π¨ ImbrellaPacker multi-stage payload packer advertised on a cybercrime forum with EDR evasion claims
β
A forum seller is advertising ImbrellaPacker, a multi-stage packing service designed to modify Cobalt Strike beacon payloads and improve their ability to evade modern endpoint detection and response products.
β
The advertised features include:
β
β’ One-click upload, processing and download workflow
β’ Preconfigured Cobalt Strike profiles
β’ Separate configurations for different EDR products
β’ Quick and advanced build modes
β’ Polymorphic builds intended to reduce signature-based detection
β’ More than 10 advertised execution methods
β’ Multiple allocation methods
β’ Anti-sandbox functionality
β’ Anti-debug functionality
β’ Domain-check options
β’ Multiple delivery and export configurations
β’ Private web-based dashboard and builder
β
The service claims to have been tested against CrowdStrike, SentinelOne, Cortex, Sophos and Microsoft Defender for Endpoint.
β
Pricing is advertised at $2,000 per month for up to 10 builds per day or $7,000 for permanent access with unlimited builds. Free demonstrations are reportedly available to established forum users and prospective buyers.
β
The seller's claims and the effectiveness of the advertised EDR evasion capabilities have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller is advertising ImbrellaPacker, a multi-stage packing service designed to modify Cobalt Strike beacon payloads and improve their ability to evade modern endpoint detection and response products.
β
The advertised features include:
β
β’ One-click upload, processing and download workflow
β’ Preconfigured Cobalt Strike profiles
β’ Separate configurations for different EDR products
β’ Quick and advanced build modes
β’ Polymorphic builds intended to reduce signature-based detection
β’ More than 10 advertised execution methods
β’ Multiple allocation methods
β’ Anti-sandbox functionality
β’ Anti-debug functionality
β’ Domain-check options
β’ Multiple delivery and export configurations
β’ Private web-based dashboard and builder
β
The service claims to have been tested against CrowdStrike, SentinelOne, Cortex, Sophos and Microsoft Defender for Endpoint.
β
Pricing is advertised at $2,000 per month for up to 10 builds per day or $7,000 for permanent access with unlimited builds. Free demonstrations are reportedly available to established forum users and prospective buyers.
β
The seller's claims and the effectiveness of the advertised EDR evasion capabilities have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ Trezor phishing injection tool advertised on a cybercrime forum for $3,000
β
A forum seller is advertising AntiTrezor, a phishing injection tool designed to impersonate the Trezor Suite interface and capture cryptocurrency wallet recovery seed phrases.
β
The advertised features include:
β
β’ Injection directly into the Trezor Suite interface
β’ Phishing flow styled to resemble the legitimate application
β’ Seed phrase capture
β’ Persistence across system reboots
β’ Windows 10 and 11 support
β’ Support for multiple Trezor device models
β’ Fake error and troubleshooting prompts intended to pressure victims
β’ Ability to display captured wallet balances in an operator panel
β’ Administrative notifications when a victim interacts with the phishing flow
β
The listing claims the tool can prevent victims from moving funds after submitting their recovery phrase and is designed to operate without modifying official Trezor executables.
β
The source code is being advertised for $3,000.
β
The seller's claims and the capabilities of the tool have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller is advertising AntiTrezor, a phishing injection tool designed to impersonate the Trezor Suite interface and capture cryptocurrency wallet recovery seed phrases.
β
The advertised features include:
β
β’ Injection directly into the Trezor Suite interface
β’ Phishing flow styled to resemble the legitimate application
β’ Seed phrase capture
β’ Persistence across system reboots
β’ Windows 10 and 11 support
β’ Support for multiple Trezor device models
β’ Fake error and troubleshooting prompts intended to pressure victims
β’ Ability to display captured wallet balances in an operator panel
β’ Administrative notifications when a victim interacts with the phishing flow
β
The listing claims the tool can prevent victims from moving funds after submitting their recovery phrase and is designed to operate without modifying official Trezor executables.
β
The source code is being advertised for $3,000.
β
The seller's claims and the capabilities of the tool have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· iMapper allegedly breached through critical Metabase vulnerability, account data and database access leaked on a cybercrime forum
β
A forum actor claims to have compromised iMapper, a French web-connected 2D laser measurement platform for building professionals, using a vulnerability identified in the listing as CVE-2026-72898 with a claimed CVSS score of 10.0.
β
The exposed account dataset reportedly contains 2,463 records and includes:
β
β’ User IDs and usernames
β’ Password hashes
β’ Account roles
β’ Email addresses
β’ Phone numbers
β’ Professions
β’ MFA status and related metadata
β’ Language preferences
β’ Stripe customer IDs
β’ Stripe tax-related identifiers
β’ Measurement and display configuration fields
β
The data is being distributed in XLSX format. The listing also claims the compromised environment contains additional database tables and offers credentials that could provide access to those systems.
β
The claims, exploitation method and authenticity, availability and scope of the allegedly exposed data and database access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have compromised iMapper, a French web-connected 2D laser measurement platform for building professionals, using a vulnerability identified in the listing as CVE-2026-72898 with a claimed CVSS score of 10.0.
β
The exposed account dataset reportedly contains 2,463 records and includes:
β
β’ User IDs and usernames
β’ Password hashes
β’ Account roles
β’ Email addresses
β’ Phone numbers
β’ Professions
β’ MFA status and related metadata
β’ Language preferences
β’ Stripe customer IDs
β’ Stripe tax-related identifiers
β’ Measurement and display configuration fields
β
The data is being distributed in XLSX format. The listing also claims the compromised environment contains additional database tables and offers credentials that could provide access to those systems.
β
The claims, exploitation method and authenticity, availability and scope of the allegedly exposed data and database access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈπΊπΈπ¨π ShinyHunters names two new victims
πΊπΈ BOK Financial - A U.S.-based regional financial services company headquartered in Tulsa, Oklahoma, providing commercial banking, consumer banking, wealth management, lending, and treasury services.
π¨π Novocure Limited - A global oncology company headquartered in Baar, Switzerland, developing and commercializing Tumor Treating Fields therapies for aggressive forms of cancer.
πΊπΈ BOK Financial - A U.S.-based regional financial services company headquartered in Tulsa, Oklahoma, providing commercial banking, consumer banking, wealth management, lending, and treasury services.
π¨π Novocure Limited - A global oncology company headquartered in Baar, Switzerland, developing and commercializing Tumor Treating Fields therapies for aggressive forms of cancer.
π2
βΌοΈπ¦πͺ A threat actor is offering admin-level Fortinet SSL-VPN access into an undisclosed UAE-based hotel reservations company with reported revenue of $17 million and 1,450 network hosts, priced at $700.
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ CVE-2026-39113: Heap Buffer Overflow in SQLite's Optional SQLAR Extension
GitHub: https://github.com/20000419/CVE-2026-39113
GitHub: https://github.com/20000419/CVE-2026-39113
β€4
Media is too big
VIEW IN TELEGRAM
The Informant's Gambit - A Darknet Mystery
The year 2013 marked a turning point in the evolution of cybercrime. The growing adoption of Bitcoin and Tor helped usher in a new era of online anonymity, underground commerce, and digital crime, culminating in one of the most widely publicized federal cases of the modern internet era.
The Silk Road case is one that many people have heard of, but far fewer understand in its entirety. Beyond the headlines, the arrest of Ross Ulbricht, and the eventual collapse of the marketplace lies a far more complicated story involving informants, undercover operations, corrupt federal agents, and figures whose roles remain largely overlooked.
This video examines the largely forgotten relationship between Ross Ulbricht and a mysterious figure known as "NotWonderful," also known as "Alpacino." The individual appeared to operate as an informant from within the darknet marketplace, yet references to the figure seemingly vanished from the government's official record as the Silk Road investigation progressed.
Who was NotWonderful, what role did they actually play in the investigation, and why did their presence seemingly disappear from the record?
Video Credit: youtube.com/@BarelySociable
The year 2013 marked a turning point in the evolution of cybercrime. The growing adoption of Bitcoin and Tor helped usher in a new era of online anonymity, underground commerce, and digital crime, culminating in one of the most widely publicized federal cases of the modern internet era.
The Silk Road case is one that many people have heard of, but far fewer understand in its entirety. Beyond the headlines, the arrest of Ross Ulbricht, and the eventual collapse of the marketplace lies a far more complicated story involving informants, undercover operations, corrupt federal agents, and figures whose roles remain largely overlooked.
This video examines the largely forgotten relationship between Ross Ulbricht and a mysterious figure known as "NotWonderful," also known as "Alpacino." The individual appeared to operate as an informant from within the darknet marketplace, yet references to the figure seemingly vanished from the government's official record as the Silk Road investigation progressed.
Who was NotWonderful, what role did they actually play in the investigation, and why did their presence seemingly disappear from the record?
Video Credit: youtube.com/@BarelySociable
How come TAs don't buy like 120 inch tvs that are $125000 and flex it? Like, I get it, you like watches but come on.
π1
π¨π―π΅ Nintendo targets more than 400 Switch emulator repositories in massive GitHub sweep
Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.
The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.
Other targets included:
β’ 29 Skyline repositories
β’ Multiple Yuzu forks and Android ports
β’ 17 MonoNX forks
β’ Yuzu Early Access mirrors
Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.
Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.
Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/
Nintendo filed seven DMCA anti-circumvention notices in a single day targeting Switch emulator projects and their forks.
The largest action hit Suyu, a Yuzu successor, with GitHub processing the notice against an entire network of 311 repositories.
Other targets included:
β’ 29 Skyline repositories
β’ Multiple Yuzu forks and Android ports
β’ 17 MonoNX forks
β’ Yuzu Early Access mirrors
Nintendo argues the emulators circumvent its technological protection measures by using unauthorized cryptographic keys to decrypt Switch games.
Most of the targeted repositories are now offline. Some of the code had already survived previous shutdowns through forks, mirrors, and revived projects, meaning keeping it offline may prove harder than removing it.
Source: https://torrentfreak.com/nintendo-wipes-out-400-switch-emulator-repos-in-single-day-github-sweep/
π3β€1
πͺ Slice For Life - Part 2 πͺ pinned Β«βοΈ I will randomly purge this channel. Over 27 forums monitored on the platform and still growing. X/Twitter: https://x.com/DarkWebInformer Main Channel: https://t.me/SliceForLifeee Backup Channel: https://t.me/SliceForLifeeee Telegram CVE Feed: https://β¦Β»