βΌοΈ New Dark Web Informer Blog Post!
Title: ToxC2 Sells a Cross Platform Agent That Runs Its Command Channel Over Tox
Link: https://darkwebinformer.com/toxc2-sells-a-cross-platform-agent-that-runs-its-command-channel-over-tox/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: ToxC2 Sells a Cross Platform Agent That Runs Its Command Channel Over Tox
Link: https://darkwebinformer.com/toxc2-sells-a-cross-platform-agent-that-runs-its-command-channel-over-tox/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
ToxC2 Sells a Cross Platform Agent That Runs Its Command Channel Over Tox
A seller posting as Reze is advertising ToxC2, a command and control agent priced at 70 dollars for builds covering Windows, macOS and Linux.
βΌοΈ New Dark Web Informer Blog Post!
Title: A 500 Dollar Phishing Panel Built to Relay Card Details and One Time Codes
Link: https://darkwebinformer.com/a-500-dollar-phishing-panel-built-to-relay-card-details-and-one-time-codes/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: A 500 Dollar Phishing Panel Built to Relay Card Details and One Time Codes
Link: https://darkwebinformer.com/a-500-dollar-phishing-panel-built-to-relay-card-details-and-one-time-codes/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
A 500 Dollar Phishing Panel Built to Relay Card Details and One Time Codes
A seller posting as PAL1T is advertising a live phishing panel at 500 dollars, presented as version 1.0 and aimed at capturing card data together with one time passcodes.
π¨πΊπΈ Dataset from unnamed US cryptocurrency exchange allegedly offered for sale, 817K records claimed
β
An unnamed cryptocurrency exchange in the United States is allegedly affected by a data exposure after a threat actor advertised what they claim is a fresh private dataset containing approximately 817,000 records.
β
The advertised data includes:
β
β’ Full names
β’ Email addresses
β’ Phone numbers
β’ Countries
β’ Physical addresses
β’ Account balance information
β’ Additional account-related data
β
The actor describes the material as a fresh dump dated August 28, 2026 and states that only one copy of the alleged dataset will be sold.
β
The listing is priced at $3,500, with the seller stating that escrow is accepted.
β
The exchange is not identified in the listing, and the claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
An unnamed cryptocurrency exchange in the United States is allegedly affected by a data exposure after a threat actor advertised what they claim is a fresh private dataset containing approximately 817,000 records.
β
The advertised data includes:
β
β’ Full names
β’ Email addresses
β’ Phone numbers
β’ Countries
β’ Physical addresses
β’ Account balance information
β’ Additional account-related data
β
The actor describes the material as a fresh dump dated August 28, 2026 and states that only one copy of the alleged dataset will be sold.
β
The listing is priced at $3,500, with the seller stating that escrow is accepted.
β
The exchange is not identified in the listing, and the claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices
A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.
CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:
β’ Access sensitive configuration data
β’ Modify device settings
β’ Disrupt device availability
Affected firmware: FW-9167-0-11
Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.
CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.
CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:
β’ Access sensitive configuration data
β’ Modify device settings
β’ Disrupt device availability
Affected firmware: FW-9167-0-11
Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.
CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
This media is not supported in your browser
VIEW IN TELEGRAM
βΌοΈ Unconfirmed reports that there is a new X account takeover exploit being used.
π8π3π1
Someone asked why I'm sharing 480p video. Bro, tell them to stop recording at 480p... there is nothing I can do there. π
π3
βΌοΈπΊπΈ McKesson Corporation has filed form 8-K due to a cybersecurity incident.
On August 25, 2026, McKesson Corporation discovered a cybersecurity incident affecting its information systems. An investigation of the incident is in its early stages. Information about the incident, including any updates, is available on the companyβs website at www.mckesson.com/cybersecurity.
As of the date of this filing, the company has not determined that the incident is material or that the incident has had, or is reasonably likely to have, any material impact on the company, including its financial condition or results of operations.
PDF: https://d18rn0p25nwr6d.cloudfront.net/CIK-0000927653/5d76bf4d-9af6-40d2-89cc-6648aa9cbb59.pdf
On August 25, 2026, McKesson Corporation discovered a cybersecurity incident affecting its information systems. An investigation of the incident is in its early stages. Information about the incident, including any updates, is available on the companyβs website at www.mckesson.com/cybersecurity.
As of the date of this filing, the company has not determined that the incident is material or that the incident has had, or is reasonably likely to have, any material impact on the company, including its financial condition or results of operations.
PDF: https://d18rn0p25nwr6d.cloudfront.net/CIK-0000927653/5d76bf4d-9af6-40d2-89cc-6648aa9cbb59.pdf
βΌοΈπ¨ Rhysida Ransomware claims a nonprofitt Federally Qualified Health Center for 37 BTC
πΊπΈ Valley Health Team - A California-based nonprofit Federally Qualified Health Center providing medical, dental, behavioral health, and other primary care services across the Central Valley.
The listing claims 3.28 TB across 9,056,196 files, including SQL databases containing information on 160,870 patients, 4.18 million diagnoses, 7.6 million unencrypted EHR scans, Social Security numbers, passports, other personal data, financial statements, salaries, and tax records.
The data is being offered for 37 BTC.
πΊπΈ Valley Health Team - A California-based nonprofit Federally Qualified Health Center providing medical, dental, behavioral health, and other primary care services across the Central Valley.
The listing claims 3.28 TB across 9,056,196 files, including SQL databases containing information on 160,870 patients, 4.18 million diagnoses, 7.6 million unencrypted EHR scans, Social Security numbers, passports, other personal data, financial statements, salaries, and tax records.
The data is being offered for 37 BTC.
Activision is wild, never fuck with game companies bro.
Activision sent representatives to Ohio on August 22 to personally serve a cheat dev with a cease-and-desist notice.
https://x.com/DarkWebInformer/status/2093474641788522889
Activision sent representatives to Ohio on August 22 to personally serve a cheat dev with a cease-and-desist notice.
https://x.com/DarkWebInformer/status/2093474641788522889
X (formerly Twitter)
Dark Web Informer (@DarkWebInformer) on X
Activision is wild, never fuck with game companies bro.
Activision sent representatives to Ohio on August 22 to personally serve a cheat provider with a cease-and-desist notice.
Activision sent representatives to Ohio on August 22 to personally serve a cheat provider with a cease-and-desist notice.
π₯1
πͺ That Dark Web Guy - Part 3 πͺ
Activision is wild, never fuck with game companies bro. Activision sent representatives to Ohio on August 22 to personally serve a cheat dev with a cease-and-desist notice. https://x.com/DarkWebInformer/status/2093474641788522889
Looks like they removed Call of Duty from their supported games list...
πͺ That Dark Web Guy - Part 3 πͺ
βΌοΈπΊπΈ ShinyHunters claims a U.S.-based financial technology. πΊπΈ Jack Henry & Associates - A U.S.-based financial technology company providing core banking, payment processing, digital banking, and other technology services to banks and credit unions.
βΌοΈπΊπΈπΈπͺ ShinyHunters claims McKesson and Elekta AB.
πΊπΈ McKesson Corporation - A U.S.-based healthcare company providing pharmaceutical distribution, medical supplies, healthcare technology, and related services. The listing claims hundreds of millions of records/rows were compromised, containing sensitive information ranging from PII to PHI.
πΈπͺ Elekta AB - A Swedish medical technology company specializing in radiation therapy, radiosurgery, and oncology software used in cancer treatment. The listing includes a September 1, 2026 deadline, but does not specify the claimed data volume or types of information compromised.
πΊπΈ McKesson Corporation - A U.S.-based healthcare company providing pharmaceutical distribution, medical supplies, healthcare technology, and related services. The listing claims hundreds of millions of records/rows were compromised, containing sensitive information ranging from PII to PHI.
πΈπͺ Elekta AB - A Swedish medical technology company specializing in radiation therapy, radiosurgery, and oncology software used in cancer treatment. The listing includes a September 1, 2026 deadline, but does not specify the claimed data volume or types of information compromised.
β€2π₯1π1
π¨π«π· ZΓ©ro Logement Vacant government dataset allegedly breached, 148M+ raw records claimed
β
ZΓ©ro Logement Vacant (ZLV), a French government initiative connected to housing and property data, is allegedly affected by a major data exposure after a threat actor claimed to have compromised administrative infrastructure and extracted information linked to DGFiP/DataFoncier datasets.
β
The actor claims the extraction contains 148,929,194 raw records, representing tens of millions of individuals after deduplication.
β
The advertised data includes:
β
β’ 82,043,407 property-owner records
β’ 66,874,995 national DGFiP/DataFoncier records
β’ Names
β’ Dates of birth
β’ Physical addresses
β’ Fiscal identifiers
β’ 47,948,974 unique individuals by person ID
β’ 71,065,268 unique individuals when matched by full name and date of birth
β’ 3,538 ZLV user accounts
β’ 3,448 bcrypt password hashes
β’ 1,636 active session tokens
β’ 3,204 OAuth account records
β’ Email addresses and phone numbers
β’ Government and local-authority account information
β’ JWT and API-related metadata
β’ Internal database connection information
β
The threat actor claims access was obtained through an administrative Metabase environment connected to production infrastructure, providing visibility into ZLV application data and large national property-owner datasets.
β
The listing includes a sample archive containing property-owner records and smaller samples of account, email, phone, session and authentication-related information. The complete alleged dataset is being offered privately, with the price listed as "Offer."
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
β
ZΓ©ro Logement Vacant (ZLV), a French government initiative connected to housing and property data, is allegedly affected by a major data exposure after a threat actor claimed to have compromised administrative infrastructure and extracted information linked to DGFiP/DataFoncier datasets.
β
The actor claims the extraction contains 148,929,194 raw records, representing tens of millions of individuals after deduplication.
β
The advertised data includes:
β
β’ 82,043,407 property-owner records
β’ 66,874,995 national DGFiP/DataFoncier records
β’ Names
β’ Dates of birth
β’ Physical addresses
β’ Fiscal identifiers
β’ 47,948,974 unique individuals by person ID
β’ 71,065,268 unique individuals when matched by full name and date of birth
β’ 3,538 ZLV user accounts
β’ 3,448 bcrypt password hashes
β’ 1,636 active session tokens
β’ 3,204 OAuth account records
β’ Email addresses and phone numbers
β’ Government and local-authority account information
β’ JWT and API-related metadata
β’ Internal database connection information
β
The threat actor claims access was obtained through an administrative Metabase environment connected to production infrastructure, providing visibility into ZLV application data and large national property-owner datasets.
β
The listing includes a sample archive containing property-owner records and smaller samples of account, email, phone, session and authentication-related information. The complete alleged dataset is being offered privately, with the price listed as "Offer."
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
π₯1
πͺ½ GitHub Tool: LastSignal
LastSignal is an open-source, self-hosted dead man's switch designed to automatically deliver encrypted messages to selected recipients if you become unresponsive.
The system sends periodic email check-ins. If repeated check-ins are missed, it progresses through reminders, can notify a trusted contact, and eventually releases the configured messages.
The repo currently has 716 GitHub stars.
Key features include:
β’ End-to-end encrypted messages
β’ Zero-knowledge architecture
β’ Self-hosted deployment
β’ Configurable check-in intervals
β’ Multiple reminder attempts
β’ Trusted contact verification
β’ Recipient-specific delivery delays
β’ Optional machine-to-machine keep-alive webhook
β’ Argon2id + XChaCha20-Poly1305 + X25519 cryptography
β’ Docker and Kamal deployment support
π GitHub: https://github.com/giovantenne/lastsignal
LastSignal is an open-source, self-hosted dead man's switch designed to automatically deliver encrypted messages to selected recipients if you become unresponsive.
The system sends periodic email check-ins. If repeated check-ins are missed, it progresses through reminders, can notify a trusted contact, and eventually releases the configured messages.
The repo currently has 716 GitHub stars.
Key features include:
β’ End-to-end encrypted messages
β’ Zero-knowledge architecture
β’ Self-hosted deployment
β’ Configurable check-in intervals
β’ Multiple reminder attempts
β’ Trusted contact verification
β’ Recipient-specific delivery delays
β’ Optional machine-to-machine keep-alive webhook
β’ Argon2id + XChaCha20-Poly1305 + X25519 cryptography
β’ Docker and Kamal deployment support
π GitHub: https://github.com/giovantenne/lastsignal
β€3
πͺ That Dark Web Guy - Part 3 πͺ
πͺ½ GitHub Tool: LastSignal LastSignal is an open-source, self-hosted dead man's switch designed to automatically deliver encrypted messages to selected recipients if you become unresponsive. The system sends periodic email check-ins. If repeated check-insβ¦
Credit (X): @giovantenne
β€1