CyberWatch

Eyes on the cyber shadows. Real-time breach alerts, crypto drainers, state threats & hidden risks🪬

[CyberWatch @CyberWatch05]

‼️Website Hacked!

🔗 https://t.co/9LMlS3Ceag
📍 Country: Indonesia 🇮🇩
🏢 Organization: Tim Penggerak Pemberdayaan dan Kesejahteraan Keluarga (TP-PKK) Kabupaten Lebak
👩‍👩‍👧‍👦 Sector: Government / Community Empowerment & Family Welfare

[CyberWatch @CyberWatch05]

‼️Website Hacked!

🔗 https://t.co/WCIdemq3sZ
📍 Country: Poland 🇵🇱
🏢 Organization: Małopolskie Centrum Doskonalenia Nauczycieli (MCDN) – Archive
🎓 Sector: Education / Teacher Professional Development

[CyberWatch @CyberWatch05]

‼️Alleged Leak of Philippine Pension & Loan Records

A threat actor claims to have leaked databases allegedly containing pension and loan records linked to multiple Philippine government and public-sector organizations, including AFP, BFP, PNP, NaPolCom, SSS, PUSU, and SEAMEN.

The allegedly exposed data is said to include information related to pensioners, active personnel, and loan records across multiple agencies.

The actor has shared sample files and claims to possess additional datasets. These claims remain unverified at this time.

Organizations referenced in the post should assess the claims, investigate for potential unauthorized access or data exposure, and take appropriate incident response measures if the allegations are substantiated.

#CyberSecurity #DataLeak #DataBreach #ThreatIntel #Philippines #AFP #PNP #BFP #SSS #OSINT

[CyberWatch @CyberWatch05]

‼️Alleged Data Leak

🇺🇸 Target: Vilebin
🌐 Country: United States 🇺🇸 (hosting/location not independently verified)

A threat actor claims to have breached Vilebin and leaked the platform’s full source code.

📄 Allegedly Exposed Data:
• Full application source code
• Node.js/Fastify backend code
• MySQL database implementation
• Redis implementation
• Application logic and internal components
• Alleged evidence of manipulated platform metrics, including:
• Fake paste view counts
• Fake online user counts
• Inflated registered user counts
• Artificially increased follower counts

⚠️ Note: The authenticity of the claims and the alleged leaked data has not been independently verified. The post reflects the threat actor’s assertions.

#DataLeak #SourceCode #Vilebin #ThreatIntelligence #CyberThreat #CyberSecurity

[CyberWatch @CyberWatch05]

‼️ Fake Website

🔗 hxxps://habitatnccgrantsmanagement[.]netlify[.]app/
📍 Target: Habitat NCC Grants Pipeline (Staff Login)
🌍 Country: United States 🇺🇸
🏢 Organization: Habitat for Humanity of New Castle County (Habitat NCC)
🏭 Sector: Nonprofit / Housing & Community Development

[CyberWatch @CyberWatch05]

‼️ Fake Website

🔗 hxxps://athlynx-platform[.]vercel[.]app/
📍 Target: AthlynXAI
🌍 Country: United States 🇺🇸
🏢 Organization: AthlynXAI
🏭 Sector: Sports Technology / AI Athlete Development Platform

[CyberWatch @CyberWatch05]

‼️Alleged ICS/SCADA Compromise

Target: NHÀ MÁY SƠI NINH PHÚ
🌐 Country: Vietnam 🇻🇳

A threat actor claims to have compromised the industrial network of NHÀ MÁY SƠI NINH PHÚ, alleging unauthorized access to SCADA, PLC, and production process control systems.

📄 Alleged Access Includes:
• SCADA monitoring and control systems
• PLC (Programmable Logic Controller) access
• Production process control systems
• Primary control servers
• Administrative privileges over operational systems
• Ability to manipulate production processes
• Potential capability to disrupt factory operations

💰 Additional Claim: The threat actor states they are offering the alleged access for sale for $200.

⚠️ Note: The authenticity of these claims and the alleged access has not been independently verified. The post reflects the threat actor’s assertions and should not be considered confirmed.

#ICS #SCADA #OTSecurity #IndustrialControlSystems #Vietnam #CriticalInfrastructure #ThreatIntelligence #CyberThreat #CyberSecurity

[CyberWatch @CyberWatch05]

Polymarket fires back: Will challenge France’s decision to block its website in court. 🇫🇷 vs. prediction markets

The platform says it’s ‘disappointed’ by the ANJ’s sudden block over gambling concerns & potential manipulation.

Free markets or overreach?
https://t.co/eLfaVJ9SQX” https://t.co/L068VfZ9X1

[CyberWatch @CyberWatch05]

‼️Primeline Group falls victim to Qilin ransomware

Ireland 🇮🇪

[CyberWatch @CyberWatch05]

‼️UB Freight Ltd falls victim to M3RX ransomware

New Zealand 🇳🇿

[CyberWatch @CyberWatch05]

‼️Alleged Sale of Telegram SDR Platform Source Code

A threat actor has claimed to be selling the source code of an AI-powered Telegram SDR (Sales Development Representative) platform on a cybercrime forum.

According to the post, the platform allegedly enables:
• AI-driven conversations across multiple Telegram accounts
• Memory and Retrieval-Augmented Generation (RAG) capabilities
• Human-like responses and persona management
• CRM integration for lead tracking
• Multi-account management and automation

The actor advertises the project as a complete source code package, claiming it includes backend components, desktop client, CRM, and Telegram management features.

⚠️ These claims are unverified and should be treated with caution until independently confirmed.

🔗 Source: https://t.co/sxd0HPQ2V3

#CyberSecurity #ThreatIntel #Telegram #AI #SourceCode #CyberCrime #OSINT #InfoSec

[CyberWatch @CyberWatch05]

‼️Alleged Data Leak | 2026 World Cup Betting Data

A threat actor claims to be selling a database containing 800,000 records allegedly linked to 2026 FIFA World Cup betting activity from an underground sports betting platform.

According to the post, the dataset is advertised as including large volumes of betting-related records associated with the 2026 tournament.

⚠️ These claims are unverified and should be treated with caution until independently confirmed.

#DataLeak #CyberThreat #ThreatIntel #DarkWeb #WorldCup2026 #SportsBetting #CyberSecurity

[CyberWatch @CyberWatch05]

‼️EFU Life Assurance Ltd. falls victim to Qilin ransomware

Pakistan 🇵🇰

[CyberWatch @CyberWatch05]

‼️Vibonum Technologies Private Limited falls victim to KRYBIT ransomware

India 🇮🇳

The group claims to have obtained 31.40 GB of Organization's data.they intends to publish the data within 3-4 days.

[CyberWatch @CyberWatch05]

‼️Cyber Threat Intelligence | Alleged Sale of Botnet Install Service

A threat actor has advertised an alleged botnet-powered malware installation service on a cybercrime forum, claiming access to a self-operated botnet of approximately 180,000 infected devices.

According to the post, the actor offers:
• WorldMix malware installation services via the botnet
• Claimed botnet size of 180K compromised systems
• Approximately 15K–20K new infections per month
• Infections allegedly spread through USB worms and PE infectors
• Trial offering of 50 test installs before purchase
• Claims to prohibit ransomware deployments while allowing other malware payloads

⚠️ These claims are unverified and originate from a criminal forum. However, such offerings highlight the continued availability of large-scale malware distribution infrastructure in underground markets.

🔗 Source: https://t.co/CYd4sLDblP

#CyberSecurity #ThreatIntel #Botnet #Malware #ThreatActor #CyberCrime #Infostealer #CTI #OSINT #InfoSec

[CyberWatch @CyberWatch05]

‼️Alleged Data Leak

🇬🇧 Target: UK Forex Traders
🌐 Country: United Kingdom 🇬🇧

A threat actor claims to have leaked a database containing information on individuals identified as UK forex trading leads.

📄 Allegedly Exposed Data:
• IP addresses
• Full names
• Email addresses
• Phone numbers
• Currency information
• Country details

⚠️ Note: The authenticity of the claims and the alleged leaked data has not been independently verified. The post reflects the threat actor’s assertions.

#DataLeak #UK #Forex #ThreatIntelligence #CyberThreat #CyberSecurity

[CyberWatch @CyberWatch05]

📢 SecondFi (formerly Yoroi) is shutting down after a $2.4M ADA wallet theft.

Attackers exploited a flaw in its transaction signing software to steal ~16.1M ADA from 374 wallets.

Cardano network unaffected; hardware wallets safe.

Recovery tools & portal coming in August. Sad day for Cardano users.

Full story: https://t.co/b9xbgUjL4n

[CyberWatch @CyberWatch05]

‼️ Fake Website

🔗 hxxps://auditpro-weld-three[.]vercel[.]app/
📍 Target: AuditPro (Startup Legal, Tax & Compliance Services)
🌍 Country: India 🇮🇳
🏢 Organization: AuditPro
🏭 Sector: Legal, Tax & Business Consulting

[CyberWatch @CyberWatch05]

‼️Alleged Sale of Windows Data Collection Framework Source Code

A threat actor claims to be selling the source code for a fully undetectable (FUD) Windows data collection framework written in C/C++.

According to the post, the framework allegedly includes:
• Modular collection from Chromium & Gecko browsers
• Cryptocurrency wallet extraction
• Messaging app & password manager data theft
• VPN client and application credential harvesting
• Reflective loading & direct system calls
• Anti-debug, Anti-VM & Anti-sandbox techniques
• Runtime ETW disabling and per-build obfuscation
• Full source code with deployment/build scripts

⚠️ These claims are unverified and should be treated as allegations until independently confirmed. However, posts advertising advanced information-stealing frameworks highlight the continued availability of offensive tooling within underground communities.

#CyberSecurity #ThreatIntel #Malware #InfoStealer #DarkWeb #ThreatHunting #CyberCrime #WindowsSecurity