Dark Web Informer :verified_paw:

https://infosec.exchange/@DarkWebInformer

Website: https://darkwebinformer.com

Website Pricing (Crypto payments are fully automated): https://darkwebinformer.com/pricing

Socials: https://darkwebinformer.com/socials

API Access: https://darkwebinformer.com/api-details

About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer

X: https://x.com/DarkWebInformer

Updated: 2026-07-20

Dark Web Informer: https://darkwebinformer.com
X/Twitter: https://www.x.com/DarkWebInformer
GitHub: https://github.com/DarkWebInformer

Public Key

npub1w3fflg7g4heq6ulgufz4xmzkv0djqpfhlyrxr4uhcn72hqu5t8tsc5gymd

NIP-05 Address

darkwebinformer_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs8g55l50y2musdw05wy32nd3tx8keqq5mljpnp67tufl9tsw29n4cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsxnt9wh

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1w3fflg7g4heq6ulgufz4xmzkv0djqpfhlyrxr4uhcn72hqu5t8tsc5gymd

Show more details

Last Notes

2026-10-30 15:04:25 UTC

🚨 Suspected hardware implant found inside Trezor Safe 5 wallet
Trezor is warning customers after receiving a credible report of an extra circuit board inside a Safe 5 purchased from former authorized reseller CryptoBilis through Tokopedia.
The suspected implant reportedly sits between the wallet’s main board and screen, allowing it to capture displayed information, including the recovery phrase, and transmit it over a mobile network when connected.
⠀
Trezor has not yet received or examined the device. No customer funds have been reported stolen, and four other CryptoBilis devices inspected by the company showed no signs of tampering.
Anyone who purchased any Trezor model supplied by CryptoBilis from March 2026 onward should:
• Move funds to a newly created wallet
• Generate a completely new recovery phrase
• Never restore the potentially exposed phrase on another device
• Keep the original device and contact Trezor Support for a replacement
Source: https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/530/470/585/564/456/original/20e31030b03bf0a2.jpg

2026-10-27 16:29:45 UTC

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks
CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.
Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.
Fixed versions:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.
The PHP team says there are no complete mitigations and that updating is the only safe solution.
Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/513/819/175/950/809/original/3577699eb45ff688.jpg

2026-10-26 18:34:53 UTC

A user on Dread is promoting Dark Empire RPG, a browser-based multiplayer cyberpunk RPG built with PHP, HTML/CSS and Python. The game features a marketplace, crafting, guilds, territory wars and law-enforcement career paths.
Dread Announcement: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/bc7cbb5e64f166778e4c
Dark Web: http://kd67wsybyev4mxqbizgw2hizs76jezqgc5eea5b6k7ftccfc65qeibid[.]onion/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/508/649/223/107/137/original/a8db00968f26acb5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/508/649/190/141/650/original/26d627b0c1738dab.png

2026-10-26 17:19:30 UTC

🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability
Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.
⠀
The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.
It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases.
⠀
Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.
Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement.
⠀
Node.js users should update to:
• 22.23.4
• 24.22.1
• 26.12.1
The WAF rules are an additional mitigation, not a replacement for patching.
Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/508/342/357/550/070/original/5bc56ba27f781e15.png

2026-10-23 16:28:14 UTC

🚨 Aesthetic infostealer source code shared on a forum
The actor "procurator" has shared what is described as the source code for Aesthetic, a Windows infostealer with remote access capabilities, a web-based control panel, and a built-in payload builder.
The malware reportedly targets Chromium and Firefox browsers, cryptocurrency wallets, messaging apps, gaming accounts, and developer tools. It also claims support for bypassing Chrome's App-Bound Encryption.
Aesthetic includes persistent remote access, screen and webcam monitoring, keylogging, file management, and remote command execution. Its control panel is built using Flask and SQLite, with subscription-based access.
The source code and advertised capabilities have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/491/164/040/929/342/original/e47a74a8a1b9f891.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/491/164/055/521/750/original/ff92e6c00c3d3e8f.png

2026-10-22 21:04:45 UTC

Ready for my YouTube year in review
Ready for my Spotify year in review
Ready for my Netflix year in review
Ready for my Instagram year in review
Ready for my TikTok year in review
Ready for my X year in review
Ready for my Reddit year in review
Ready for my Discord year in review
Ready for my Twitch year in review
Ready for my Steam year in review
Ready for my PlayStation year in review
Ready for my Xbox year in review
Ready for my Nintendo year in review
Ready for my Amazon year in review
Ready for my Google year in review
Ready for my Apple year in review
Ready for my Microsoft year in review
Ready for my Snapchat year in review
Ready for my Facebook year in review
Ready for my LinkedIn year in review
Ready for my Uber year in review
Ready for my DoorDash year in review
Ready for my Airbnb year in review
Ready for my PayPal year in review
Ready for my Venmo year in review
Ready for my Duolingo year in review
Ready for my ChatGPT year in review
Ready for my GitHub year in review
Ready for my Cloudflare year in review
Ready for my Wikipedia year in review
Ready for my FBI watchlist year in review 😬
Ready for my therapist's year in review

2026-10-22 20:01:31 UTC

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution
PoC: https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/340/449/628/680/original/d3ab93014d7f9493.mp4

2026-10-22 19:13:49 UTC

Passed the security audit.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/153/145/314/026/original/7d6d784edd131812.webp

2026-10-22 18:51:18 UTC

🚨 Two critical Linux KSMBD remote code execution flaws disclosed before fixes were available
The vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549, both carry CVSS scores of 9.0 and affect KSMBD, the Linux kernel’s built-in SMB server.
⠀
ZDI-CAN-33774 can reportedly be triggered without authentication against systems running KSMBD on port 445.
ZDI-CAN-33549 affects the SMB Direct path and requires an RDMA-capable interface, a writable KSMBD share and a client using SMB Direct.
⠀
Neither vulnerability currently has a CVE identifier. As of October 22, fixes had not been added to the mainline Linux kernel or linux-next.
Administrators should determine whether KSMBD is active and consider restricting network access until fixes become available.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/064/612/760/057/original/255430a2eb8f2f88.png

2026-10-21 19:44:22 UTC

A look at critical PHP vulnerabilities from a darknet forum operator's perspective, revealing just how quickly new exploits are turning into real-world threats.
Dread Thread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/14d9b2557ae62186394e
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/480/610/667/184/605/original/8f3a79b3e18d73f7.png

2026-10-21 16:22:40 UTC

Bro Said Real Devs Don’t Use PHP, Then Got Hit With a $90,000 Reality Check
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/479/817/843/422/110/original/37c94980c58d94fa.png

2026-10-21 15:51:22 UTC

🚨🇦🇪 Dubai International Financial Centre (DIFC) allegedly breached, with $5 million ransom demanded
The "Reze" ransomware group, alongside "BBK", claims to have compromised DIFC, a major financial hub in Dubai, UAE.
The actors claim to have obtained approximately 200 GB of data, including 432,178 email addresses, 324,239 phone numbers, 391,382 names, 37,352 passport records, Emirates ID information, and thousands of internal documents.
The group has published samples and is demanding $5 million, giving DIFC 10 days to respond.
Claim is currently unverified.
Note: This alert was captured before this forum went down due to PHP2Shell.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/479/694/756/797/587/original/9104dc9e784e6c47.png

2026-10-20 15:36:05 UTC

🚨 Discord mass-reporting tool shared on a forum
An actor known as "WrlBreach" has shared a Python-based tool called "Discord Mass Reporter," designed to automate large numbers of reports against Discord messages.
⠀
The tool reportedly supports reporting categories such as harassment, spam, phishing, illegal content, and other policy violations.
⠀
The archive contains a Python script, README, and dependencies. It has only undergone static analysis, and its functionality has not been verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/473/972/358/143/009/original/21bd46dd418f6834.png

2026-10-18 18:21:55 UTC

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.
Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/463/299/546/455/773/original/a7f4ba5a7dccef82.mp4

2026-10-18 17:37:04 UTC

🚨🇧🇷 $470,000 shipment of RTX 5090 graphics cards goes missing at Brazilian airport
Brazilian technology distributor Oderço says two pallets of Zotac GeForce RTX 5090 GPUs disappeared after reportedly arriving at São Paulo’s Guarulhos International Airport.
⠀
The company valued the shipment at R$2.5 million, approximately $470,000, based on its acquisition cost.
Oderço said it has sought information about the shipment but received no official explanation. The distributor described the incident as unprecedented in its 38-year history.
⠀
The number of missing graphics cards remains unknown. No arrival date, tracking information or other shipment records have been made public.
Authorities have not confirmed that the shipment was stolen, and the circumstances of its disappearance remain unclear.
Source: https://www.tomshardware.com/pc-components/gpus/nvidia-rtx-5090-shipment-worth-usd470-000-goes-missing-in-brazilian-airport-two-pallets-disappear-distributor-seeks-explanations-but-met-with-zero-answers
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/463/123/158/581/196/original/37444fd87974d531.webp

2026-10-16 19:16:31 UTC

I have added 8 new incidents to the Physical Bitcoin Attacks page. Be safe.
https://darkwebinformer.com/physical-bitcoin-attacks/

2026-10-16 15:17:40 UTC

🚨 Ledger Wallet zero-day exploit advertised for $2,000, claims to steal wallet recovery information
An actor known as "work159" is advertising what they claim is a zero-day exploit targeting the Ledger Wallet desktop application on Windows and macOS.
⠀
The seller claims the exploit can display a fake wallet recovery process directly inside the legitimate application, rather than redirecting victims to an external phishing website.
⠀
According to the listing, the attack requires just one click, with no further user interaction needed.
⠀
The advertised capabilities include:
• Custom phishing overlays displayed inside Ledger Wallet
• Fake wallet recovery screens
• Support for Windows and macOS
• Exfiltration of private keys to a Telegram bot
• Integration into existing Ledger Wallet interface pages
⠀
The seller also claims to provide unobfuscated source code and customizable templates. The asking price has been reduced from $7,500 to $2,000.
⠀
No working demonstration or technical evidence confirming the claimed zero-day vulnerability was included in the visible listing.
⠀
The exploit's existence and capabilities remain unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/451/250/454/174/895/original/e94738395282d1ba.png

2026-10-12 20:08:54 UTC

🚨🇺🇸 Giant Food websites taken offline after cybersecurity incident at parent company Ahold Delhaize
Websites for The GIANT Company, Giant Food, Food Lion, Hannaford and Stop & Shop were taken offline after Ahold Delhaize detected a security issue within its network.
Online grocery ordering and deliveries have been disrupted while systems are kept offline as a precaution. The company’s physical stores remain open and continue serving customers.
⠀
The incident is also affecting several European Ahold Delhaize brands, including Albert Heijn, Etos, Gall & Gall and Delhaize.
Ahold Delhaize has not disclosed how its network was compromised, identified an attacker or confirmed whether any data was stolen. There is currently no estimated restoration time.
Source: https://lancasteronline.com/news/local/giants-website-taken-down-following-cyber-attack-on-parent-company/article_808bae86-cb7b-41f5-8b1d-8c006c65e569.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/429/746/207/842/956/original/925f2c79efb19a3e.png

2026-10-09 23:43:27 UTC

‼️🇩🇪 Black X ransomware names Bayer
Bayer is a German multinational life sciences company specializing in pharmaceuticals, consumer healthcare products, and agricultural solutions.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/413/602/848/632/927/original/1574b90578847e75.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/413/602/856/079/282/original/83d07594ec9d1c56.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/413/602/863/069/134/original/6c690c63451e4e08.png

2026-10-09 14:52:13 UTC

🚨🇯🇵 enTouch Administrator Access Offered for Sale for $90
An actor is selling administrator access to enTouch, a Japanese healthcare technology company that connects pharmaceutical and medical device companies with healthcare professionals.
The seller claims access to 45,572 doctor records, 6,003 user accounts, and 33,010 online meeting records, including attendee passwords.
The database also reportedly contains 18,714 survey responses and 15,801 medical representative activity reports.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/411/514/443/422/957/original/8e9178b64ebce581.png

2026-10-08 17:36:16 UTC

🚨 🇺🇸 Empire Market co-creator sentenced to 40 years for operating $430 million dark web marketplace
Raheim Hamilton, 30, also known online as “Sydney” and “ZeroAngel,” has been sentenced to 40 years in federal prison and fined $5 million.
Hamilton and co-creator Thomas Pavey operated Empire Market from 2018 until its shutdown in 2020.
At its peak, the marketplace had approximately 1.68 million registered users, including more than 5,000 vendors and nearly 360,000 buyers.
More than four million transactions worth over $430 million were completed through the marketplace.
Drug sales accounted for nearly $375 million, while vendors also sold stolen credentials, personal information, counterfeit currency and hacking tools.
Hamilton pleaded guilty earlier this year to a federal drug conspiracy charge. He also agreed to forfeit approximately 1,230 bitcoin, 24.4 Ether and three properties in Virginia.
Pavey has also pleaded guilty and is scheduled to be sentenced later this month.
Source: https://www.justice.gov/usao-ndil/pr/co-creator-dark-web-marketplace-sentenced-40-years-federal-prison
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/406/497/237/992/877/original/1617a54a5f6aeca5.png

2026-10-07 16:34:53 UTC

🚨 New Ransomware Group: SCARLETTGROUP
Dark Web: http://scarlettgugldabhgz3uertpnxglxytddxbd5vnoma5pihfk6k5q2sid[.]onion/
Forum claim: https://x.com/DarkWebInformer/status/2107862989701316939
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/400/592/602/647/009/original/d0ee00d25ebdfdc3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/400/592/615/795/522/original/f1531f911415706a.png

2026-10-06 17:19:45 UTC

🚨 Windows 11 Zero-Day LPE and Pre-Auth RCE Exploits Offered for Sale
A forum actor is advertising an alleged Windows 11 zero-day local privilege escalation exploit claimed to work across all versions.
The seller also claims to have pre-auth RCE exploits for Ivanti Connect Secure SSLVPN and Zimbra, along with an RCE exploit targeting Switchvox SMB.
Pricing is negotiable, with transactions offered through escrow.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/395/107/628/022/529/original/6b164ab071bfb68b.png

2026-10-01 14:57:19 UTC

🚨 Teenagers suspected of leading ransomware group arrested in international operation
Authorities from nine countries have disrupted KillSec, a ransomware group linked to almost 1,000 attacks worldwide.
⠀
A 16-year-old is suspected of serving as the group’s administrator and main operator.
Another suspected developer recently turned 18 and was a minor during several of the alleged offenses.
⠀
The operation resulted in:
• Three arrests
• Eight searches in Spain, Greece, the UK and Romania
• Five servers seized
• KillSec-operated domains seized
• At least 110 TB of stolen data secured
⠀
KillSec allegedly exploited poorly secured access points, particularly cloud storage, to steal sensitive data.
Victims were threatened with publication unless they paid a ransom.
The investigation remains ongoing.
Source: https://www.eurojust.europa.eu/news/teenagers-suspected-leading-ransomware-group-arrested-during-international-operation
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/366/234/697/549/382/original/88374aa3a849a4d7.jpg

2026-09-30 15:48:51 UTC

🚨 Akuma Stealer Advertised With Free 3-Day Trial
A new information-stealing malware called Akuma Stealer is being advertised on a forum, with the developer offering a free three-day trial.
The seller claims the malware has been in development for more than a year and is primarily written in C, with additional C++ and Assembly components.
According to the listing, Akuma Stealer is designed to collect browser data, cryptocurrency wallet information, password manager data, 2FA-related information, VPN credentials, corporate and cloud access details, messaging data, gaming accounts, system information, and screenshots.
The developer also claims the stealer includes anti-analysis, anti-VM, persistence, obfuscation, and geographic blocking features, while marketing it as capable of evading several major antivirus and EDR products.
Pricing starts at $49.99 for seven days, with lifetime access listed at $1,499.99.
These claims have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/360/776/082/974/819/original/5fa2ff5945425188.png

2026-09-28 23:27:45 UTC

🚨🇧🇷 Vakinha Dataset Allegedly Leaked After Ransom Demand
A dataset allegedly belonging to Brazilian crowdfunding platform Vakinha has been shared on a forum after the actor claimed a ransom was not paid.
The post claims the dataset contains approximately 18 million records and includes donor and recipient information.
According to the actor, exposed fields include names, email addresses, phone numbers, CPF numbers, IP addresses, payment methods, transaction values, campaign information, and other account-related data.
A sample of the purported data was included in the post, which lists the material as dating from July 2026.
These claims have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/256/193/100/523/original/82a255c4149ad3bf.png

2026-09-28 16:31:34 UTC

🚨 ShinyHunters
104[.]192[.]2[.]46
ASN: 27176
Org: DataWagon LLC
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/349/619/475/933/231/original/8e44c117823dabe2.png

2026-09-26 17:41:28 UTC

🚨 Companies are being urged to shut down their NetScaler instances immediately due to multiple unpatched Citrix NetScaler RCE vulnerabilities.
Source: https://x.com/watchtowrcyber/status/2103891689857228803

2026-09-25 17:58:05 UTC

Added 1 new incident to the Physical Bitcoin Attacks page.
https://darkwebinformer.com/physical-bitcoin-attacks/

2026-09-25 16:25:56 UTC

🚨 🇮🇳 Data allegedly related to India’s Astra missile program offered for sale
⠀
The Astra is an air-to-air missile developed by India’s Defence Research and Development Organisation (DRDO).
⠀
The actor "0x4ziz" is offering a 1 GB collection for $800. The advertised material allegedly includes:
⠀
• Astra Mk-1 documents
• Computer and account information
• Contacts and deal records
• Passports and other identity documents
⠀
The actor shared screenshots as purported proof but did not disclose how the material was obtained. The post does not establish that DRDO systems were breached.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/332/610/543/483/319/original/acec545d136b4854.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/332/610/542/578/592/original/5c0667e5b6ece0a0.png

2026-09-24 19:41:58 UTC

‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)
GitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/327/719/124/186/716/original/6dd8d74d612e5668.png

2026-09-23 18:02:49 UTC

‼️🇺🇸 An actor claims to be offering full GitHub organization access for Pfizer, including internal repositories, source code, and developer infrastructure.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/321/666/927/111/947/original/719d2d3980d20142.png

2026-09-23 16:04:39 UTC

🚨 Windows password and PIN sniffer tool shared on a forum
⠀
An actor using the handle "Apollinaris" is distributing a tool advertised as capturing local Windows user and administrator passwords or PINs.
⠀
The screenshots show a Windows Update impersonation prompt asking the victim to enter credentials to approve a supposed Wi-Fi driver update.
⠀
The actor provides separate password and PIN versions and claims compatibility with remote access tools. The screenshots demonstrate the credential prompts, but do not establish successful credential capture.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/321/201/886/178/645/original/3d0a2f63d306d497.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/321/201/890/741/190/original/325f00b583f38f89.png

2026-09-22 23:04:17 UTC

‼️🇩🇪 ShinyHunters names a German healthcare company
🇩🇪 Fresenius Medical Care - A Germany-headquartered healthcare company specializing in dialysis products, services, and treatments for people with kidney disease.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/317/189/913/125/196/original/7ec2f15217a2dbdc.png

2026-09-22 22:46:44 UTC

Lul
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/317/120/741/712/977/original/d87f078726c99c7f.jpeg

2026-09-22 17:27:22 UTC

‼️ ShinyHunters has shared a message on their pay or leak portal to Director Brett Leatherman of the FBI Cyber Division and Director Kash Patel of the FBI:
"Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI,
During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended.
We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to "disrupt" our operations, an effort that ultimately proved unsuccessful.
For us to properly address and correct these unfounded allegations, we were compelled to adopt a forceful and assertive posture to ensure our response was fully acknowledged. This PSA today does just that.
Our PSA today works to address these allegations and correct them.
We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job. Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more.
We are willing to allow you a time of 1 week to correct or simply REMOVE the 2026 Quarter 2 FLASH report on us that includes several FALSE allegations:
- "Threat actors often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims. "
- "To exert pressure on victims[1], SH actors commonly use harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting"
- " Threat actors may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist."
We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff. This PSA today is living evidence of that.
We wish to state unequivocally we have NEVER conducted swatting attacks against corporate victims personnel nor have we ever texted victims personnel family members any threats.
We wish to state unequivocally we have NEVER claimed to have sensitive or compromising information, including embarrassing photographs and videos of victims. WE ARE NOT SEXTORTIONISTS.
Finally, we wish to STATE UNEQUIVOCALLY we are NOT apart of "The Com". We have NEVER been apart of "The Com". "The Com" is a propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalising this nonsense.
As a big believer and supporter of the U.S. Constitution - we are exercising the First Amendment and actively combating disinformation. This is not a ransom, coercion, or extortion. Your federal policies do not apply here. This PSA is NOT financially motivated.
We recognise that certain statements within your FLASH report appear to stem from biased public reporting by certain journalists who have previously and intentionally propagated false narratives about our organisation in an attempt to "disrupt" our operations and hinder clients trust in our organisation hoping nobody pays us. Should those certain journalists and you know very well who you are, continue these unwarranted attacks and defamatory statements, we will be forced to respond in a civil manner with a commensurate and forceful defence of our reputation. As any human being would do.
We welcome any and all journalists to inquire us at shinygroup@onionmail.com to hear our side of the story.
Make the right decision, don't be the next headline.
Thank you for your attention to this matter. -SH"
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/315/865/226/103/574/original/5f8a00ecb7d0c77b.png

2026-09-20 22:57:48 UTC

Interesting way to launder 💸
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/305/839/935/198/809/original/297943f6278dbd96.png

2026-09-19 23:42:43 UTC

- reply

‼️ ShinyHunters has a message for Cl0p ransomware after hacking and defacing Cl0p's DLS earlier today.
"Email us from your official email at shinygroup@onionmail.com and lets see how rich you really are. 2.333% of my networth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/300/351/925/237/986/original/90163fb5fe83ac8b.png

2026-09-19 16:09:09 UTC

‼️ ShinyHunters defaced the Cl0p Ransomware site
http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad[.]onion/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/298/570/114/753/679/original/d2aff64013f23bbd.png

2026-09-13 23:40:54 UTC

Dread user looking for a "US or EU citizen for marriage" 🫡
https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/d5f0f031d14d431dca5d
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/266/373/217/832/946/original/d2d2b5e9a3790976.png

2026-09-07 16:35:59 UTC

‼️ A forum actor is seeking to purchase a Claude AI account that has the Mythos feature enabled, requesting sellers to provide price and account details via private message.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/230/728/576/335/644/original/0026f35fd0d02522.png

2026-09-06 15:53:47 UTC

🚨🇪🇸 Spain SIPS energy supply dataset allegedly leaked, 40M+ CUPS records claimed
⠀
SIPS (Sistema de Información de Puntos de Suministro), Spain’s electricity and gas supply-point information system, is named in a cybercrime forum post where a threat actor claims to have obtained a full dataset covering more than 40 million CUPS records.
⠀
Claimed exposure
⠀
• Customer names and NIF/CIF identifiers
• Dates of birth and customer addresses
• CUPS supply-point identifiers
• Electricity and gas supply information
• Supply addresses and municipalities
• Distribution companies and tariffs
• Contracted power and voltage data
• Meter information and access rights
• Consumption profiles and billing frequency
• Annual energy consumption figures
• Meter readings and BIE-related dates
⠀
The actor describes the dataset as fresh and claims it contains detailed information associated with electricity and gas supply points throughout Spain.
⠀
A sample record containing personal, address and supply information was also published in the forum post.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/224/900/181/783/488/original/c3a8effcd36f66d8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/224/900/180/687/143/original/f8d1c7e1c3e5d67d.png

2026-09-04 17:05:45 UTC

‼️ Exploit disclosed for CVE-2026-52924... 9.8 CVSS Linux Root Privilege Escalation
GitHub: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52924-ubuntu-7.0.0-28/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/213/858/631/596/440/original/c0bc572e5a3e14b6.mp4

2026-09-03 16:08:35 UTC

Need.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/207/971/584/517/166/original/de4c47e50fdb5bd2.mp4

2026-09-03 13:14:56 UTC

‼️ Security researcher Nightmare Eclipse has released a new zero-day called FalconFlank, a CrowdStrike Falcon local privilege escalation (LPE) vulnerability.
GitHub: https://github.com/MSNightmare/FalconFlank
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/207/288/708/670/012/original/29dfe47abbbcb916.png

2026-08-11 17:26:58 UTC

‼️ A forum actor claims to represent an experienced pentester team seeking ongoing partnerships with suppliers of initial access, specifying revenue thresholds for Tier1 (10M+) and Tier2 (100M+) targets.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/078/046/621/018/771/original/723ca201f7b36f5b.png

2026-07-20 17:39:21 UTC

Windows is the only landlord that charges rent, installs a billboard in your living room, and calls it a feature.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/953/524/481/107/057/original/ef39992c1de46a48.jpg

2026-07-13 20:44:25 UTC

‼️ Telegram's t[.]me domain is down with WHOIS now showing a "serverHold" status which is a registry-level suspension that stops the domain from resolving entirely.
All t[.]me links are currently broken. The app itself still works, but link sharing is toast until this gets lifted. 🤣
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/914/616/003/724/004/original/9c4d525a38b6f0b9.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/914/616/012/480/294/original/37a1a6ec1b43e842.png

2026-06-29 18:27:58 UTC

How hackers pivot after initial access
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/834/807/094/273/781/original/e424095f2064e4fa.mp4

2026-06-28 17:16:22 UTC

Priorities: save the codebase, then yourself.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/828/863/292/579/649/original/68a1ebcb2f97a25a.jpg

2026-02-10 22:13:52 UTC

‼️🇨🇳 Root RCE and full admin panel access to a Chinese agentic AI edge-as-a-service (EaaS) corporation is being sold for $200. The target runs Linux with firewall device access.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/633/491/982/500/original/464189e43b5114a8.png

2026-02-01 22:50:11 UTC

‼️🇺🇸 Polycom now by the name Poly Inc. has fallen victim to Everest Ransomware
Allegedly 90 GB of data stolen
Revenue: $1.73 Billion (FY, 2021)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/997/808/037/176/398/original/c3060d360afaef39.png

2026-02-01 21:26:48 UTC

Beware of cat
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/997/488/324/026/986/original/580f2384db0e5008.mp4

2026-01-12 17:52:24 UTC

❗️Chronomaly: Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x.
GitHub: https://github.com/farazsth98/chronomaly
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/883/398/150/321/405/original/bc70175c9181030a.mp4

2026-01-11 23:02:59 UTC

X suspended Twitter. 😭
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/878/958/102/317/114/original/8cb283ade3fa0e85.png

2026-01-03 23:59:04 UTC

😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/833/880/151/280/836/original/5081290f147ff25b.jpg

2025-11-25 00:12:33 UTC

📰Tor is upgrading its relay encryption with a new algorithm called Counter Galois Onion (CGO). CGO prevents tampering, adds forward secrecy, and brings Tor’s encryption up to modern security standards.
https://blog.torproject.org/introducing-cgo/

2025-10-07 18:22:55 UTC

Expectation vs Reality
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/334/273/623/151/640/original/4ca8e4b2e6035e38.png

2025-10-01 17:12:13 UTC

🔥Disable Javascript: Full Technical Explanation with Examples, Proof, Why & How JS NEGATIVELY Affects Your Security
Dread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/b5e83a29b2217a21a0dd
Note: This is a good read, but very long.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/022/796/293/761/original/adaaf0f57eb58368.png

2025-09-23 15:40:58 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/365/869/911/217/original/28182e8b38dd2deb.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/365/869/749/223/original/f8d8bca63fa0293e.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/365/875/426/935/original/723a56d2694a22d7.jpg

2025-09-23 15:40:45 UTC

🚨The U.S. Secret Service uncovered and shut down a hidden network of devices across the New York tri-state area. The setup included more than 300 SIM servers and over 100,000 SIM cards, spread out in multiple locations. Investigators say it was being used to make threats against senior government officials.
But it went beyond just phone calls. The equipment could disrupt cell towers, block communications through denial-of-service attacks, and give criminals or foreign agents a way to talk secretly without being traced. Early findings suggest that some of the activity involved contacts between nation-state actors and people already on law enforcement’s radar.
The discovery came at a tense moment, just miles from where world leaders are gathering for the U.N. General Assembly in New York. Officials moved quickly to dismantle the threat, and the investigation is still underway with help from federal, state, and local partners.
Source: https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/364/936/135/421/original/97a84342afa6e79f.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/364/957/171/344/original/1c1b042dfe057733.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/364/959/649/310/original/b1a7365299c60722.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/254/364/968/932/210/original/480a5a0a7951e94f.jpg

2025-09-21 23:57:26 UTC

Linux Networking Commands
Credit: sysxplore.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/244/993/181/924/623/original/4fc5a9077b005fcc.jpg

2025-07-22 20:52:08 UTC

SIGIT: Simple Information Gathering Toolkit
GitHub: https://github.com/termuxhackers-id/SIGIT
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/898/863/513/114/664/original/f2a1913a5b7c050d.png

2025-06-09 18:13:58 UTC

🚨🇺🇸Alleged Sale of 51M User Data from Social Security Administration
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/654/762/258/371/288/original/6bbabb29bdbada48.png

2025-02-18 17:30:37 UTC

Windows: Would you like to end this process?🥺
Linux: Terminate. No negotiations.🔫
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/026/075/592/213/661/original/3f63c152f7cced76.png

2024-12-20 16:22:52 UTC

- reply

It's been there for a bit, but looking at your other posts with some showing concerns of this being a phishing url is incorrect. You're using the correct link which comes from: http://ngemgrlhmdqi3zsgscjgjrbwpietxf3kbwjfzrarb4h6f3nimjsiu7yd.onion/