Dark Web Informer :verified_paw:

Visit my links below!

Website: https://darkwebinformer.com

Website Pricing (Crypto payments are fully automated): https://darkwebinformer.com/pricing

Socials: https://darkwebinformer.com/socials

API Access: https://darkwebinformer.com/api-details

About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer

Updated: 2026-06-29

Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrvqhr5sdnf9rds8qq0l844cx64cjej76wqjcs06pw26sfpsxehqgpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzrmhwden5te0dehhxarj9ekk7mghu4zea

Publishing to

relay.ditto.pub

nostr.mom

relay.mostr.pub

Author Public Key

npub1xcpw8fqmxj2xmqwqql70ttsd4t39n9a5up93ql5zu44qjrqdnwqsfthx5s

Show more details

Last Notes

2026-07-17 20:50:41 UTC

‼️ New Dark Web Informer Blog Post!
Title: OpenSSL HollowByte Flaw Lets 11-Byte TLS Requests Exhaust Server Memory
Link: https://darkwebinformer.com/openssl-hollowbyte-flaw-lets-11-byte-tls-requests-exhaust-server-memory/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

2026-07-16 22:27:13 UTC

‼️ CVE-2026-58635: Windows Narrator Braille Local Privilege Escalation
PoC: https://github.com/DavidCarliez/CVE-2026-58635-PoC
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/932/007/156/737/447/original/ea1c4ec21e03fa65.png

2026-07-15 22:34:38 UTC

💥 Forgejo: Forgejo is a self-hosted, open-source Git software forge for managing repositories, issues, pull requests, CI/CD, and software projects.
https://forgejo.org

2026-07-15 22:33:29 UTC

💥 Forgejo: Forgejo is a self-hosted, open-source Git software forge for managing repositories, issues, pull requests, CI/CD, and software projects.
https://forgejo.org
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/926/369/540/710/253/original/ec71ba032188cb71.png

2026-07-14 16:16:58 UTC

‼️ New Dark Web Informer Blog Post!
Title: Welsh Doxbin Administrator Jailed for Encouraging Swatting Attacks Across Three Countries
Link: https://darkwebinformer.com/welsh-doxbin-administrator-jailed-for-encouraging-swatting-attacks-across-three-countries/

2026-07-13 18:45:32 UTC

‼️ New Dark Web Informer Blog Post!
Title: CISA Adds Cisco IOS Flaw Exploited by Russian FSB Actors to KEV Catalog
Link: https://darkwebinformer.com/cisa-adds-cisco-ios-flaw-exploited-by-russian-fsb-actors-to-kev-catalog/

2026-07-13 17:15:02 UTC

🚨Betrial runner and billing data allegedly leaked
A forum actor claims to have released a partial database tied to Betrial, an online platform used by trail-running enthusiasts to discover races, track results, compare rankings, and monitor performance.
The listing references 2,831,633 runners across multiple countries, including 954,013 records from France, 135,988 from Belgium, and 80,632 from Spain. The files reportedly total 537MB in JSON and JSONL formats.
The advertised data includes runner IDs, names, aliases, genders, ages, postal codes, cities, countries, and account creation dates. Additional files allegedly contain around 1,500 Stripe invoice records and 241 linked user-account records, including names, email addresses, subscription and payment details, account metadata, roles, and runner identifiers.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/913/792/656/347/337/original/6ac5e3562605a34b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/913/792/677/455/030/original/b31d4829e661a722.png

2026-07-09 20:53:06 UTC

‼️ New Dark Web Informer Blog Post!
Title: Federal Prisoner Charged With Stealing $290K in Forfeited Cryptocurrency
Link: https://darkwebinformer.com/federal-prisoner-charged-with-stealing-290k-in-forfeited-cryptocurrency/

2026-07-06 19:55:14 UTC

🚨 NetNut[.]io has finally been seized by the FBI.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/874/786/435/727/580/original/0730a1ba238bcec1.png

2026-07-06 17:32:17 UTC

‼️ New Dark Web Informer Blog Post!
Title: A Long-Lived KVM Bug Resurfaces: Shadow Paging Use-After-Free in the Linux Kernel (CVE-2026-53359)
Link: https://darkwebinformer.com/a-long-lived-kvm-bug-resurfaces-shadow-paging-use-after-free-in-the-linux-kernel-cve-2026-53359/

2026-07-04 19:32:18 UTC

🚨 A verified X ad was caught pushing Mac malware.
A sponsored post from a verified account promoted what looked like DynamicLake, the Mac utility that brings a Dynamic Island-style feature to the MacBook notch.
The ad redirected users to a fake lookalike domain, dynamicmacisland[.]com, where visitors were told to open Terminal and paste an install command.
Jamf identified the payload as a recent Atomic Stealer variant tracked as MacSync, with DigitStealer also seen in some cases.
The report also highlighted ConsentFix, a newer ClickFix-style trick that can steal Microsoft 365 session tokens through the browser without installing malware or asking for a password.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/863/371/624/956/448/original/cbaa55b846aa43cc.jpg

2026-06-30 19:55:11 UTC

When the company has one DBA and he’s been carrying prod since 1998.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/840/811/997/036/202/original/d8436ab6b4635a55.mp4

2026-02-11 16:41:24 UTC

‼️🇰🇼 A data set allegedly from Zain Kuwait, a major telecommunications provider, has been posted for sale containing 3,849,601 subscriber records totaling 11.3GB in JSON format.
The breach is dated 2026 and includes subscriber numbers, owner names, and associate names. Sample data shows Arabic-language subscriber records with phone numbers, verification status, and spam flags.
The seller offers tiered pricing in Monero: 15 XMR for takedown, 10 XMR for exclusive purchase with deletion, 5 XMR for non-exclusive access, or 2 XMR for the scraping exploit itself.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/216/160/172/original/3af896c0c9ba0626.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/989/203/693/696/original/a9e25b850d4224c8.png

2026-02-10 20:02:46 UTC

Story of my life. 😭
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/118/743/353/697/original/d5ccf5d851ceac23.webp

2026-02-09 23:51:28 UTC

‼️🇬🇧 A data set allegedly from alphacapitalgroup.uk, a UK-based forex trading platform, has been posted for download.
The dump dates from May 2024 and contains 240,647 lines including payment IDs, transaction IDs, user IDs, emails, payment types, amounts in dollars, user profiles, countries, promo/coupon names, account login IDs, challenge names, and timestamps.
Sample data shows transactions from users across the UK, Australia, India, South Africa, Nigeria, Kuwait, and other countries with various "Alpha Pro" account tiers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/043/353/464/905/227/original/600cfdd75fbf067c.png

2026-02-09 23:21:41 UTC

Daily Dose of Dark Web Informer - February 9th, 2026
https://darkwebinformer.com/daily-dose-of-dark-web-informer-february-9th-2026/

2026-02-09 21:08:07 UTC

❗️🇦🇷 WordPress admin access to an Argentinian e-commerce store is being auctioned by a threat actor.
The listing claims a payment card redirect via MercadoPago is in place, with 100 orders in January and 26 in February, and 90% unique orders.
The auction starts at $300 with a blitz price of $600.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/710/248/660/346/original/b022ae5f8e636eb6.png

2026-02-09 20:05:58 UTC

❗️🇿🇦 WordPress admin access to a South African e-commerce store is being auctioned by a threat actor.
The listing claims a payment card redirect via PayGate is already in place, with 200 orders processed in January and 100% unique orders.
The auction starts at $300 with a blitz price of $600.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/467/749/657/563/original/2b740c1fb36d76f4.png

2026-02-09 19:23:37 UTC

❗️ The threat actor advertises custom malware development and related technical services, including bots, parsers, automation tools, reverse engineering, native executable crypters (excluding .NET), traffic-flooding capabilities, and credential stealers.
They explicitly state they are not interested in cryptocurrency-related projects, brute-force tooling, web development, or C2 infrastructure, and emphasize a preference for native, lightweight malware, including shellcode-based implementations.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/301/568/506/585/original/e308209fde2f75aa.png

2026-02-09 19:14:39 UTC

❗️🇮🇱 Cyber Islamic resistance-Axis targeted the website of Maayan
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/277/886/011/original/5812d8e7964dc2a3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/266/280/483/537/original/e05e410688dd1de2.png

2026-02-09 19:03:13 UTC

‼️ An Android antidetect and device-changing tool called "DeviceChanger/Antidetect+" is being advertised.
The software offers device model and parameter spoofing, hardware/software ID changes, Wi-Fi network blocking and creation, GPS spoofing, app ID changing, remote device management, OVPN/SOCKS clients, Play Integrity bypass, and video/photo stream substitution.
The tool is priced at $100/month.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/936/542/858/original/a3a1c1e5f786bd0c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/042/220/950/054/843/original/f49975c866bcc77e.png

2026-02-09 17:40:50 UTC

‼️🇪🇬 A threat actor is selling an alleged full database of EgyptAir containing 104,000+ records and sensitive documents.
The dump includes multiple CSV tables: 21 admin-included user records, 88,653 user accounts with emails, passwords, and national IDs, HR application records, 1,114 HR final results, and 9,607 personal data records from 2020 containing national IDs, birth dates, addresses, phone numbers, military status, marital status, and education details.
The leak also includes 42 PDF files, 3 images, and 1 video from staff emails.
Pricing starts at $300 in Monero.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/097/963/940/original/d4abb94aeda476e6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/897/099/844/155/original/ea2be45db5483f04.png

2026-02-09 17:32:35 UTC

nmapUnleashed: A modern CLI wrapper for Nmap, designed to make network scanning more comfortable and effective.
GitHub: https://github.com/Sharkeonix/nmap-unleashed
Released: Jan 31, 2026
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/123/316/original/57a47d6930e62794.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/865/149/818/515/original/af4e3f6ddee4cd45.png

2026-02-09 17:07:30 UTC

⚠️ The Weekly Whiskey - Valentine's Edition 02/09/2026
This is a 1:1 copy from Dread user /u/samwhiskey
https://darkwebinformer.com/the-weekly-whiskey-valentines-edition-02-09-2026/

2026-02-09 16:50:41 UTC

‼️🇬🇧 UK Fast Food Chain Pepe's Piri Piri Allegedly Breached After Refusing Ransom, 2.1 Million Customer Records Leaked
https://darkwebinformer.com/uk-fast-food-chain-pepes-piri-piri-allegedly-breached-after-refusing-ransom-2-1-million-customer-records-leaked/

2026-02-09 16:34:59 UTC

‼️🇫🇷 French Insurance Company Maxance Allegedly Breached, 348K Customer Records Leaked
https://darkwebinformer.com/french-insurance-company-maxance-allegedly-breached-348k-customer-records-leaked/

2026-02-09 16:18:33 UTC

❗️🇺🇸 A threat actor is auctioning domain admin access to a U.S. construction management company with an estimated revenue of ~$20 million.
The listing specifies Fortinet VPN access with SentinelOne antivirus in place. The auction starts at $2,000 with a $500 step and a blitz price of $4,000.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/573/835/702/072/original/effd21b4aced28b5.png

2026-02-09 16:08:44 UTC

❗️🇱🇺 A threat actor has posted a scrape of 6,555,206 Jamendo.com user records dated February 8, 2026.
Jamendo is a music sharing platform. The dataset is 366MB uncompressed CSV (88MB compressed) and contains user IDs, display names, emails, gender, biography, managed artist IDs, and admin status.
The actor notes that only around a couple million of the 6.5M records have emails set, and that display names are often autofilled from email addresses during registration.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/534/667/315/871/original/a83c62823da6a009.png

2026-02-09 15:19:35 UTC

❗️🇨🇦 Access to a Canadian PrestaShop e-commerce store with native payment forms is being auctioned. The site has processed 51,339 total orders, with 3,737 credit card orders between June 2025 and January 2026.
The listing includes access to admin panels, webshell, and Adminer. The seller notes the store has high customer retention, with only 1 in 4.5 customers being new.
The auction starts at $600 with a blitz price of $2,500.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/341/890/996/715/original/93bcd937f5b213f9.png

2026-02-08 21:33:05 UTC

- reply

On next update I will put an active/not active next to each channel that way you can see the historical review behind it and likely a filter to make it easier to see either/or.

2026-02-06 22:57:02 UTC

‼️🇺🇸 Atlas Air has been claimed a victim to Everest Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/153/064/135/768/original/620e9fa122eebbf7.png

2026-02-06 22:50:29 UTC

❗️Alleged leak of Jeffrey Epstein client password list
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/026/128/041/976/053/original/daaa1074c6455ae5.png

2026-02-06 00:20:50 UTC

‼️ Dutch authorities just seized one Windscribe VPN server without a warrant, claiming they'll return it after they "fully analyze it."
They say their real concern "is the unredacted Epstein files we had on there..."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/020/821/121/627/915/original/08308233d455cf6d.png

2026-01-31 16:31:13 UTC

❗️🇺🇸 A threat actor claims to have breached Apollo[.]io, a B2B sales intelligence platform, allegedly exposing 48.03 GB of compressed data including names, emails, organization names, job titles, and other contact information.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/990/662/837/420/395/original/5227a86805221209.png

2026-01-30 23:41:55 UTC

The new Pro/Elite threat feed (Plus feed was fine) was showing unstyled CSS and wasn't loading data properly on mobile. It's fixed. The CSS was not made for mobile though, so when using the mobile version switch your browser to desktop site and everything will work fine.

2026-01-30 16:48:13 UTC

‼️ An international law enforcement operation called "Operation Switch off" has concluded, targeting what authorities describe as a large-scale illegal IPTV streaming network.
Led by Italy's Catania Public Prosecutor's Office and coordinated through Eurojust, Europol, and Interpol, the investigation identified 31 individuals allegedly connected to a transnational criminal organization. The suspects face accusations including unauthorized broadcasting of access-controlled content, computer fraud, and money laundering.
According to investigators, the network captured and redistributed live broadcasts and on-demand content from major platforms including Sky, DAZN, Amazon Prime, Netflix, Paramount, and Disney+, allegedly serving millions of users worldwide.
More than 100 Italian Postal Police officers executed searches across 11 Italian cities and 14 international locations, with cooperation from authorities in the United Kingdom, Spain, Romania, Kosovo, Canada, India, South Korea, and the United Arab Emirates.
The year-long investigation built on intelligence from a previous operation called "Taken Down." Authorities allege the suspects used cryptocurrency investments, shell companies, and fictitious asset registrations to obscure proceeds that reportedly generated millions of euros monthly.
The operation disrupted approximately 1,000 Italian resellers and cut service to over 100,000 end users in Italy, with millions more affected globally. Three illegal IPTV platforms were seized in Italy, while investigators in Romania identified a significant distribution operation running six servers.
The original video is in 360p. Source: https://www.poliziadistato.it/articolo/166979f86bd0846335000880
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/985/068/226/878/280/original/aeee38b875f0d78a.mp4

2026-01-25 01:58:07 UTC

Clawdbot: A personal AI assistant you run on your own devices.
GitHub: https://github.com/clawdbot/clawdbot
Clawdbot answers you on the channels you already use (WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, Microsoft Teams, WebChat), plus extension channels like BlueBubbles, Matrix, Zalo, and Zalo Personal. It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/953/253/246/849/388/original/ae07fbb027b6c046.jpg

2026-01-23 21:20:57 UTC

‼️Microsoft reportedly provided the FBI with a set of BitLocker encryption keys that allowed investigators to unlock laptops belonging to criminal suspects, according to reports.
https://techcrunch.com/2026/01/23/microsoft-gave-fbi-a-set-of-bitlocker-encryption-keys-to-unlock-suspects-laptops-reports
The case centered on multiple individuals suspected of committing fraud tied to the Pandemic Unemployment Assistance program in Guam, a U.S. territory in the Pacific.

2026-01-22 00:20:54 UTC

- reply

Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/de15ce7b85f87e80375f

2026-01-22 00:19:32 UTC

⚠️A vendor using the alias speedypharma (link) was arrested by law enforcement. Following the arrest, authorities likely accessed his Dark Matter Market account using his credentials.
There was discussion around how the “last login” timestamp works. In Dark Matter Market’s codebase, this timestamp reflects a fully successful login, which strongly suggests law enforcement access rather than routine activity. Dark Matter requires a PGP to be used to login to the account. So LE likely also has access to the vendor's PGP key. Something similar occurred with LEA using the Archetyp admin's PGP to sign messages on Dread.
Markets typically ban vendors quickly after a bust to reduce the window in which law enforcement can access accounts and collect additional data.
https://darkwebinformer.com/man-arrested-in-south-bakersfield-on-federal-drug-charges/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/935/875/795/316/531/original/910655b7c1619193.png

2026-01-21 19:07:10 UTC

NMAP Commands
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/934/653/914/854/911/original/45418b77ac6c8998.jpg

2026-01-19 20:32:49 UTC

Every cable has a purpose… except no one knows what it is.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/923/666/121/764/228/original/d3aa9e81df76b444.jpg

2026-01-15 23:32:44 UTC

A Hacker Shares His Biggest Fears
A white hat hacker, a cybersecurity analyst with more than 30 years of experience at a major Silicon Valley firm, reflects on why he walked away from black hat hacking to use his skills for the greater good.
He explains the unsettling truth about how vulnerable modern systems really are, from the possibility of attackers crippling the American power grid or shutting down critical medical facilities to how effortlessly someone with nothing more than WiFi and spare time can access private information most people assume is secure.
Video Credit: youtube.com/@VICE
Video Date: August 11th, 2021
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/901/723/916/286/946/original/ec8943640825feb0.mp4

2026-01-13 16:54:07 UTC

- reply

Orion Ransomware has been added to the Threat-Surface GitHub repo: https://github.com/DarkWebInformer/Threat-Surface

2026-01-13 16:52:48 UTC

‼️Affiliate Access login, Client Portal login, and Server Status from the Orion Ransomware DLS:
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/access/partner-access
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/user/access
http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid[.]onion/server-status
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/098/587/313/original/b2896ffab59c821e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/107/926/352/original/7100828da8f8ef13.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/888/821/122/901/173/original/250afd563b8880aa.png

2026-01-10 15:50:29 UTC

‼️17.5 Million Instagram Accounts Exposed in Major API Data Leak
Meta is facing a significant security incident after cybersecurity firm Malwarebytes confirmed a breach impacting 17.5 million Instagram users.
The leaked dataset, which includes usernames, email addresses, phone numbers, and partial physical addresses, is now being actively circulated on dark web forums.
In the aftermath, millions of Instagram users have reported receiving unexpected password reset emails from the platform’s legitimate domain: security@mail[.]instagram[.]com.
Although the emails are authentic, they were not requested by recipients, fueling widespread confusion over whether Instagram is experiencing a glitch or if users are being targeted in phishing attempts.
Security researchers now believe these unsolicited reset emails are directly linked to the breach, suggesting threat actors may be using the exposed data to initiate account recovery flows or to obscure targeted phishing activity.
The dataset is believed to have been obtained by a hacker known as “Solonik”, with the underlying issue reportedly tied to an API-related exposure dating back to 2024 (see screenshot 2).
As of now, Meta has not issued an official statement regarding the incident.
Sources: https://cybersecuritynews.com/instagram-data-leak-exposes-sensitive-info-of-17-5m-accounts/
https://cyberinsider.com/malwarebytes-warns-of-instagram-data-breach-impacting-17-5-million-users/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/871/593/655/931/961/original/1b91be7c78d052e2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/871/593/663/194/671/original/42462a623c6c05d5.png

2026-01-09 23:16:10 UTC

Why Oversharing is the Real OPSEC Failure - OPSEC for High Threat Models
https://darkwebinformer.com/why-oversharing-is-the-real-opsec-failure-opsec-for-high-threat-models/
This is a 1:1 copy from Dread user /u/jake0126. The original post can be found on Dread at: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/a9dd03e88e92dfc0715c. The screenshots from the post are at the bottom of this page.

2026-01-05 18:03:27 UTC

Microsoft Office is no more... it is now called "Microsoft 365 Copilot app" 🤣
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/843/806/300/520/461/original/a3c7f463e390c424.png

2026-01-04 20:00:33 UTC

🚨 L4663R666H05T & Simsimi defaced the website of Faith Victory Association
Umbra Forums: https://x.com/DarkWebInformer/status/2007495858997399775
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/838/603/203/084/936/original/1666f5c3b934c4e1.png

2026-01-03 00:05:42 UTC

A hacker going by the name Martha Root... takes down a white supremacist dating website and leaks all of the data. Good f*cking shit @BackTwoTheRoot!
okstupid[.]lol
https://x.com/DarkWebInformer/status/2007241716831793170

2025-12-31 19:46:42 UTC

- reply

ENSAI was also claimed on 9/15/2025 (TA: ghidra) and 12/23/2024 (TA: st0jke)

2025-12-31 19:40:28 UTC

🚨🇫🇷 French engineering school ENSAI (École nationale de la statistique et de l'analyse de l'information) allegedly fully compromised. Complete source code and extensive student databases breached including 3,900 student records.
▪️ All student information (3,900 students)
▪️ All student photos with names
▪️ Personal and professional email addresses
▪️ Personal mobile phone numbers
▪️ First and last names of ENSAI professors
▪️ Payment receipts (partial credit card numbers, CVV, expiration dates)
▪️ Applications (DUSTID, LMJET, LMJR, MDATACU, SDDP, SMARTDATA)
▪️ Evaluation forms
▪️ SQL files
▪️ Students' residential addresses
▪️ All ENSAI student accounts
▪️ Complete ENSAI source code (60,000 files + 21GB)
This is a comprehensive institutional breach affecting thousands of students and faculty members.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/069/291/463/original/1c5b8bb3f55862e4.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/074/684/016/original/7367b8e6d7e0bb60.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/815/874/132/417/473/original/13b47c375884f589.png

2025-12-30 01:35:26 UTC

- reply

Yes, you can find it in the response header, but you will find something else on this site. 😉

2025-12-30 01:30:29 UTC

- reply

🚨 The site is running on Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion/cgi-bin/printenv
http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion/cgi-bin/test-cgi
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/928/034/220/292/original/89fd4bde8de94d53.png

2025-12-29 23:20:11 UTC

🚨 New Ransomware Group Identified: The Sicari Knife
Dark Web 1: http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad[.]onion
Dark Web 2: http://sicariktdbhjtrk6f2pwdh6wlequw7pcjva25skkzz4m3zz3opyox3qd[.]onion
Dark Web 3: http://sicari7zpu3mtxqggde7mu3ywppntdqg22arcukvlaihjbfcb2rnktid[.]onion
Dark Web 4: http://sicarilxx2br6esqnhad4w26bcgb5j2snbbnhyo4b6t7kby2oy4x3jad[.]onion
Dark Web 5: http://sicari7m63wlggfxajiuonfsk72fgencne5ztzakyuhfxzq5rnbkjead[.]onion
Dark Web 6: http://sicariifoucvhyqg54smi3esg5sfcyw5z65t6yigqu4loyuoz62bb2id[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/664/257/506/original/b8903c3fc176c2cc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/694/678/860/original/559369fb3b8d764f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/699/714/092/original/c9e74199fe704588.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/805/415/699/645/909/original/d05e06f719a01687.png

2025-12-29 19:53:58 UTC

💡Darknet Markets Timeline is now available for everyone. https://darkwebinformer.com/darknet-markets-timeline/. There is some inconsistencies & bugs! Some details/sources are still missing, but will be gradually added when I have time. It can also be found on the Resources menu at the header of the website.

2025-12-29 17:49:59 UTC

🚨 Unauthorized backdoor access to Intelligence X threat intelligence platform listed for sale
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/804/116/216/218/036/original/875f55bfdc3d9dcb.png

2025-12-26 23:35:00 UTC

⚠️pgpfreak's is an OpenPGP key server (HKP) focused on privacy. It's a free service that you can use to share PGP keys and certificates with other anonymous users
Onion: http://pgpfreake3valkfdt2id4x6smq6uial4xa4wy2woyzuvf35n4f2eruid[.]onion
Dread Announcement: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/6c0bd1a0362750dd1808
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/788/484/898/048/000/original/73af821a343930ad.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/788/484/919/490/399/original/7c49c6926c8e8427.png

2025-12-26 19:12:21 UTC

KeePassXC: A modern, secure, and open-source password manager that stores and manages your most sensitive information.
GitHub: https://github.com/keepassxreboot/keepassxc
Highly recommended!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/787/453/270/887/269/original/b6939621fbfe7a67.png

2025-12-25 02:44:29 UTC

🚨 AWS is currently having an outage. Many services are being affected by it; Arc Raiders, Fortnite, Steam, Rocket League, Epic Games, Embark Studios, PlayStation Network, etc.
Happy Holidays!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/467/223/379/original/af36162f3365bd14.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/467/868/773/original/ea9f9552b5c83313.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/777/907/469/535/648/original/ea6dc8e1e77e6832.png

2025-12-23 22:57:35 UTC

- reply

Thread (Pitch): https://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd[.]onion/p/59be59fa

2025-12-23 22:46:10 UTC

Paris provided the following update on Pitch in regards to the Dread outage
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/771/306/787/569/707/original/9d29fde8cfa16adc.png

2025-12-22 21:51:35 UTC

- reply

Added to Threat-Surface: https://github.com/DarkWebInformer/Threat-Surface

2025-12-22 21:49:05 UTC

🚨 Fraud Shop: RONDA
Clearnet: rondastore[.]org
Dark Web: r4hyxmieadsyhnqzccmib45qtwa3x74gpnp24ovicuiuc5jzj3jxj2ad[.]onion
IP: 5[.]188[.]86[.]67
ASN: 49453
Org: Global Layer B.V.
Ports: 80, 443, 2947
Server: nginx/1.18.0 (Ubuntu)
Port 2947: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
Invalid SSH identification string.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/765/420/553/962/794/original/6efbe447ca7ff129.png

2025-12-21 17:26:03 UTC

🚨 Shinyhunte[.]rs domain is now up for sale for 20 XMR or $9,392.14 at time of this post
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/758/723/513/927/720/original/d87309a0439e83eb.png

2025-12-20 22:34:24 UTC

- reply

Or here: https://shinyhunte[.]rs

2025-12-20 22:00:24 UTC

"THE TRUTH ABOUT Scattered LAPSUS$ Hunters"
If you are interested, you can see more, including the images, here: https://t.me/BreachForumsNews/83
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/754/138/769/362/354/original/4d197e7595589e44.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/754/138/772/646/983/original/1f89b05875708fbd.png

2025-12-18 19:29:55 UTC

- reply

Added to Threat-Surface repo: https://github.com/DarkWebInformer/Threat-Surface

2025-12-18 19:13:17 UTC

Forum: rootsploit[.]org
IP: 89.35.130.51
ASN: 214309
Server: nginx
Ports: 21, 22, 80, 110, 143, 443, 993, 995, 1500, 1501, 5414, 27356
IMAP/POP3 SSL Cert: rootsploitpshack.aurorix.net
ispmanager: https://89.35.130.51:1500/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/742/142/476/589/321/original/4b6488497bba54c6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/742/156/841/369/045/original/97c1e51a444a57e9.png

2025-12-18 17:13:43 UTC

Apologies for the inconvenience... the issue is resolved. If you are sitting on one of the threat feed pages do a refresh and alerts should start again. 🙃

2025-12-18 16:18:42 UTC

There is an issue with the threat feed updating, I'm looking into it. This doesn't affect any of the other feeds.

2025-12-13 20:12:45 UTC

🚨 Ledger, Binance, Coinbase, Gemini, and Kraken User Leads For Sale on a Hacker Forum
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/714/080/561/114/404/original/c437af0b39931b76.png

2025-12-10 00:14:36 UTC

🚨176 transfers have been made from the Silk Road crypto wallet in the last 4 hours
https://intel.arkm.com/explorer/entity/silk-road
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/692/383/453/954/595/original/026036703da456f5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/692/383/453/837/663/original/a1f83254008910a9.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/692/383/456/661/302/original/4bbab4fd99b54e9e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/692/383/458/043/146/original/4d4a8023191e2de8.png

2025-12-08 19:48:47 UTC

Silent.Link: Buy global mobile 4G/5G Internet access and burner phone numbers instantly and privately on any modern eSIM-compatible smartphone.
KYC: Terms explicitly state KYC will never be requested.
X: @silentlink1
Payment: Monero (XMR), Bitcoin (BTC), Lightning
Clearnet: https://silent.link
Dark Web: http://silentlnit5ryavvfz5vw7s4qg62jujd666lnc4tg2chj64zuwuqtvqd[.]onion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/685/675/019/159/095/original/c7fa78f70605971f.png

2025-12-07 22:39:20 UTC

- reply

If you only have a plus subscription, you will still see Ransomware stats and recent events from Ransomware groups.

2025-12-07 22:27:06 UTC

I have moved the Threat Intelligence Analytics to the subscribers area for all paid subscribers.
https://darkwebinformer.com/threat-intelligence-analytics/
Some of the charts are interactive by clicking on the bars. All of them allow you to hover over the different parts of the charts to see the numbers. More charts and features will be added after the new year.

2025-12-07 01:44:16 UTC

The SimpleXChat X account was hacked a couple of hours ago, but the post since has been removed. The founder of SimpleXChat says he is still locked out of the account.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/675/746/451/274/574/original/edb22ce31eedb6de.png

2025-12-06 17:20:42 UTC

🚨 LockBit 5.0 IP Leak. Original find by @nprofile…mmf7
▪️IP: 205.185.116.233 (Credit @nprofile…mmf7)
▪️Domain: karma0[.]xyz (Credit @nprofile…mmf7)
▪️Country: 🇺🇸
▪️ASN: 53667
▪️RDP: 205.185.116.233:3389
▪️Name: WINDOWS-401V6QI
▪️Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
▪️Ports: 21, 80, 3389, 5000, 5985, 47001, 49666
▪️VirusTotal IP: https://www.virustotal.com/gui/ip-address-analysis/i-b6dda26ba11dc1d1836b0d53e689fc0ab3d3cce8caff6f75354ee1957babd746-1765041144
▪️VirusTotal Domain: https://www.virustotal.com/gui/domain/karma0.xyz
▪️VirusTotal MD5 (e818a9afd55693d556a47002a7b7ef31, (Credit @nprofile…mmf7): https://www.virustotal.com/gui/file-analysis/ZTgxOGE5YWZkNTU2OTNkNTU2YTQ3MDAyYTdiN2VmMzE6MTc2NTA0MTMyMA==
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/673/767/376/959/884/original/ec4d5e3efc7c402d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/673/767/379/313/863/original/d2f6f897e62b29fc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/673/767/390/334/899/original/e5dfb47beb5a1c7c.png

2025-12-05 19:49:32 UTC

🚨🇬🇧 Alleged Sale of 1 Million Personal Records From the United Kingdom
https://darkwebinformer.com/alleged-sale-of-1-million-personal-records-from-the-united-kingdom/

2025-12-05 17:28:12 UTC

🚨🇺🇸 Fargo Park District has been claimed a victim to INTERLOCK Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/668/134/359/313/179/original/48adc561b8725ebc.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/668/134/372/177/643/original/f0c3fcc606af7f47.png

2025-12-04 18:21:36 UTC

🚨CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability has been added to the CISA KEV Catalog
Vendor: OpenPLC
Product: ScadaBR
CVSS: 8.8
https://darkwebinformer.com/cisa-kev-catalog/

2025-12-04 16:19:09 UTC

"Enterprise browser completely locked out our entire org"
🤣
https://www.reddit.com/r/cybersecurity/comments/1p9xn2b/enterprise_browser_completely_locked_out_our/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/200/298/570/307/original/3d63acd2bb4e3550.png

2025-12-04 15:58:59 UTC

🚨🇺🇸 Scientology has been claimed a victim to Qilin Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/122/020/755/544/original/99e26276f4daeb7d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/122/021/792/860/original/14a04598a129f353.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/662/122/035/352/524/original/a4d14be4237ae3f5.png

2025-12-03 22:19:50 UTC

🚨🇬🇧 NCFE is investigating a cybersecurity incident after detecting suspicious activity on its systems late last week. The company says it wants customers and stakeholders to be informed as early as possible.
Source: https://www.ncfe.org.uk/servicecontinuity/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/957/246/426/936/original/f73163aa659e800c.png

2025-12-03 19:07:30 UTC

🚨🇺🇸 Providence Academy has been claimed a victim to INTERLOCK Ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/198/242/391/926/original/713c0c62b9c84072.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/198/248/183/864/original/31aa81b1ee4375ff.png

2025-12-03 17:41:35 UTC

🚨 Alleged Sale of Full Shop Admin Panel With Customer & Payment Data
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/656/863/358/021/819/original/4ea394c1ea051fad.png

2025-12-03 17:29:40 UTC

🚨 Akira Ransomware Claims 8 Victims
🇺🇸 Pan-O-Gold Baking Company
🇨🇦 Quality Engineered Homes
🇺🇸 Building Controls and Services
🇺🇸 Custom Engineered Wheels (CEW Inc.)
🇺🇸 Eggelhof Inc.
🇺🇸 Fuji Vegetable Oil
🇺🇸 Wynn & Wynn, P.C.
🇺🇸 Rouse Frets White Goss Gentile Rhodes
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/656/816/488/613/662/original/b16c0f4242fd4860.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/656/816/491/138/566/original/fbecfa9d537c79b5.png

2025-12-03 16:35:19 UTC

https://x.com/DarkWebInformer/status/1996256681630547976

2025-12-01 18:13:53 UTC

🚨🇺🇸 A threat actor is allegedly selling CABoom Leads
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/645/665/073/530/483/original/531590d8d75f7f2f.png

2025-11-27 16:51:05 UTC

🦃 Stay informed. Holidays don’t stop threat actors.

2025-11-27 16:26:44 UTC

🚨🇰🇷 A threat actor claims to have leaked source code to Intellivix
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/622/595/171/277/628/original/060c0a6f6b604206.png

2025-11-26 22:42:07 UTC

🚨🇫🇷 Alleged Sale of French Prestashop Store Access
📌 France
▪️Industry: E-Commerce
▪️Threat Actor: cosm0drome
▪️Network: Clearnet, Dark Web
🧠 A dark web actor is auctioning access to a France-based Prestashop store, claiming full admin rights and unrestricted module access. Listing shows 2,282 credit-card orders in the last 90 days with an average order value of €50.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/618/409/755/961/482/original/71b46ace5f755194.png

2025-11-26 17:27:37 UTC

Another update... if you are an API subscriber you now have access to an endpoint that provides the news feed in real time. The update can be found at the top of the docs page. The full IOC history is being worked on & may come out in the first week of December rather than Nov.

2025-11-25 01:12:51 UTC

🚨🇺🇸 Infrastructure Destruction Squad claims to be targeting the US
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/607/674/771/910/138/original/78fcd6e8e294347a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/607/674/775/692/624/original/15f158ed5e943396.png

2025-11-25 00:47:52 UTC

🚨 MEDUSA Ransomware Claims 2 Victims
🇧🇷 WR Comercial
🇧🇷 Universidade Municipal de São Caetano
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/607/578/798/842/004/original/211a49f9f87a996a.png

2025-11-24 23:09:16 UTC

Ransomware Attack Update for the 24th of November 2025
https://darkwebinformer.com/ransomware-attack-update-for-the-24th-of-november-2025/

2025-11-24 19:59:48 UTC

Never seems to get old.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/606/446/913/788/003/original/d4718e41d84e176e.jpeg

2025-11-24 19:36:16 UTC

I had a couple people ask me privately if I would be doing any holiday sales, and the answer is no. Also have been asked if there are watermarks or blurred images on any of the feeds, no to that as well. All images on feeds and within the paywall blog posts contain no watermarks or blurred images (all unredacted).

2025-11-23 23:49:11 UTC

I pushed some updates to the Whiteintel Corp Alerts feed for those with access to the early access program. Search, sorting, some stats at the top, and some loading behavior. Should be available to all paid subscribers by no later than Wednesday.

2025-11-23 18:04:47 UTC

My @nprofile…znqz was suspended and I can't even login to appeal. No email either. GGs. All of my code/repos is locally backed up.
https://github.com/darkwebInformer/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/600/330/705/373/646/original/c8f53c9f17665874.png