🚨X-HAVEN exploit service advertised: silent document payload execution tool promoted on underground forum
A threat actor is advertising X-HAVEN, a malicious exploit service claiming to support silent payload execution through weaponized document formats.
━━━━━━━━━━━━━━━━━━━━
Service: X-HAVEN
Sector: Malware / Exploit Sales / Cybercrime Infrastructure
Incident: Exploit Service Advertisement
Exposure: DOC, XLS, and PDF payload delivery
Actor: TheStrain
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Silent document-based payload execution
▪️ Claimed Microsoft Office compatibility across multiple versions
▪️ Antivirus and Windows Defender bypass claims
▪️ Direct attachment delivery for email-based campaigns
▪️ Payload support for multiple executable and script formats
Potential impact:
The advertised service could enable malware delivery, phishing campaigns, credential theft, unauthorized access, and compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The seller posted promotional material describing exploit capabilities, payment terms, and support channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising X-HAVEN, a malicious exploit service claiming to support silent payload execution through weaponized document formats.
━━━━━━━━━━━━━━━━━━━━
Service: X-HAVEN
Sector: Malware / Exploit Sales / Cybercrime Infrastructure
Incident: Exploit Service Advertisement
Exposure: DOC, XLS, and PDF payload delivery
Actor: TheStrain
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Silent document-based payload execution
▪️ Claimed Microsoft Office compatibility across multiple versions
▪️ Antivirus and Windows Defender bypass claims
▪️ Direct attachment delivery for email-based campaigns
▪️ Payload support for multiple executable and script formats
Potential impact:
The advertised service could enable malware delivery, phishing campaigns, credential theft, unauthorized access, and compromise of personal or enterprise systems.
Status:
Underground forum advertisement. The seller posted promotional material describing exploit capabilities, payment terms, and support channels.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
😁1
🚨 Domain and Telegram takedown service offered against fraudulent and illegal resources
😭3
🔪 Slice For Life - Part 2 🔪
🚨 Domain and Telegram takedown service offered against fraudulent and illegal resources
Chat we are actually safe for once, allegedly.
😁2
🚨🇰🇼 Kuwait Ministry of Electricity allegedly breached: employee database leaked from government ministry records
A threat actor claims to have leaked employee data tied to Kuwait’s Ministry of Electricity, the government ministry responsible for electricity-related public services and infrastructure.
━━━━━━━━━━━━━━━━━━━━
Target: Kuwait Ministry of Electricity
Sector: Government / Energy / Public Utilities
Incident: Database Leak
Exposure: Ministry employee records
Actor: Revesky
Country: Kuwait
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to Kuwait’s Ministry of Electricity
▪️ Full name fields
▪️ Job status information
▪️ Phone number fields
▪️ Phone-related metadata
▪️ Job location data
▪️ Full dataset allegedly hidden behind forum access
Potential impact:
The exposed data could be used for phishing, impersonation, targeted social engineering, and fraud attempts against ministry employees and public-sector contacts.
Status:
Unverified underground forum claim.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked employee data tied to Kuwait’s Ministry of Electricity, the government ministry responsible for electricity-related public services and infrastructure.
━━━━━━━━━━━━━━━━━━━━
Target: Kuwait Ministry of Electricity
Sector: Government / Energy / Public Utilities
Incident: Database Leak
Exposure: Ministry employee records
Actor: Revesky
Country: Kuwait
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to Kuwait’s Ministry of Electricity
▪️ Full name fields
▪️ Job status information
▪️ Phone number fields
▪️ Phone-related metadata
▪️ Job location data
▪️ Full dataset allegedly hidden behind forum access
Potential impact:
The exposed data could be used for phishing, impersonation, targeted social engineering, and fraud attempts against ministry employees and public-sector contacts.
Status:
Unverified underground forum claim.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇫🇷 ARGUS Lookup allegedly advertised: French dataleak lookup, geolocation, and spyware-style intelligence platform promoted on underground forum
A threat actor is advertising ARGUS Lookup, a French-focused doxxing and spyware-style intelligence platform claiming to combine leaked databases, identity lookup, geolocation, facial recognition, and account correlation features.
━━━━━━━━━━━━━━━━━━━━
Service: ARGUS Lookup
Sector: Doxxing Tools / Spyware / Cybercrime Intelligence
Incident: Spyware & Dataleak Service Advertisement
Exposure: French dataleak lookup and real-time geolocation tools
Actor: near2tlg
Country: France
Price: $400 for 7 days / $1,300 for 30 days / $3,500 lifetime
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ French dataleak lookup covering records from 2010–2026
▪️ Identity, contact, address, and account correlation features
▪️ SS7 and HLR/VLR-style geolocation lookup claims
▪️ Facial recognition and profile-matching capabilities
▪️ Database access tied to financial, government, insurance, and telecom-style sources
▪️ Stealer, URL password, and combo lookup/checking functionality
▪️ Premium subscription tiers with cryptocurrency payment options
Potential impact:
The advertised service could enable doxxing, stalking, identity theft, SIM-swap targeting, phishing, financial fraud, and targeted surveillance against French individuals.
Status:
Underground forum advertisement. The actor posted a dashboard preview, listed claimed lookup capabilities, and included premium pricing tiers for access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising ARGUS Lookup, a French-focused doxxing and spyware-style intelligence platform claiming to combine leaked databases, identity lookup, geolocation, facial recognition, and account correlation features.
━━━━━━━━━━━━━━━━━━━━
Service: ARGUS Lookup
Sector: Doxxing Tools / Spyware / Cybercrime Intelligence
Incident: Spyware & Dataleak Service Advertisement
Exposure: French dataleak lookup and real-time geolocation tools
Actor: near2tlg
Country: France
Price: $400 for 7 days / $1,300 for 30 days / $3,500 lifetime
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ French dataleak lookup covering records from 2010–2026
▪️ Identity, contact, address, and account correlation features
▪️ SS7 and HLR/VLR-style geolocation lookup claims
▪️ Facial recognition and profile-matching capabilities
▪️ Database access tied to financial, government, insurance, and telecom-style sources
▪️ Stealer, URL password, and combo lookup/checking functionality
▪️ Premium subscription tiers with cryptocurrency payment options
Potential impact:
The advertised service could enable doxxing, stalking, identity theft, SIM-swap targeting, phishing, financial fraud, and targeted surveillance against French individuals.
Status:
Underground forum advertisement. The actor posted a dashboard preview, listed claimed lookup capabilities, and included premium pricing tiers for access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🇪🇺 Europol Press Release
━━━━━━━━━━━━━━━━━━━━━
EU targets Iran’s Revolutionary Guard propaganda ecosystem in an online crackdown
Full Press Release → europol.europa.eu
━━━━━━━━━━━━━━━━━━━━━
🕵️ Dark Web Informer • Europol Monitor
Note: Europol articles that are not Cyber related will be removed manually.
━━━━━━━━━━━━━━━━━━━━━
EU targets Iran’s Revolutionary Guard propaganda ecosystem in an online crackdown
Full Press Release → europol.europa.eu
━━━━━━━━━━━━━━━━━━━━━
🕵️ Dark Web Informer • Europol Monitor
Note: Europol articles that are not Cyber related will be removed manually.
Europol
EU targets Iran’s Revolutionary Guard propaganda ecosystem in an online crackdown – Investigators identified 14 200 links tied…
A total of 14 200 posts linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), now designated as a terrorist organisation by the European Union (EU), have been targeted in a coordinated action against terrorist content online.
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Chanhassen Dinner Theatres
Domain:
Country: 🇺🇸 US
Date: May 16th, 2026
Summary:
Chanhassen Dinner Theatres was forced to temporarily suspend certain performances due to a cyberattack detected on its computer network, which prompted the theater to take its systems offline as a precautionary measure. The organization is working diligently with external experts to restore services and reschedule the affected performances. Ticketholders for the affected shows will be contacted directly by phone or email for further details.
Source: https://bringmethenews.com/minnesota-lifestyle/chanhassen-dinner-theatres-says-cyber-attack-may-affect-upcoming-performances
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: Chanhassen Dinner Theatres
Domain:
chanhassendt.comCountry: 🇺🇸 US
Date: May 16th, 2026
Summary:
Chanhassen Dinner Theatres was forced to temporarily suspend certain performances due to a cyberattack detected on its computer network, which prompted the theater to take its systems offline as a precautionary measure. The organization is working diligently with external experts to restore services and reschedule the affected performances. Ticketholders for the affected shows will be contacted directly by phone or email for further details.
Source: https://bringmethenews.com/minnesota-lifestyle/chanhassen-dinner-theatres-says-cyber-attack-may-affect-upcoming-performances
Bring Me The News
Chanhassen Dinner Theatres says cyber attack may affect upcoming performances
An attack on its computer network will result in some rescheduled shows, though details are still being worked out.
🚨Google-signed SMTP mailer allegedly advertised: Gmail relay-based mailer service promoted on underground forum
A threat actor is advertising a “Gmail Mailer” service, claiming it can send emails through a Google.com-signed SMTP relay with high inbox placement and customizable templates.
━━━━━━━━━━━━━━━━━━━━
Service: Gmail Mailer
Sector: Phishing Infrastructure / Spam Services / Cybercrime Tools
Incident: Mailer Service Advertisement
Exposure: Google.com-signed SMTP relay claims
Actor: Anon
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Google.com-signed SMTP mailer service
▪️ Claims of direct Google relay delivery
▪️ High inbox placement claims
▪️ Multiple templates and custom input options
▪️ Test access offered by the seller
Potential impact:
The advertised service could be used for phishing, spam campaigns, credential theft, business email compromise attempts, and impersonation of trusted email infrastructure.
Status:
Underground forum sale listing. The actor claims they are not selling the source code and are offering limited access to the mailer service.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising a “Gmail Mailer” service, claiming it can send emails through a Google.com-signed SMTP relay with high inbox placement and customizable templates.
━━━━━━━━━━━━━━━━━━━━
Service: Gmail Mailer
Sector: Phishing Infrastructure / Spam Services / Cybercrime Tools
Incident: Mailer Service Advertisement
Exposure: Google.com-signed SMTP relay claims
Actor: Anon
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Google.com-signed SMTP mailer service
▪️ Claims of direct Google relay delivery
▪️ High inbox placement claims
▪️ Multiple templates and custom input options
▪️ Test access offered by the seller
Potential impact:
The advertised service could be used for phishing, spam campaigns, credential theft, business email compromise attempts, and impersonation of trusted email infrastructure.
Status:
Underground forum sale listing. The actor claims they are not selling the source code and are offering limited access to the mailer service.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨XIA Stealer advertised: DLL-based information stealer promoted as “fully undetected” on underground forum
A threat actor is advertising XIA, a DLL-based information stealer claiming to target modern Windows systems while avoiding detection during scan time and runtime.
━━━━━━━━━━━━━━━━━━━━
Service: XIA Stealer
Sector: Malware / Info-Stealer / Cybercrime Tools
Incident: Malware Service Advertisement
Exposure: Credential theft and browser data collection tool
Actor: kandricklamar
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ DLL-based information stealer under 500KB
▪️ Browser cookie, login, and autofill data collection claims
▪️ Credit card and wallet-related data theft capabilities
▪️ Crypto wallet extension targeting claims
▪️ File collection from desktop and text files
▪️ Persistence, stealth, and anti-analysis features
▪️ Discord webhook logging and Windows compatibility claims
Potential impact:
The advertised tool could be used for credential theft, crypto wallet compromise, account takeover, financial fraud, and broader malware campaigns against Windows users.
Status:
Underground forum advertisement. The actor posted a feature list and directs users to an external channel for more information and showcase material.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising XIA, a DLL-based information stealer claiming to target modern Windows systems while avoiding detection during scan time and runtime.
━━━━━━━━━━━━━━━━━━━━
Service: XIA Stealer
Sector: Malware / Info-Stealer / Cybercrime Tools
Incident: Malware Service Advertisement
Exposure: Credential theft and browser data collection tool
Actor: kandricklamar
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ DLL-based information stealer under 500KB
▪️ Browser cookie, login, and autofill data collection claims
▪️ Credit card and wallet-related data theft capabilities
▪️ Crypto wallet extension targeting claims
▪️ File collection from desktop and text files
▪️ Persistence, stealth, and anti-analysis features
▪️ Discord webhook logging and Windows compatibility claims
Potential impact:
The advertised tool could be used for credential theft, crypto wallet compromise, account takeover, financial fraud, and broader malware campaigns against Windows users.
Status:
Underground forum advertisement. The actor posted a feature list and directs users to an external channel for more information and showcase material.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇫🇷 ManoMano allegedly breached: 38.7M user and ticket records advertised for sale from home improvement marketplace database
A threat actor claims to be selling a database tied to ManoMano, a European online marketplace specializing in DIY, home improvement, gardening, and renovation products.
━━━━━━━━━━━━━━━━━━━━
Target: ManoMano
Sector: E-commerce / Home Improvement / Marketplace
Incident: Database Leak / Data Sale
Exposure: 38,773,441 total lines across users and tickets datasets
Actor: Saikaa
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ User database records allegedly linked to ManoMano
▪️ Customer account and marketplace profile data
▪️ Ticket and support-related records
▪️ Attachment folder containing uploaded files
▪️ Large-scale JSON datasets for users and tickets
▪️ Sample data references shared by the actor
Potential impact:
The exposed data could be used for phishing, account impersonation, customer support scams, marketplace fraud, and targeted social engineering against ManoMano users and sellers.
Status:
Unverified underground forum sale listing. The actor claims the files include 37,838,030 user lines, 935,411 ticket lines, and 13,522 attachment files.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a database tied to ManoMano, a European online marketplace specializing in DIY, home improvement, gardening, and renovation products.
━━━━━━━━━━━━━━━━━━━━
Target: ManoMano
Sector: E-commerce / Home Improvement / Marketplace
Incident: Database Leak / Data Sale
Exposure: 38,773,441 total lines across users and tickets datasets
Actor: Saikaa
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ User database records allegedly linked to ManoMano
▪️ Customer account and marketplace profile data
▪️ Ticket and support-related records
▪️ Attachment folder containing uploaded files
▪️ Large-scale JSON datasets for users and tickets
▪️ Sample data references shared by the actor
Potential impact:
The exposed data could be used for phishing, account impersonation, customer support scams, marketplace fraud, and targeted social engineering against ManoMano users and sellers.
Status:
Unverified underground forum sale listing. The actor claims the files include 37,838,030 user lines, 935,411 ticket lines, and 13,522 attachment files.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❤1
The API daily limit has been changed from 50 requests daily to 150 requests. This has been reflected on the necessary pages.
If you have already used 40 requests for the day you now have 110 requests remaining.
An optional addon is available for those who need higher limits.
Daily limit resets at 12am UTC.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
If you have already used 40 requests for the day you now have 110 requests remaining.
An optional addon is available for those who need higher limits.
Daily limit resets at 12am UTC.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Telegram
🔪 Slice For Life - Part 2 🔪
Backup: t.me/SliceForLifeeee
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API Access: https://darkwebinformer.com/api-details
Donate: darkwebinformer.com/donations
❤2
🚨🇺🇸 Venture Yours allegedly breached: 70K vacation rental management files and KYC/PII records exposed
A threat actor claims to have leaked part of a customer database tied to Venture Yours, a vacation rental management platform handling rental agreements, booking details, customer communications, and property-related operations.
━━━━━━━━━━━━━━━━━━━━
Target: Venture Yours
Sector: Vacation Rental Management / Property Technology
Incident: Database Leak
Exposure: 70,000+ files / 64GB
Actor: zSenior
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer PII records allegedly linked to vacation rental management operations
▪️ Names, emails, phone numbers, roles, and address fields
▪️ Property address and rental agreement-related data
▪️ Driver license and KYC document references
▪️ Booking details, contracts, and customer communication logs
▪️ Conversation metadata from customer support systems
▪️ CSV records containing logs and personal information
▪️ File archives containing identity and rental documentation
Potential impact:
The exposed data could be used for identity theft, rental fraud, phishing, customer impersonation, property scams, and targeted social engineering against guests, property owners, and rental managers.
Status:
Unverified underground forum claim. The actor posted CSV samples, support-log previews, and a driver license image as proof.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked part of a customer database tied to Venture Yours, a vacation rental management platform handling rental agreements, booking details, customer communications, and property-related operations.
━━━━━━━━━━━━━━━━━━━━
Target: Venture Yours
Sector: Vacation Rental Management / Property Technology
Incident: Database Leak
Exposure: 70,000+ files / 64GB
Actor: zSenior
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer PII records allegedly linked to vacation rental management operations
▪️ Names, emails, phone numbers, roles, and address fields
▪️ Property address and rental agreement-related data
▪️ Driver license and KYC document references
▪️ Booking details, contracts, and customer communication logs
▪️ Conversation metadata from customer support systems
▪️ CSV records containing logs and personal information
▪️ File archives containing identity and rental documentation
Potential impact:
The exposed data could be used for identity theft, rental fraud, phishing, customer impersonation, property scams, and targeted social engineering against guests, property owners, and rental managers.
Status:
Unverified underground forum claim. The actor posted CSV samples, support-log previews, and a driver license image as proof.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
.@zachxbt is offering another $10,000 bounty for credible intelligence on the Hong Kong market maker Heisenberg Guru, also known as HSBG, allegedly linked to multiple CEX market manipulation incidents, including $RIVER.
He is considering evidence that may include chat logs, contracts, internal communications, or other verifiable materials.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
He is considering evidence that may include chat logs, contracts, internal communications, or other verifiable materials.
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🔥1
Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: HDFC Asset Management Company
Domain:
Country: 🇮🇳 IN
Date: May 16th, 2026
Summary:
HDFC Asset Management Company's stock fell 3.8% on Monday following the disclosure of a cyberattack on its IT infrastructure. The incident occurred on May 16 and the company is working to contain it. The stock decline came after the company was notified by an anonymous source. The incident is part of a broader increase in security risks facing India's financial sector.
Source: https://www.freepressjournal.in/business/hdfc-amc-stock-declines-38-after-company-reports-cyberattack-on-it-infra
━━━━━━━━━━━━━━━━━━━━━━━━━
Victim: HDFC Asset Management Company
Domain:
hdfcfund.comCountry: 🇮🇳 IN
Date: May 16th, 2026
Summary:
HDFC Asset Management Company's stock fell 3.8% on Monday following the disclosure of a cyberattack on its IT infrastructure. The incident occurred on May 16 and the company is working to contain it. The stock decline came after the company was notified by an anonymous source. The incident is part of a broader increase in security risks facing India's financial sector.
Source: https://www.freepressjournal.in/business/hdfc-amc-stock-declines-38-after-company-reports-cyberattack-on-it-infra
Free Press Journal
HDFC AMC Stock Declines 3.8% After Company Reports Cyberattack on IT Infra
The stock of HDFC Asset Management Company fell up to 3.8 percent on Monday after the company reported a cyberattack on its IT infrastructure. The stock opened lower by 1.4 percent at Rs 2,662.85 compared to the previous close of Rs 2,703.10 apiece
‼️ New Dark Web Informer Blog Post!
Title: Perm National Research Polytechnic University Allegedly Breached: 362K Internal Student Research System Records Leaked
Link: https://darkwebinformer.com/perm-national-research-polytechnic-university-allegedly-breached-362k-internal-student-research-system-records-leaked/
Title: Perm National Research Polytechnic University Allegedly Breached: 362K Internal Student Research System Records Leaked
Link: https://darkwebinformer.com/perm-national-research-polytechnic-university-allegedly-breached-362k-internal-student-research-system-records-leaked/
Dark Web Informer
Perm National Research Polytechnic University Allegedly Breached: 362K Internal Student Research System Records Leaked
A threat actor claims to have leaked a complete database dump tied to Perm National Research Polytechnic University, a major technical university in Russia, from an internal accounting and monitoring system used for student research work.