One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!
The Dark Web
Joined August 2023
- Tweets36.8K
- Following94
- Followers263K
- Likes34.5K
Pinned Tweet
‼️ Footage of the LeakBase domain administrator getting arrested in Taganrog, Russia.
techcrunch.com/2026/03/25/ru…
Here is the Gootloader seizure banner.
🚨 International police operation takes down 235 servers and 257 domains linked to major malware networks
Europol and law enforcement agencies from nine countries have dismantled infrastructure supporting Gootloader, CastleRAT, and StealC, three malware operations linked to credential theft, remote access attacks, and ransomware infections.
The latest phase of Operation Endgame resulted in the seizure of 235 servers and 257 domains, with authorities identifying approximately 6.4 million datasets stolen from infected victims.
The stolen information was being used for further cyberattacks and sold to other criminals. Authorities are working with cybersecurity organizations, including Have I Been Pwned, to notify affected victims.
1
3
2,550
🚨 Critical Apache HTTP Server flaw discovered by Anthropic and Google could allow hackers to execute code without authentication; CVE-2026-119618
The Apache Software Foundation has released an urgent security update addressing a critical remote code execution vulnerability in Apache HTTP Server's HTTP/2 module.
The flaw, tracked as CVE-2026-119618, involves a race condition that could allow unauthenticated attackers to corrupt server memory and potentially execute malicious code on vulnerable systems.
The vulnerability was independently discovered by Anthropic's AI-powered OSS Scanner and researchers at Google Cloud.
Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, with version 2.4.71 released to address the issue.
Source: httpd.apache.org/security/vu…
No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
4
928
🚨 Public exploit released for critical Cisco Expressway flaw allowing attackers to gain root access without authentication; CVE-2026-76466
github.com/dinosn/cve-2026-7…
A public proof-of-concept (PoC) exploit has been released for a critical Cisco Expressway vulnerability that could allow unauthenticated attackers to execute commands with root privileges on affected systems.
Tracked as CVE-2026-76466 (CVSS 9.8), the flaw involves hard-coded authentication credentials and insufficient certificate validation in clustered Expressway deployments. Researchers have demonstrated successful exploitation, potentially giving attackers complete control of vulnerable servers.
Cisco has released security updates, with Expressway versions X15.5.3 and earlier requiring an upgrade to X15.5.20. No active exploitation has been confirmed.
Source: sec.cloudapps.cisco.com/secu…
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
1
1,850
Dark Web Informer retweeted
🚨 Many major services appear to be down or experiencing disruptions, with user reports spiking on Downdetector:
• Microsoft Outlook
• Microsoft 365
• Microsoft Store
• Microsoft Copilot
• Microsoft Teams
• Amazon Web Services (AWS)
• Microsoft Azure
• Gmail
• Microsoft OneDrive
• Google
• Microsoft Account
• Cloudflare
• Zoom
• GoDaddy
• Xfinity
• Xbox Network
• Steam
• Amazon
• Calendly
• Salesforce
• Claude AI
• Yahoo Mail
• X (Twitter)
• Facebook
• Archive of Our Own
• Slack
• Microsoft Dynamics
• Microsoft Entra
The scope and cause remain unclear.
More services starting to show disruptions.
• Microsoft Power BI
• ADP
• QuickBooks Online
• RingCentral
• iMessage
• Spectrum
• Verizon
• AT&T
🚨 Many major services appear to be down or experiencing disruptions, with user reports spiking on Downdetector:
• Microsoft Outlook
• Microsoft 365
• Microsoft Store
• Microsoft Copilot
• Microsoft Teams
• Amazon Web Services (AWS)
• Microsoft Azure
• Gmail
• Microsoft OneDrive
• Google
• Microsoft Account
• Cloudflare
• Zoom
• GoDaddy
• Xfinity
• Xbox Network
• Steam
• Amazon
• Calendly
• Salesforce
• Claude AI
• Yahoo Mail
• X (Twitter)
• Facebook
• Archive of Our Own
• Slack
• Microsoft Dynamics
• Microsoft Entra
The scope and cause remain unclear.
💥 Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
‼️🇫🇷 HomeMaison Data Sale Claim Lists 36.4 Million Records, 1.6M Emails and 330K Plaintext Passwords
darkwebinformer.com/homemais…
1
5,240
🚨 Ledger Live zero-day exploit allegedly offered for $3,000, targeting cryptocurrency recovery phrases
An actor using the handle "honeymanOne" is selling a tool claimed to exploit Ledger Live by displaying a fraudulent wallet recovery process inside the application.
The advertised attack uses a fake wallet integrity warning to trick users into entering their 12, 20, or 24-word recovery phrase.
Features include:
• Fake in-app wallet recovery prompts
• Customizable phishing overlays
• Deep-link-based activation
• Simulated recovery success messages
• Source code included
The seller claims the attack remains within the Ledger Live interface, making the phishing attempt appear legitimate.
Claim is currently unverified. No genuine Ledger Live zero-day vulnerability has been demonstrated.
3
7
6,834
💥 Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
1
1,874
Threat feed script had some major updates this week... some only apply to me but a lot to you. 80% of alerts now come within minutes of a forum post. The remaining 20% are being worked on to reach that goal.
• Expanded monitoring to 16 simultaneous forum groups.
• Prioritized new posts before deeper page scans.
• Added automatic catch-up scans after outages.
• Improved scheduling so slow forums don’t hold up healthy sources.
• Added clearer reporting for stale sections and overdue scans.
• Reused browser sessions to reduce repeated startup work.
• Fixed recovery attempts being cut short by timeouts.
• Kept proxies, cookies, and browser identities consistent across requests.
• Saved verified browser sessions for reuse after retries and restarts.
• Improved cleanup of stalled browser workers.
• Kept screenshots tied to verified original thread content.
• Updated source URLs while preserving tracking history and duplicate detection.
• Added checks to confirm actual forum content before reporting success.
10
5,073
🚨 Palo Alto Networks patches PAN-OS flaw allowing attackers to execute commands with root privileges, CVE-2026-0330
Palo Alto Networks has released security updates for a remote code execution vulnerability in PAN-OS that could allow authenticated administrators to execute arbitrary commands with root privileges on Panorama management systems.
The flaw, tracked as CVE-2026-0330 (CVSS 8.6), affects multiple PAN-OS versions from 10.2 through 12.2. Successful exploitation could give attackers complete control of affected Panorama systems, potentially compromising the infrastructure used to manage enterprise firewalls.
Palo Alto Networks has released patches and recommends restricting management access to trusted internal networks. There is currently no evidence of exploitation in the wild.
Source: security.paloaltonetworks.co…
Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
2
1,704
🚨 Critical MongoDB flaw allows unauthenticated attackers to crash database servers, with potential for remote code execution; CVE-2026-118383
MongoDB has released emergency security updates addressing a critical use-after-free vulnerability (CVSS 9.5) that could allow attackers to crash database servers without authentication and potentially execute malicious code under specific conditions.
Researchers at Datadog Security Labs demonstrated how just two specially crafted requests could trigger a crash during a replica set failover, potentially disrupting database availability. Standalone MongoDB instances are not affected.
The vulnerability affects multiple MongoDB Server versions, including 4.4 through 9.0. Patches are available, and administrators are urged to update affected replica set members immediately.
MongoDB says it has found no evidence of exploitation in the wild.
Source: mongodb.com/community/forums…
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
2
1,578
🚨 Hackers hijack 4,837 GitHub accounts and target over 61,000 repositories in massive credential theft campaign
Security researchers at @AikidoSecurity have uncovered a large-scale attack in which hackers used stolen GitHub credentials to inject malicious code into 61,764 repositories, with at least 1,835 confirmed to have executed the payload and leaked credentials.
The malware targets GitHub Actions secrets, AWS, Azure, Google Cloud credentials, and API keys for services including OpenAI and Anthropic. Attackers also attempted to establish persistent cloud access.
The campaign began on November 10, with attackers quickly removing malicious commits and deleting workflow logs to conceal their activity. Researchers warn that affected organizations should revoke compromised tokens and rotate exposed credentials immediately.
Source: aikido.dev/blog/compromised-…
Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing
Need API access? darkwebinformer.com/api-deta…
Check out the Telegram channel: t.me/SliceForLifeee
2
1,736
⚠️🇺🇸 OSINT...
An X account allegedly linked to the shooter in today’s Washington, DC mass shooting posted: “My manifesto is an engineering report.”
The attached pages describe water intrusion, suspected mold growth, deteriorating building materials, and alleged defects in window and façade repairs at a condominium building.
xitter.twitterapi.xyz/miceandmold/status/212…
