‼️🇵🇹 BLAT Studio (blatstudio.com), a Lisbon-based creative digital agency, has allegedly been breached, exposing personal data of Portuguese PSD political deputies and hashed credentials from multiple Portuguese university student associations.
⠀
‣ Threat Actor: Boogeymann
‣ Category: Data Leak
‣ Victim: BLAT Studio (with downstream impact on PSD deputies and Portuguese universities)
‣ Industry: Marketing / Political / Education
⠀
The actor states the data was obtained through an exposed Firebase database instance left without security rules. The breach impacts BLAT Studio's clients, which include Portugal's Social Democratic Party (PSD) and several student associations across Portuguese universities (ISCAL, IST, FADU, ESML, and others).
⠀
What's in it:
⠀
▪️ 119 university emails from student associations with hashed credentials (Base64 encoded + bcrypt)
▪️ 127 records of PSD political deputies, including names, addresses, phone numbers, work and personal emails, positions, and social media links (Facebook, Instagram, Twitter, TikTok, YouTube, LinkedIn)
▪️ 1,018,396 lines of internal BLAT Studio communications with clients, including message bodies, timestamps, user IDs, attachments, and conversations
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ Dolphin X, a new all-in-one Windows RAT advertised with over 600 functions, is allegedly being sold on a hacking forum, marketed as a hybrid stealer, HVNC, DDoS botnet, and bootkit-capable malware.

‣ Threat Actor: Kontraktnik
‣ Category: Malware / RAT Sale
‣ Product: Dolphin X
‣ Industry: Cybercrime / Malware-as-a-Service

The actor is advertising a 4MB Windows-only RAT with claimed UEFI bootkit and metamorphic capabilities, a Linux/Debian build reportedly in development.

【 Stealer 】
Browser theft across Chromium and Gecko (cookies, passwords, autofill, bookmarks), WiFi password harvester, Windows Credential Manager dump, sensitive file hunter, crypto wallet theft (Exodus, MetaMask), targeted app stealing (Discord, Telegram, Steam, Minecraft), and sysadmin credential theft (FileZilla, WinSCP, PuTTY).

【 Remote Control 】
HVNC, remote desktop, reverse shell, file manager, network scanner, crypto clipper, and reverse proxy.

【 Persistence & Evasion 】
UEFI bootkit, multiple persistence methods (startup, scheduled tasks, services), Task Scheduler and Windows Services manipulation, anti-forensics, polymorphic / metamorphic / ultramorphic mutation, Defender manipulation, firewall and hosts file editing.

【 System Manipulation 】
Update blocking, Registry Editor access, Task Manager control, BSOD trigger, DLL and shellcode injection, software inventory.

【 Propagation 】
USB spreading, 20+ DDoS methods, botnet proxying and control mechanisms.

【 Utility 】
"Funny Trolls" features, Export All, BotKiller.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️TomodachiShare allegedly exposing 145K user accounts

The actor TheAnonymousShipper has shared a dataset containing emails, nicknames, descriptions, and profile photos from accounts created on TomodachiShare.com, a fan community site centered on the Tomodachi Life game.

Post details:

▸ Actor: TheAnonymousShipper
▸ Sector: Online Community / Gaming
▸ Type: Data Leak
▸ Records: ~145,000
▸ Price: Free

Compromised data:

▪️ User ID
▪️ Account name
▪️ Email address
▪️ Email verification status
▪️ Profile image / avatar URL
▪️ Profile description
▪️ Account creation timestamp
▪️ Last update timestamp
▪️ Image last-updated timestamp
▪️ Likes count
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇫🇷 CAF (Caisse d'Allocations Familiales) allegedly breached exposing 22 million records

The actor eztocard has shared a 15.35 GB JSON dataset claimed to originate from CAF, France's family allowance fund agency. Sample records include extensive personal, demographic, and administrative data on individual beneficiaries.

Post details:

▸ Actor: eztocard
▸ Sector: Government / Social Services
▸ Type: Data Leak
▸ Format: JSON (15.35 GB, file: a.json)
▸ Records: ~22,000,000
▸ Price: Free

Compromised data:

▪️ Internal IDs (id, id_psp)
▪️ Full name, first name, title (Mr/Mrs)
▪️ Date of birth
▪️ Gender
▪️ Email address
▪️ Phone number
▪️ Matricule (registration number)
▪️ Organisation code & affiliation (CAF)
▪️ Beneficiary status & situation
▪️ Full postal address (street, number, postal code, INSEE code, commune)
▪️ Address complement
▪️ Exercise ID & validation status
▪️ Document UUID & rejection flag
▪️ Account creation & update timestamps
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇨🇦 Croesus (croesus.com) allegedly breached exposing 19,220 Canadian user records

The actor moxzey is selling a database claimed to originate from Croesus, a Canadian financial software provider serving the wealth management industry. The dataset is being offered for $250.

Post details:

▸ Actor: moxzey
▸ Sector: Finance / Wealth Management Software
▸ Type: Data Sale
▸ Records: 19,220
▸ Format: CSV
▸ Leaked Date: 1 May 2026
▸ Price: $250

Compromised data:

▪️ Full name
▪️ Phone number
▪️ Address
▪️ City
▪️ Zip / postal code
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇪🇪 Määrdekeskus allegedly breached exposing customer and affiliate records from the Estonian lubricant retailer

A threat actor claims to have breached Määrdekeskus (maardekeskus.ee), an Estonian lubricant and oil retailer serving the Maardu area, and shared the database on a hacking forum. The post states the leak contains 174 tables including 4,108 customer records and 127 affiliate records with hashed credentials and banking details.

Post details:

▸ Actor(s): NightBroker
▸ Sector: Retail / Automotive (lubricants & oil)
▸ Type: Data Leak
▸ Format: SQL, 119MB (1 file, 174 tables)
▸ Price: 4 forum points
▸ Records: 4,108 customers, 127 affiliates
▸ Country: Estonia
▸ Date: 05/05/2026

Compromised data:

▪️ Customer ID, group ID, store ID, language ID
▪️ First name, last name, email, telephone, fax
▪️ Password (MD5) and salt
▪️ Cart, wishlist, newsletter, address ID, custom field
▪️ IP, status, approved, safe, token, code, date added
▪️ Affiliate ID, company, website
▪️ Address 1 & 2, city, postcode, country ID, zone ID, code
▪️ Commission, tax, payment, cheque, PayPal
▪️ Bank name, branch number, SWIFT code, account name, account number
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations