🚨🇧🇷 Central dos Benefícios dataset allegedly offered for sale, 2.7M+ people claimed
⠀
Central dos Benefícios, a Brazilian corporate benefits platform providing employee benefit services, is named in a cybercrime forum post where a threat actor claims to be selling a 1 GB dataset containing millions of records.
⠀
Claimed exposure
⠀
• 2,734,282 people records
• 2,086,659 payment card records
• 784,045 application users
• 32,322 security group records
• 11,059 security users
• 1,119 operator records
• Names and email addresses
• CPF/CNPJ identifiers
• Payment card numbers, expiration dates and CVV data
• Account and credential-related information
⠀
The actor claims the dataset contains approximately 3.5 million lines and is provided in JSON format.
⠀
A sample of the allegedly exposed records was published in the forum post. The dataset is advertised for $5,000, with XMR or BTC accepted.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
⠀
Central dos Benefícios, a Brazilian corporate benefits platform providing employee benefit services, is named in a cybercrime forum post where a threat actor claims to be selling a 1 GB dataset containing millions of records.
⠀
Claimed exposure
⠀
• 2,734,282 people records
• 2,086,659 payment card records
• 784,045 application users
• 32,322 security group records
• 11,059 security users
• 1,119 operator records
• Names and email addresses
• CPF/CNPJ identifiers
• Payment card numbers, expiration dates and CVV data
• Account and credential-related information
⠀
The actor claims the dataset contains approximately 3.5 million lines and is provided in JSON format.
⠀
A sample of the allegedly exposed records was published in the forum post. The dataset is advertised for $5,000, with XMR or BTC accepted.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
❤1
🚨🇨🇴 Unidad Central del Valle del Cauca allegedly breached, 4.1K+ individuals affected
⠀
Unidad Central del Valle del Cauca (UCEVA), a public higher education institution in Colombia, is named in a cybercrime forum post where a threat actor claims to have obtained student PII, staff account information, internal documents and data from exposed university systems.
⠀
Claimed exposure
⠀
• 4,090 student records
• Institutional email addresses
• Colombian CC/TI identification numbers
• Dates of birth, including records tied to minors
• 20 WordPress administrative and staff accounts
• 2,910 internal documents
• Contracts, payroll records and academic documents
• 36+ election and voter-related documents
• WordPress, OJS and Koha system information
• Three allegedly exposed vulnerabilities
⠀
The actor claims the exposed records affect more than 4,100 individuals, including students, faculty, administrative staff and contractors.
⠀
The data is advertised in CSV, JSON, HTML and XML formats, with samples and a download link published in the forum post.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
⠀
Unidad Central del Valle del Cauca (UCEVA), a public higher education institution in Colombia, is named in a cybercrime forum post where a threat actor claims to have obtained student PII, staff account information, internal documents and data from exposed university systems.
⠀
Claimed exposure
⠀
• 4,090 student records
• Institutional email addresses
• Colombian CC/TI identification numbers
• Dates of birth, including records tied to minors
• 20 WordPress administrative and staff accounts
• 2,910 internal documents
• Contracts, payroll records and academic documents
• 36+ election and voter-related documents
• WordPress, OJS and Koha system information
• Three allegedly exposed vulnerabilities
⠀
The actor claims the exposed records affect more than 4,100 individuals, including students, faculty, administrative staff and contractors.
⠀
The data is advertised in CSV, JSON, HTML and XML formats, with samples and a download link published in the forum post.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
🚨🇺🇸 Miami-Dade County government data allegedly breached, 1.9M records offered for sale
⠀
Miami-Dade County, Florida’s most populous county, is named in a cybercrime forum post where a threat actor claims to have compromised an official government endpoint and extracted approximately 1.9 million records spanning property, utility, business and permitting systems.
⠀
Claimed exposure
⠀
• 943,533 property assessor records
• 500,034 water and sewer customer records
• 262,243 building permit records
• 193,852 business tax records
• 670,105 person-to-property ownership records
• 1.18M+ recorded property sale records
• 79,786 properties valued above $1 million
• 165,860 business contact records
• Names, addresses, phone numbers and email addresses
• Property values, ownership and sale history
• Utility account and meter information
• Contractor names and license numbers
• Business ownership and occupation data
• 83 dangerous-dog records containing owner and animal information
⠀
The actor claims the data was obtained on September 7, 2026 and consists of five primary datasets plus four additional tables.
⠀
The listing is advertised as an exclusive sale for $250 in XMR, with the seller claiming they will delete their copies after the buyer confirms receipt.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
⠀
Miami-Dade County, Florida’s most populous county, is named in a cybercrime forum post where a threat actor claims to have compromised an official government endpoint and extracted approximately 1.9 million records spanning property, utility, business and permitting systems.
⠀
Claimed exposure
⠀
• 943,533 property assessor records
• 500,034 water and sewer customer records
• 262,243 building permit records
• 193,852 business tax records
• 670,105 person-to-property ownership records
• 1.18M+ recorded property sale records
• 79,786 properties valued above $1 million
• 165,860 business contact records
• Names, addresses, phone numbers and email addresses
• Property values, ownership and sale history
• Utility account and meter information
• Contractor names and license numbers
• Business ownership and occupation data
• 83 dangerous-dog records containing owner and animal information
⠀
The actor claims the data was obtained on September 7, 2026 and consists of five primary datasets plus four additional tables.
⠀
The listing is advertised as an exclusive sale for $250 in XMR, with the seller claiming they will delete their copies after the buyer confirms receipt.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
🚨 🇺🇸 Initial Access: US Health Sector
A threat actor is advertising access to an unnamed U.S. healthcare organization reportedly generating $4.8B in revenue.
The advertised access includes Epic Hyperdrive, Epic Hyperspace, MultiPatient View CRM, RDP Domain Admin, and backdoor access to a computer.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
A threat actor is advertising access to an unnamed U.S. healthcare organization reportedly generating $4.8B in revenue.
The advertised access includes Epic Hyperdrive, Epic Hyperspace, MultiPatient View CRM, RDP Domain Admin, and backdoor access to a computer.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
🚨🇹🇷 Alfred dataset allegedly offered for sale, hundreds of thousands of customer records claimed
⠀
Alfred, a Turkish services company, is named in a cybercrime forum post where a threat actor claims to be selling a dataset containing customer, employee and sales information spanning 2012 to 2026.
⠀
Claimed exposure
⠀
• 292,000 customer records
• 199,000 additional client records
• 71,000 service-user records
• 1,000 employee records
• Full names and email addresses
• Phone numbers
• Gender and registration dates
• Vehicle license plates and car brands
• Driver information
• Promotion codes and pricing data
• Employee names and specialties
• Sales documents from 2012–2026
⠀
The actor published multiple samples of the allegedly exposed data and says the sale price is negotiable.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
Alfred, a Turkish services company, is named in a cybercrime forum post where a threat actor claims to be selling a dataset containing customer, employee and sales information spanning 2012 to 2026.
⠀
Claimed exposure
⠀
• 292,000 customer records
• 199,000 additional client records
• 71,000 service-user records
• 1,000 employee records
• Full names and email addresses
• Phone numbers
• Gender and registration dates
• Vehicle license plates and car brands
• Driver information
• Promotion codes and pricing data
• Employee names and specialties
• Sales documents from 2012–2026
⠀
The actor published multiple samples of the allegedly exposed data and says the sale price is negotiable.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 🇮🇩 Initial Access: Indonesian Insurance Company
A threat actor is advertising access to an unnamed Indonesian insurance company reportedly generating $100M–$250M in revenue, with a network of approximately 1,000 hosts.
The advertised access includes WireGuard VPN access with SYSTEM privileges. Bitdefender GravityZone is reportedly deployed in the environment.
The listing is priced at 0.00930216 BTC or $732.75 USD.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
A threat actor is advertising access to an unnamed Indonesian insurance company reportedly generating $100M–$250M in revenue, with a network of approximately 1,000 hosts.
The advertised access includes WireGuard VPN access with SYSTEM privileges. Bitdefender GravityZone is reportedly deployed in the environment.
The listing is priced at 0.00930216 BTC or $732.75 USD.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
‼️ New Dark Web Informer Blog Post!
Title: 11.8 Million Transfast Payment SMS Records Offered With Portal Access
Link: https://darkwebinformer.com/11-8-million-transfast-payment-sms-records-offered-with-portal-access/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: 11.8 Million Transfast Payment SMS Records Offered With Portal Access
Link: https://darkwebinformer.com/11-8-million-transfast-payment-sms-records-offered-with-portal-access/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
11.8 Million Transfast Payment SMS Records Offered With Portal Access
A forum actor posting as Marx is advertising access to what they describe as a live database of messaging records belonging to Transfast, a cross border payment network acquired by Mastercard in 2019 and now operating as part of its transaction services business.
If losing it would devastate you... BACK IT UP.
Photos. Videos. Documents. Work.
If you only have one copy, you don't have a backup.
Photos. Videos. Documents. Work.
If you only have one copy, you don't have a backup.
❤4
Media is too big
VIEW IN TELEGRAM
Another good banger.
311 - Come Original
Song Released: October 12, 1999
311 - Come Original
Song Released: October 12, 1999
🔥2
🚨 Kleptomania Stealer advertised on a cybercrime forum, extensive browser and cryptocurrency theft capabilities claimed
⠀
Kleptomania Stealer, a newly advertised Windows information-stealing malware, is being promoted on a cybercrime forum with claims that it can harvest credentials, browser data, cryptocurrency wallets and active application sessions from infected systems.
⠀
Advertised capabilities
⠀
• Password, cookie and browser history theft
• Saved payment card and CVV/CVV2 data
• Google OAuth token theft
• Autofill and form data collection
• Screenshot capture
• Telegram and Discord session theft
• 70+ Chromium-based browsers
• 35+ Gecko-based browsers
• 125+ cryptocurrency browser extensions
• 65+ desktop cryptocurrency wallets
• 20+ gaming clients
• 15+ messaging applications
• 15+ VPN clients
• 20+ FTP clients
• Smart file grabbing and sorting
• Anti-VM and obfuscation features
⠀
The seller specifically advertises support for software including Chrome, Edge, Brave, Firefox, MetaMask, Phantom, Trust Wallet, Exodus, Electrum, Steam, Telegram, Discord, Mullvad, NordVPN, FileZilla and WinSCP.
⠀
Additional modules advertised include a seed phrase scanner, cryptocurrency wallet targeting, and planned loader, clipper, HVNC and macOS components.
⠀
Kleptomania is advertised at $150 for one month, $400 for three months, or $1,500 for 12 months. The seller also claims a roughly 700 KB build size and promotes a claimed 98% reporting rate.
⠀
The malware’s capabilities, effectiveness and compatibility claims have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
Kleptomania Stealer, a newly advertised Windows information-stealing malware, is being promoted on a cybercrime forum with claims that it can harvest credentials, browser data, cryptocurrency wallets and active application sessions from infected systems.
⠀
Advertised capabilities
⠀
• Password, cookie and browser history theft
• Saved payment card and CVV/CVV2 data
• Google OAuth token theft
• Autofill and form data collection
• Screenshot capture
• Telegram and Discord session theft
• 70+ Chromium-based browsers
• 35+ Gecko-based browsers
• 125+ cryptocurrency browser extensions
• 65+ desktop cryptocurrency wallets
• 20+ gaming clients
• 15+ messaging applications
• 15+ VPN clients
• 20+ FTP clients
• Smart file grabbing and sorting
• Anti-VM and obfuscation features
⠀
The seller specifically advertises support for software including Chrome, Edge, Brave, Firefox, MetaMask, Phantom, Trust Wallet, Exodus, Electrum, Steam, Telegram, Discord, Mullvad, NordVPN, FileZilla and WinSCP.
⠀
Additional modules advertised include a seed phrase scanner, cryptocurrency wallet targeting, and planned loader, clipper, HVNC and macOS components.
⠀
Kleptomania is advertised at $150 for one month, $400 for three months, or $1,500 for 12 months. The seller also claims a roughly 700 KB build size and promotes a claimed 98% reporting rate.
⠀
The malware’s capabilities, effectiveness and compatibility claims have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇸🇬 Malone Lam pleads guilty over $245M Bitcoin social engineering heist
The 22-year-old Singaporean admitted his role in the operation that stole more than 4,100 BTC from a single Washington, D.C. victim in August 2024.
Members of the group impersonated Google and Gemini representatives and convinced the victim to provide access to his Google Drive and security codes, allowing Lam to drain the wallets.
The stolen Bitcoin was worth more than $245M at the time.
Lam and his associates then laundered the crypto and went on a massive spending spree involving private jets, mansions, luxury watches, and exotic cars.
Lam alone reportedly:
• Spent $569K in one night at an LA nightclub
• Bought a $2M watch
• Acquired more than 30 cars, including Porsches, Lamborghinis, and Ferraris
The broader enterprise is accused of stealing more than $263M in cryptocurrency through social engineering, hacking, money laundering, and even home break-ins targeting hardware wallets.
18 people have been charged. Lam is the 11th to plead guilty.
He faces up to 20 years in federal prison. A sentencing date has not yet been set.
Source: https://abcnews.com/Business/wireStory/singapore-man-pleads-guilty-orchestrating-240-million-bitcoin-136279302
The 22-year-old Singaporean admitted his role in the operation that stole more than 4,100 BTC from a single Washington, D.C. victim in August 2024.
Members of the group impersonated Google and Gemini representatives and convinced the victim to provide access to his Google Drive and security codes, allowing Lam to drain the wallets.
The stolen Bitcoin was worth more than $245M at the time.
Lam and his associates then laundered the crypto and went on a massive spending spree involving private jets, mansions, luxury watches, and exotic cars.
Lam alone reportedly:
• Spent $569K in one night at an LA nightclub
• Bought a $2M watch
• Acquired more than 30 cars, including Porsches, Lamborghinis, and Ferraris
The broader enterprise is accused of stealing more than $263M in cryptocurrency through social engineering, hacking, money laundering, and even home break-ins targeting hardware wallets.
18 people have been charged. Lam is the 11th to plead guilty.
He faces up to 20 years in federal prison. A sentencing date has not yet been set.
Source: https://abcnews.com/Business/wireStory/singapore-man-pleads-guilty-orchestrating-240-million-bitcoin-136279302
❤1
🔪 That Dark Web Guy - Part 3 🔪
⚠️ Avoid using DarkMatter Market. The admin has not provided any new information in the past 24 hours. The market may be in the process of conducting an exit scam. Dread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/76b7ab226321fdbcab2e
All DarkMatter onions are being monitored by the FBI Watchdog script. https://t.me/FBI_Watchdog
Telegram
FBI Watchdog Alerts by Dark Web Informer
Website: darkwebinformer.com
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API: https://darkwebinformer.com/api-details
Main: https://t.me/SliceForLifeee
Website Pricing (Includes Crypto): darkwebinformer.com/pricing
Socials: darkwebinformer.com/socials
API: https://darkwebinformer.com/api-details
Main: https://t.me/SliceForLifeee
🚨🇧🇷 Cia de Trade allegedly breached, 965 staff credentials and Philip Morris campaign data claimed
⠀
Cia de Trade, a Brazilian trade marketing agency and web host involved in Philip Morris International brand campaigns, is named in a cybercrime forum post where a threat actor claims to have compromised internal systems and obtained staff, campaign and HR data.
⠀
Claimed exposure
⠀
• 965 staff login accounts with MD5-salted password hashes
• 379 accounts using @pmi.com email addresses
• 27 accounts using @contracted.pmi.com addresses
• 87,762 access-log records containing IPs, page URIs and timestamps
• 12,293 session records
• 8,093 distinct campaign session tokens
• 956 client records and 156 client logins
• Multiple MySQL database dumps
• 215 MB Outlook PST archive
• Brazilian employee paystubs containing HR PII
• 46 keys identifying client brands
⠀
The actor claims the compromised infrastructure supported Philip Morris campaigns and the Dapal loyalty platform, alongside work involving other major brands and organizations.
⠀
The post also claims credentials associated with Dapal and several other corporate domains were present in the exposed account data.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
⠀
Cia de Trade, a Brazilian trade marketing agency and web host involved in Philip Morris International brand campaigns, is named in a cybercrime forum post where a threat actor claims to have compromised internal systems and obtained staff, campaign and HR data.
⠀
Claimed exposure
⠀
• 965 staff login accounts with MD5-salted password hashes
• 379 accounts using @pmi.com email addresses
• 27 accounts using @contracted.pmi.com addresses
• 87,762 access-log records containing IPs, page URIs and timestamps
• 12,293 session records
• 8,093 distinct campaign session tokens
• 956 client records and 156 client logins
• Multiple MySQL database dumps
• 215 MB Outlook PST archive
• Brazilian employee paystubs containing HR PII
• 46 keys identifying client brands
⠀
The actor claims the compromised infrastructure supported Philip Morris campaigns and the Dapal loyalty platform, alongside work involving other major brands and organizations.
⠀
The post also claims credentials associated with Dapal and several other corporate domains were present in the exposed account data.
⠀
The breach claim, exposed data and scope have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API: https://darkwebinformer.com/api-details
Donations: https://darkwebinformer.com/donations
Socials: https://darkwebinformer.com/socials
🚨 GirlsChase.TV dataset allegedly offered on a cybercrime forum
⠀
GirlsChase.TV is a platform focused on dating, social skills, and relationship advice.
⠀
A threat actor using the handle zooz claims to possess the platform’s full dataset and published a sample containing customer, subscription, and payment-related records.
⠀
Sample data includes:
⠀
• Customer email addresses
• Stripe and PayPal references
• Customer and subscription IDs
• Payment amounts and currencies
• Transaction timestamps
• Subscription and payment status information
⠀
The claim and full scope of the exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
GirlsChase.TV is a platform focused on dating, social skills, and relationship advice.
⠀
A threat actor using the handle zooz claims to possess the platform’s full dataset and published a sample containing customer, subscription, and payment-related records.
⠀
Sample data includes:
⠀
• Customer email addresses
• Stripe and PayPal references
• Customer and subscription IDs
• Payment amounts and currencies
• Transaction timestamps
• Subscription and payment status information
⠀
The claim and full scope of the exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
‼️ Security researcher Nightmare Eclipse has created a new GitHub repository called ShieldCrash, which is described as a Windows Defender zero-day vulnerability.
Currently, the repository is empty.
GitHub: https://github.com/MSNightmare/ShieldCrash
Currently, the repository is empty.
GitHub: https://github.com/MSNightmare/ShieldCrash
🔥4