Dark Web Informer

One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!

[Dark Web Informer @DarkWebInformer]

‼️ Footage of the LeakBase domain administrator getting arrested in Taganrog, Russia.

https://t.co/RqCmNhSbn7

[Dark Web Informer @DarkWebInformer]

🚨 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194

Microsoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by tricking users into opening specially crafted files.

The flaw, tracked as CVE-2026-124194 (CVSS 6.5), allows Outlook to connect to attacker-controlled locations without displaying the usual external content security warning, potentially exposing credentials to further attacks.

Microsoft confirmed exploitation in the wild as part of its November 2026 Patch Tuesday updates. Users and administrators are urged to install the latest security fixes immediately.

[Dark Web Informer @DarkWebInformer]

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

‼️🇺🇸 n0n ransomware claims DraftKings, threatening to publish large datasets tied to customers and advertising audiences.

🇺🇸 DraftKings - A U.S.-based digital sports entertainment and gaming company offering sports betting, fantasy sports, and online casino products.

The listing claims the data includes:

• 6.3 million mobile advertising identifiers across three gaming audiences
• 7.4 million hashed consumer email addresses, with 2,886,388 allegedly resolved to named individuals
• Campaign demographic analytics covering 11,421 devices, including age, gender, language, handset, carrier, and app-profile data

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

‼️ UPDATE: Across Protocol confirms its domain was hijacked

Across says a social engineering attack against Namecheap let an attacker take control of its domain and host a phishing site. The malicious site is now offline, but some visitors may have been affected.

The frontend and API remain down while Across secures the domain. Third-party integrations and API users were unaffected. Affected visitors should revoke attacker permissions and contact Across.

[Dark Web Informer @DarkWebInformer]

‼️ Across Protocol is investigating an issue with its domain and warns users not to visit the app, connect wallets, or sign transactions or approvals until further notice.

[Dark Web Informer @DarkWebInformer]

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨🇧🇷 Brazil's CAPES allegedly leaked, millions of email addresses and banking records exposed

The actor group "HSRgroup" claims to have leaked data from CAPES, a Brazilian federal agency under the Ministry of Education responsible for supporting and evaluating graduate education.

The advertised dataset reportedly contains:

• Over 4 million email addresses
• Over 4 million phone numbers
• More than 1 million banking records

The group has published a sample and is offering access to the remaining data.

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

💥 Enterprise-level intel, without the enterprise price tag. Plans for everyone. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

🚨 Rust-based infostealer advertised with fileless execution and alleged zero antivirus detection

An actor known as "fentag" is selling access to a Rust-based information stealer that allegedly operates without detection, featuring a separate assembly-based loader and dropper.

The malware reportedly includes:

• Chromium and Firefox credential theft
• Cryptocurrency wallet and clipboard hijacking
• Discord, Telegram, Steam, and other application data theft
• Screenshot capture and system information collection
• File extraction using custom filters and regex
• Anti-analysis and fileless execution capabilities

The seller also claims the malware uses quantum-resistant cryptographic algorithms and is offering its source code separately.

The advertised capabilities and zero-detection claims have not been verified.

[Dark Web Informer @DarkWebInformer]

‼️ Across Protocol is investigating an issue with its domain and warns users not to visit the app, connect wallets, or sign transactions or approvals until further notice.

[Dark Web Informer @DarkWebInformer]

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

🚨🇨🇦 Betty customer account database allegedly exposed, over 600,000 records offered for sale

An actor using the handle "Marx1337" is selling a database allegedly linked to Betty, a regulated online casino operating in Ontario, Canada.

The advertised dataset reportedly contains over 600,000 records, with published samples showing:

• Account usernames and passwords
• Customer names
• Linked account information
• Deposit and account statuses
• Slot game results and activity records

The actor is asking $500 for the database. The source of the records and whether Betty's systems were compromised remain unclear.

Claim is currently unverified.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/Av67oInJ8C

Enterprise-level intel, without the enterprise price tag. Plans for everyone. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨 Google patches 8th actively exploited Chrome zero-day of 2026, warns attackers can execute malicious code

Google has released an emergency Chrome security update addressing CVE-2026-125350, a high-severity use-after-free vulnerability in the browser's XML component that could allow attackers to execute malicious code through specially crafted webpages.

Google confirmed that an exploit exists in the wild but has not disclosed who is exploiting the vulnerability or which organizations have been targeted.

The flaw is among nine vulnerabilities patched in the latest release, marking the eighth Chrome zero-day addressed this year. Users are urged to update Chrome to version 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/2xSZf8gSnP

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

🚨 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194

Microsoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by tricking users into opening specially crafted files.

The flaw, tracked as CVE-2026-124194 (CVSS 6.5), allows Outlook to connect to attacker-controlled locations without displaying the usual external content security warning, potentially exposing credentials to further attacks.

Microsoft confirmed exploitation in the wild as part of its November 2026 Patch Tuesday updates. Users and administrators are urged to install the latest security fixes immediately.

[Dark Web Informer @DarkWebInformer]

Source: https://t.co/5xoNEHPDtG

Enterprise-level intel, without the enterprise price tag. Plans for everyone. https://t.co/hXp6zyrZaS

Need API access? https://t.co/H0l3L44QTL

Check out the Telegram channel: https://t.co/KgFecRMigq

[Dark Web Informer @DarkWebInformer]

🚨 Hackers actively exploiting critical Xen Orchestra flaw to hijack virtualization servers without authentication

Vates has confirmed active exploitation of a critical authentication bypass vulnerability in Xen Orchestra, allowing attackers to gain administrator privileges without valid credentials.

Tracked as VSA-2026-062, the flaw allows attackers to use specially crafted authentication cookies to bypass security controls, execute arbitrary commands, and potentially take complete control of XCP-ng virtualization hosts with root privileges.

The vulnerability has no assigned CVE or CVSS score yet. Security updates are available in Xen Orchestra 6.9.1 and 6.10.0, with administrators urged to patch immediately and investigate potential compromises.

[Dark Web Informer @DarkWebInformer]

💥 Enterprise-level intel, without the enterprise price tag. Plans for everyone. https://t.co/hXp6zysx0q

Need API access? https://t.co/H0l3L45oJj

Check out the Telegram channel: https://t.co/KgFecRMQ5Y

[Dark Web Informer @DarkWebInformer]

🚨 WordPress administrator credentials being targeted through a paid credential-checking service

An actor using the handle "priimeepresss" is advertising a service that checks stolen or compromised login credentials against WordPress wp-admin and wp-login pages to identify working administrator accounts.

The service claims to offer:

• Bulk credential validation
• Proxy-based login checking
• Comparison against private credential databases
• Identification of valid administrator access
• Results reporting and confidentiality

The actor offers $1–$3 per successful administrator login, depending on the quality and volume of credentials submitted.

The service's effectiveness has not been independently verified.

[Dark Web Informer @DarkWebInformer]

‼️🇫🇷 Geofixe Data Leak Claim Lists 1,656 Records With Customer, Billing and Payment Information

https://t.co/enAp4Fsztu