home.social

Search

40 results for “darkwebinformer”

  1. Dark Web Informer :verified_paw: @darkwebinformer

    🚨 Cryptocurrency theft tool advertised for $90 to $310, supports automatic withdrawals across 25+ cryptocurrencies

    An actor known as "BEP20" is advertising "404 Crypto AutoWithdraw," a tool designed to automatically drain cryptocurrency wallets using stolen seed phrases and private keys.
    ⠀
    The software reportedly supports Bitcoin, Ethereum, Litecoin, Solana, TRON, USDT, and more than 25 cryptocurrencies. It includes wallet balance checking, automatic withdrawals, real-time transaction monitoring, and Telegram notifications.
    ⠀
    The seller also advertises a web dashboard and the ability to import large collections of compromised wallet credentials. The tool's advertised capabilities remain unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  2. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇵🇪 Peru's regional government agency C.A.F.E.D. allegedly breached, with 1.4 million records leaked

    The actor "femboy" claims to have compromised C.A.F.E.D., a regional government agency in Peru, and released approximately 1.4 million lines of data.
    ⠀
    The actor claims the information was published after a payment demand went unmet. They also claim to have deleted the agency's database and advised officials to restore it from backups.
    ⠀
    The breach and alleged database deletion remain unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  3. Dark Web Informer :verified_paw: @darkwebinformer

    "Jong Woo Son" has been added to the OpSec Failures page.

    Direct file: darkwebinformer.com/opsec-fail

  4. Dark Web Informer :verified_paw: @darkwebinformer

    ‼️ New Dark Web Informer Blog Post!

    Title: ISEP France User Database Leak Claim Lists 5,088 People Across 5,091 JSON Records

    Link: darkwebinformer.com/isep-franc

    💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: darkwebinformer.com/pricing

  5. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 U.S. Department of Homeland Security dataset containing over 6 million records advertised for $10,500

    An actor known as "INS" claims to have obtained a 1.98 GB dataset linked to the U.S. Department of Homeland Security (DHS), containing approximately 6.02 million records.
    ⠀
    The published sample includes names, dates of birth, government email addresses, password hashes, IP addresses, and account verification details.
    ⠀
    The actor has released a sample containing 582,911 records and is offering the full dataset for $10,500. The alleged DHS compromise and authenticity of the records remain unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  6. Dark Web Informer :verified_paw: @darkwebinformer

    ‼️ New Dark Web Informer Blog Post!

    Title: I-CAD Partial Database Sale Claim Lists 2.95 Million Records Covering 2.9 Million Animals and 50,629 Vets

    Link: darkwebinformer.com/i-cad-part

    💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: darkwebinformer.com/pricing

  7. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 Chicago International Film Festival dataset containing over 52,000 records allegedly leaked

    The Chicago International Film Festival, one of North America's longest-running competitive film festivals, has been named in a data breach claim involving 52,434 customer records.
    ⠀
    The actor "skra" claims to have obtained personal information including names, email addresses, phone numbers, and residential addresses.
    ⠀
    The alleged breach and authenticity of the records remain unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  8. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 Hudson Valley Seed customer order dataset containing 2 million records allegedly leaked

    Hudson Valley Seed Company, a New York-based business specializing in heirloom and open-pollinated garden seeds, has been named in a data breach claim involving approximately 2 million customer order records.
    ⠀
    The actor "skra" claims the dataset contains customer email addresses, purchased products, pricing information, and geographic details.
    ⠀
    The alleged breach and authenticity of the dataset remain unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  9. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇫🇷 ZOU! transport service allegedly breached, with over 89,000 records exposed

    An actor known as "blocus" claims to have leaked 89,083 records from ZOU!, the regional public transport network serving southern France.
    ⠀
    The dataset reportedly contains passenger names, membership numbers, residential addresses, phone numbers, ages, registration dates, and account activity.

    Published samples also include records belonging to children.
    ⠀
    The actor is offering the dataset for sale or trade. Claim is currently unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  10. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇧🇬 KindyROO Bulgaria allegedly compromised, exposing children's and parents' information

    An actor representing "ZentinelTeam" claims to have gained administrative access to KindyROO, an early childhood education platform in Bulgaria.
    ⠀
    The access reportedly exposes children's names, ages, parent contact details, enrollment records, and class schedules. The actor also claims they can send emails directly to parents through the platform.
    ⠀
    Screenshots of the administrative dashboard were shared as proof. The extent of the compromise remains unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  11. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇨🇴 Fundación FIRE patient records, medical imaging details, and internal server information allegedly leaked

    Fundación FIRE, a Colombian healthcare organization associated with medical imaging and diagnostic services, has been named in a data leak involving patient information, medical records, and internal infrastructure details.
    ⠀
    The actor "Synq1xxss" shared samples containing patient names, identification numbers, ages, medical examinations, and diagnostic imaging information, including brain MRI studies.
    ⠀
    The exposed material reportedly includes:

    • Patient names and national identification numbers
    • Medical examination types and study descriptions
    • Healthcare providers and referring institutions
    • Patient record statuses and examination priorities
    • Internal server names, IP addresses, and service ports
    • Doctors' names, email addresses, and system roles
    ⠀
    The actor also published what they describe as Firebase server information and a directory of medical professionals associated with the organization.
    ⠀
    The listing does not specify how many patient records were obtained or how the information was accessed.
    ⠀
    Claim is currently unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  12. Dark Web Informer :verified_paw: @darkwebinformer

    ‼️🇺🇸🇪🇸🇺🇸 Actor "skra" claims to have leaked datasets from 3 companies.

    🇺🇸 vFairs - Virtual events platform. 50,000 internal Jira tickets and private Slack conversations.

    🇪🇸 Habitacion - Spanish real estate investment platform. Over 15,972 records containing personal information.

    🇺🇸 Semper Laser - American laser hair removal chain. Over 2.1 million customer records, including PII and conversations.

    Claims are currently unverified.

    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  13. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇫🇷 Blissim payment logs allegedly leaked, exposing 1.9 million records and payment card details

    Blissim, a French beauty retailer selling skincare, makeup, and other cosmetic products, is the subject of a data leak involving nearly 2 million payment-related records.
    ⠀
    The actor "ChimeraZ" claims to have released a partial collection of the company's payment logs, containing 1,916,599 records in a 688 MB JSON file.
    ⠀
    The dataset reportedly includes 399,236 payment records, with 97,187 entries containing cardholder names.
    ⠀
    A published sample shows cardholder names, card expiration dates, the last four digits of payment cards, and transaction reference numbers. The records cover 13 payment card brands and methods, including Visa, Mastercard, Carte Bancaire, American Express, Apple Pay, and Google Pay.
    ⠀
    The actor has provided a sample and made the dataset available through a restricted download. The listing does not explain how the payment information was obtained or whether the records originated directly from Blissim's systems.
    ⠀
    Claim is currently unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  14. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇻🇳 Vietnam Ministry of Health allegedly breached, with records of 484,733 doctors and nurses offered for sale

    An owner on a forum claims to have obtained personal and professional information belonging to 484,733 doctors and nurses from Vietnam's Ministry of Health.
    ⠀
    The dataset reportedly contains:

    • Full names, dates of birth, and national ID numbers
    • Residential addresses, phone numbers, and email addresses
    • Nationality, ethnicity, and places of birth
    • Current workplaces and affiliated medical institutions
    • Medical practice licenses and certification details
    • Employment histories, qualifications, and training records
    • Disciplinary actions, assessments, and application records
    ⠀
    The actor claims the ministry refused to pay for the information, prompting them to offer the dataset for sale.
    ⠀
    The listing includes a paid download section, but no samples were visible in the post.
    ⠀
    The alleged breach, the number of affected medical professionals, and the authenticity of the records have not been independently verified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  15. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇫🇷 Axialys dataset containing over 63,000 records shared online

    Axialys, a French telecommunications and software company specializing in cloud telephony, contact center solutions, and AI-powered customer service tools, has been named in a data leak involving 63,036 records.
    ⠀
    The actor "Syrv4x" has shared a 209 MB dataset containing what looks to be internal support tickets and incident reports.
    ⠀
    The records include customer complaints, technical issues, service providers, assigned staff, ticket priorities, status updates, and communication histories.
    ⠀
    One of the published samples contains a complaint involving Neworth Telecom, with details about unwanted SMS messages, telephone numbers, and the actions taken by support staff.
    ⠀
    The listing does not explain how the information was obtained, and the authenticity of the records has not been independently verified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  16. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇬🇧 Phonelyne customer database allegedly leaked, including eSIM activation codes and API keys

    Phonelyne, a UK-based eSIM provider offering mobile data plans across more than 100 destinations, has been named in a data breach claim involving customer accounts, orders, payments, and business partners.
    ⠀
    The actor "DaOnlySpark" claims to have obtained a database containing 1,087 orders, 1,022 payment transactions, 916 eSIM subscriptions, and 795 issued eSIMs covering 54 destinations.
    ⠀
    The dataset also reportedly includes:

    • 332 user accounts, including 224 from Nigeria, 52 from the UK, and 23 from the US
    • Customer names, email addresses, and phone numbers
    • Bcrypt password hashes
    • eSIM ICCIDs and activation codes
    • API key values and referral codes
    • 319 partner customer records
    • Information on 19 B2B travel agency partners and four upstream eSIM providers
    ⠀
    The actor published a sample containing user account details and password hashes.
    ⠀
    The listing does not explain how the information was obtained or whether the exposed API keys and eSIM activation codes remain valid.
    ⠀
    Claim is currently unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  17. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 Actor claims years of access to major U.S. telecom provider, including millions of customer routers and internal systems

    An actor using the handle "cvvman" is offering a collection of allegedly stolen data and internal access information from an unidentified U.S. internet service provider, with an asking price in the six figures.
    ⠀
    The actor claims to have maintained unauthorized access to the company's network for several years, collecting employee information, customer records, administrative credentials, and details about its infrastructure.
    ⠀
    The advertised material includes:

    • Complete employee and customer email datasets
    • Claimed root-level access to millions of customer routers
    • Internal VPN endpoints and employee application URLs
    • Instructions for accessing RSA web administration and Cisco management systems
    • Active Directory password hashes, most allegedly cracked
    • Domain controller access information
    ⠀
    The actor says the company's network connects to one of the three largest U.S. telecommunications providers, potentially extending the significance of the alleged compromise.
    ⠀
    According to the post, the actor eventually lost access after allowing approximately 15 VPN logins to expire. They also claim the company was unaware of the intrusion and that its security team had previously dismissed the need for CrowdStrike.
    ⠀
    The seller believes the information is worth at least six figures and says screenshots and samples can be provided to serious buyers.
    ⠀
    No company name has been disclosed, and the claims of widespread router access, compromised credentials, and years of undetected activity have not been independently verified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  18. Dark Web Informer :verified_paw: @darkwebinformer

    🚨 VirusTotal Enterprise API key with 3 million monthly requests and advanced threat intelligence access advertised for sale

    An actor known as "Zerrix" is advertising a VirusTotal Enterprise API key that allegedly provides access to some of the platform's highest-tier threat intelligence and malware analysis features.
    ⠀
    The seller claims the key supports up to 3 million API requests per month and includes Retrohunt Tier 3, allowing users to search VirusTotal's historical malware collection using YARA rules.
    ⠀
    The advertised access also includes:

    • Google Threat Intelligence and Mandiant threat actor intelligence
    • Advanced malware and IOC searches
    • Private file scanning and analysis
    • Downloads of malware samples
    • Dark web monitoring and compromised credential alerts
    • Threat hunting, automated workflows, and API integrations
    ⠀
    The seller published a lengthy JSON response showing dozens of supposedly enabled permissions, including access to malware collections, threat actor profiles, vulnerability intelligence, and advanced Retrohunt capabilities.
    ⠀
    The key is advertised as valid until March 12, 2028. The listing does not disclose how it was obtained or whether the seller is authorized to transfer it.
    ⠀
    The API key's authenticity, permissions, and advertised monthly request allowance have not been independently verified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  19. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇸🇦 Kafiil dataset containing over 300,000 records allegedly leaked

    Kafiil, a Saudi Arabian freelance marketplace connecting businesses with freelancers across the Arab world, has been named in a data breach claim involving more than 300,000 records.
    ⠀
    The actor "Onyxx" claims to have compromised the platform and released a dataset containing user profile information.
    ⠀
    The dataset reportedly includes:

    • Full names and usernames
    • Account verification status
    • Freelancer ratings and average rates
    • Profile completion percentages
    • Profile visits and favorites
    • Gallery counts and avatar URLs
    ⠀
    The information is being distributed as a CSV file, with the download offered for free.
    ⠀
    The listing does not explain how the records were obtained. No passwords or email addresses are included in the advertised fields.
    ⠀
    Claim is currently unverified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  20. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 PG Group (Pure Options), a Michigan-based cannabis operator, has been targeted in a data leak published by the actor "MashroomBlind" linked to n0n ransomware.

    The actor claims the first batch contains a complete directory database with passwords for 577 accounts, staff password records, financial and contract backups, inventory data, and network perimeter configurations.

    The actor threatens to release additional batches until a settlement is reached.

    Interestingly, the .onion address included in the forum post redirects to the n0n ransomware group's leak site.

    Claim is currently unverified.

    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  21. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇦🇺 Initial Access: Australian Retail Company

    A threat actor is advertising access to an unnamed Australian retail company reportedly generating $1.1B in revenue.

    The advertised access includes Azure, GCP, Braintree Payments, BrowserStack, and source code. Payment is requested in XMR.

    This claim is currently unverified.

    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  22. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇺🇸 Cardinal Health employee dataset containing over 67,000 records allegedly stolen from Microsoft Azure

    Cardinal Health, a U.S. healthcare services and medical products company headquartered in Dublin, Ohio, has been named in a data theft claim involving more than 67,000 internal employee records.
    ⠀
    The actor "TheHatman" claims to have accessed the company's Microsoft Azure tenant using compromised credentials and downloaded employee information directly from the environment.
    ⠀
    The dataset allegedly contains:

    • Full names and email addresses
    • Job titles and departments
    • Phone numbers and physical addresses
    • Employee and service account information
    • Additional Azure tenant account records
    ⠀
    The actor has published a sample containing 1,500 records and is offering the complete dataset for sale.
    ⠀
    The listing also claims that the seller possesses similar datasets from other companies, although no additional organizations were identified.
    ⠀
    The alleged Azure compromise and the authenticity of the employee records have not been independently verified.
    ⠀
    💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

  23. Dark Web Informer :verified_paw: @darkwebinformer

    🚨 Malicious Rank Math PRO update delivered a self-restoring WordPress backdoor

    Copies of Rank Math PRO 3.0.123 downloaded or installed through updates between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware.
    ⠀
    Activated copies could create persistent backdoors, administrator accounts, scheduled tasks and other malicious files. Credentials, database passwords and API keys accessible to compromised sites may also have been exposed.
    ⠀
    Tracked as CVE-2026-111862, the incident carries a CVSS score of 9.8.

    Rank Math released a clean version, 3.0.124, but updating alone does not remove backdoors already planted elsewhere. Affected websites should be treated as compromised and restored from a clean backup where possible.

    The free Rank Math plugin available through WordPress.org was not affected.

  24. Dark Web Informer :verified_paw: @darkwebinformer

    ASAN Scout... tomorrow.

    A Python-based ASN reconnaissance tool for Windows and Linux that discovers IP ranges, scans live hosts and services, collects HTTP/TLS intelligence, and monitors infrastructure changes through an interactive ASCII interface.

  25. Dark Web Informer :verified_paw: @darkwebinformer

    🚨🇷🇺 Hackers steal customer data from Russian hosting provider FirstVDS

    Attackers exploited a vulnerability in ISPsystem’s VMmanager 6 platform to access part of FirstVDS’s infrastructure and copy data from customer virtual servers.
    ⠀
    The malware mounted virtual disks in read-only mode, allowing it to steal passwords, cloud credentials, configuration files, cryptocurrency wallets and other data without leaving traces inside the affected servers.
    ⠀
    FirstVDS has not disclosed how many customers were affected. The company told notified users to assume everything stored on impacted servers was compromised and replace passwords, keys and access tokens.

    The attackers remain unidentified, and the vulnerability was reportedly not fully fixed at the time of disclosure.

    Source: therecord.media/russia-cyberat

  26. Dark Web Informer :verified_paw: @darkwebinformer

    Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site via Brian Krebs

    krebsonsecurity.com/2026/10/fe

  27. Dark Web Informer :verified_paw: @darkwebinformer

    Somewhere out there, a rabbit hole is waiting to turn a simple question into a thousand more.

  28. Dark Web Informer :verified_paw: @darkwebinformer

    On October 8, 2022 Iranian state television was hacked during a live broadcast, briefly displaying images of Supreme Leader Ayatollah Ali Khamenei engulfed in flames as chants of "Woman, Life, Freedom" played in the background.

    The broadcast then returned to the news presenter.

  29. Dark Web Informer :verified_paw: @darkwebinformer

    Sounds right.

  30. Dark Web Informer :verified_paw: @darkwebinformer

    CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

    Write-up: samchen.blog/blog/vscode-neste

Next page
Share on Mastodon

Enter the server where you have an account.