← Feed

Posts

• View post

  🚨 An autonomous AI agent escaped an OpenAI evaluation sandbox, compromised a third-party sandbox, then breached Hugging Face through malicious datasets. It executed roughly 17,600 actions, moved laterally & accessed challenge solutions. Hugging Face put together this reconstruction. Article: https://huggingface.co/blog/agent-intrusion-technical-timeline

• View post

  ‼️ New Ransomware Group: Владивосток or Vladivostok in English Dark Web: http://dr5beljvyqljgq5ppro57pgetg4yeslcsexmuhvv3p46wod3odsh3fid[.]onion The message in the second screenshot says: "Welcome to the blog of the new "Vladivostok" group of companies! We are open for business; our contact details will be published shortly. We are ready to collaborate with researchers, penetration testers, and disgruntled employees. Our partners will receive a generous share—negotiated to poten...

• View post

  🚨 🇧🇪 Judo Vlaanderen dataset with 98,000 member records and plaintext passwords offered for sale ⠀ The actor "RedStone" is selling a dataset they claim belongs to Judo Vlaanderen, the Belgian judo federation serving Flanders. ⠀ The listing advertises 1.8 million rows across 99 tables. Some of the claimed data includes: • 98,495 member records with names, dates of birth, addresses, emails, phone numbers, and nationalities • More than 75,000 plaintext password entries • 1,248 cleartext O...

• View post

  🚨 🇵🇭 Initial access to the National Nutrition Council and LBC Express allegedly offered ⠀ The actor "realchimera" is advertising what they describe as full access involving two organizations in the Philippines: • National Nutrition Council, a government organization • LBC Express, a courier, cargo, and money remittance company ⠀ The listing claims the access includes government documents and user credentials. It does not identify the affected systems, number of accounts, access method,...

• View post

  🤨 "LARP Social Media Pack"

• View post

  🚨 🇫🇷 Planity customer and business data allegedly exposed ⠀ The actor "Syrv4x" has released a dataset they claim belongs to Planity, a French booking and management platform used by hair salons, beauty institutes, and barbershops. ⠀ The 12 MB file is advertised as containing 17,244 lines. Some of the claimed data includes: • Customer names, email addresses, and phone numbers • Business and customer identifiers • Account usernames • Appointment counts and booking frequency • Revenue tot...

• View post

  🚨 🇲🇽 GhostLeakers claims to have exposed phpMyAdmin credentials for ITESHU ⠀ The "GhostLeakers" team claims it obtained credentials for a phpMyAdmin instance belonging to Instituto Tecnológico Superior de Huichapan, a higher education institution in Hidalgo, Mexico. ⠀ The credentials are reportedly being distributed for free through the group’s Telegram channel. The post provides no evidence of successful access and does not claim that a dataset or institutional records were stolen. ⠀ T...

• View post

  🚨 🇷🇴 Initial Access: Romanian Small Business Network A threat actor is advertising administrative access to an unnamed Romanian business network reportedly generating approximately $1M in annual revenue. The advertised access includes full admin control of a RouterOS gateway, three internal LANs, two WireGuard tunnels, WiFi credentials, and network reach across approximately 161 hosts. The access is listed for around $150 in XMR. This claim is currently unverified. 💥 No delays. No guessing....

• View post

  🚨 Companies are being urged to shut down their NetScaler instances immediately due to multiple unpatched Citrix NetScaler RCE vulnerabilities. Source: https://x.com/watchtowrcyber/status/2103891689857228803

• View post

  🚨 ShinyHunters resumes mass exploitation of critical Oracle PeopleSoft flaw using simple WAF bypass. Mandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters. ⠀ The critical vulnerability allows unauthenticated remote code execution in Oracle PeopleSoft PeopleTools and carries a CVSS score of 9.8. Oracle released an emergency patch on June 10. ⠀ The new campaign targets organizations that attempted to mitig...

• View post

  For the next hour you may see shoutbox alerts a little back to back, while I integrate the 30th forum.

• View post

  I'm looking for some PAID OSINT tools. They need to accept crypto as payment. I'm working on some projects (people). Will share any information when it gets to that point. Submit via: https://darkwebinformer.com/tips/.

• View post

  🚨 Roundcube SQL injection flaw actively exploited months after patches were released The Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild. ⠀ Roundcube is an open-source webmail application that lets people access email through a browser. The flaw affects its virtuser_query plugin and allows SQL injection before authentication. ⠀ Key details: • CVSS score: 8.1 • No attacker credentials required...

• View post

  There is a bug on the Threat Feed where some forums are not showing any data when filtering by a specific forum. This should be fixed shortly.

• View post

  🚨 Sasai Fintech source code allegedly stolen and released ⠀ The actor "888" claims responsibility for a September 2026 breach of Sasai Fintech, a pan-African digital financial services and technology company. ⠀ The actor claims to have stolen and released the company’s source code. A file tree is provided as a sample, but the affected applications and volume of code were not disclosed. ⠀ This claim is currently unverified. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat...

• View post

  🚨 BREAKING: Chargeflow is notifying merchants of a security incident detected on September 20. The company says data from affected Shopify stores may have been involved. ⠀ Headquartered in New York, Chargeflow automates chargeback prevention and disputes for online merchants. GetLatka estimates its 2025 annual revenue at $16.4 million. ⠀ Potentially affected data includes customer contact details and addresses, order records, redacted payment details, payment metadata, and merchant profile infor...

• View post

  🚨 Bitget reportedly suffered a hack resulting in more than $170 million in losses.

• View post

  👀 🚨 VMware vCenter exploit advertised for $55,000 ⠀ VMware vCenter is used to centrally manage virtual machines and ESXi hosts. ⠀ An actor using the handle "Lalo" is selling a claimed one-day exploit that can reset a vCenter administrator account’s password. The seller claims no public exploit code is available. ⠀ Advertised capabilities include: ⠀ • Python-based vulnerability checking and exploitation • Administrator account takeover with network access • Instructions for resetting ES...

• View post

  ‼️🇺🇸 An actor claims to be offering full GitHub organization access for Pfizer, including internal repositories, source code, and developer infrastructure.

• View post

  🚨 The U.S. Postal Inspection Service (USPIS) seized a major domain used to generate millions of fraudulent shipping labels, causing an estimated $126 million in losses for the U.S. Postal Service. USPIS did not identify the domain or provide further information, and the link in its X post returns a 404 error.

• View post

  🚨🇨🇱 DealerNET data and account access allegedly offered for 35 BTC ⠀ A forum actor using the handle "Karim000" claims to possess more than 100 GB of DealerNET data and access to over 5,000 platform accounts, including those used by banks, insurers, automotive businesses, and pension fund administrators. ⠀ Some of the claimed exposed material includes: ⠀ • Personal reports on Chilean citizens, journalists, and politicians • Contact details and addresses • Asset and vehicle information •...

• View post

  🚨🇫🇷 Autobacs customer and booking data allegedly leaked ⠀ A forum actor using the handle "0xDzz" claims to have released part of a dataset belonging to automotive parts retailer Autobacs, containing approximately 34,000 records totaling 159 MB. ⠀ Some of the claimed exposed material includes: ⠀ • Customer names, email addresses, and phone numbers • Vehicle registration numbers • Appointment dates and booking statuses • Store identifiers ⠀ The displayed sample contains booking records da...

• View post

  🚨🇫🇷 Mes Marchés dataset allegedly exposes 2,535 exhibitor records ⠀ A forum actor using the handle "Quantique" claims to have released a dataset from French platform Mes Marchés after accessing its API. The actor also claims to have scraped all hosted images. ⠀ Some of the claimed exposed material includes: ⠀ • Names, email addresses, and phone numbers • Addresses and location coordinates • Business identifiers and profile information • Password, reset-token, and account verification fi...

• View post

  🚨🇫🇷 LVMH internal credentials and vulnerability information allegedly offered for sale ⠀ LVMH is a French luxury goods group spanning fashion, jewelry, cosmetics, wines, and spirits. ⠀ A forum actor using the handle "HollowCrimeCorp" claims to be offering a package of internal assets and information related to LVMH. ⠀ The advertised package includes: ⠀ • Internal URLs and access portals • Administrator logins and passwords • Confidential information and documents • Alleged XSS, IDOR, an...

• View post

  🚨 Android spyware and RAT source code advertised for $500 ⠀ A forum actor using the handle "greekdev" is advertising an Android surveillance application, including its client source code, server code, and web-based control panel. ⠀ Some of the claimed capabilities include: ⠀ • Live microphone, camera, and screen monitoring • Call recording across messaging apps • Keylogging, SMS tracking, and notification interception • Access to files, contacts, and browsing history • Remote device co...

• View post

  ‼️ New Dark Web Informer Blog Post! Title: TRC20 Drainer + AML Project + QR Method Offered as a 3-in-1 Crypto Theft Kit Link: https://darkwebinformer.com/trc20-drainer-aml-project-qr-method-offered-as-a-3-in-1-crypto-theft-kit/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

• View post

  🚨 Actor seeks crypto trading intelligence from logs, account access, and API keys ⠀ A forum actor using the handle "Theriella" is seeking partners who can provide cryptocurrency trading intelligence derived from logs, compromised access, or API keys. ⠀ The actor claims to have capital available for decentralized exchange trading, mentioning an initial $5,000 test and up to $10,000 for testing, with a proposed 50% profit share. ⠀ The recruitment post seeks: ⠀ • Insider information: acti...

• View post

  Interesting way to launder 💸

• View post

  👀ShinyHunters provided an updated message to Cl0p Ransomware. "UPDATE, 20 Sep, 1:39 a.m ET: Dear Likhogray & Tarasov, tell your boss j0nny to wake the fuck up. Run those pockets. I want all the money you made off the EBS campaign plus more AND WITH INTEREST. before I start releasing information regarding the companies that paid you, how much, and to what Bitcoin address. My phone book contains all major financial media outlets. CLOCK IS TICKING! LETS GET THE BALL ROLLING! Be sure...

• View post

  🚨 Forum actor offering 10% commission to brokers who find buyers for French and Belgian datasets ⠀ A forum actor using the handle "ChimeraZ" is recruiting intermediaries to help sell datasets associated with French and Belgian targets. ⠀ The actor says anyone who brings a buyer that purchases at least two datasets will receive 10% of the resulting revenue. ⠀ The advertised arrangement includes: ⠀ • Focus on French and Belgian datasets • Minimum purchase of two datasets • 10% commission...