🚨🇪🇨 VimaSistema allegedly breached: 35GB financial software data exposed across Ecuadorian cooperative records
A threat actor claims to have leaked data tied to VimaSistema, a financial software provider serving savings and credit cooperatives, mutual societies, and pension funds in Ecuador.
━━━━━━━━━━━━━━━━━━━━
Target: VimaSistema / VimaCoop
Sector: Financial Software / Credit Cooperatives
Incident: Data Breach / Multiple Data Leak
Exposure: 35GB+
Actor: tost0n
Country: Ecuador
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and cooperative member records
▪️ Names, identity number fields, and demographic details
▪️ Biometric and fingerprint-related data
▪️ Email, address, and cellphone number fields
▪️ Bank account number and transaction-related records
▪️ Cloud server database files and SQL exports
▪️ Records organized across 2024 and 2025 datasets
▪️ Data tied to multiple Ecuadorian cooperative domains and financial entities
Potential impact:
The exposed data could be used for identity theft, banking fraud, phishing, account impersonation, financial scams, and targeted social engineering against cooperative members and institutions.
Status:
Unverified underground forum claim. The actor posted folder previews and proof-of-concept samples showing structured financial and personal data fields.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked data tied to VimaSistema, a financial software provider serving savings and credit cooperatives, mutual societies, and pension funds in Ecuador.
━━━━━━━━━━━━━━━━━━━━
Target: VimaSistema / VimaCoop
Sector: Financial Software / Credit Cooperatives
Incident: Data Breach / Multiple Data Leak
Exposure: 35GB+
Actor: tost0n
Country: Ecuador
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and cooperative member records
▪️ Names, identity number fields, and demographic details
▪️ Biometric and fingerprint-related data
▪️ Email, address, and cellphone number fields
▪️ Bank account number and transaction-related records
▪️ Cloud server database files and SQL exports
▪️ Records organized across 2024 and 2025 datasets
▪️ Data tied to multiple Ecuadorian cooperative domains and financial entities
Potential impact:
The exposed data could be used for identity theft, banking fraud, phishing, account impersonation, financial scams, and targeted social engineering against cooperative members and institutions.
Status:
Unverified underground forum claim. The actor posted folder previews and proof-of-concept samples showing structured financial and personal data fields.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❤1
🚨🇫🇷 Gîtes de France allegedly breached: 389K guest and booking records exposed from French holiday rental database
A threat actor claims to have leaked a database tied to Gîtes de France, a French holiday rental network specializing in countryside stays, rural gîtes, and tourist accommodation across France.
━━━━━━━━━━━━━━━━━━━━
Target: Gîtes de France
Sector: Hospitality / Travel / Holiday Rentals
Incident: Database Leak
Exposure: 389,129 people / 312,685 lines / 470MB
Actor: ChimeraZ
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Guest and client records allegedly linked to Gîtes de France bookings
▪️ Names, email addresses, and telephone number fields
▪️ Address and accommodation site information
▪️ Booking start and end dates
▪️ Guest count and occupant details
▪️ Stay duration and nightly booking fields
▪️ Tourism tax, price, and agent-related records
▪️ Site log and ticket-related JSON records
Potential impact:
The exposed data could be used for booking impersonation, targeted phishing, travel fraud, customer scams, and social engineering against guests, property owners, and tourism operators.
Status:
Unverified underground forum claim. The actor posted structured JSON samples and claims the archive includes booking, site log, and ticket-related datasets.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database tied to Gîtes de France, a French holiday rental network specializing in countryside stays, rural gîtes, and tourist accommodation across France.
━━━━━━━━━━━━━━━━━━━━
Target: Gîtes de France
Sector: Hospitality / Travel / Holiday Rentals
Incident: Database Leak
Exposure: 389,129 people / 312,685 lines / 470MB
Actor: ChimeraZ
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Guest and client records allegedly linked to Gîtes de France bookings
▪️ Names, email addresses, and telephone number fields
▪️ Address and accommodation site information
▪️ Booking start and end dates
▪️ Guest count and occupant details
▪️ Stay duration and nightly booking fields
▪️ Tourism tax, price, and agent-related records
▪️ Site log and ticket-related JSON records
Potential impact:
The exposed data could be used for booking impersonation, targeted phishing, travel fraud, customer scams, and social engineering against guests, property owners, and tourism operators.
Status:
Unverified underground forum claim. The actor posted structured JSON samples and claims the archive includes booking, site log, and ticket-related datasets.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨TLNTrip allegedly breached: 690K travel agency customer and booking records advertised for sale
A threat actor claims to be selling a database tied to TLNTrip, an online travel agency platform used by B2B and B2C customers to book, manage, and issue air tickets, hotels, and holiday packages.
━━━━━━━━━━━━━━━━━━━━
Target: TLNTrip
Sector: Travel / Online Travel Agency / Booking Platform
Incident: Database Leak / Data Sale
Exposure: 690K records
Actor: Sensitive2025
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead user records allegedly linked to TLNTrip
▪️ Passenger names, titles, gender, and date-of-birth fields
▪️ Email addresses, phone numbers, and address records
▪️ Passport number, issuing country, and expiration date fields
▪️ Flight booking transaction and ticketing records
▪️ Booking status, payment method, and journey details
▪️ Hotel records including hotel names, addresses, cities, countries, and location metadata
Potential impact:
The exposed data could be used for identity theft, passport fraud, travel booking impersonation, phishing, payment scams, and targeted social engineering against travelers and travel agency customers.
Status:
Unverified underground forum sale listing. The actor posted CSV/SQL samples and claims the database was updated less than three weeks before the listing.
Stop guessing what's redacted. Subscribers see everything → http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a database tied to TLNTrip, an online travel agency platform used by B2B and B2C customers to book, manage, and issue air tickets, hotels, and holiday packages.
━━━━━━━━━━━━━━━━━━━━
Target: TLNTrip
Sector: Travel / Online Travel Agency / Booking Platform
Incident: Database Leak / Data Sale
Exposure: 690K records
Actor: Sensitive2025
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead user records allegedly linked to TLNTrip
▪️ Passenger names, titles, gender, and date-of-birth fields
▪️ Email addresses, phone numbers, and address records
▪️ Passport number, issuing country, and expiration date fields
▪️ Flight booking transaction and ticketing records
▪️ Booking status, payment method, and journey details
▪️ Hotel records including hotel names, addresses, cities, countries, and location metadata
Potential impact:
The exposed data could be used for identity theft, passport fraud, travel booking impersonation, phishing, payment scams, and targeted social engineering against travelers and travel agency customers.
Status:
Unverified underground forum sale listing. The actor posted CSV/SQL samples and claims the database was updated less than three weeks before the listing.
Stop guessing what's redacted. Subscribers see everything → http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇦🇪 Dubai Sports Council allegedly breached: 336 internal files advertised for sale from UAE government sports authority
A threat actor claims to be selling a file leak tied to the Dubai Sports Council, the Dubai government entity responsible for developing and regulating the sports sector in the emirate.
━━━━━━━━━━━━━━━━━━━━
Target: Dubai Sports Council
Sector: Government / Sports / Public Administration
Incident: Data Leak / Data Sale
Exposure: 336 files
Actor: hexogenous
Country: United Arab Emirates
Price: $500
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Internal files allegedly linked to Dubai Sports Council operations
▪️ NOCs, permits, approvals, certificates, and licenses
▪️ Event information, schedules, and invitation records
▪️ Marketing material, logos, and public-facing event assets
▪️ Administrative documents related to sports sector activities
▪️ Files connected to clubs, events, programs, and partnerships
Potential impact:
The exposed files could create operational, reputational, phishing, impersonation, and administrative security risks for the council, event partners, clubs, and affiliated organizations.
Status:
Unverified underground forum sale listing. The actor claims the leak contains 336 files and is being offered for $500, negotiable.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a file leak tied to the Dubai Sports Council, the Dubai government entity responsible for developing and regulating the sports sector in the emirate.
━━━━━━━━━━━━━━━━━━━━
Target: Dubai Sports Council
Sector: Government / Sports / Public Administration
Incident: Data Leak / Data Sale
Exposure: 336 files
Actor: hexogenous
Country: United Arab Emirates
Price: $500
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Internal files allegedly linked to Dubai Sports Council operations
▪️ NOCs, permits, approvals, certificates, and licenses
▪️ Event information, schedules, and invitation records
▪️ Marketing material, logos, and public-facing event assets
▪️ Administrative documents related to sports sector activities
▪️ Files connected to clubs, events, programs, and partnerships
Potential impact:
The exposed files could create operational, reputational, phishing, impersonation, and administrative security risks for the council, event partners, clubs, and affiliated organizations.
Status:
Unverified underground forum sale listing. The actor claims the leak contains 336 files and is being offered for $500, negotiable.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇲🇽 Perfilan allegedly breached: 3.7M Mexican real estate customer records exposed from business service database
A threat actor claims to have leaked part of a customer database tied to Perfilan, a Mexico-based service provider for businesses in the real estate sector.
━━━━━━━━━━━━━━━━━━━━
Target: Perfilan
Sector: Real Estate / Business Services / CRM Data
Incident: Database Leak
Exposure: 3,711,285 records / 83 CSV files / 924MB
Actor: zSenior
Country: Mexico
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead records allegedly linked to Perfilan
▪️ Names, phone numbers, and email address fields
▪️ Real estate project and origin/source fields
▪️ Registration dates and lead status information
▪️ Discard reason and general notes fields
▪️ Call count, last call date, and last note metadata
▪️ CRM-style customer interaction and sales pipeline records
Potential impact:
The exposed data could be used for phishing, real estate scams, customer impersonation, lead fraud, and targeted social engineering against buyers, sellers, and real estate businesses.
Status:
Unverified underground forum claim. The actor posted CSV sample data and claims this is a partial leak containing more than 3.7M records.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked part of a customer database tied to Perfilan, a Mexico-based service provider for businesses in the real estate sector.
━━━━━━━━━━━━━━━━━━━━
Target: Perfilan
Sector: Real Estate / Business Services / CRM Data
Incident: Database Leak
Exposure: 3,711,285 records / 83 CSV files / 924MB
Actor: zSenior
Country: Mexico
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead records allegedly linked to Perfilan
▪️ Names, phone numbers, and email address fields
▪️ Real estate project and origin/source fields
▪️ Registration dates and lead status information
▪️ Discard reason and general notes fields
▪️ Call count, last call date, and last note metadata
▪️ CRM-style customer interaction and sales pipeline records
Potential impact:
The exposed data could be used for phishing, real estate scams, customer impersonation, lead fraud, and targeted social engineering against buyers, sellers, and real estate businesses.
Status:
Unverified underground forum claim. The actor posted CSV sample data and claims this is a partial leak containing more than 3.7M records.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
I am testing backend functionality with screenshots for the next hour... you may see broken screenshots. I will update once maintenance is complete.
🔪 Slice For Life - Part 2 🔪
I am testing backend functionality with screenshots for the next hour... you may see broken screenshots. I will update once maintenance is complete.
Maintenance on threat-feed images is complete, and images should no longer appear broken.
The backend has been updated to run a visual safety check on images before they are sent to the feeds.
Screenshots may be automatically suppressed before appearing in the feed if they fail automated visual safety checks, return an uncertain result, or cannot be scanned.
The alert itself will still appear when text-based threat intelligence is available. Suppression only affects the screenshot preview; it does not necessarily mean the alert is invalid or unrelated to cyber threat activity.
There is no evidence that unsafe imagery has passed through to the feed. I'm remaining transparent with any changes done as always. This is a preventative safety measure. If unsafe imagery were ever to bypass the scanner and other filters, I would take appropriate action, including reporting to law enforcement where required.
The backend has been updated to run a visual safety check on images before they are sent to the feeds.
Screenshots may be automatically suppressed before appearing in the feed if they fail automated visual safety checks, return an uncertain result, or cannot be scanned.
The alert itself will still appear when text-based threat intelligence is available. Suppression only affects the screenshot preview; it does not necessarily mean the alert is invalid or unrelated to cyber threat activity.
There is no evidence that unsafe imagery has passed through to the feed. I'm remaining transparent with any changes done as always. This is a preventative safety measure. If unsafe imagery were ever to bypass the scanner and other filters, I would take appropriate action, including reporting to law enforcement where required.
🚨🇩🇿 University of Guelma allegedly breached: seminar management system compromised and user data exposed
A threat actor claims to have compromised the seminar management application hosted by the University of Guelma, an Algerian public university platform used for seminar-related registration and management.
━━━━━━━━━━━━━━━━━━━━
Target: University of Guelma
Sector: Education / Higher Education
Incident: Data Breach
Exposure: Seminar system database
Actor: govmaroc
Country: Algeria
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Seminar management system database access
▪️ User credential and account-related records
▪️ Personal information tied to seminar users
▪️ Seminar registration and participation details
▪️ Backend database content allegedly accessed through the application
▪️ Administrative system integrity concerns
▪️ University-hosted application data linked to the seminar platform
Potential impact:
The exposed data could be used for phishing, account takeover attempts, impersonation, credential targeting, and further social engineering against students, staff, and seminar participants.
Status:
Unverified underground forum claim.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have compromised the seminar management application hosted by the University of Guelma, an Algerian public university platform used for seminar-related registration and management.
━━━━━━━━━━━━━━━━━━━━
Target: University of Guelma
Sector: Education / Higher Education
Incident: Data Breach
Exposure: Seminar system database
Actor: govmaroc
Country: Algeria
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Seminar management system database access
▪️ User credential and account-related records
▪️ Personal information tied to seminar users
▪️ Seminar registration and participation details
▪️ Backend database content allegedly accessed through the application
▪️ Administrative system integrity concerns
▪️ University-hosted application data linked to the seminar platform
Potential impact:
The exposed data could be used for phishing, account takeover attempts, impersonation, credential targeting, and further social engineering against students, staff, and seminar participants.
Status:
Unverified underground forum claim.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇮🇩 Indonesian National Armed Forces allegedly breached: 14K military officer records leaked from TNI database
A threat actor claims to have leaked a database tied to the Indonesian National Armed Forces, also known as Tentara Nasional Indonesia (TNI), allegedly exposing personnel and service-related records for military officers.
━━━━━━━━━━━━━━━━━━━━
Target: Indonesian National Armed Forces
Sector: Military / Government / Defense
Incident: Database Leak
Exposure: 14K rows
Actor: mosad
Country: Indonesia
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Military officer records allegedly linked to TNI systems
▪️ Full names and military identification number fields
▪️ Rank, corps/branch, unit, and job title information
▪️ Date of birth, age, gender, and religion fields
▪️ Current position assignment and rank promotion dates
▪️ Military education and training classification fields
▪️ Employment status, office address, and home address fields
▪️ Phone number fields tied to personnel records
Potential impact:
The exposed data could create serious operational security, impersonation, phishing, social engineering, and personnel privacy risks for military officers and defense-related institutions.
Status:
Unverified underground forum claim. The actor posted a field breakdown and sample reference, with download links shared through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database tied to the Indonesian National Armed Forces, also known as Tentara Nasional Indonesia (TNI), allegedly exposing personnel and service-related records for military officers.
━━━━━━━━━━━━━━━━━━━━
Target: Indonesian National Armed Forces
Sector: Military / Government / Defense
Incident: Database Leak
Exposure: 14K rows
Actor: mosad
Country: Indonesia
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Military officer records allegedly linked to TNI systems
▪️ Full names and military identification number fields
▪️ Rank, corps/branch, unit, and job title information
▪️ Date of birth, age, gender, and religion fields
▪️ Current position assignment and rank promotion dates
▪️ Military education and training classification fields
▪️ Employment status, office address, and home address fields
▪️ Phone number fields tied to personnel records
Potential impact:
The exposed data could create serious operational security, impersonation, phishing, social engineering, and personnel privacy risks for military officers and defense-related institutions.
Status:
Unverified underground forum claim. The actor posted a field breakdown and sample reference, with download links shared through external channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❤1
🔪 Slice For Life - Part 2 🔪
🚨🇫🇷 Gîtes de France allegedly breached: 389K guest and booking records exposed from French holiday rental database A threat actor claims to have leaked a database tied to Gîtes de France, a French holiday rental network specializing in countryside stays,…
Gîtes de France has confirmed a security incident.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨X-HAVEN exploit service advertised: silent document payload execution tool promoted on underground forum
A threat actor is advertising X-HAVEN, a malicious exploit service claiming to support silent payload execution through weaponized document formats.
━━━━━━━━━━━━━━━━━━━━
Service: X-HAVEN
Sector: Malware / Exploit Sales / Cybercrime Infrastructure
Incident: Exploit Service Advertisement
Exposure: DOC, XLS, and PDF payload delivery
Actor: TheStrain
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Silent document-based payload execution
▪️ Claimed Microsoft Office compatibility across multiple versions
▪️ Antivirus and Windows Defender bypass claims
▪️ Direct attachment delivery for email-based campaigns
▪️ Payload support for multiple executable and script formats
Potential impact:
The advertised service could enable malware delivery, phishing campaigns, credential theft, unauthorized access, and compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The seller posted promotional material describing exploit capabilities, payment terms, and support channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising X-HAVEN, a malicious exploit service claiming to support silent payload execution through weaponized document formats.
━━━━━━━━━━━━━━━━━━━━
Service: X-HAVEN
Sector: Malware / Exploit Sales / Cybercrime Infrastructure
Incident: Exploit Service Advertisement
Exposure: DOC, XLS, and PDF payload delivery
Actor: TheStrain
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Silent document-based payload execution
▪️ Claimed Microsoft Office compatibility across multiple versions
▪️ Antivirus and Windows Defender bypass claims
▪️ Direct attachment delivery for email-based campaigns
▪️ Payload support for multiple executable and script formats
Potential impact:
The advertised service could enable malware delivery, phishing campaigns, credential theft, unauthorized access, and compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The seller posted promotional material describing exploit capabilities, payment terms, and support channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
😁1