๐จ ๐ช๐ธ A threat actor going by HiddenHq is selling an alleged dataset of Spanish individuals and companies with IBAN banking details on a popular cybercrime forum, claiming around 50,000 lines.
โฃ Threat Actor: HiddenHq
โฃ Category: Alleged Data Leak
โฃ Target: Individuals & companies in Spain
โฃ Format: TXT
โฃ Price: $500
The actor claims the dataset includes first and last names, city, phone numbers, IBAN numbers, and company names, with a sample posted in the listing. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โฃ Threat Actor: HiddenHq
โฃ Category: Alleged Data Leak
โฃ Target: Individuals & companies in Spain
โฃ Format: TXT
โฃ Price: $500
The actor claims the dataset includes first and last names, city, phone numbers, IBAN numbers, and company names, with a sample posted in the listing. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐จ ๐ฒ๐ฝ A threat actor going by Alz_157s is selling an alleged data leak of Mexico's Secretarรญa de Marina (SEMAR), the country's navy, on a popular cybercrime forum, claiming records on 29,788 officers.
โฃ Threat Actor: Alz_157s
โฃ Category: Alleged Data Leak - Military / Government
โฃ Target: Secretarรญa de Marina (SEMAR), Mexico
The actor claims the dataset includes personal records such as names, CURP, RFC, dates of birth, contact details, and state of birth, alongside PDF medical examination acknowledgments and results.
Noted for awareness - leaks targeting military personnel carry elevated physical-safety and doxxing risk for the individuals named.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โฃ Threat Actor: Alz_157s
โฃ Category: Alleged Data Leak - Military / Government
โฃ Target: Secretarรญa de Marina (SEMAR), Mexico
The actor claims the dataset includes personal records such as names, CURP, RFC, dates of birth, contact details, and state of birth, alongside PDF medical examination acknowledgments and results.
Noted for awareness - leaks targeting military personnel carry elevated physical-safety and doxxing risk for the individuals named.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โผ๏ธ New Dark Web Informer Blog Post!
Title: French Campsite Federation FNHPA Hit by Alleged 9K Member & Invoice Leak
Link: https://darkwebinformer.com/french-campsite-federation-fnhpa-hit-by-alleged-9k-member-invoice-leak/
Title: French Campsite Federation FNHPA Hit by Alleged 9K Member & Invoice Leak
Link: https://darkwebinformer.com/french-campsite-federation-fnhpa-hit-by-alleged-9k-member-invoice-leak/
Dark Web Informer
French Campsite Federation FNHPA Hit by Alleged 9K Member & Invoice Leak
A threat actor using the alias ChimeraZ claims to have leaked a database allegedly belonging to FNHPA (Fรฉdรฉration Nationale de l'Hรดtellerie de Plein Air), the main professional organization representing campsite and outdoor-hospitality operators in France.
โผ๏ธ New Dark Web Informer Blog Post!
Title: Mexican Civil Protection Training Portal Hit by Alleged Admin Compromise & Credential Leak
Link: https://darkwebinformer.com/mexican-civil-protection-training-portal-hit-by-alleged-admin-compromise-credential-leak/
Title: Mexican Civil Protection Training Portal Hit by Alleged Admin Compromise & Credential Leak
Link: https://darkwebinformer.com/mexican-civil-protection-training-portal-hit-by-alleged-admin-compromise-credential-leak/
Dark Web Informer
Mexican Civil Protection Training Portal Hit by Alleged Admin Compromise & Credential Leak
A threat actor using the alias azazeljakel claims to have gained administrator access to preparados.gob.mx, a training portal of Mexico's Coordinaciรณn Nacional de Protecciรณn Civil (Civil Protection authority), and to have exfiltrated the user list.
๐จ ๐ซ๐ท A threat actor going by xMetah, alongside an associate named Lagui, is sharing an alleged data leak of Jet Systems Hรฉlicoptรจres Services (jshs.fr), a French helicopter services company, on a popular cybercrime forum, claiming 4,190 client records.
โฃ Threat Actor: xMetah (with Lagui)
โฃ Category: Alleged Data Leak
โฃ Target: Jet Systems Hรฉlicoptรจres Services (jshs.fr), France
โฃ Format: JSONL (clients_export.jsonl)
The actor claims the dataset includes client records such as names, titles, emails, mobile numbers, company names, addresses, cities, country, SIRET numbers, billing details, and helicopter pricing information. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โฃ Threat Actor: xMetah (with Lagui)
โฃ Category: Alleged Data Leak
โฃ Target: Jet Systems Hรฉlicoptรจres Services (jshs.fr), France
โฃ Format: JSONL (clients_export.jsonl)
The actor claims the dataset includes client records such as names, titles, emails, mobile numbers, company names, addresses, cities, country, SIRET numbers, billing details, and helicopter pricing information. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โผ๏ธ New Dark Web Informer Blog Post!
Title: Bermudian Financial Service EasyPay Hit by Alleged Full Database Leak With 2M Transactions & 10K Cards
Link: https://darkwebinformer.com/bermudian-financial-service-easypay-hit-by-alleged-full-database-leak-with-2m-transactions-10k-cards/
Title: Bermudian Financial Service EasyPay Hit by Alleged Full Database Leak With 2M Transactions & 10K Cards
Link: https://darkwebinformer.com/bermudian-financial-service-easypay-hit-by-alleged-full-database-leak-with-2m-transactions-10k-cards/
Dark Web Informer
Bermudian Financial Service EasyPay Hit by Alleged Full Database Leak With 2M Transactions & 10K Cards
A threat actor using the alias henrymartin has posted what is described as the full leak of EasyPay, a now-defunct Bermudian financial service that processed transactions between individuals and businesses.
๐จ๐ช๐ธ Spanish public payroll panel allegedly offered for sale
A threat actor claims to have access to 371 payroll accounts tied to a Spanish public management portal, allegedly allowing modification of bank deposit details used for SEPA payroll payments.
Whatโs allegedly exposed:
โข 371 payroll accounts
โข April payroll total of โฌ962,246.73 net after taxes
โข Employee bank/payment fields including IBAN-related details
โข Claimed PDF proof and access screenshots
Details:
๐ง๐ฎ๐ฟ๐ด๐ฒ๐: Spanish public management payroll portal
๐๐ผ๐๐ป๐๐ฟ๐: Spain
๐ฆ๐ฒ๐ฐ๐๐ผ๐ฟ: Public sector / Payroll
๐๐ฐ๐๐ผ๐ฟ: pw0x2
๐๐น๐ฎ๐ถ๐บ: Administrative payroll access sale
๐ข๐ฏ๐๐ฒ๐ฟ๐๐ฒ๐ฑ: May 26, 2026
Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have access to 371 payroll accounts tied to a Spanish public management portal, allegedly allowing modification of bank deposit details used for SEPA payroll payments.
Whatโs allegedly exposed:
โข 371 payroll accounts
โข April payroll total of โฌ962,246.73 net after taxes
โข Employee bank/payment fields including IBAN-related details
โข Claimed PDF proof and access screenshots
Details:
๐ง๐ฎ๐ฟ๐ด๐ฒ๐: Spanish public management payroll portal
๐๐ผ๐๐ป๐๐ฟ๐: Spain
๐ฆ๐ฒ๐ฐ๐๐ผ๐ฟ: Public sector / Payroll
๐๐ฐ๐๐ผ๐ฟ: pw0x2
๐๐น๐ฎ๐ถ๐บ: Administrative payroll access sale
๐ข๐ฏ๐๐ฒ๐ฟ๐๐ฒ๐ฑ: May 26, 2026
Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
1/2๐จ DragonForce Ransomware Claims 22 Victims
๐จ๐ฆ K Smart Associates - Canadian civil engineering and land-use planning consulting firm - 284.28 GB allegedly stolen
๐ฌ๐ง WSM - UK tax advisory and professional services firm - 119.23 GB allegedly stolen
๐บ๐ธ Northbridge - US venture capital firm focused on technology and innovation investments - 22.09 GB allegedly stolen
๐ณ๐ฑ Dunas Groen - Netherlands-based landscape design and garden supplies company - 21.9 GB allegedly stolen
๐ฌ๐ง Refreshment Systems - UK vending machine and refreshment services company - 178.24 GB allegedly stolen
๐ฌ๐ง Practicus - UK consulting firm specializing in interim management, executive search, and project management - 576.62 GB allegedly stolen
๐บ๐ธ NEMD Architects - US architecture firm providing functional and sustainable design services - 397.44 GB allegedly stolen
๐ฎ๐น Pieralisi - Italian industrial equipment manufacturer specializing in centrifugal separation systems - 1.31 TB allegedly stolen
๐บ๐ธ J.C. Ripberger Construction - US general contractor specializing in structural concrete, carpentry, and construction services - 44.07 GB allegedly stolen
๐ณ๐ฑ Profundo - Netherlands-based research organization focused on sustainability and social justice - 149.31 GB allegedly stolen
๐บ๐ธ Waypoint Business Solutions - US IT solutions provider offering hardware, software, and professional services - 9.68 GB allegedly stolen
๐ฌ๐ง ERH - UK traffic management solutions provider offering installation, maintenance, and commissioning services - 145.31 GB allegedly stolen
๐บ๐ธ Fabbrica - US design, development, and manufacturing company focused on high-quality fabrication work - 235.6 GB allegedly stolen
๐บ๐ธ Ramos Rheumatology - US rheumatology care center specializing in autoimmune disease treatment - 51.87 GB allegedly stolen
๐ฎ๐ฑ FWMK Law Offices - Israeli full-service law firm with expertise in high tech, mergers, acquisitions, and real estate - 585.52 GB allegedly stolen
๐บ๐ธ Henry Broch Foods - US food ingredient manufacturer and processor founded in 1941 - 77.21 GB allegedly stolen
๐บ๐ธ Denton Law Firm - US law firm focused on rapid response and legal solutions - 27.1 GB allegedly stolen
๐ฆ๐บ QLS Logistics - Australian e-waste and polystyrene recycling company serving retail and consumer markets - 554.65 GB allegedly stolen
๐จ๐ฆ Dubois Agrinovation - Canadian agricultural equipment and solutions company - 445.17 GB allegedly stolen
๐ฉ๐ช WG Neukรถlln - German housing cooperative offering apartments and residential services in Berlin - 33.64 GB allegedly stolen
๐จ๐ฆ Delbrook Capital Advisors - Canadian investment manager focused on the global materials sector - 252.45 GB allegedly stolen
๐บ๐ธ Greenway Technologies - US fire protection company based in Phoenix, Arizona - 23.5 GB allegedly stolen
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐จ๐ฆ K Smart Associates - Canadian civil engineering and land-use planning consulting firm - 284.28 GB allegedly stolen
๐ฌ๐ง WSM - UK tax advisory and professional services firm - 119.23 GB allegedly stolen
๐บ๐ธ Northbridge - US venture capital firm focused on technology and innovation investments - 22.09 GB allegedly stolen
๐ณ๐ฑ Dunas Groen - Netherlands-based landscape design and garden supplies company - 21.9 GB allegedly stolen
๐ฌ๐ง Refreshment Systems - UK vending machine and refreshment services company - 178.24 GB allegedly stolen
๐ฌ๐ง Practicus - UK consulting firm specializing in interim management, executive search, and project management - 576.62 GB allegedly stolen
๐บ๐ธ NEMD Architects - US architecture firm providing functional and sustainable design services - 397.44 GB allegedly stolen
๐ฎ๐น Pieralisi - Italian industrial equipment manufacturer specializing in centrifugal separation systems - 1.31 TB allegedly stolen
๐บ๐ธ J.C. Ripberger Construction - US general contractor specializing in structural concrete, carpentry, and construction services - 44.07 GB allegedly stolen
๐ณ๐ฑ Profundo - Netherlands-based research organization focused on sustainability and social justice - 149.31 GB allegedly stolen
๐บ๐ธ Waypoint Business Solutions - US IT solutions provider offering hardware, software, and professional services - 9.68 GB allegedly stolen
๐ฌ๐ง ERH - UK traffic management solutions provider offering installation, maintenance, and commissioning services - 145.31 GB allegedly stolen
๐บ๐ธ Fabbrica - US design, development, and manufacturing company focused on high-quality fabrication work - 235.6 GB allegedly stolen
๐บ๐ธ Ramos Rheumatology - US rheumatology care center specializing in autoimmune disease treatment - 51.87 GB allegedly stolen
๐ฎ๐ฑ FWMK Law Offices - Israeli full-service law firm with expertise in high tech, mergers, acquisitions, and real estate - 585.52 GB allegedly stolen
๐บ๐ธ Henry Broch Foods - US food ingredient manufacturer and processor founded in 1941 - 77.21 GB allegedly stolen
๐บ๐ธ Denton Law Firm - US law firm focused on rapid response and legal solutions - 27.1 GB allegedly stolen
๐ฆ๐บ QLS Logistics - Australian e-waste and polystyrene recycling company serving retail and consumer markets - 554.65 GB allegedly stolen
๐จ๐ฆ Dubois Agrinovation - Canadian agricultural equipment and solutions company - 445.17 GB allegedly stolen
๐ฉ๐ช WG Neukรถlln - German housing cooperative offering apartments and residential services in Berlin - 33.64 GB allegedly stolen
๐จ๐ฆ Delbrook Capital Advisors - Canadian investment manager focused on the global materials sector - 252.45 GB allegedly stolen
๐บ๐ธ Greenway Technologies - US fire protection company based in Phoenix, Arizona - 23.5 GB allegedly stolen
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐จ The FBI has released a new FLASH Warning on Silent Ransome Group
The Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider, and UNC3753, is targeting law firms through social engineering campaigns.
SRG actors commonly impersonate IT support through phone calls and phishing emails to gain access to victim systems. Once access is established, they exfiltrate data using legitimate remote access tools or, in some cases, by sending someone to the victim organizationโs physical location to access computers directly.
Although SRG has impacted organizations across sectors such as insurance, finance, and healthcare, the group has maintained a consistent focus on U.S.-based law firms since spring 2023.
PDF: https://www.ic3.gov/CSA/2026/260526.pdf
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
The Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider, and UNC3753, is targeting law firms through social engineering campaigns.
SRG actors commonly impersonate IT support through phone calls and phishing emails to gain access to victim systems. Once access is established, they exfiltrate data using legitimate remote access tools or, in some cases, by sending someone to the victim organizationโs physical location to access computers directly.
Although SRG has impacted organizations across sectors such as insurance, finance, and healthcare, the group has maintained a consistent focus on U.S.-based law firms since spring 2023.
PDF: https://www.ic3.gov/CSA/2026/260526.pdf
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โผ๏ธ Qilin Ransomware Claims 4 Victims
๐ฌ๐ง William Davis Homes
๐บ๐ธ Roofing Solutions
๐บ๐ธ Shocco Springs
๐บ๐ธ Mainstreet Organization of Realtors
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐ฌ๐ง William Davis Homes
๐บ๐ธ Roofing Solutions
๐บ๐ธ Shocco Springs
๐บ๐ธ Mainstreet Organization of Realtors
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐จ ๐ฒ๐ฝ A threat actor going by Black0ut_Exi is sharing an alleged data leak of Universidad de Ixtlahuaca (CUI), a Mexican university, on a popular cybercrime forum, claiming around 20,000 records.
โฃ Threat Actor: Black0ut_Exi (credited to "okami" / Exiliados #555)
โฃ Category: Alleged Data Leak
โฃ Target: Universidad de Ixtlahuaca CUI, Mexico
The actor claims the dataset includes student and personal records such as names, parents' surnames, dates of birth, gender, marital status, nationality, address, postal code, phone numbers, email addresses, CURP, school details, academic period, social media handles, employer, and academic standing. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โฃ Threat Actor: Black0ut_Exi (credited to "okami" / Exiliados #555)
โฃ Category: Alleged Data Leak
โฃ Target: Universidad de Ixtlahuaca CUI, Mexico
The actor claims the dataset includes student and personal records such as names, parents' surnames, dates of birth, gender, marital status, nationality, address, postal code, phone numbers, email addresses, CURP, school details, academic period, social media handles, employer, and academic standing. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โผ๏ธ The FBI is providing a Public Service Announcement (PSA) warning that cyber criminals are creating fake versions of FIFA's website ahead of the 2026 World Cup to steal personal information, sell counterfeit tickets and hospitality packages, and enable further fraud such as opening accounts in victims' names.
Attackers use "typo squatting" by registering domains that resemble http://fifa.com through misspellings (e.g., fiffa, filfa, wvvw-fifa), alternative top-level domains (.org, .cab, .pink, .click), or fake subdomains (jobs-fifa[.com, fifa-careerhub[.com).
The FBI has already identified roughly 30+ spoofed domains, including fifa-2026[.xyz, worldcup26ticket[.com, fifa-ticket[.live, and fifaworldcup26[.sale, and expects more to appear through the tournament.
PSA: https://www.ic3.gov/PSA/2026/PSA260527
IOCs provided by the FBI are below:
www.fifa[.]cab
www.fifa[.]pink
www.fifa[.]blue
www.fifa[.]pub
FIFA[.]city
Fifa[.]bio
fifa[.]beer
fifa[.]click
fifa[.]cam
fifa[.]ceo
fifa[.]help
filfa[.]org
fifa-online[.]com
https://fifa-2026[.]xyz
jobs-fifa[.]com
fifa-hr[.]com
fifa-careerhub[.]com
fifaworldcup-careers[.]com
fifa-hiring[.]com
fifahiring[.]com
fifa-ticket[.]live
http://fifastore.us[.]com
fifaworldcup26[.]sale
fifaworldcup26.xcover-staging[.]com
http://worldcup2026-tickets.com[.]mx
worldcup26ticket[.]com
2026fifaworldcuptickets[.]online
fwc2026[.]net
fwc2026.web[.]app
www.fifa2026p[.]com
fifa2026fworldcup[.]com
wvvw-fifa[.]com
ww-fifa[.]com
fifa-com[.]com
www.fifa-com[.]services
quiniela-fifa-2026.pages[.]dev
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Attackers use "typo squatting" by registering domains that resemble http://fifa.com through misspellings (e.g., fiffa, filfa, wvvw-fifa), alternative top-level domains (.org, .cab, .pink, .click), or fake subdomains (jobs-fifa[.com, fifa-careerhub[.com).
The FBI has already identified roughly 30+ spoofed domains, including fifa-2026[.xyz, worldcup26ticket[.com, fifa-ticket[.live, and fifaworldcup26[.sale, and expects more to appear through the tournament.
PSA: https://www.ic3.gov/PSA/2026/PSA260527
IOCs provided by the FBI are below:
www.fifa[.]cab
www.fifa[.]pink
www.fifa[.]blue
www.fifa[.]pub
FIFA[.]city
Fifa[.]bio
fifa[.]beer
fifa[.]click
fifa[.]cam
fifa[.]ceo
fifa[.]help
filfa[.]org
fifa-online[.]com
https://fifa-2026[.]xyz
jobs-fifa[.]com
fifa-hr[.]com
fifa-careerhub[.]com
fifaworldcup-careers[.]com
fifa-hiring[.]com
fifahiring[.]com
fifa-ticket[.]live
http://fifastore.us[.]com
fifaworldcup26[.]sale
fifaworldcup26.xcover-staging[.]com
http://worldcup2026-tickets.com[.]mx
worldcup26ticket[.]com
2026fifaworldcuptickets[.]online
fwc2026[.]net
fwc2026.web[.]app
www.fifa2026p[.]com
fifa2026fworldcup[.]com
wvvw-fifa[.]com
ww-fifa[.]com
fifa-com[.]com
www.fifa-com[.]services
quiniela-fifa-2026.pages[.]dev
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐2
๐จ ๐ซ๐ท A threat actor going by DumpsecIsBack is sharing an alleged data leak affecting multiple French companies including Biocoop, La Vie Claire, Naturalia, Satoriz, and Marcel & Fils on a popular cybercrime forum, claiming 5,635 company sales records.
โฃ Threat Actor: DumpsecIsBack
โฃ Category: Alleged Data Leak
โฃ Target: Biocoop, La Vie Claire, Naturalia, Satoriz, Marcel & Fils, others (France)
โฃ Format: CSV
The actor claims the dataset spans three files: 1,553 contact records, 5,640 company records, and 1,490 sales visit/appointment records, including names, roles, contact emails, phone numbers, company addresses, and detailed sales-visit notes. Samples were posted in the listing, with multiple file-sharing download links provided. The actor also announced plans for further leaks branded as "Black June" starting June 1, 2026. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โฃ Threat Actor: DumpsecIsBack
โฃ Category: Alleged Data Leak
โฃ Target: Biocoop, La Vie Claire, Naturalia, Satoriz, Marcel & Fils, others (France)
โฃ Format: CSV
The actor claims the dataset spans three files: 1,553 contact records, 5,640 company records, and 1,490 sales visit/appointment records, including names, roles, contact emails, phone numbers, company addresses, and detailed sales-visit notes. Samples were posted in the listing, with multiple file-sharing download links provided. The actor also announced plans for further leaks branded as "Black June" starting June 1, 2026. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
๐ญ1
๐จ ๐ซ๐ท A threat actor group going by AplaGroup is sharing an alleged data leak of Apogas Immobilier, a French real estate agency, on a popular cybercrime forum.
โโโโโโโโโโโโโโโโโโโโโโ
โ ๐ฏ AplaGroup
โ ๐ Alleged Data Leak
โ ๐ข Apogas Immobilier
โ ๐ซ๐ท France
โ ๐ Real Estate
โโโโโโโโโโโโโโโโโโโโโโ
The group claims the dataset includes an agents file with names, SIRET and VAT numbers, contact details, dates of birth, and marital status, plus a separate file of properties listed for sale. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
โโโโโโโโโโโโโโโโโโโโโโ
โ ๐ฏ AplaGroup
โ ๐ Alleged Data Leak
โ ๐ข Apogas Immobilier
โ ๐ซ๐ท France
โ ๐ Real Estate
โโโโโโโโโโโโโโโโโโโโโโ
The group claims the dataset includes an agents file with names, SIRET and VAT numbers, contact details, dates of birth, and marital status, plus a separate file of properties listed for sale. Authenticity is unverified.
Stop guessing what's redacted. Subscribers see everything: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations