7-000/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇷🇺 Russian state-backed hackers can steal 90 days of ...

2026-07-23T18:13:18Z

🚨🇷🇺 Russian state-backed hackers can steal 90 days of Zimbra emails when a victim simply views a message

A joint international advisory warns that LAUNDRY BEAR is exploiting CVE-2025-66376 against unpatched Zimbra Collaboration Suite servers.

The malicious JavaScript executes when an email is viewed in a vulnerable version of Zimbra webmail. No link click, attachment, or additional interaction is required.

The group’s Ulej tool attempts to steal:

• The victim’s last 90 days of emails
• Email addresses and organization directories
• Saved passwords
• 2FA recovery codes
• Newly created application passwords

The attackers can also enable IMAP and create an application password named “ZimbraWeb” to maintain access to compromised mailboxes.

The vulnerability was patched in Zimbra 10.0.18 and 10.1.13. Organizations running older versions should update immediately and investigate for signs of compromise.

Full details: https://www.ic3.gov/CSA/2026/260723.pdf

‼️ Robinhood CEO’s X account has been hacked. ...

2026-07-23T17:56:52Z

‼️ Robinhood CEO’s X account has been hacked.

🚨 NightSpire ransomware DLS IP leak 👇 154[.]29[.]74[.]158 ...

2026-07-23T17:46:35Z

🚨 NightSpire ransomware DLS IP leak 👇

154[.]29[.]74[.]158

Credit: https://x.com/DarkJstr/status/2080308644625965331

💥 Darkdump: An open-source OSINT tool for deep web ...

2026-07-20T23:24:03Z

💥 Darkdump: An open-source OSINT tool for deep web investigation.

GitHub: https://github.com/josh0xA/darkdump

Given a search query it fetches results from multiple dark web search engines, optionally scrapes each result site for emails, metadata, keywords, documents, and images, and streams everything live to either the terminal or a local browser-based interface.

Windows is the only landlord that charges rent, installs a ...

2026-07-20T17:39:21Z

Windows is the only landlord that charges rent, installs a billboard in your living room, and calls it a feature.

💥 PlayStation 4 emulator for Windows, Linux, macOS and FreeBSD ...

2026-07-19T00:58:50Z

💥 PlayStation 4 emulator for Windows, Linux, macOS and FreeBSD written in C++

GitHub: https://github.com/shadps4-emu/shadPS4

🖕Sony

💥 DocuSeal: An open source platform that provides secure and ...

2026-07-18T18:25:46Z

💥 DocuSeal: An open source platform that provides secure and efficient digital document signing and processing.

GitHub: https://github.com/docusealco/docuseal

Demo: https://demo.docuseal.tech

‼️ CVE-2026-58635: Windows Narrator Braille Local Privilege ...

2026-07-16T22:27:13Z

‼️ CVE-2026-58635: Windows Narrator Braille Local Privilege Escalation

PoC: https://github.com/DavidCarliez/CVE-2026-58635-PoC

💥 I will be adding my repositories from GitHub to my own site ...

2026-07-16T19:51:43Z

💥 I will be adding my repositories from GitHub to my own site this weekend. I've added Telegram Checker for now. You cannot register, only view... for the time being. I will update once everything has been migrated.

Link: https://git.darkwebinformer.com/

Microsoft fixed an Age of Empires RCE from yesterday’s Patch ...

2026-07-15T20:18:06Z

Microsoft fixed an Age of Empires RCE from yesterday’s Patch Tuesday (CVE-2026-50663). Here is an example of how it was done.

Credit: https://x.com/rdjgr/status/2077331427549421918

‼️ New Dark Web Informer Blog Post! Title: Welsh Doxbin ...

2026-07-14T16:16:58Z

‼️ New Dark Web Informer Blog Post!

Title: Welsh Doxbin Administrator Jailed for Encouraging Swatting Attacks Across Three Countries

Link: https://darkwebinformer.com/welsh-doxbin-administrator-jailed-for-encouraging-swatting-attacks-across-three-countries/

🚨🇲🇽 Guanajuato health patient and staff dataset ...

2026-07-09T15:06:02Z

🚨🇲🇽 Guanajuato health patient and staff dataset allegedly leaked

A forum actor claims to have leaked data tied to Guanajuato health services in Mexico, with the listing referencing emergency patient records and SALUD Guanajuato personnel.

The visible samples show JSON-style records that appear to include patient admission and emergency-care fields such as names, surnames, CURPs, sex, age, dates, hospital/attention details, diagnosis or procedure-style fields, and residency information.

A second sample appears to focus on staff records, including usernames, names, CURPs, emails, phone numbers, institutional data, job or personnel fields, and access/account metadata.

This claim is currently unverified.

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

🚨 Critical Gitea flaw CVE-2026-20896 is being probed in the ...

2026-07-07T17:38:26Z

🚨 Critical Gitea flaw CVE-2026-20896 is being probed in the wild

Researchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.

The issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.

The vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container’s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.

Gitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.

Sysdig says the first in-the-wild probing was seen 13 days after disclosure.

Observed IP: 159[.]26[.]98[.]241

🚨 NetNut[.]io has finally been seized by the FBI. ...

2026-07-06T19:55:14Z

🚨 NetNut[.]io has finally been seized by the FBI.

💥OpenOSINT turns OSINT into a terminal-based AI agent. Give it ...

2026-07-02T19:59:57Z

💥OpenOSINT turns OSINT into a terminal-based AI agent.

Give it an email, username, domain, IP, or target, and it can chain real tools, pivot on findings, and save a structured report.

GitHub: https://github.com/OpenOSINT/OpenOSINT

Live Demo: https://demo.openosint.tech/

🚨ULP Parser Checker tool advertised on a forum A forum user is ...

2026-06-29T21:34:04Z

🚨ULP Parser Checker tool advertised on a forum

A forum user is advertising ULP Parser Checker, a tool described as being used to read, extract, and simplify data from large activity logs or unstructured text collections.

The post shows example output involving keyword searches across log-style records.

Advertised tool includes:

• URL / login parser functionality
• Large log file processing
• Keyword-based filtering
• Account count summaries
• Domain-based result extraction
• Telegram and download references

‼️ CVE-2026-24418: OpenSTAManager v2.9.8 and earlier contain ...

2026-06-29T18:55:30Z

‼️ CVE-2026-24418: OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module.

GitHub: https://github.com/BridgerAlderson/CVE-2026-24418

🚨🇫🇷 Saint-Médard-en-Jalles municipal police dataset ...

2026-06-29T17:27:58Z

🚨🇫🇷 Saint-Médard-en-Jalles municipal police dataset claim posted on a forum

LogipolWeb.fr is a web platform used to support daily management for municipal police services.

A forum user claims a dataset tied to the Police municipale de Saint-Médard-en-Jalles was leaked, allegedly containing municipal police records, logs, files, and case-related documents.

Advertised data includes:

• 470MB of data
• CSV, JSON, PDF, and image files
• 158,104 log lines
• 39,405 files in the fichiers folder
• 6,700 lost property records
• 1,679 handrail / incident-style records
• 767 call records
• 127 public reception records
• References to 14,642 additional victim files

Details:

• Target: Police municipale de Saint-Médard-en-Jalles / LogipolWeb.fr
• Country: France
• Sector: Government / Municipal police
• Actor: ChimeraZ
• Claim: Municipal police software dataset allegedly leaked
• Volume: 470MB claimed
• Category: Dataset leak claim

Claim is unverified.

💥 Stop guessing what's redacted. Paid subscribers see everything: http://darkwebinformer.com/pricing

Priorities: save the codebase, then yourself. ...

2026-06-28T17:16:22Z

Priorities: save the codebase, then yourself.

‼️🇰🇼 A data set allegedly from Zain Kuwait, a major ...

2026-02-11T16:41:24Z

‼️🇰🇼 A data set allegedly from Zain Kuwait, a major telecommunications provider, has been posted for sale containing 3,849,601 subscriber records totaling 11.3GB in JSON format.

The breach is dated 2026 and includes subscriber numbers, owner names, and associate names. Sample data shows Arabic-language subscriber records with phone numbers, verification status, and spam flags.

The seller offers tiered pricing in Monero: 15 XMR for takedown, 10 XMR for exclusive purchase with deletion, 5 XMR for non-exclusive access, or 2 XMR for the scraping exploit itself.

Story of my life. 😭 ...

2026-02-10T20:02:46Z

Story of my life. 😭

‼️🇬🇧 A data set allegedly from alphacapitalgroup.uk, a ...

2026-02-09T23:51:28Z

‼️🇬🇧 A data set allegedly from alphacapitalgroup.uk, a UK-based forex trading platform, has been posted for download.

The dump dates from May 2024 and contains 240,647 lines including payment IDs, transaction IDs, user IDs, emails, payment types, amounts in dollars, user profiles, countries, promo/coupon names, account login IDs, challenge names, and timestamps.

Sample data shows transactions from users across the UK, Australia, India, South Africa, Nigeria, Kuwait, and other countries with various "Alpha Pro" account tiers.

Daily Dose of Dark Web Informer - February 9th, 2026 ...

2026-02-09T23:21:41Z

Daily Dose of Dark Web Informer - February 9th, 2026

https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-9th-2026/

❗️🇦🇷 WordPress admin access to an Argentinian ...

2026-02-09T21:08:07Z

❗️🇦🇷 WordPress admin access to an Argentinian e-commerce store is being auctioned by a threat actor.

The listing claims a payment card redirect via MercadoPago is in place, with 100 orders in January and 26 in February, and 90% unique orders.

The auction starts at $300 with a blitz price of $600.

⚠️ The Weekly Whiskey - Valentine's Edition 02/09/2026 ...

2026-02-09T17:07:30Z

⚠️ The Weekly Whiskey - Valentine's Edition 02/09/2026

This is a 1:1 copy from Dread user /u/samwhiskey

https://darkwebinformer.com/the-weekly-whiskey-valentines-edition-02-09-2026/

‼️🇬🇧 UK Fast Food Chain Pepe's Piri Piri Allegedly ...

2026-02-09T16:50:41Z

‼️🇬🇧 UK Fast Food Chain Pepe's Piri Piri Allegedly Breached After Refusing Ransom, 2.1 Million Customer Records Leaked

https://darkwebinformer.com/uk-fast-food-chain-pepes-piri-piri-allegedly-breached-after-refusing-ransom-2-1-million-customer-records-leaked/

‼️🇮🇩🇦🇷 A threat actor is auctioning domain admin ...

2026-02-08T18:37:08Z

‼️🇮🇩🇦🇷 A threat actor is auctioning domain admin access to two companies, each with an estimated revenue of ~$35 million.

The first is an Indonesian finance/retail company with McAfee antivirus, and the second is an Argentinian hospitality company.

Both auctions start at $2,000 with a $500 step and a blitz price of $4,000.

❗️Alleged leak of Jeffrey Epstein client password list ...

2026-02-06T22:50:29Z

❗️Alleged leak of Jeffrey Epstein client password list

‼️ A threat actor using the handle "Anigma" is ...

2026-02-06T21:39:56Z

‼️ A threat actor using the handle "Anigma" is selling database access and platform control of a large logistics company on a dark web forum.

Screenshots show an internal management panel with €1,337,037.51 in payments processed between January and February 2026, and a client database containing 2,796 records.

The platform includes contract management, invoice generation, email capabilities, and routing data for shipments. The seller notes the company's main audience is businesses in Latvia, Lithuania, and Kazakhstan, with additional customers worldwide.

‼️🇨🇦 A set of 200 Canadian credit cards obtained via ...

2026-02-06T21:19:13Z

‼️🇨🇦 A set of 200 Canadian credit cards obtained via sniffing is being auctioned, with a claimed 75–95% validity rate.

The data includes full card numbers, CVVs, expiration dates, names, addresses, phone numbers, emails, and IPs. Card balances reportedly range from $300–$600. The auction starts at $2,000 with a blitz price of $6,000.

❗️🇺🇸 A group calling themselves "The Islamic Cyber ...

2026-02-06T19:38:52Z

❗️🇺🇸 A group calling themselves "The Islamic Cyber Resistance in Iraq - Team 313" has claimed responsibility for a cyberattack against the Internet Archive (archive.org).

The group posted a screenshot showing the site timing out, claiming the attack caused the website to go offline and was ongoing at the time of their announcement.

‼️🇦🇺 Synkli and The Kalculators, connected Australian ...

2026-02-06T19:34:41Z

‼️🇦🇺 Synkli and The Kalculators, connected Australian accounting software platforms, have allegedly been breached with data on 70,000+ consumers now posted for download.

The exposed records include business and personal client details such as names, emails, phone numbers, TFNs (Tax File Numbers), ABNs, postal and residential addresses, trust structures, and organizational relationships.

‼️🇯🇴 A French hacker collective calling themselves ...

2026-02-06T18:17:57Z

‼️🇯🇴 A French hacker collective calling themselves "X-VDP-X" claims to have compromised wsip.mwi.gov.jo, a Jordanian government site under the Ministry of Water and Irrigation.

The group states they have extracted sensitive information from the databases, with sample data available in CSV format.

‼️🇺🇸 Payouts Kings Ransomware Group Claims Attack on ...

2026-02-06T17:54:02Z

‼️🇺🇸 Payouts Kings Ransomware Group Claims Attack on Prater Engineering Associates, Threatens to Leak 2.5TB of Data

https://darkwebinformer.com/payouts-kings-ransomware-group-claims-attack-on-prater-engineering-associates-threatens-to-leak-2-5tb-of-data/

❗️🇮🇳 Indian IT Firm Leora Infotech Allegedly Breached, ...

2026-02-06T16:58:42Z

❗️🇮🇳 Indian IT Firm Leora Infotech Allegedly Breached, 35K User Records Listed for Sale

https://darkwebinformer.com/indian-it-firm-leora-infotech-allegedly-breached-35k-user-records-listed-for-sale/

‼️ Dutch authorities just seized one Windscribe VPN server ...

2026-02-06T00:20:50Z

‼️ Dutch authorities just seized one Windscribe VPN server without a warrant, claiming they'll return it after they "fully analyze it."

They say their real concern "is the unredacted Epstein files we had on there..."

❗️LeakBase has been down for about two days now. The last two ...

2026-02-05T23:48:08Z

❗️LeakBase has been down for about two days now. The last two times the site went offline, it remained down for a week or two. There’s no information on any new domains or updates, and no recent news regarding the site. It is, however, hosted by the notorious Njalla.

Daily Dose of Dark Web Informer - February 5th, 2026 ...

2026-02-05T23:19:54Z

Daily Dose of Dark Web Informer - February 5th, 2026

https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-5th-2026/

Eyedex: Open directory file search. Search in 2.6 PB of 2,529,928 ...

2026-02-05T21:08:01Z

Eyedex: Open directory file search. Search in 2.6 PB of 2,529,928 files among 338,376 directories on 103 servers.

https://www.eyedex.org/

‼️ CISA has added two vulnerabilities to the KEV Catalog ...

2026-02-05T20:27:07Z

‼️ CISA has added two vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability:

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability:

React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

‼️ Incognito Market Owner "Pharaoh" Sentenced to 30 ...

2026-02-05T16:30:37Z

‼️ Incognito Market Owner "Pharaoh" Sentenced to 30 Years for Running $105M Dark Web Drug Empire

Rui-Siang Lin, a 24-year-old Taiwanese national who operated under the pseudonym "Pharaoh," was sentenced to 30 years in federal prison on February 3, 2026, for running Incognito Market, one of the largest dark web narcotics marketplaces ever created.

The platform, which operated from October 2020 until its closure in March 2024, facilitated over 640,000 drug transactions totaling more than $105 million in sales. Its inventory included over 1,000 kilograms each of cocaine and methamphetamine, along with hundreds of kilograms of other narcotics and fentanyl-laced pills disguised as oxycodone.

The marketplace served more than 400,000 buyer accounts and hosted over 1,800 vendors, while Lin personally collected more than $6 million in profits.

Lin oversaw every aspect of Incognito Market's operations from various locations including St. Lucia, where he ironically conducted a training session for local police on cybercrime and cryptocurrency. The platform functioned like a professional e-commerce site, complete with branding, customer service, and its own internal cryptocurrency bank that kept buyers and sellers anonymous.

In January 2022, Lin introduced a policy explicitly allowing opiate sales on the site, which led to the sale of counterfeit oxycodone pills laced with fentanyl. directly contributing to the death of a 27-year-old man from Arkansas in September 2022.

When Lin shut down the marketplace in March 2024, he stole at least $1 million in user deposits and attempted to extort vendors and buyers by threatening to publish their transaction histories.

The sentencing judge called it the most serious drug crime she had encountered in 27.5 years on the bench. Lin was also ordered to forfeit over $105 million and serve five years of supervised release.

https://darkwebinformer.com/incognito-market-owner-pharaoh-sentenced-to-30-years-for-running-105m-dark-web-drug-empire/

‼️🇺🇸 Cardbase, a U.S.-based platform that aggregates ...

2026-02-05T16:11:58Z

‼️🇺🇸 Cardbase, a U.S.-based platform that aggregates trading card prices across 30+ marketplaces, has allegedly been breached.

The listing claims 248,000 user records containing emails, names, and profile pictures are for sale.

‼️🇬🇧 WordPress admin and shell access to a UK-based ...

2026-02-05T15:30:38Z

‼️🇬🇧 WordPress admin and shell access to a UK-based online shop is being auctioned. The store processes payments via Stripe iframe with roughly 558 orders across the last three months and a 70% unique order rate. The auction starts at $700 with a blitz price of $1,500.

‼️🇪🇸 Guardia Civil Dismantled a Bank Mule Network in La ...

2026-02-05T15:04:30Z

‼️🇪🇸 Guardia Civil Dismantled a Bank Mule Network in La Rioja

Under Operation Vicentius, Spain's Guardia Civil has identified 12 suspects linked to fraud, money laundering, and unauthorized access to computer systems.

The group allegedly operated fake cryptocurrency investment platforms and used remote access software to drain victims' bank accounts and take out loans in their names, causing an estimated €442,650 in total losses.

Stolen funds were funneled to accounts in Denmark, Lithuania, the United Kingdom, and China. The investigation remains ongoing as authorities work to trace and recover the money.

Source: Guardia Civil

❗️🇵🇱 Access to a Polish PrestaShop store with bank ...

2026-02-03T21:08:38Z

❗️🇵🇱 Access to a Polish PrestaShop store with bank transfer payment processing is being auctioned.

The shop has 4,363 total orders with 260 in the current month, split between 180 bank transfers and 57 cash-on-delivery. The auction starts at $400 with a blitz price of $750.

❗️🇫🇷 Data from "Choisir le service public," the ...

2026-02-03T20:55:32Z

❗️🇫🇷 Data from "Choisir le service public," the French government's official public sector job portal, is allegedly being sold.

The listing claims to contain records of 377,418 job seekers, with proof screenshots showing candidate profiles including personal details, emails, phone numbers, and application history.

OSINT-D2 ingests usernames and/or emails, aggregates public ...

2026-02-03T19:58:40Z

OSINT-D2 ingests usernames and/or emails, aggregates public evidence from multiple OSINT sources, and enriches the dataset with targeted scrapers.

GitHub: https://github.com/Doble-2/osint-d2

‼️ Reuters reports that French prosecutors raided X’s Paris ...

2026-02-03T18:09:49Z

‼️ Reuters reports that French prosecutors raided X’s Paris offices on Tuesday as part of a criminal investigation originally opened in January 2025 over alleged algorithm manipulation.

The probe has since expanded to include charges of complicity in distributing child sexual abuse material, generating sexually explicit deepfakes via the Grok AI chatbot, and Holocaust denial, which is a crime under French law.

The raid was carried out by the Paris prosecutor’s cybercrime unit with support from Europol and French police. Voluntary interview summonses for April 20 have been issued to both Elon Musk and former X CEO Linda Yaccarino.

X has previously denied wrongdoing and characterized the French investigation as politically motivated.

❗️🇲🇹 Gozo Channel, the ferry operator connecting ...

2026-02-03T17:56:49Z

❗️🇲🇹 Gozo Channel, the ferry operator connecting Malta's islands, confirmed it was targeted in a cyberattack on Tuesday. The company said the incident impacted certain internal IT systems but was quickly contained thanks to existing infrastructure safeguards and contingency protocols.

Ferry services were not disrupted. The company emphasized that all vessels continue to run on their normal schedule and that operations remain fully unaffected.

Technical teams are currently working to restore the administrative systems that were impacted, and the company plans to bring in specialist cybersecurity forensic experts to support the investigation and recovery effort.

https://www.independent.com.mt/articles/2026-02-03/local-news/Gozo-Channel-Ltd-maintains-full-ferry-operations-following-cyber-security-incident-6736286933

‼️🇺🇸 Infrastructure Destruction Squad claims to have ...

2026-02-03T00:36:02Z

‼️🇺🇸 Infrastructure Destruction Squad claims to have breached the servers of Lawrence Livermore National Laboratory, a facility affiliated with the U.S. Department of Energy.

The alleged breach reportedly includes over 15 TB of sensitive data encompassing engineering blueprints, classified internal video recordings, and documents related to nuclear physics, fusion, particle acceleration, and pulsed sphere experiments. The group is offering full server access for $12,000.

Daily Dose of Dark Web Informer - February 2nd, 2026 ...

2026-02-02T23:02:52Z

Daily Dose of Dark Web Informer - February 2nd, 2026

https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-2nd-2026/

Threat Attack Update - February 2nd, 2026 ...

2026-02-02T22:37:35Z

Threat Attack Update - February 2nd, 2026

https://darkwebinformer.com/threat-attack-update-february-2nd-2026/