Dark Web Informer :verified_paw:

I am currently only posting on X and Discord as of 2026/02/13. Visit my socials below!

Website: https://darkwebinformer.com/

Pricing: https://darkwebinformer.com/pricing

Socials: https://darkwebinformer.com/socials

API Access: https://darkwebinformer.com/api-details

Donations: https://darkwebinformer.com/donations

Advertise (Only Legitimate Companies): https://darkwebinformer.com/advertising

About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer

Updated: 2026-02-12

Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrvqhr5sdnf9rds8qq0l844cx64cjej76wqjcs06pw26sfpsxehqgpz4mhxue69uhkg6t5w3hjuur4vghhyetvv9usvcsqkz

Publishing to

ditto.pub/relay

Author Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

Show more details

Last Notes

2026-02-11 16:41:24 UTC

‼️🇰🇼 A data set allegedly from Zain Kuwait, a major telecommunications provider, has been posted for sale containing 3,849,601 subscriber records totaling 11.3GB in JSON format.
The breach is dated 2026 and includes subscriber numbers, owner names, and associate names. Sample data shows Arabic-language subscriber records with phone numbers, verification status, and spam flags.
The seller offers tiered pricing in Monero: 15 XMR for takedown, 10 XMR for exclusive purchase with deletion, 5 XMR for non-exclusive access, or 2 XMR for the scraping exploit itself.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/216/160/172/original/3af896c0c9ba0626.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/203/693/696/original/a9e25b850d4224c8.png

2026-02-09 23:51:28 UTC

‼️🇬🇧 A data set allegedly from alphacapitalgroup.uk, a UK-based forex trading platform, has been posted for download.
The dump dates from May 2024 and contains 240,647 lines including payment IDs, transaction IDs, user IDs, emails, payment types, amounts in dollars, user profiles, countries, promo/coupon names, account login IDs, challenge names, and timestamps.
Sample data shows transactions from users across the UK, Australia, India, South Africa, Nigeria, Kuwait, and other countries with various "Alpha Pro" account tiers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/043/353/464/905/227/original/600cfdd75fbf067c.png

2026-02-09 23:21:41 UTC

Daily Dose of Dark Web Informer - February 9th, 2026
https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-9th-2026/

2026-02-09 21:08:07 UTC

❗️🇦🇷 WordPress admin access to an Argentinian e-commerce store is being auctioned by a threat actor.
The listing claims a payment card redirect via MercadoPago is in place, with 100 orders in January and 26 in February, and 90% unique orders.
The auction starts at $300 with a blitz price of $600.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/710/248/660/346/original/b022ae5f8e636eb6.png

2026-02-09 20:05:58 UTC

❗️🇿🇦 WordPress admin access to a South African e-commerce store is being auctioned by a threat actor.
The listing claims a payment card redirect via PayGate is already in place, with 200 orders processed in January and 100% unique orders.
The auction starts at $300 with a blitz price of $600.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/467/749/657/563/original/2b740c1fb36d76f4.png

2026-02-09 19:23:37 UTC

❗️ The threat actor advertises custom malware development and related technical services, including bots, parsers, automation tools, reverse engineering, native executable crypters (excluding .NET), traffic-flooding capabilities, and credential stealers.
They explicitly state they are not interested in cryptocurrency-related projects, brute-force tooling, web development, or C2 infrastructure, and emphasize a preference for native, lightweight malware, including shellcode-based implementations.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/301/568/506/585/original/e308209fde2f75aa.png

2026-02-09 19:14:39 UTC

❗️🇮🇱 Cyber Islamic resistance-Axis targeted the website of Maayan
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/277/886/011/original/5812d8e7964dc2a3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/280/483/537/original/e05e410688dd1de2.png

2026-02-09 19:03:13 UTC

‼️ An Android antidetect and device-changing tool called "DeviceChanger/Antidetect+" is being advertised.
The software offers device model and parameter spoofing, hardware/software ID changes, Wi-Fi network blocking and creation, GPS spoofing, app ID changing, remote device management, OVPN/SOCKS clients, Play Integrity bypass, and video/photo stream substitution.
The tool is priced at $100/month.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/936/542/858/original/a3a1c1e5f786bd0c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/950/054/843/original/f49975c866bcc77e.png

2026-02-09 17:40:50 UTC

‼️🇪🇬 A threat actor is selling an alleged full database of EgyptAir containing 104,000+ records and sensitive documents.
The dump includes multiple CSV tables: 21 admin-included user records, 88,653 user accounts with emails, passwords, and national IDs, HR application records, 1,114 HR final results, and 9,607 personal data records from 2020 containing national IDs, birth dates, addresses, phone numbers, military status, marital status, and education details.
The leak also includes 42 PDF files, 3 images, and 1 video from staff emails.
Pricing starts at $300 in Monero.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/097/963/940/original/d4abb94aeda476e6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/099/844/155/original/ea2be45db5483f04.png

2026-02-09 17:32:35 UTC

nmapUnleashed: A modern CLI wrapper for Nmap, designed to make network scanning more comfortable and effective.
GitHub: https://github.com/Sharkeonix/nmap-unleashed
Released: Jan 31, 2026
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/123/316/original/57a47d6930e62794.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/818/515/original/af4e3f6ddee4cd45.png

2026-02-09 17:07:30 UTC

⚠️ The Weekly Whiskey - Valentine's Edition 02/09/2026
This is a 1:1 copy from Dread user /u/samwhiskey
https://darkwebinformer.com/the-weekly-whiskey-valentines-edition-02-09-2026/

2026-02-09 16:50:41 UTC

‼️🇬🇧 UK Fast Food Chain Pepe's Piri Piri Allegedly Breached After Refusing Ransom, 2.1 Million Customer Records Leaked
https://darkwebinformer.com/uk-fast-food-chain-pepes-piri-piri-allegedly-breached-after-refusing-ransom-2-1-million-customer-records-leaked/

2026-02-09 16:34:59 UTC

‼️🇫🇷 French Insurance Company Maxance Allegedly Breached, 348K Customer Records Leaked
https://darkwebinformer.com/french-insurance-company-maxance-allegedly-breached-348k-customer-records-leaked/

2026-02-09 16:18:33 UTC

❗️🇺🇸 A threat actor is auctioning domain admin access to a U.S. construction management company with an estimated revenue of ~$20 million.
The listing specifies Fortinet VPN access with SentinelOne antivirus in place. The auction starts at $2,000 with a $500 step and a blitz price of $4,000.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/573/835/702/072/original/effd21b4aced28b5.png

2026-02-09 16:08:44 UTC

❗️🇱🇺 A threat actor has posted a scrape of 6,555,206 Jamendo.com user records dated February 8, 2026.
Jamendo is a music sharing platform. The dataset is 366MB uncompressed CSV (88MB compressed) and contains user IDs, display names, emails, gender, biography, managed artist IDs, and admin status.
The actor notes that only around a couple million of the 6.5M records have emails set, and that display names are often autofilled from email addresses during registration.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/534/667/315/871/original/a83c62823da6a009.png

2026-02-09 15:19:35 UTC

❗️🇨🇦 Access to a Canadian PrestaShop e-commerce store with native payment forms is being auctioned. The site has processed 51,339 total orders, with 3,737 credit card orders between June 2025 and January 2026.
The listing includes access to admin panels, webshell, and Adminer. The seller notes the store has high customer retention, with only 1 in 4.5 customers being new.
The auction starts at $600 with a blitz price of $2,500.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/341/890/996/715/original/93bcd937f5b213f9.png

2026-02-08 21:33:05 UTC

- reply

On next update I will put an active/not active next to each channel that way you can see the historical review behind it and likely a filter to make it easier to see either/or.

2026-02-06 22:57:02 UTC

‼️🇺🇸 Atlas Air has been claimed a victim to Everest Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/153/064/135/768/original/620e9fa122eebbf7.png

2026-02-06 22:50:29 UTC

❗️Alleged leak of Jeffrey Epstein client password list
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/128/041/976/053/original/daaa1074c6455ae5.png

2026-02-06 00:20:50 UTC

‼️ Dutch authorities just seized one Windscribe VPN server without a warrant, claiming they'll return it after they "fully analyze it."
They say their real concern "is the unredacted Epstein files we had on there..."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/020/821/121/627/915/original/08308233d455cf6d.png

2026-01-30 23:41:55 UTC

The new Pro/Elite threat feed (Plus feed was fine) was showing unstyled CSS and wasn't loading data properly on mobile. It's fixed. The CSS was not made for mobile though, so when using the mobile version switch your browser to desktop site and everything will work fine.

2026-01-30 16:48:13 UTC

‼️ An international law enforcement operation called "Operation Switch off" has concluded, targeting what authorities describe as a large-scale illegal IPTV streaming network.
Led by Italy's Catania Public Prosecutor's Office and coordinated through Eurojust, Europol, and Interpol, the investigation identified 31 individuals allegedly connected to a transnational criminal organization. The suspects face accusations including unauthorized broadcasting of access-controlled content, computer fraud, and money laundering.
According to investigators, the network captured and redistributed live broadcasts and on-demand content from major platforms including Sky, DAZN, Amazon Prime, Netflix, Paramount, and Disney+, allegedly serving millions of users worldwide.
More than 100 Italian Postal Police officers executed searches across 11 Italian cities and 14 international locations, with cooperation from authorities in the United Kingdom, Spain, Romania, Kosovo, Canada, India, South Korea, and the United Arab Emirates.
The year-long investigation built on intelligence from a previous operation called "Taken Down." Authorities allege the suspects used cryptocurrency investments, shell companies, and fictitious asset registrations to obscure proceeds that reportedly generated millions of euros monthly.
The operation disrupted approximately 1,000 Italian resellers and cut service to over 100,000 end users in Italy, with millions more affected globally. Three illegal IPTV platforms were seized in Italy, while investigators in Romania identified a significant distribution operation running six servers.
The original video is in 360p. Source: https://www.poliziadistato.it/articolo/166979f86bd0846335000880
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/985/068/226/878/280/original/aeee38b875f0d78a.mp4

2026-01-22 00:20:54 UTC

- reply

Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/de15ce7b85f87e80375f

2026-01-13 16:54:07 UTC

- reply

Orion Ransomware has been added to the Threat-Surface GitHub repo: https://github.com/DarkWebInformer/Threat-Surface

2026-01-03 00:05:42 UTC

A hacker going by the name Martha Root... takes down a white supremacist dating website and leaks all of the data. Good f*cking shit @BackTwoTheRoot!
okstupid[.]lol
https://x.com/DarkWebInformer/status/2007241716831793170

2025-12-31 19:46:42 UTC

- reply

ENSAI was also claimed on 9/15/2025 (TA: ghidra) and 12/23/2024 (TA: st0jke)

2025-12-30 01:35:26 UTC

- reply

Yes, you can find it in the response header, but you will find something else on this site. 😉

2025-12-29 19:53:58 UTC

💡Darknet Markets Timeline is now available for everyone. https://darkwebinformer.com/darknet-markets-timeline/. There is some inconsistencies & bugs! Some details/sources are still missing, but will be gradually added when I have time. It can also be found on the Resources menu at the header of the website.

2025-12-23 22:57:35 UTC

- reply

Thread (Pitch): https://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd[.]onion/p/59be59fa

2025-12-22 21:51:35 UTC

- reply

Added to Threat-Surface: https://github.com/DarkWebInformer/Threat-Surface

2025-12-20 22:34:24 UTC

- reply

Or here: https://shinyhunte[.]rs

2025-12-18 19:29:55 UTC

- reply

Added to Threat-Surface repo: https://github.com/DarkWebInformer/Threat-Surface

2025-12-18 17:13:43 UTC

Apologies for the inconvenience... the issue is resolved. If you are sitting on one of the threat feed pages do a refresh and alerts should start again. 🙃

2025-12-18 16:18:42 UTC

There is an issue with the threat feed updating, I'm looking into it. This doesn't affect any of the other feeds.

2025-12-08 19:48:47 UTC

Silent.Link: Buy global mobile 4G/5G Internet access and burner phone numbers instantly and privately on any modern eSIM-compatible smartphone.
KYC: Terms explicitly state KYC will never be requested.
X: @silentlink1
Payment: Monero (XMR), Bitcoin (BTC), Lightning
Clearnet: https://silent.link
Dark Web: http://silentlnit5ryavvfz5vw7s4qg62jujd666lnc4tg2chj64zuwuqtvqd[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/685/675/019/159/095/original/c7fa78f70605971f.png

2025-12-07 22:39:20 UTC

- reply

If you only have a plus subscription, you will still see Ransomware stats and recent events from Ransomware groups.

2025-12-03 16:35:19 UTC

https://x.com/DarkWebInformer/status/1996256681630547976

2025-11-27 16:51:05 UTC

🦃 Stay informed. Holidays don’t stop threat actors.

2025-11-26 17:27:37 UTC

Another update... if you are an API subscriber you now have access to an endpoint that provides the news feed in real time. The update can be found at the top of the docs page. The full IOC history is being worked on & may come out in the first week of December rather than Nov.

2025-11-24 19:59:48 UTC

Never seems to get old.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/606/446/913/788/003/original/d4718e41d84e176e.jpeg

2025-11-24 19:36:16 UTC

I had a couple people ask me privately if I would be doing any holiday sales, and the answer is no. Also have been asked if there are watermarks or blurred images on any of the feeds, no to that as well. All images on feeds and within the paywall blog posts contain no watermarks or blurred images (all unredacted).

2025-11-23 23:49:11 UTC

I pushed some updates to the Whiteintel Corp Alerts feed for those with access to the early access program. Search, sorting, some stats at the top, and some loading behavior. Should be available to all paid subscribers by no later than Wednesday.

2025-11-22 21:38:26 UTC

CISA Kev Catalog Feed and News Feed were updated with some mobile fixes so you can view them on your phone now. Whiteintel Corporate alerts/feed (early access) now shows every page and not just the first 3 pages. It also has a search bar now.

2025-11-19 20:38:54 UTC

- reply

This timeline will be available to everyone once it is ready.

2025-11-19 20:37:19 UTC

The Darknet Markets Timeline that is currently in early access has been updated. 2010-2023 are about 90% accurate now, the only thing missing is source articles which will take time because no one really covers Darknet Markets. 2024-2025 are still to be added. https://darkwebinformer.com/darknet-markets-timeline/

2025-11-12 23:16:03 UTC

Ransomware Attack Update for the 12th of November 2025
https://darkwebinformer.com/ransomware-attack-update-for-the-12th-of-november-2025/

2025-11-12 17:35:25 UTC

It's 1995 & you startup a 486DX
Video Credit: youtube.com/@PCUSER486
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/537/931/167/438/750/original/7705ac80814922d1.mp4

2025-11-11 17:32:04 UTC

🚨RansomHouse Ransomware claims 3 victims
🇫🇮 Octomeca Oy
🇵🇭 Public Safety Mutual Benefit Fund
🇲🇹 Polidano Group
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/532/254/974/395/434/original/7c4b78adde7ed68c.png

2025-11-01 21:57:44 UTC

- reply

These will be added under Resources -> Services on the navigation bar.

2025-10-30 17:16:20 UTC

- reply

First seen is showing by newest instead of latest. Refresh.

2025-10-29 21:41:08 UTC

- reply

Also will eventually add some things like Domain info, shortcut links to check on sites like http://crt.sh/, fofa, virustotal, urlscan, etc.

2025-10-21 20:08:55 UTC

⚠️Chat, the feds don't tell anyone when someone gets arrested until you see the press release or documents. You could say someone could be arrested if they go silent for a while, but even then you really don't know. 🥷

2025-10-20 23:05:18 UTC

- reply

“Sic transit gloria mundi” is Latin for “Thus passes the glory of the world” meaning fame, status, or influence fades.

2025-10-19 03:12:36 UTC

Hackers are exploiting a 0-day vulnerability in Windows Remote Access Connection Manager in ongoing attacks.
CVE: CVE-2025-59230
https://gbhackers.com/hackers-exploit-windows-remote-access-connection-manager-0-day/

2025-10-18 23:22:13 UTC

It’s more peaceful when everything is private. #privacy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/736/178/164/756/original/792696d1930072c1.jpg

2025-10-18 21:26:34 UTC

- reply

Stay Connected with Dark Web Informer
Get full access to exclusive intelligence, unredacted screenshots, claim URLs, early alerts and more at darkwebinformer.com
Join Telegram: t.me/SliceForLife🔪
Follow the X Bot for More Intel: x.com/DarkWebIntelBot

2025-10-18 21:26:25 UTC

🚨🇵🇪 MC INVERSIONES INMOBILIARIAS Construction Company has Fallen Victim to RADAR Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/280/363/831/013/original/37e171a70a909457.png

2025-10-18 20:36:50 UTC

- reply

2025-10-18 20:36:23 UTC

🚨TK HOLDINGS GROUP has been Claimed a Victim to RADAR Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/397/084/915/536/103/original/b444a75f4840b0eb.png

2025-10-18 20:23:39 UTC

- reply

2025-10-18 19:42:40 UTC

- reply

2025-10-18 19:42:28 UTC

If you are an Elite subscriber, I made a lot of bug fixes to the Darknet Markets Timeline. There is still some inconsistencies and bugs but the flow is a lot better. 2024 and 2025 are the remaining years to be added.
https://darkwebinformer.com/darknet-markets-timeline/

2025-10-18 19:09:04 UTC

🚨CVE-2025-21420: Proof of Concept for Windows Disk Cleanup Tool EoP
GitHub: https://github.com/moiz-2x/CVE-2025-21420_POC
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/396/741/814/097/842/original/fa863eb989021bcc.mp4

2025-10-18 17:09:11 UTC

🚨CVE-2025-49144: A high-severity local privilege escalation flaw in the Notepad++ installer affecting version 8.8.1 and earlier.
GitHub: https://github.com/TheTorjanCaptain/CVE-2025-49144_PoC
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/396/268/766/985/595/original/452fbab567720afc.png

2025-10-18 16:54:06 UTC

🚨Alleged Data Breach Exposing 1.5 Million Israeli Settlers
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/396/211/188/999/535/original/4ca4b0ff0fb3bd8e.png

2025-10-18 16:44:22 UTC

🚨Claimed Sale of Advanced Phishlets
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/396/172/887/277/107/original/86c03d239cfacf16.png

2025-10-17 00:34:30 UTC

🚨New Telegram Channel: https://t.me/SliceForLife

2025-10-16 22:40:43 UTC

My main Telegram account and the Telegram channel (Phasyr) were both just banned... again.

2025-10-15 00:06:44 UTC

For anyone who uses X, you should be aware of this. https://x.com/DarkWebInformer/status/1978249519344091364

2025-10-13 22:14:50 UTC

Mischievous idea: logging into someone's Cloudflare account and changing DNS records from proxied to DNS only.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/369/156/998/993/188/original/c98e3b4947d0b397.mp4

2025-10-13 21:28:46 UTC

Threat Attack Daily - 13th of October 2025
https://darkwebinformer.com/threat-attack-daily-13th-of-october-2025/

2025-10-13 20:31:31 UTC

⚠️"The Weekly Whiskey 10/13/2025"
Different Threads for the last week on Dread.
Dread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/9c806eaa787edeb26b58
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/753/361/473/788/original/8653d5c71773fe22.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/753/362/410/264/original/5917108ada70a47a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/753/374/928/974/original/73193f9adddb53c5.png

2025-10-13 20:20:28 UTC

🚨🇯🇵 Furuno Electric has Fallen Victim to Rhysida Ransomware
Ransom: 15 BTC or $1,736,934.00 USD at time of post
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/709/556/348/758/original/3db35efcab0bc626.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/709/645/290/126/original/696d836cdd8e1105.png

2025-10-13 17:38:25 UTC

🚨🇫🇷 Hauts-de-France Region has Fallen Victim to Qilin Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/368/073/330/389/156/original/39024caadf16b2e9.png

2025-10-13 17:19:18 UTC

🚨 Alleged Auction of MERGE CC Shop Data (2022–2025) Containing 9.8 Million Cards
📌 Global (80% USA)
• Industry: Financial / Carding
• Threat Actor: cashmoneycard
• Network: Clearnet, Dark Web
Details: Threat actor cashmoneycard is auctioning a large payment card data allegedly sourced from the former MERGE CC Shop. The listing claims over 9.8 million card entries (2022–2025) and 7.5 million cards from 2026 onward, divided into 200 separate bases. Approximately 80% of the data is said to originate from U.S. sources. Starting bid $5,000, step $1,000, blitz $25,000. Bases are reportedly private and not publicly accessible.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/997/567/300/597/original/ee82bfaa76b51be8.png

2025-10-13 16:56:42 UTC

[Darknetlive Archive] Woman Pleads Guilty to Hiring a Hitman
https://darkwebinformer.com/darknetlive-archive-woman-pleads-guilty-to-hiring-a-hitman/

2025-10-13 16:23:53 UTC

🚨 Claimed Sale of Android Spyware 2025: Rails-based C2 with Metasploit and ADB
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/778/794/410/171/original/49d11f9b8902b137.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/778/814/279/433/original/6ed590c6a787f34b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/778/817/641/144/original/9b04689b5faa46ce.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/778/851/733/849/original/2f1e430266f9b51a.png

2025-10-13 15:58:11 UTC

🚨🇺🇸 North Stonington Public Schools Falls Victim to INTERLOCK Ransomware
https://darkwebinformer.com/north-stonington-public-schools-falls-victim-to-interlock-ransomware/

2025-10-13 15:42:37 UTC

🚨 Alleged Sale of “Exotic West Africa” Online Shop with 2,200 Daily Orders
📌 West Africa
• Industry: E-Commerce / Online Retail
• Threat Actor: Stari4ok
• Network: Clearnet, Dark Web
Details: Threat actor Stari4ok is auctioning access to an online shop operating under the name “Exotic West Africa,” claiming an average of approximately 2,200 daily orders over the past five months. The listing references payment processing through cloudwaysapps.com and shows active transaction logs with thousands of completed orders. Auction terms include a $2,000 starting bid, $300 increments, and an $8,000 blitz price.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/367/617/474/588/565/original/968ab9daf9e2abed.png

2025-10-13 15:24:41 UTC

🚨🇺🇸 Kearney Public Schools Confirms Cybersecurity Breach, Classes to Continue Without Network Access
https://darkwebinformer.com/kearney-public-schools-confirms-cybersecurity-breach-classes-to-continue-without-network-access/

2025-10-12 23:33:51 UTC

🚨 How long till this GitHub page gets seized and will it be a GitHub first? 🤣
https://vfvct.github[.]io/VFVCT/
Ransomware or Hacktivism or both? 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/805/540/598/147/original/f3c612c922e9f7b8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/805/528/480/746/original/316cb80319815128.png

2025-10-12 23:02:34 UTC

🚨🇮🇹🇺🇸 Alleged Sale of RDP Access to Italian Construction Company, Italian Industrial Machinery Company, and US Corporation within Advertising & Marketing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/685/171/166/911/original/990ca3e1752389a7.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/685/173/979/814/original/b8e239824a63a608.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/685/178/555/731/original/5a36daeed59be05f.png

2025-10-12 21:21:51 UTC

⚠️Dread: Rate my OpSec
3/10
Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/9348dda96ad2effe33d4
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/363/289/075/424/696/original/cb37a859876a00c3.png

2025-10-12 17:31:19 UTC

🚨New Oracle Security Alert Advisory - CVE-2025-61884
CVSS: 7.5
https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
This security alert covers CVE-2025-61884 affecting Oracle E-Business Suite. The flaw is remotely exploitable without authentication, allowing network-based attacks that do not require a username or password. Successful exploitation may grant access to sensitive resources.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/362/379/635/465/389/original/f36a3ce280827fc5.png

2025-10-12 17:26:07 UTC

🚨🇪🇸🇫🇷🇱🇹 Alleged Sale of Prestashop Admin Access in Spain, France and Lithuania with Credit Card Redirect
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/362/361/828/060/550/original/9d0f993ab4a24ede.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/362/361/828/600/653/original/8cb7b6f814fecac6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/362/361/830/384/247/original/817d32aae84c6624.png

2025-10-06 01:13:20 UTC

🚨🇿🇦 Alleged Data Breach of Methodist Church of Southern Africa
📌 South Africa
• Industry: Religious Organization / Education / Community Support
• Threat Actor: Unlisted
• Network: Clearnet, Dark Web
Details: Threat actors claim to hold 150GB of data tied to the Methodist Church of Southern Africa. Reported revenue $14.2M. Allegedly includes internal documents, records, and community program data.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/324/562/664/364/001/original/6abac0808df46862.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/324/562/670/556/177/original/d0c59eda6ca16b01.png

2025-08-23 23:25:50 UTC

GoSearch: Search anyone's digital footprint across 300+ websites
GitHub: https://github.com/ibnaleem/gosearch
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/080/660/013/797/955/original/5180ccc2781bf1e2.png

2025-08-17 01:20:42 UTC

🚨🇺🇸 Alleged Sale of 300K+ U.S. Leads and Shopify Store Orders with Daily Data Feed
📌 United States
• Industry: E-commerce / Retail
• Threat Actor: XHJACK
• Network: Clearnet, Dark Web
• Forum: Exploit
• Price: $0.8 per daily order | 4,500$ for 300K historical dataset (2020–2025)
Details: The listing claims to offer a database of more than 300,000 customer records from a U.S.-based pet products Shopify store. The data is said to include names, email addresses, phone numbers, order histories, and physical addresses, with between 300 and 1,000 new orders reportedly available each day. The seller emphasizes that the dataset is untouched and unprocessed, with daily order data priced individually and the full 2020–2025 historical archive available as a bulk purchase.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/041/476/244/805/237/original/520ddec7458a0765.png

2025-08-11 14:46:25 UTC

🚨🇧🇷UseRH Database Breach, 10K User Records Allegedly Exposed
https://darkwebinformer.com/userh-database-breach-10k-user-records-allegedly-exposed/

2025-08-10 17:11:48 UTC

🚨Alleged Sale of njRAT v0.11G Source Code
• Industry: Malware
• Threat Actor: Richest
• Network: Clearnet, Dark Web
• Details: A threat actor is allegedly sharing the source code for njRAT v0.11G, a Remote Access Trojan (RAT) with capabilities such as remote desktop control, webcam access, microphone activation, keystroke logging, password extraction from browser history, file execution, USB spreading, and encrypted host communications.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/562/453/278/744/original/58ca78a3f5d76988.png

2025-08-01 17:53:48 UTC

addy.io: Anonymous Email Forwarding. Protect your real email address using email aliases.
Clearnet: https://addy.io
Open-source: https://github.com/anonaddy/anonaddy
Features: Disposable email addresses, Custom domain support, Multiple inboxes, Catch-all address, Browser extensions, Email forwarding, Spam filtering, Alias generation, API access, Self-destructing addresses, Dark mode, PGP encryption support, Web interface, Email blocking rules, Open-source platform
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/954/779/744/156/205/original/157925910ae026d8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/954/779/747/262/250/original/5b0b81c002157599.png

2025-07-29 18:33:02 UTC

RoboSats: An easy & privacy focused way to trade BTC for regular currencies. It streamlines the peer-to-peer process, using lightning hold invoices to reduce the need for trust or third-party custody.
Clearnet: robosats.org
Onion: http://robosatsy56bwqn56qyadmcxkx767hnabg4mihxlmgyt6if5gnuxvzad[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/937/951/721/482/879/original/ef613f8ddd98f76e.webp

2025-07-19 21:44:07 UTC

Dark Scrape: An OSINT Tool For Scraping Dark Web Websites
GitHub: https://github.com/itsmehacker/DarkScrape
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/882/081/194/424/037/original/1e274be03dd0f92f.png

2025-07-15 18:26:20 UTC

yt-dlp: A feature-rich command-line audio/video downloader with support for thousands of sites.
GitHub: https://github.com/yt-dlp/yt-dlp

2025-07-13 20:48:00 UTC

Fact #Fortinet
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/847/885/857/278/421/original/53a179741a62190f.jpg

2025-06-12 14:39:36 UTC

🚨🇺🇸Alleged Sale of T-Mobile US Customer Data
Claims to contain 64 Million Records
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/670/906/526/690/324/original/74d2c24e43d742b3.png

2025-05-19 15:32:56 UTC

🚨Allegedly 9GB of Data Belonging to NATO has been Leaked
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/535/220/380/003/288/original/473a384c9c3cfe02.png

2025-05-16 16:25:18 UTC

🚨🇺🇸Alleged Data for Sale of 183 Million US citizens
Fields: Full name, address, city, state, zip code, cellphone number, email, phone carrier, and gender.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/518/439/798/226/240/original/a680d08a756f6db3.png

2025-05-01 17:00:12 UTC

90s Internet: America Online (AOL)
Credit: youtube.com/@PCUSER486
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/433/642/292/702/438/original/f1948b05aafc1039.mp4

2025-04-08 22:29:27 UTC

💡 Threat Attack Daily - 8th of April 2025
https://darkwebinformer.com/threat-attack-daily-8th-of-april-2025/