πͺ Slice For Life - Part 2 πͺ
An "entity" has been working with me for awhile now. They wish to have access to Doxxing websites and similarly be alerted with new pastes. Kind of like the forum alerts. I have always declined this, but I'm always open to changing things and having an openβ¦
This is a legal entity btw, not an actor.
I have added 3 new incidents to the Physical Bitcoin Attacks page.
https://darkwebinformer.com/physical-bitcoin-attacks/
https://darkwebinformer.com/physical-bitcoin-attacks/
Dark Web Informer
Physical Bitcoin Attacks
A comprehensive database of known physical attacks against Bitcoin and crypto asset holders occurring in meatspace.
π¨π«π· Roussel Agri 62 email, CRM and business documents allegedly leaked
β
A forum actor claims to have leaked data belonging to Roussel Agri 62, a French agricultural business. The post is described as the first in a series of alleged leaks connected to BlgCloud.
β
The advertised collection includes:
β
β’ 9.33GB of data
β’ 45,684 files
β’ 29,127 emails
β’ 23,816 CRM records
β’ 45,681 business documents
β’ Customer and business contact information
β’ Names, email addresses and phone numbers
β’ Postal and company addresses
β’ CRM relationship and account data
β’ Banking details, including IBAN information
β’ Orders, invoices and other commercial documents
β
The actor published email, CRM and document samples alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have leaked data belonging to Roussel Agri 62, a French agricultural business. The post is described as the first in a series of alleged leaks connected to BlgCloud.
β
The advertised collection includes:
β
β’ 9.33GB of data
β’ 45,684 files
β’ 29,127 emails
β’ 23,816 CRM records
β’ 45,681 business documents
β’ Customer and business contact information
β’ Names, email addresses and phone numbers
β’ Postal and company addresses
β’ CRM relationship and account data
β’ Banking details, including IBAN information
β’ Orders, invoices and other commercial documents
β
The actor published email, CRM and document samples alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· CLCV consumer association database allegedly leaked
β
A forum actor claims to have leaked approximately 80,031 records associated with CLCV, a French national consumer and user advocacy organization.
β
The exposed data allegedly includes:
β
β’ Names and contact information
β’ Email addresses and phone numbers
β’ Postal addresses and cities
β’ Membership numbers
β’ Consumer request and complaint details
β’ Housing-related inquiries
β’ Mediation and intervention information
β’ Case status and follow-up details
β’ Sector and classification information
β’ Payment and transaction-related fields
β
The dataset is advertised in JSON format at roughly 109MB, with a sample published alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have leaked approximately 80,031 records associated with CLCV, a French national consumer and user advocacy organization.
β
The exposed data allegedly includes:
β
β’ Names and contact information
β’ Email addresses and phone numbers
β’ Postal addresses and cities
β’ Membership numbers
β’ Consumer request and complaint details
β’ Housing-related inquiries
β’ Mediation and intervention information
β’ Case status and follow-up details
β’ Sector and classification information
β’ Payment and transaction-related fields
β
The dataset is advertised in JSON format at roughly 109MB, with a sample published alongside the post.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· BlgCloud breach allegedly exposes data from more than 150 companies
β
A forum actor claims to have breached BlgCloud, a French cloud-based ERP and business management platform used by equipment dealers, rental companies, repair businesses and wholesalers.
β
The actor claims BlgCloud operates roughly 230 customer instances and that access was obtained to approximately 159 of them.
β
The compromised data allegedly includes:
β
β’ Customer and company CRM records
β’ Business contact information
β’ Email archives and attachments
β’ Invoices and commercial documents
β’ Banking information, including IBAN and BIC fields
β’ Customer addresses and phone numbers
β’ Company registration and legal information
β’ Internal account and user information
β’ Administrative credentials and configuration data
β’ Millions of documents across multiple customer environments
β
The actor published CRM, email and document samples alongside the post and claims both individual company datasets and the underlying access method are being offered for sale. The group also says it plans to release data from one affected company for free each day.
β
The listing describes the total exposure as potentially reaching terabytes of data across the affected BlgCloud customers.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have breached BlgCloud, a French cloud-based ERP and business management platform used by equipment dealers, rental companies, repair businesses and wholesalers.
β
The actor claims BlgCloud operates roughly 230 customer instances and that access was obtained to approximately 159 of them.
β
The compromised data allegedly includes:
β
β’ Customer and company CRM records
β’ Business contact information
β’ Email archives and attachments
β’ Invoices and commercial documents
β’ Banking information, including IBAN and BIC fields
β’ Customer addresses and phone numbers
β’ Company registration and legal information
β’ Internal account and user information
β’ Administrative credentials and configuration data
β’ Millions of documents across multiple customer environments
β
The actor published CRM, email and document samples alongside the post and claims both individual company datasets and the underlying access method are being offered for sale. The group also says it plans to release data from one affected company for free each day.
β
The listing describes the total exposure as potentially reaching terabytes of data across the affected BlgCloud customers.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ PokΓ©mon Center vending machine data and broader retail SaaS infrastructure allegedly breached
β
A forum actor claims to have breached a US-based automated retail SaaS platform used to operate more than 217 smart vending machines and kiosks across 28 brands, including 66 PokΓ©mon Center vending machines. The claim appears to target the underlying SwyftStore / Zoom Systems infrastructure rather than PokΓ©mon directly.
β
The actor claims the exposed environment includes:
β
β’ 206,092 unique email addresses
β’ 70,546 payment card hashes
β’ 59,797 customer receipts containing masked card numbers
β’ 8,545 sales transactions with amounts and purchased products
β’ 217 vending machine locations with inventory and planogram data
β’ 66 PokΓ©mon Center vending machines
β’ Customer and administrator PII
β’ Session and activity logs
β’ API credentials and backend reporting access
β’ Firebase databases, storage buckets and related cloud infrastructure
β’ Source code from three production applications
β’ 229 original source files
β’ Product catalogs, pricing, UPCs and SKU information
β
The actor claims the affected platform serves 28 brands, with records referencing PokΓ©mon Company International, CVS Pharmacy, Best Buy, Disney, Google, Dollar Shave Club, Juul, Sennheiser, Vera Bradley, Nespresso and others.
β
A 1,000-record sample was published alongside the post. The actor is asking $3,000 for the full collection and claims some of the affected cloud services remained accessible when the listing was published.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have breached a US-based automated retail SaaS platform used to operate more than 217 smart vending machines and kiosks across 28 brands, including 66 PokΓ©mon Center vending machines. The claim appears to target the underlying SwyftStore / Zoom Systems infrastructure rather than PokΓ©mon directly.
β
The actor claims the exposed environment includes:
β
β’ 206,092 unique email addresses
β’ 70,546 payment card hashes
β’ 59,797 customer receipts containing masked card numbers
β’ 8,545 sales transactions with amounts and purchased products
β’ 217 vending machine locations with inventory and planogram data
β’ 66 PokΓ©mon Center vending machines
β’ Customer and administrator PII
β’ Session and activity logs
β’ API credentials and backend reporting access
β’ Firebase databases, storage buckets and related cloud infrastructure
β’ Source code from three production applications
β’ 229 original source files
β’ Product catalogs, pricing, UPCs and SKU information
β
The actor claims the affected platform serves 28 brands, with records referencing PokΓ©mon Company International, CVS Pharmacy, Best Buy, Disney, Google, Dollar Shave Club, Juul, Sennheiser, Vera Bradley, Nespresso and others.
β
A 1,000-record sample was published alongside the post. The actor is asking $3,000 for the full collection and claims some of the affected cloud services remained accessible when the listing was published.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ WARDEN Stealer MaaS advertised with 360+ targets, browser theft, crypto grabbing and loader capabilities
β
A threat actor is advertising WARDEN, a malware-as-a-service platform combining an information stealer, grabber, crypto clipper and loader into a single Windows payload reportedly around 350KB in size.
β
The advertised capabilities include:
β
β’ Chromium and Gecko browser data theft across multiple profiles
β’ Passwords, cookies and active session cookies
β’ Stored payment cards, including cardholder and billing information
β’ Google OAuth tokens collected from Chromium-based browsers
β’ Autofill data, browsing history and search history
β’ More than 200 cryptocurrency wallet extensions
β’ More than 360 targeted applications across 13 categories
β’ Cryptocurrency wallets and related applications
β’ Messaging, email and gaming clients
β’ Password managers and 2FA applications
β’ VPN, FTP, RDP and VNC software
β’ Cloud, trading, notes and other applications
β’ Custom file and Windows Registry collection
β’ System information and desktop screenshots
β’ BTC, ETH, TRX, XMR, SOL and TON clipboard replacement
β’ Additional payload execution through an integrated loader
β
WARDEN also advertises infrastructure and evasion features including encrypted data transfer, segmented log delivery, duplicate filtering, automatic gateway failover, anti-VM checks and a code morphing system designed to alter builds between deployments.
β
The operator claims the platform includes a web panel with live log tracking, filtering, markers for high-value accounts, dashboards, Telegram notifications, configurable builds, statistics sharing and an API for higher-tier customers.
β
Three subscription tiers are advertised:
β
β’ Test: $90 per week
β’ Personal: $349 per month
β’ Premium: $499 per month
β
The Premium tier advertises increased build, gateway and log limits along with API access and priority builds. The seller also states that the malware is not intended to operate in CIS or Baltic countries.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A threat actor is advertising WARDEN, a malware-as-a-service platform combining an information stealer, grabber, crypto clipper and loader into a single Windows payload reportedly around 350KB in size.
β
The advertised capabilities include:
β
β’ Chromium and Gecko browser data theft across multiple profiles
β’ Passwords, cookies and active session cookies
β’ Stored payment cards, including cardholder and billing information
β’ Google OAuth tokens collected from Chromium-based browsers
β’ Autofill data, browsing history and search history
β’ More than 200 cryptocurrency wallet extensions
β’ More than 360 targeted applications across 13 categories
β’ Cryptocurrency wallets and related applications
β’ Messaging, email and gaming clients
β’ Password managers and 2FA applications
β’ VPN, FTP, RDP and VNC software
β’ Cloud, trading, notes and other applications
β’ Custom file and Windows Registry collection
β’ System information and desktop screenshots
β’ BTC, ETH, TRX, XMR, SOL and TON clipboard replacement
β’ Additional payload execution through an integrated loader
β
WARDEN also advertises infrastructure and evasion features including encrypted data transfer, segmented log delivery, duplicate filtering, automatic gateway failover, anti-VM checks and a code morphing system designed to alter builds between deployments.
β
The operator claims the platform includes a web panel with live log tracking, filtering, markers for high-value accounts, dashboards, Telegram notifications, configurable builds, statistics sharing and an API for higher-tier customers.
β
Three subscription tiers are advertised:
β
β’ Test: $90 per week
β’ Personal: $349 per month
β’ Premium: $499 per month
β
The Premium tier advertises increased build, gateway and log limits along with API access and priority builds. The seller also states that the malware is not intended to operate in CIS or Baltic countries.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ Access to unidentified top 10 Asian telecom allegedly offered for sale
β
A forum actor claims to be selling access to a large, publicly traded telecommunications company in Asia with approximately $4 billion in annual revenue.
β
The advertised access allegedly includes:
β
β’ SSH access
β’ Corporate VPN access
β’ Load balancer access
β’ Access to a large internal network
β’ Network mapping information
β
The seller describes the victim as a top 10 telecommunications company in Asia and is asking $500 for the access.
β
The affected company was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling access to a large, publicly traded telecommunications company in Asia with approximately $4 billion in annual revenue.
β
The advertised access allegedly includes:
β
β’ SSH access
β’ Corporate VPN access
β’ Load balancer access
β’ Access to a large internal network
β’ Network mapping information
β
The seller describes the victim as a top 10 telecommunications company in Asia and is asking $500 for the access.
β
The affected company was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ DoorDash and T-Mobile insider access allegedly offered on cybercrime forum
β
A forum actor claims to be offering insider services involving employees at DoorDash and T-Mobile, with the ability to retrieve customer information using an email address or phone number.
β
The advertised DoorDash access allegedly includes:
β
β’ Full names
β’ Email addresses and phone numbers
β’ Recent order history
β’ Home addresses
β’ Last four digits of payment cards when available
β
The advertised T-Mobile access allegedly includes:
β
β’ Email addresses and phone numbers
β’ Subscriber names and addresses
β’ Additional lines on the account
β’ Account numbers
β’ Billing amounts and billing dates
β’ ICCID and IMEI numbers
β’ Social Security numbers
β’ Dates of birth
β’ Recent billing information
β
The seller notes that some T-Mobile accounts with SIM protection or advanced account protections may restrict what information can be viewed.
β
The actor is also openly recruiting additional insiders and people with access to corporate systems, including help desk, Okta, Salesforce and similar environments.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be offering insider services involving employees at DoorDash and T-Mobile, with the ability to retrieve customer information using an email address or phone number.
β
The advertised DoorDash access allegedly includes:
β
β’ Full names
β’ Email addresses and phone numbers
β’ Recent order history
β’ Home addresses
β’ Last four digits of payment cards when available
β
The advertised T-Mobile access allegedly includes:
β
β’ Email addresses and phone numbers
β’ Subscriber names and addresses
β’ Additional lines on the account
β’ Account numbers
β’ Billing amounts and billing dates
β’ ICCID and IMEI numbers
β’ Social Security numbers
β’ Dates of birth
β’ Recent billing information
β
The seller notes that some T-Mobile accounts with SIM protection or advanced account protections may restrict what information can be viewed.
β
The actor is also openly recruiting additional insiders and people with access to corporate systems, including help desk, Okta, Salesforce and similar environments.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π΅πΎ Crypto investor Harry Yeh found dead outside Paraguay high-rise
Harry Chun Tak Yeh, founder of Quantum Fintech Group, was found dead outside the Jade Park residential complex in AsunciΓ³n after investigators believe "he fell" from around the 30th floor.
Police responding around 4:30 a.m. reportedly found his body outside the building.
Investigators later entered the 30th-floor apartment associated with Yeh and found the doors open and the interior heavily disturbed. Evidence was collected from the apartment, another property linked to him on the 27th floor, and the area outside the building.
Authorities have not determined what caused the fall.
Police and prosecutors are investigating multiple possibilities, including an accident, suicide, or involvement by another person.
An autopsy and review of surveillance footage are expected to help establish what happened.
Source: https://www.kucoin.com/news/flash/chinese-crypto-investor-harry-yeh-found-dead-after-falling-from-30th-floor-in-paraguay
Harry Chun Tak Yeh, founder of Quantum Fintech Group, was found dead outside the Jade Park residential complex in AsunciΓ³n after investigators believe "he fell" from around the 30th floor.
Police responding around 4:30 a.m. reportedly found his body outside the building.
Investigators later entered the 30th-floor apartment associated with Yeh and found the doors open and the interior heavily disturbed. Evidence was collected from the apartment, another property linked to him on the 27th floor, and the area outside the building.
Authorities have not determined what caused the fall.
Police and prosecutors are investigating multiple possibilities, including an accident, suicide, or involvement by another person.
An autopsy and review of surveillance footage are expected to help establish what happened.
Source: https://www.kucoin.com/news/flash/chinese-crypto-investor-harry-yeh-found-dead-after-falling-from-30th-floor-in-paraguay
π1
π¨π«π· Duvignau database leaked in second alleged BlgCloud-related breach
β
A forum actor claims to have leaked data belonging to Duvignau, a French agricultural equipment company, as part of an ongoing series of alleged leaks tied to BlgCloud.
β
The published collection is advertised as approximately 30MB across 24 files and allegedly includes:
β
β’ Customer and CRM records
β’ Names and business contact information
β’ Email addresses and phone numbers
β’ Postal and company addresses
β’ Internal CRM identifiers and account metadata
β’ Email communications
β’ Order and customer correspondence
β’ Commercial documents and PDF attachments
β’ BlgCloud-related support and administrative records
β
The actor published email, CRM and document samples alongside the post and stated that additional BlgCloud customer data will continue to be released.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have leaked data belonging to Duvignau, a French agricultural equipment company, as part of an ongoing series of alleged leaks tied to BlgCloud.
β
The published collection is advertised as approximately 30MB across 24 files and allegedly includes:
β
β’ Customer and CRM records
β’ Names and business contact information
β’ Email addresses and phone numbers
β’ Postal and company addresses
β’ Internal CRM identifiers and account metadata
β’ Email communications
β’ Order and customer correspondence
β’ Commercial documents and PDF attachments
β’ BlgCloud-related support and administrative records
β
The actor published email, CRM and document samples alongside the post and stated that additional BlgCloud customer data will continue to be released.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing