‼️🇸🇦 Wateen allegedly breached: 180K blood donor records exposed from Saudi Arabia blood donation app database
A threat actor claims to have leaked a database linked to Wateen, the official blood donation mobile application in Saudi Arabia launched in collaboration with the Ministry of Health. The actor alleges the exposed dataset contains 180,438 blood donor records, including donor identity, donation, blood type, and contact-related fields.
▸ Actor: lulzintel
▸ Sector: Healthcare / Blood Donation / Mobile App
▸ Type: Database Leak
▸ Records: 180,438 donor records
▸ Country: Saudi Arabia
▸ Date: 15/05/2026
Compromised data:
▪️ Blood donor records allegedly linked to the Wateen mobile application
▪️ Donor names and identity-related fields
▪️ Blood group and blood type information
▪️ Gender and donation date records
▪️ Donation type and donation status fields
▪️ Mobile number and donor ID-related fields
▪️ Blood bank and blood bag number references
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database linked to Wateen, the official blood donation mobile application in Saudi Arabia launched in collaboration with the Ministry of Health. The actor alleges the exposed dataset contains 180,438 blood donor records, including donor identity, donation, blood type, and contact-related fields.
▸ Actor: lulzintel
▸ Sector: Healthcare / Blood Donation / Mobile App
▸ Type: Database Leak
▸ Records: 180,438 donor records
▸ Country: Saudi Arabia
▸ Date: 15/05/2026
Compromised data:
▪️ Blood donor records allegedly linked to the Wateen mobile application
▪️ Donor names and identity-related fields
▪️ Blood group and blood type information
▪️ Gender and donation date records
▪️ Donation type and donation status fields
▪️ Mobile number and donor ID-related fields
▪️ Blood bank and blood bag number references
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A company that has an API subscription requested a specific forum to be scraped that is Tor only. I'm testing that functionality now with another forum. Assuming everything works properly I will be onboarding Tor only forums starting next week. Thought I would share.
❤1🔥1
‼️ DOJ Press Release
━━━━━━━━━━━━━━━━━━━━━
Georgia Woman Who Faked Identity of Pregnant Teen to Target Adoptive Parents Sentenced on Cyberstalking and Threat Offenses
Full Press Release → justice.gov
━━━━━━━━━━━━━━━━━━━━━
🕵️ Dark Web Informer • DOJ Monitor
Note: DOJ articles that are not Cyber related will be removed manually.
━━━━━━━━━━━━━━━━━━━━━
Georgia Woman Who Faked Identity of Pregnant Teen to Target Adoptive Parents Sentenced on Cyberstalking and Threat Offenses
Full Press Release → justice.gov
━━━━━━━━━━━━━━━━━━━━━
🕵️ Dark Web Informer • DOJ Monitor
Note: DOJ articles that are not Cyber related will be removed manually.
www.justice.gov
Georgia Woman Who Faked Identity of Pregnant Teen to Target Adoptive
A Georgia woman was sentenced today to 20 months in prison and three years of supervised release for cyberstalking, transmitting threats to kidnap or injure in interstate commerce and identity theft.
‼️@TheGentlemen26 The Gentlemen are allegedly recruiting affiliates: ransomware-as-a-service program and locker tooling advertised on underground forum
A threat actor claims to be promoting The Gentlemen’s RaaS, a ransomware affiliate program targeting access brokers, pentesters, and criminal operators. The post advertises affiliate revenue sharing, victim negotiation control, locker and decryptor tooling, and cross-platform support for enterprise environments.
▸ Actor: hastalamuerte
▸ Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
▸ Type: RaaS Advertisement
▸ Records: Not applicable
▸ Country: Unknown / Global
▸ Date: 15/05/2026
Advertised capabilities:
▪️ Ransomware affiliate program allegedly offering revenue sharing and victim negotiation control
▪️ Locker and decryptor tooling promoted for Windows, Linux, NAS, BSD, and ESXi environments
▪️ Cross-platform support for enterprise and virtualized infrastructure
▪️ Features marketed around selective encryption, network targeting, and automated operation
▪️ Affiliate access requirements involving prepared target data or deposits
▪️ Additional tooling references including EDR-related components, builder access, and multichain pivot support
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be promoting The Gentlemen’s RaaS, a ransomware affiliate program targeting access brokers, pentesters, and criminal operators. The post advertises affiliate revenue sharing, victim negotiation control, locker and decryptor tooling, and cross-platform support for enterprise environments.
▸ Actor: hastalamuerte
▸ Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
▸ Type: RaaS Advertisement
▸ Records: Not applicable
▸ Country: Unknown / Global
▸ Date: 15/05/2026
Advertised capabilities:
▪️ Ransomware affiliate program allegedly offering revenue sharing and victim negotiation control
▪️ Locker and decryptor tooling promoted for Windows, Linux, NAS, BSD, and ESXi environments
▪️ Cross-platform support for enterprise and virtualized infrastructure
▪️ Features marketed around selective encryption, network targeting, and automated operation
▪️ Affiliate access requirements involving prepared target data or deposits
▪️ Additional tooling references including EDR-related components, builder access, and multichain pivot support
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🇺🇸 Grafana has been claimed a victim to Coinbasecartel
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🔪 Slice For Life - Part 2 🔪
‼️🇺🇸 Eli Lilly allegedly breached: 1.2K internal repositories and 40GB of Veeva Vault documents exposed from drug development and clinical trial systems up for sale for $70K A threat actor claims to have obtained internal codebases belonging to Eli Lilly…
‼️🇺🇸 Offers for the Eli Lilly data are being considered...
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🇻🇪 Movistar Venezuela allegedly breached: 4.15M customer phone records exposed from 2026 telecom database
A threat actor claims to have breached Movistar Venezuela, a major Venezuelan telecommunications provider operated by Telefónica. The actor alleges the exposed dataset contains 4.15 million current phone number records from 2026, including subscriber identifiers, account details, geographic area data, lifecycle status, payment method, and product line information.
▸ Actor: GordonFreeman
▸ Sector: Telecommunications / Mobile Network Operator
▸ Type: Database Leak
▸ Records: 4.15 million customer records
▸ Country: Venezuela
▸ Date: 15/05/2026
Compromised data:
▪️ Customer phone number records allegedly linked to Movistar Venezuela
▪️ Subscriber ID and account number fields
▪️ Billing account number records
▪️ Customer names and identity number fields
▪️ Geographic area and service region data
▪️ Lifecycle status and product line information
▪️ Payment method fields tied to subscriber accounts
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have breached Movistar Venezuela, a major Venezuelan telecommunications provider operated by Telefónica. The actor alleges the exposed dataset contains 4.15 million current phone number records from 2026, including subscriber identifiers, account details, geographic area data, lifecycle status, payment method, and product line information.
▸ Actor: GordonFreeman
▸ Sector: Telecommunications / Mobile Network Operator
▸ Type: Database Leak
▸ Records: 4.15 million customer records
▸ Country: Venezuela
▸ Date: 15/05/2026
Compromised data:
▪️ Customer phone number records allegedly linked to Movistar Venezuela
▪️ Subscriber ID and account number fields
▪️ Billing account number records
▪️ Customer names and identity number fields
▪️ Geographic area and service region data
▪️ Lifecycle status and product line information
▪️ Payment method fields tied to subscriber accounts
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Media is too big
VIEW IN TELEGRAM
Play the Barcoder
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
This media is not supported in your browser
VIEW IN TELEGRAM
‼️ CVE-2026-34621: Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain
GitHub: https://github.com/azefzafyoussef/CVE-2026-34621
Write-up: https://youssefazefzaf.com/posts/research-CVE-2026-34621
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
GitHub: https://github.com/azefzafyoussef/CVE-2026-34621
Write-up: https://youssefazefzaf.com/posts/research-CVE-2026-34621
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️TeamPCP announces forum co-ownership: platform operations, partnerships, moderation, and resource quality responsibilities outlined
TeamPCP announced its new role as co-owners of the Breached forum platform, stating the team will help manage staffing, partnerships, community decisions, moderation, escrow services, and premium resource access. The post frames the role as focused on platform reliability, community growth, verified content, and maintaining forum standards.
▸ Actor: TeamPCP
▸ Sector: Cybercrime Forum / Community Operations
▸ Type: Forum Announcement
▸ Date: 15/05/2026
Key points:
▪️ TeamPCP announced a co-ownership role within the Breached forum platform
▪️ Responsibilities include infrastructure uptime, staff management, moderation, and dispute handling
▪️ Community growth plans include onboarding partners and expanding access to premium resources
▪️ Resource quality efforts include verifying shared databases and tools
▪️ Low-quality, fake, or malicious content is described as subject to removal
▪️ Members who provide verified material may be rewarded by the platform
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
TeamPCP announced its new role as co-owners of the Breached forum platform, stating the team will help manage staffing, partnerships, community decisions, moderation, escrow services, and premium resource access. The post frames the role as focused on platform reliability, community growth, verified content, and maintaining forum standards.
▸ Actor: TeamPCP
▸ Sector: Cybercrime Forum / Community Operations
▸ Type: Forum Announcement
▸ Date: 15/05/2026
Key points:
▪️ TeamPCP announced a co-ownership role within the Breached forum platform
▪️ Responsibilities include infrastructure uptime, staff management, moderation, and dispute handling
▪️ Community growth plans include onboarding partners and expanding access to premium resources
▪️ Resource quality efforts include verifying shared databases and tools
▪️ Low-quality, fake, or malicious content is described as subject to removal
▪️ Members who provide verified material may be rewarded by the platform
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
On Monday, at some point, I will be increasing the rate limit to the API and the accounts who currently have the default limit.
This only applies to the daily request limit. I will update on Monday as to the new request count.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
This only applies to the daily request limit. I will update on Monday as to the new request count.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Telegram
🔪 Slice For Life - Part 2 🔪
Backup: t.me/SliceForLifeeee
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
‼️🇲🇽 Acapulco City Government allegedly breached: 97K+ license records exposed from municipal permit data
A threat actor claims to have leaked license records linked to the Acapulco City Government in Mexico. The actor alleges the exposed dataset contains more than 97,000 license records totaling approximately 28GB, including CURP identifiers, photographs, fingerprints, and additional municipal licensing data.
▸ Actor: homie157
▸ Sector: Government / Municipal Services
▸ Type: Database Leak
▸ Records: 97,000+ license records
▸ Country: Mexico
▸ Date: 15/05/2026
Compromised data:
▪️ Municipal license records allegedly linked to Acapulco City Government systems
▪️ CURP-related identity fields
▪️ Photograph records tied to license entries
▪️ Fingerprint image or biometric-related data
▪️ Additional license holder information
▪️ High-volume archive allegedly containing recent and high-quality Acapulco licensing records
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked license records linked to the Acapulco City Government in Mexico. The actor alleges the exposed dataset contains more than 97,000 license records totaling approximately 28GB, including CURP identifiers, photographs, fingerprints, and additional municipal licensing data.
▸ Actor: homie157
▸ Sector: Government / Municipal Services
▸ Type: Database Leak
▸ Records: 97,000+ license records
▸ Country: Mexico
▸ Date: 15/05/2026
Compromised data:
▪️ Municipal license records allegedly linked to Acapulco City Government systems
▪️ CURP-related identity fields
▪️ Photograph records tied to license entries
▪️ Fingerprint image or biometric-related data
▪️ Additional license holder information
▪️ High-volume archive allegedly containing recent and high-quality Acapulco licensing records
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️🇺🇸 Stansberry Research allegedly breached: 1.17M customer records exposed from investment research subscriber database
A threat actor claims to have leaked a database linked to Stansberry Research, a U.S.-based financial publishing and investment research company. The actor alleges the exposed dataset contains approximately 1,179,000 lines of customer and subscriber records, including contact information, account-related fields, and platform metadata.
▸ Actor: STOMP2
▸ Sector: Financial Publishing / Investment Research
▸ Type: Database Leak
▸ Records: 1,179,000 lines
▸ Country: United States
▸ Date: 16/05/2026
Compromised data:
▪️ Customer and subscriber records allegedly linked to Stansberry Research
▪️ Email address fields and contact information
▪️ Names and profile-related identifiers
▪️ Phone number fields where available
▪️ Address records including city, state, country, and postal code fields
▪️ Account and platform metadata including user IDs, creation dates, and related service identifiers
▪️ Deposit or subscription-related metadata referenced in sample records
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database linked to Stansberry Research, a U.S.-based financial publishing and investment research company. The actor alleges the exposed dataset contains approximately 1,179,000 lines of customer and subscriber records, including contact information, account-related fields, and platform metadata.
▸ Actor: STOMP2
▸ Sector: Financial Publishing / Investment Research
▸ Type: Database Leak
▸ Records: 1,179,000 lines
▸ Country: United States
▸ Date: 16/05/2026
Compromised data:
▪️ Customer and subscriber records allegedly linked to Stansberry Research
▪️ Email address fields and contact information
▪️ Names and profile-related identifiers
▪️ Phone number fields where available
▪️ Address records including city, state, country, and postal code fields
▪️ Account and platform metadata including user IDs, creation dates, and related service identifiers
▪️ Deposit or subscription-related metadata referenced in sample records
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇵🇰 University of Agriculture Pakistan staff database allegedly leaked
A threat actor claims to have leaked a staff database tied to the University of Agriculture Pakistan, with a second part allegedly planned to include student information in the same format.
━━━━━━━━━━━━━━━━━━━━
Target: University of Agriculture Pakistan
Sector: Education / Higher Education
Incident: Database Leak
Exposure: Staff database records
Actor: FlipperOne
Country: Pakistan
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Staff identity and profile fields
▪️ Names, gender, and address-related data
▪️ Phone, mobile, and fax number fields
▪️ Primary and secondary email addresses
▪️ Qualification, specialization, and designation details
▪️ Administrative and research role information
▪️ Job status, department, and faculty identifiers
▪️ Social/profile links, profile photos, resumes, and related staff records
Potential impact:
The exposed data could be used for phishing, impersonation, credential-targeting, and social engineering against university staff and departments.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a staff database tied to the University of Agriculture Pakistan, with a second part allegedly planned to include student information in the same format.
━━━━━━━━━━━━━━━━━━━━
Target: University of Agriculture Pakistan
Sector: Education / Higher Education
Incident: Database Leak
Exposure: Staff database records
Actor: FlipperOne
Country: Pakistan
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Staff identity and profile fields
▪️ Names, gender, and address-related data
▪️ Phone, mobile, and fax number fields
▪️ Primary and secondary email addresses
▪️ Qualification, specialization, and designation details
▪️ Administrative and research role information
▪️ Job status, department, and faculty identifiers
▪️ Social/profile links, profile photos, resumes, and related staff records
Potential impact:
The exposed data could be used for phishing, impersonation, credential-targeting, and social engineering against university staff and departments.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇺🇸 IRS tax payment scam page advertised on underground forum
A threat actor is advertising an IRS-themed tax payment scam page, claiming it can collect personal and payment information from victims through a fraudulent form.
━━━━━━━━━━━━━━━━━━━━
Target Theme: IRS Tax Payment
Sector: Government Impersonation / Financial Fraud
Incident: Scam Kit Advertisement
Exposure: Personal and payment data collection
Actor: tgov02
Country: United States
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly collected:
▪️ Full names and residential address details
▪️ City, state, and ZIP code fields
▪️ Phone numbers and email addresses
▪️ Date of birth fields
▪️ Social Security number fields
▪️ Cardholder and payment card details
▪️ Expiration date and security code fields
Potential impact:
The scam page could be used for identity theft, payment card fraud, tax-related impersonation, and financial phishing against U.S. victims.
Status:
Underground forum advertisement. The actor posted a sample attachment showing an IRS-themed payment assistant page and requested direct contact from interested buyers.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising an IRS-themed tax payment scam page, claiming it can collect personal and payment information from victims through a fraudulent form.
━━━━━━━━━━━━━━━━━━━━
Target Theme: IRS Tax Payment
Sector: Government Impersonation / Financial Fraud
Incident: Scam Kit Advertisement
Exposure: Personal and payment data collection
Actor: tgov02
Country: United States
Date: 16/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly collected:
▪️ Full names and residential address details
▪️ City, state, and ZIP code fields
▪️ Phone numbers and email addresses
▪️ Date of birth fields
▪️ Social Security number fields
▪️ Cardholder and payment card details
▪️ Expiration date and security code fields
Potential impact:
The scam page could be used for identity theft, payment card fraud, tax-related impersonation, and financial phishing against U.S. victims.
Status:
Underground forum advertisement. The actor posted a sample attachment showing an IRS-themed payment assistant page and requested direct contact from interested buyers.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations