‼️🏴‍☠️ R4T Ghost v1.7.5 Remote Access Trojan allegedly being sold on a hacking forum

An actor is selling ownership of "R4T Ghost v1.7.5," a Windows Remote Access Trojan, for $1,530, advertising it as their "latest 2026" build with a free update guarantee. Screenshots from the post show a builder/controller GUI with modules for client management, file transfer, registry editing, screenshot capture, webcam and microphone access, keylogging, and a remote shell.

Post details:

▸ Actor(s): MDGhost
▸ Sector: Malware / Offensive tooling
▸ Type: Tool Sale (Remote Access Trojan)
▸ Format: Builder + controller (port 5555 default listener)
▸ Price: $1,530 (with claimed free update guarantee)

Capabilities described in the post:

▪️ Steal files and saved passwords
▪️ Spy on user activity
▪️ Take screenshots
▪️ Access webcam and microphone
▪️ Remote control of victim devices
▪️ Exfiltrate internal documents and customer databases
▪️ Harvest emails, login credentials, project files, and financial data
▪️ Client dashboard with IP, country, PC name, user, OS, AV, ping, idle time
▪️ Tabs for system info, network, process manager, files, registry, services, tasks, screenshot, webcam, keylogger, remote shell

Defender notes:

▪️ Hunt for unsigned binaries opening listeners on port 5555 or other non-standard high ports
▪️ Alert on unexpected webcam/microphone access by non-conferencing processes
▪️ Monitor for new persistence entries (Run keys, scheduled tasks, services) created by recently executed user-mode binaries
▪️ EDR rules for combined keystroke logging plus screen capture plus outbound C2 beaconing patterns
▪️ Block execution of binaries from user-writable paths via AppLocker/WDAC and enforce MFA on credential stores

Note: The blurs on the RAT screenshot are not mine.

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇻🇪 Cashea allegedly re-leaked exposing 79 million transaction records from the Venezuelan BNPL app

A threat actor is reposting and updating a leak of Cashea, a Venezuelan "buy now, pay later" app, claiming a 46.5GB JSON dataset dated 21/02/2026 with sample files including transaction history through that date. The post warns about scammers recycling earlier samples and includes a record showing customer identity, phone, and an installment payment schedule.

Post details:

▸ Actor(s): malconguerra2
▸ Sector: Fintech / BNPL (buy now, pay later)
▸ Type: Data Re-leak (update)
▸ Format: JSON, 46.5GB compressed
▸ Records: 79,006,942 transactions, 29,769 stores, 15,227 merchants
▸ Country: Venezuela
▸ Date: 07/05/2026 (data dated 21/02/2026)

Compromised data:

▪️ Transaction ID, created/billing dates
▪️ Amount and invoice ID
▪️ Paid-to-merchant flag
▪️ Identifier number
▪️ Delivery type, channel, delivery status
▪️ User identification number
▪️ Down payment paid date and status (OPEN/CLOSED)
▪️ Payment details
▪️ Full user profile: identification number, full name, phone number
▪️ Installment schedules (ID, number, scheduled payment date, amount, status)
▪️ Store ID and store name
▪️ Merchant ID and merchant name
▪️ Order products and shipment data
▪️ Status name

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations