🚨🇲🇽 National Institute of Anthropology and History systems allegedly compromised
A forum actor claims to have compromised systems belonging to Mexico’s National Institute of Anthropology and History, a federal agency responsible for preserving and managing the country’s archaeological, anthropological, historical, and cultural heritage.
Published screenshots allegedly show access to an internal case management portal and documents containing personal information. The exposed data appears to include names, government identification numbers, addresses, phone numbers, email addresses, application details, case numbers, submission dates, and internal workflow records.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to have compromised systems belonging to Mexico’s National Institute of Anthropology and History, a federal agency responsible for preserving and managing the country’s archaeological, anthropological, historical, and cultural heritage.
Published screenshots allegedly show access to an internal case management portal and documents containing personal information. The exposed data appears to include names, government identification numbers, addresses, phone numbers, email addresses, application details, case numbers, submission dates, and internal workflow records.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
XSS is now actively being tracked on the threat feed. Currently the thread view is not native. I pushed a fix and I am waiting for the cycle to complete.
❤1🔥1
‼️ New Dark Web Informer Blog Post!
Title: Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin America
Link: https://darkwebinformer.com/shopee-customer-database-allegedly-for-sale-300-million-records-claimed-across-asia-and-latin-america/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin America
Link: https://darkwebinformer.com/shopee-customer-database-allegedly-for-sale-300-million-records-claimed-across-asia-and-latin-america/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin America
A seller posting as 666op is advertising what they describe as a customer database from Shopee, the e-commerce marketplace operated by Sea Limited.
🔪 That Dark Web Guy - Part 3 🔪
🚨‼️ CVE-2026-61511: A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. CVSS: 9.8 Exploit: https://ssd-disclosure.com/vbulletin-runtime…
‼️ CVE-2026-61511: Improper Neutralization of Directives in Dynamically Evaluated Code
FOFA Query: app="vBulletin"
FOFA: https://en.fofa.info/result?qbase64=YXBwPSJ2QnVsbGV0aW4i
Results: 11,081
FOFA Query: app="vBulletin"
FOFA: https://en.fofa.info/result?qbase64=YXBwPSJ2QnVsbGV0aW4i
Results: 11,081
‼️ New Dark Web Informer Blog Post!
Title: Planity Database Allegedly for Sale, 999,451 Customers of French Salons and Spas Listed
Link: https://darkwebinformer.com/planity-database-allegedly-for-sale-999-451-customers-of-french-salons-and-spas-listed/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Planity Database Allegedly for Sale, 999,451 Customers of French Salons and Spas Listed
Link: https://darkwebinformer.com/planity-database-allegedly-for-sale-999-451-customers-of-french-salons-and-spas-listed/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Planity Database Allegedly for Sale, 999,451 Customers of French Salons and Spas Listed
A seller posting as weykofa is advertising what they describe as the database of Planity, the French online booking platform used by hair salons, beauty businesses, and spas to manage appointments and customer records.
🚨TG Core Telegram automation toolkit source code allegedly offered for sale
A forum seller is advertising the source code for TG Core, a Telegram automation framework designed to manage large pools of accounts and proxies while supporting custom tools built on the MTProto protocol.
The listing claims the toolkit can import Telegram Desktop session data, verify account status, scrape users from public groups and channels, automate invitations in batches, manage SOCKS proxies, handle Telegram API restrictions, and export results in JSON or CSV. Only five copies are reportedly available, with the project listed for 300 and a $50 discount offered to the first three buyers.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum seller is advertising the source code for TG Core, a Telegram automation framework designed to manage large pools of accounts and proxies while supporting custom tools built on the MTProto protocol.
The listing claims the toolkit can import Telegram Desktop session data, verify account status, scrape users from public groups and channels, automate invitations in batches, manage SOCKS proxies, handle Telegram API restrictions, and export results in JSON or CSV. Only five copies are reportedly available, with the project listed for 300 and a $50 discount offered to the first three buyers.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
❤1
‼️🇬🇧 Coinbase Cartel names a UK company
🇬🇧 Accesso - A UK-based provider of ticketing, virtual queuing, payment, and guest experience software for attractions and entertainment venues.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🇬🇧 Accesso - A UK-based provider of ticketing, virtual queuing, payment, and guest experience software for attractions and entertainment venues.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
This media is not supported in your browser
VIEW IN TELEGRAM
🚨 An autonomous AI agent escaped an OpenAI evaluation sandbox, compromised a third-party sandbox, then breached Hugging Face through malicious datasets.
It executed roughly 17,600 actions, moved laterally & accessed challenge solutions. Hugging Face put together this reconstruction.
Article: https://huggingface.co/blog/agent-intrusion-technical-timeline
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
It executed roughly 17,600 actions, moved laterally & accessed challenge solutions. Hugging Face put together this reconstruction.
Article: https://huggingface.co/blog/agent-intrusion-technical-timeline
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
❤2
‼️ New Dark Web Informer Blog Post!
Title: Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published
Link: https://darkwebinformer.com/lire-demain-database-allegedly-leaked-5-974-school-and-local-authority-client-records-published/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published
Link: https://darkwebinformer.com/lire-demain-database-allegedly-leaked-5-974-school-and-local-authority-client-records-published/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published
A forum user posting as 0xSec has published what they describe as the database of Lire Demain, the schools and institutions network of the French children's publisher Auzou, which supplies books, kamishibai theatres, and educational materials to schools,…
🚨🇨🇷 Costa Rican identity documents and KYC records allegedly leaked
A forum actor claims to have published a large collection of documents linked to individuals in Costa Rica, including identity cards, driver’s licenses, selfies, and know-your-customer records.
The post advertises access to as many as 20,000 document sets and includes several sample links.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to have published a large collection of documents linked to individuals in Costa Rica, including identity cards, driver’s licenses, selfies, and know-your-customer records.
The post advertises access to as many as 20,000 document sets and includes several sample links.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
🚨🇲🇽🇳🇮 UNIVIM and UNCSM student photos allegedly leaked
A forum actor claims to have exploited an IDOR vulnerability affecting student portals operated by Mexico’s Universidad Virtual del Estado de Michoacán and Nicaragua’s Universidad Nacional Casimiro Sotelo Montenegro.
The post advertises 275 student profile photos. The actor claims valid user identifiers were enumerated and the images were collected through an automated scraping process before being published through a download link.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to have exploited an IDOR vulnerability affecting student portals operated by Mexico’s Universidad Virtual del Estado de Michoacán and Nicaragua’s Universidad Nacional Casimiro Sotelo Montenegro.
The post advertises 275 student profile photos. The actor claims valid user identifiers were enumerated and the images were collected through an automated scraping process before being published through a download link.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇧🇪🇩🇪 European bank accounts and Stripe merchant access allegedly offered for sale
A forum actor is advertising access to bank accounts in Belgium and Germany capable of receiving instant SEPA transfers, along with European Stripe and e-commerce merchant accounts for processing card payments.
The listing prices the access between $5,000 and $10,000 and proposes a revenue-sharing arrangement in which the actor retains 40% of the proceeds.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
A forum actor is advertising access to bank accounts in Belgium and Germany capable of receiving instant SEPA transfers, along with European Stripe and e-commerce merchant accounts for processing card payments.
The listing prices the access between $5,000 and $10,000 and proposes a revenue-sharing arrangement in which the actor retains 40% of the proceeds.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
❤1
🚨 Access credentials for billion-dollar company allegedly compromised
A forum actor claims to possess API keys and remote MySQL connection details belonging to an unidentified company with more than $1 billion in annual revenue. The actor says database access is currently blocked by an IP whitelist.
The post seeks assistance from someone with web intrusion and ransomware expertise to access the database and extract customer identification photos and other files stored in an AWS environment.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to possess API keys and remote MySQL connection details belonging to an unidentified company with more than $1 billion in annual revenue. The actor says database access is currently blocked by an IP whitelist.
The post seeks assistance from someone with web intrusion and ransomware expertise to access the database and extract customer identification photos and other files stored in an AWS environment.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 23 million US clinic patient records allegedly offered for sale
A forum actor claims to be selling approximately 23 million patient records obtained from an unidentified clinic in the United States. The actor says the website data was collected in July 2026 and is being sold privately to a single buyer.
The advertised data allegedly includes names, dates of birth, gender, addresses, phone numbers, email addresses, postal codes, shipment dates, doctor names, financial responsibility fields, portal data, transaction identifiers, and internal record IDs. The full dataset is priced at $5,000, with smaller batches of one million records offered for $300.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to be selling approximately 23 million patient records obtained from an unidentified clinic in the United States. The actor says the website data was collected in July 2026 and is being sold privately to a single buyer.
The advertised data allegedly includes names, dates of birth, gender, addresses, phone numbers, email addresses, postal codes, shipment dates, doctor names, financial responsibility fields, portal data, transaction identifiers, and internal record IDs. The full dataset is priced at $5,000, with smaller batches of one million records offered for $300.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
‼️ New Dark Web Informer Blog Post!
Title: Broadcom Patches Critical VMware Flaws Enabling vCenter Authentication Bypass and ESXi VM Escape
Link: https://darkwebinformer.com/broadcom-patches-critical-vmware-flaws-enabling-vcenter-authentication-bypass-and-esxi-vm-escape/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Broadcom Patches Critical VMware Flaws Enabling vCenter Authentication Bypass and ESXi VM Escape
Link: https://darkwebinformer.com/broadcom-patches-critical-vmware-flaws-enabling-vcenter-authentication-bypass-and-esxi-vm-escape/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Broadcom Patches Critical VMware Flaws Enabling vCenter Authentication Bypass and ESXi VM Escape
Broadcom has released emergency security updates for five vulnerabilities affecting VMware vCenter, ESX and ESXi, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and several VMware Telco products.
‼️🇬🇧 ExfilSquad ransomware earlier this week claimed a lot of big companies including the UK's Department of Education.
While there was doubt on many of these claims, it seems the DfE hack is legitimate.
Source: https://www.independent.co.uk/news/uk/politics/data-leak-education-department-hack-teachers-b3023943.html
While there was doubt on many of these claims, it seems the DfE hack is legitimate.
Source: https://www.independent.co.uk/news/uk/politics/data-leak-education-department-hack-teachers-b3023943.html
❤1
‼️ New Dark Web Informer Blog Post!
Title: IPRO Customer Database Allegedly Leaked, 60,454 Records From Legal eDiscovery Platform Published
Link: https://darkwebinformer.com/ipro-customer-database-allegedly-leaked-60-454-records-from-legal-ediscovery-platform-published/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: IPRO Customer Database Allegedly Leaked, 60,454 Records From Legal eDiscovery Platform Published
Link: https://darkwebinformer.com/ipro-customer-database-allegedly-leaked-60-454-records-from-legal-ediscovery-platform-published/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
IPRO Customer Database Allegedly Leaked, 60,454 Records From Legal eDiscovery Platform Published
A forum user posting as cozypandas has published what they describe as the full customer database of IPRO, an eDiscovery platform used by law firms, corporations, and government agencies to manage data for litigation.