TerminalFix turns fake Cloudflare CAPTCHAs into network access
Microsoft reports a new ClickFix campaign on compromised websites that tricks users into running PowerShell commands. The malware installs persistence and a reverse tunnel, giving attackers a route into adjacent systems for reconnaissance, data theft or ransomware deployment.
@SableIndex | @SableIndexOTC
Microsoft reports a new ClickFix campaign on compromised websites that tricks users into running PowerShell commands. The malware installs persistence and a reverse tunnel, giving attackers a route into adjacent systems for reconnaissance, data theft or ransomware deployment.
@SableIndex | @SableIndexOTC
👀5💊2
Exploit.in actor pitches extensions allegedly built to steal crypto
Aezakmi789 allegedly offers a Chrome Web Store bypass service with crypto drainers, seed-phrase theft and cookie hijacking.
No victims are confirmed.
@SableIndex | @SableIndexOTC
Aezakmi789 allegedly offers a Chrome Web Store bypass service with crypto drainers, seed-phrase theft and cookie hijacking.
No victims are confirmed.
@SableIndex | @SableIndexOTC
👀5🥱3
One of the most popular investigators in crypto, ZachXBT, was doxxed by the threat actor @ease (milan)
ease is also currently offering money to anyone who can get in touch with ZachXBT regarding the Tiffany Milanovich case.
@SableIndex | @SableIndexOTC
ease is also currently offering money to anyone who can get in touch with ZachXBT regarding the Tiffany Milanovich case.
@SableIndex | @SableIndexOTC
1👀6🤣2
In China, an investor was robbed at gunpoint of 270 +888 numbers (594,000 TON).
Yesterday, someone listed a batch of 270 anonymous numbers on the market for $2,000 each, while the floor price was above $3,000.
A Chinese investor shared that armed men broke into his acquaintance's home. They held a gun to his head, beat him up, forced access to his crypto wallet, and liquidated everything via Marketapp. Half a million bucks went straight to the attackers address.
Victim's address:
Address used by the perpetrators to receive funds:
@SableIndex | @SableIndexOTC
Yesterday, someone listed a batch of 270 anonymous numbers on the market for $2,000 each, while the floor price was above $3,000.
A Chinese investor shared that armed men broke into his acquaintance's home. They held a gun to his head, beat him up, forced access to his crypto wallet, and liquidated everything via Marketapp. Half a million bucks went straight to the attackers address.
Victim's address:
UQATlFN7sPu-3yqw3QEoma4BXA7bULm2sES8Sz_mUw8vQfhb
Address used by the perpetrators to receive funds:
EQBocm8R7SRcKTO8L7SVmIqk332_-Ns1U1is01GDXQYxPJD5
@SableIndex | @SableIndexOTC
🕊5💊1
FindFemboys database allegedly offered on dark-web forum
A threat actor claims to be selling 40,198 FindFemboys user records for $20 in Monero, including emails, usernames, location and birth-date data, profile details and password hashes.
@SableIndex | @SableIndexOTC
A threat actor claims to be selling 40,198 FindFemboys user records for $20 in Monero, including emails, usernames, location and birth-date data, profile details and password hashes.
@SableIndex | @SableIndexOTC
😭12👀4💊1
cba to make ad
join @SableIndex for com and darkweb news and @SableIndexOTC for HQ ads js for 33⭐️
$150 gw starts tomorrow
join @SableIndex for com and darkweb news and @SableIndexOTC for HQ ads js for 33
$150 gw starts tomorrow
Please open Telegram to view this post
VIEW IN TELEGRAM
12👀18🤣9🕊7
Five companies just landed on Qilin’s dark-web hit list
Colonial Hyundai, The Big Table Group, Nolan Consulting Group, Jouvet SAS and G&S Technologies have appeared on Qilin’s ransomware portal.
Qilin’s next move could be a ransom deadline or data leak.
@SableIndex | @SableIndexOTC
Colonial Hyundai, The Big Table Group, Nolan Consulting Group, Jouvet SAS and G&S Technologies have appeared on Qilin’s ransomware portal.
Qilin’s next move could be a ransom deadline or data leak.
@SableIndex | @SableIndexOTC
👀8💊1
A trader lost $907K chasing a token after a hacked-account post
Trader lost about $907,000 across two trades in MEME and SLINK, selling after spending nearly $1.3mil on the tokens.
SLINK surged after a post from the reportedly compromised account of Shivon Zilis and a reply from Elon Musk.
The token later dropped more than 80%.
@SableIndex | @SableIndexOTC
Trader lost about $907,000 across two trades in MEME and SLINK, selling after spending nearly $1.3mil on the tokens.
SLINK surged after a post from the reportedly compromised account of Shivon Zilis and a reply from Elon Musk.
The token later dropped more than 80%.
@SableIndex | @SableIndexOTC
😭14👀4🥱2
Requirements:
• Join @SableIndex
• Join @SableIndexOTC
2nd place 2500 stars
3rd place https://t.me/nft/SwagBag-181084
Participants: 671
Giveaway Ended
• @Lupidus
• @gamblerxyz
• @hallowings
Check @sableindexvouch for proofs
Please open Telegram to view this post
VIEW IN TELEGRAM
14🕊24👀11💊8
267000 XRP Reportedly Drained - XRPH Wallet Tells Users to Quit
XRP Healthcare has urged users to stop using XRPH Wallet after reports of unauthorized transfers.
Tech Insider, citing CoinTurk, puts the reported loss at about 267000 XRP plus XRPH and XRPHAI tokens, with the main drain dated Sept 3
@SableIndex | @SableIndexOTC
XRP Healthcare has urged users to stop using XRPH Wallet after reports of unauthorized transfers.
Tech Insider, citing CoinTurk, puts the reported loss at about 267000 XRP plus XRPH and XRPHAI tokens, with the main drain dated Sept 3
@SableIndex | @SableIndexOTC
😭12👀5💊2
The Com-linked crypto ringleader pleads guilty
Malone Lam pleaded guilty in Washington on September 8 to leading a cybercrime scheme that stole more than $245 million in cryptocurrency. Callers posed as Google and Gemini staff, tricked a wealthy investor into revealing access codes, and drained over 4100 bitcoin.
Threat actor: Malone Lam. Court filings list his aliases as “King Greavys”, “King Greavy”, “Greavys”, “Kg”, “Anne Hathaway” and “$$$” - these are all names used by the same person.
@SableIndex | @SableIndexOTC
Malone Lam pleaded guilty in Washington on September 8 to leading a cybercrime scheme that stole more than $245 million in cryptocurrency. Callers posed as Google and Gemini staff, tricked a wealthy investor into revealing access codes, and drained over 4100 bitcoin.
Threat actor: Malone Lam. Court filings list his aliases as “King Greavys”, “King Greavy”, “Greavys”, “Kg”, “Anne Hathaway” and “$$$” - these are all names used by the same person.
@SableIndex | @SableIndexOTC
🤣7👀2
UTA0560 exploited Chrome and Windows zero-days in one chain
Chinese-linked threat actor UTA0560 targeted NGOs and European organisations with precision spear-phishing. Victims were sent to trusted websites where a reflective XSS flaw in Google Chrome helped launch the first stage of the attack.
The chain then used CVE-2026-85046 in Chrome and CVE-2026-85880 in the Windows kernel to escape browser protections and execute malware silently. The combination allowed attackers to move from a booby-trapped web page to deeper system access without obvious user interaction.
@SableIndex | @SableIndexOTC
Chinese-linked threat actor UTA0560 targeted NGOs and European organisations with precision spear-phishing. Victims were sent to trusted websites where a reflective XSS flaw in Google Chrome helped launch the first stage of the attack.
The chain then used CVE-2026-85046 in Chrome and CVE-2026-85880 in the Windows kernel to escape browser protections and execute malware silently. The combination allowed attackers to move from a booby-trapped web page to deeper system access without obvious user interaction.
@SableIndex | @SableIndexOTC
🤣7😭1🤓1