‼️🇲🇽 A database allegedly containing 318,000 user records from Bienestar.org, a healthcare organization serving the Latino Gay Community with HIV/AIDS treatment, sexual health, mental health, substance abuse counseling, and medication-assisted treatment since 1989, is being sold on a popular cybercrime forum.
▪️ Records: 318,000 users
▪️ Data Fields: First name, last name, mobile phone number, email, date of birth
▪️ Price: $300
Given the nature of the organization, this breach is particularly sensitive as it could potentially expose individuals' sexual orientation and healthcare status. The listing includes both the dataset and access to the platform.
▪️ Records: 318,000 users
▪️ Data Fields: First name, last name, mobile phone number, email, date of birth
▪️ Price: $300
Given the nature of the organization, this breach is particularly sensitive as it could potentially expose individuals' sexual orientation and healthcare status. The listing includes both the dataset and access to the platform.
😭3
‼️🇦🇪 Source code from multiple UAE websites has allegedly been leaked on a popular cybercrime forum, including exposed repositories and projects.
▪️ Country: UAE
▪️ Leak Type: Source code + exposed repositories/projects
▪️ Includes: PHP code samples and GitHub Personal Access Token (PAT)
The post lists multiple affected platforms and includes a PHP code sample as proof.
▪️ Country: UAE
▪️ Leak Type: Source code + exposed repositories/projects
▪️ Includes: PHP code samples and GitHub Personal Access Token (PAT)
The post lists multiple affected platforms and includes a PHP code sample as proof.
‼️A high-ranking forum moderator is publicly seeking to buy any data or access from active or defunct BreachForums clones, claiming the goal is to "put an end to these clones."
▪️ Seeking: Data, server access, database backups, exploits, staff/admin accounts
▪️ Targeted Domains: .sb, .ac, .fi, .bf, .us, etc.
▪️ Offer: "Exceptional amount" for staff or admin access
The post is directed at anyone who is staff, has server access, holds a database backup, or possesses an exploit related to any BreachForums clone operation.
▪️ Seeking: Data, server access, database backups, exploits, staff/admin accounts
▪️ Targeted Domains: .sb, .ac, .fi, .bf, .us, etc.
▪️ Offer: "Exceptional amount" for staff or admin access
The post is directed at anyone who is staff, has server access, holds a database backup, or possesses an exploit related to any BreachForums clone operation.
❤3
🔪 Slice For Life 🔪
This internal script I've been using to find different domains that were just registered. I'm getting closer to releasing it on GitHub... it's fairly simple and brings back results very quick. It is a Python script that scans a base domain across 800+ TLDs…
I don't have much more to add to this tool to be honest. I'm just running some tests and need to create a Readme on GitHub. The only addition since this past update is it will provide a HTML file from the rolling updates you've done for that particular keyword.
Will release this next week on GitHub.
Will release this next week on GitHub.
❤1
⚠️ FBI Watchdog - WHOIS Change ⚠️
🔗 DarkWebInformer.com - Cyber Threat Intelligence
Domain: handala-team.to
Record Type: WHOIS Change
Time Detected: 2026-03-27 17:57:52 UTC
Previous Records:
New Records:
🔗 DarkWebInformer.com - Cyber Threat Intelligence
Domain: handala-team.to
Record Type: WHOIS Change
Time Detected: 2026-03-27 17:57:52 UTC
Previous Records:
status: ['clienttransferprohibited']
New Records:
status: ['clienttransferprohibited'] → ['clienttransferprohibited', 'serverhold', 'serverupdateprohibited']
😭2
‼️Access to over 30 Claro Cloud user websites is allegedly being offered on a popular cybercrime forum, with claims that the telecom giant's cloud platform has severe security flaws allowing malicious code uploads and website infections.
▪️ Target: Claro Cloud (sitios web / website hosting platform)
▪️ Sites Affected: 30+
▪️ Access Level: Full website management panel (build, pages, clipboard, design, options, settings, databases)
▪️ Exposed Data: Advisor names, mobile numbers, emails, zone information
▪️ Backend Access: FTP Administrator, Windows Services, email, metrics, website creators, files, and databases
Screenshots demonstrate full access to the Claro Cloud admin panel, including the ability to edit HTML, manage web apps, view client advisor contact data, and access database management tools.
One screenshot shows a defacement with "HACKED BY WORRYSEC" injected into a live site as proof of exploitation.
▪️ Target: Claro Cloud (sitios web / website hosting platform)
▪️ Sites Affected: 30+
▪️ Access Level: Full website management panel (build, pages, clipboard, design, options, settings, databases)
▪️ Exposed Data: Advisor names, mobile numbers, emails, zone information
▪️ Backend Access: FTP Administrator, Windows Services, email, metrics, website creators, files, and databases
Screenshots demonstrate full access to the Claro Cloud admin panel, including the ability to edit HTML, manage web apps, view client advisor contact data, and access database management tools.
One screenshot shows a defacement with "HACKED BY WORRYSEC" injected into a live site as proof of exploitation.
🔪 Slice For Life 🔪
‼️ Handala Hack claims "Tonight, your sons will deliver a surprise in a joint cyber-missile operation. Do not forget the recitation of Surah al-Fath." What a time to be alive.
We are going to need lots of alcohol sevy, get it ready. 😂
😁2😭2
Just a FYI, you may see duplicate posts on the threat feed for the next 48 hours or so. It will be minimal, it's to provide better screenshots on the feed in the coming days/week. Ignore them unless you see them published on different claim sites.
‼️🇺🇸 Sheraton Hotels and Resorts, the American international hotel chain owned by Marriott International, has allegedly been listed on a ransomware leak site with its status marked as "Disclosed."
▪️ Revenue: $193.5M
▪️ Employees: 5,000
▪️ Hotels: 431 with 150,640 rooms globally
▪️ Financial & Operational Documents: 321.0 GB (348,199 files)
▪️ Databases & Backups: 59.3 GB (18,065 files)
The leaked data reportedly spans financial and operational documents as well as full database backups. Sheraton operates locations across North America, Africa, Asia-Pacific, Central and South America, Europe, the Middle East, and the Caribbean.
▪️ Revenue: $193.5M
▪️ Employees: 5,000
▪️ Hotels: 431 with 150,640 rooms globally
▪️ Financial & Operational Documents: 321.0 GB (348,199 files)
▪️ Databases & Backups: 59.3 GB (18,065 files)
The leaked data reportedly spans financial and operational documents as well as full database backups. Sheraton operates locations across North America, Africa, Asia-Pacific, Central and South America, Europe, the Middle East, and the Caribbean.
🔪 Slice For Life 🔪
⚠️ FBI Watchdog - WHOIS Change ⚠️ 🔗 DarkWebInformer.com - Cyber Threat Intelligence Domain: handala-team.to Record Type: WHOIS Change Time Detected: 2026-03-27 17:57:52 UTC Previous Records: status: ['clienttransferprohibited'] New Records: status: ['c…
‼️ Handala Hack's website is currently offline. Their previous website was seized by the FBI last week. It's possible that a new seizure could be taking place, but that is just my opinion for now. Nothing from the feds or Handala at this time.
😭2
‼️A new Android Remote Administration Tool (RAT) called "Darkweb" is being sold on a popular cybercrime forum, marketed as "the most powerful" Android hacking tool available.
▪️ Access: Tor browser (.onion link)
▪️ Developer Contact: Telegram
▪️ Features Include: Client Folder, Permissions, APK Tool, Crypter, Dropper, Create APK
The tool offers an extensive set of capabilities:
▪️ VNC/AcVNC: Real-time device screen control with gesture support; bypasses Android's Secure flag (black screen) protection
▪️ Keylogger: Records UI interactions and captures device unlock passwords
▪️ Target Detect: Identifies crypto and banking apps for direct launch or removal
▪️ Injects: Bank-oriented overlays for stealing credentials from crypto/banking apps
▪️ Control Elements: Full device control (Home, Back, Power, Volume, etc.)
▪️ Blank/Update Screen: Hides operations behind fake loading or system update screens
▪️ Password Logging: Enhanced capture during device unlock
▪️ APK Dropper/Crypter: Silent malware deployment with encryption to evade antivirus
▪️ Ransomware: Lock/encrypt victim devices and demand payment
▪️ File & Gallery: Silent upload of photos, videos, and documents to C2 server
▪️ Microphone & Camera: Covert activation of front/back cameras and microphone
▪️ Unlock & Screen Wake: Force wake and unlock using captured PINs/patterns
▪️ Call & Message: Monitor, initiate calls, send messages, and access contacts
Additional features include client ranking by banking/crypto app presence, auto firewall configuration, domain support, HTML editor for dropper customization, and auto-install of dependencies.
Onion: http://kiwodb2ke4zeebyplcme3nr6xr5n63ainigtiibyhqs4hzloc7jnvkad[.]onion
▪️ Access: Tor browser (.onion link)
▪️ Developer Contact: Telegram
▪️ Features Include: Client Folder, Permissions, APK Tool, Crypter, Dropper, Create APK
The tool offers an extensive set of capabilities:
▪️ VNC/AcVNC: Real-time device screen control with gesture support; bypasses Android's Secure flag (black screen) protection
▪️ Keylogger: Records UI interactions and captures device unlock passwords
▪️ Target Detect: Identifies crypto and banking apps for direct launch or removal
▪️ Injects: Bank-oriented overlays for stealing credentials from crypto/banking apps
▪️ Control Elements: Full device control (Home, Back, Power, Volume, etc.)
▪️ Blank/Update Screen: Hides operations behind fake loading or system update screens
▪️ Password Logging: Enhanced capture during device unlock
▪️ APK Dropper/Crypter: Silent malware deployment with encryption to evade antivirus
▪️ Ransomware: Lock/encrypt victim devices and demand payment
▪️ File & Gallery: Silent upload of photos, videos, and documents to C2 server
▪️ Microphone & Camera: Covert activation of front/back cameras and microphone
▪️ Unlock & Screen Wake: Force wake and unlock using captured PINs/patterns
▪️ Call & Message: Monitor, initiate calls, send messages, and access contacts
Additional features include client ranking by banking/crypto app presence, auto firewall configuration, domain support, HTML editor for dropper customization, and auto-install of dependencies.
Onion: http://kiwodb2ke4zeebyplcme3nr6xr5n63ainigtiibyhqs4hzloc7jnvkad[.]onion
🔥3😁2😭1
🔪 Slice For Life 🔪
‼️ Spear forum, you have several IPs leaking, I would suggest changing them...
‼️Spear, I don't know if this a new forum IP being used or what, it wasn't there yesterday. Regardless, your IP is leaking, again. 😭
😭3
Cybersecurity Incident Disclosure
Fri, 27 Mar 2026 17:00:09 EDT
A cybersecurity incident has been disclosed by CareCloud, Inc., Inc CIK: 0001582982, Ticker: $CCLD.
View SEC Filing
Fri, 27 Mar 2026 17:00:09 EDT
A cybersecurity incident has been disclosed by CareCloud, Inc., Inc CIK: 0001582982, Ticker: $CCLD.
View SEC Filing