🔪 That Dark Web Guy - Part 3 🔪

🚨🇩🇴 Edesur Dominicana customer data allegedly leaked, over 500,000 records exposed Edesur Dominicana, an electricity distribution company in the Dominican Republic, has been named in a data leak by the actor "K3RN3L_P4N1C". The dataset reportedly contains over 500,000 records, including customer names, national identification numbers, residential addresses, phone numbers, email addresses, account statuses, and outstanding electricity debts. The actor has published a sample of approximately 1,000 records and is offering additional information through private messages. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

For anyone wondering the context right now with me criticizing Polymarket, here's some context dating back to April 2026. April 28–29, 2026: My threat feed documented allegations involving Polymarket, including exposed APIs, authentication bypasses, potential user-data exposure, and a threat actor claiming to have extracted over 10 million records. For transparency you can read the original post here: https://x.com/DarkWebInformer/status/2049163029430870034 May 22, 2026: Approximately $500,000 (some say $700,000) was drained from wallets associated with Polymarket's internal operations following a suspected private-key compromise. Polymarket acknowledged the incident but maintained that user funds and core infrastructure were unaffected. Source: https://www.theblock.co/news/ecosystems/2026-05-22-zachxbt-flags-suspected-exploit-involving-polymarkets-uma-adapter-contract-on-polygon-402327 June 25, 2026: Polymarket confirmed that a compromised third-party vendor allowed malicious code to be injected into its website. Blockchain investigators estimated approximately $3 million stolen from affected users. Polymarket said the incident was contained and promised full reimbursement. Source: https://sourcedefense.com/resources/polymarket-users-drained-of-3m-by-a-trusted-third-party-script-exposing-the-limits-of-csp-and-sri/ October 2026: Instead of ignoring these incidents, I continue to question Polymarket's security priorities while its social media account promotes celebrity-driven engagement content and useless headlines with no sources. The criticism is about security, transparency, accountability, and protecting the people who trust these platforms with their money.

🚨 Zero-click “SMS of Death” flaw can crash Android phone services A researcher has disclosed an unpatched Android vulnerability that allows a malformed WAP Push SMS to silently crash the com.android.phone process, dropping active calls and temporarily disabling cellular service without any interaction from the victim. The message does not appear in the inbox, and carrier redelivery can repeatedly trigger the crash. The researcher also found that sending multiple messages rapidly could corrupt the SMS dataset, leaving telephony services crashing after every reboot. ⠀ • CVE: None assigned • Attack vector: Remote WAP Push SMS • User interaction: None • Impact: Denial of service, dropped calls and possible persistent loss of telephony • Tested: Pixel 9 and multiple Samsung Galaxy and A-series devices • Patch status: None available • Vendor status: “Won’t Fix” and classified as a non-security issue, according to the disclosure ⠀ The researcher reported the flaw to Google in May and publicly disclosed it on October 29 after the report and subsequent appeals were rejected. There is currently no evidence that the vulnerability is being exploited in the wild. Source: https://smsofdeath.com/

Mood

GET SHIT ON

k i feel better

Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks! Polymarket hacked. Get shit on you fucks!

🚨🇨🇦 Hootsuite corporate account data allegedly exposed, 19,400 records offered for sale An actor known as "webshell" is advertising a dataset containing 19,400 records allegedly obtained from Hootsuite, the Canadian social media management platform. The records reportedly include user names, email addresses, corporate organization names, tenant IDs, account permissions, enabled features, and invoice history. The seller is asking $15,000 for the dataset, which could expose organizations to targeted phishing, billing fraud, and account takeover attempts. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Major Tor Browser update to v16. https://blog.torproject.org/new-release-tor-browser-160/ Tor Browser 16.0 is a major stable update built on Firefox ESR 153, bringing current Firefox security fixes, redesigned settings, an updated built-in manual, improved Tor connection handling and additional anti-fingerprinting protections. It also updates Tor to 0.4.9.14 and NoScript, while ending support for 32-bit x86 Linux and Android devices and Android versions older than 8.0.

🚨🇺🇸 Microsoft fixes Remote Desktop failures caused by recent Windows updates Microsoft has resolved a Windows 11 issue that prevented non-administrator users from connecting to Remote Desktop hosts with Administrator protection enabled. The problem appeared after installing the September 2026 preview update KB5124010 or later updates. Connection attempts could fail with error 0xC000000D and the message, “The token that was passed to the function is invalid.” ⠀ Affected systems include Windows 11 versions 24H2, 25H2, 26H1 and 26H2, primarily in enterprise environments using affected devices as Remote Desktop hosts. The fix is included in the October 28 KB5127936 preview update and later releases. Administrators unable to install the update can temporarily disable Administrator protection through Microsoft Intune or Group Policy. Sources: https://learn.microsoft.com/windows/release-health/status-windows-11-26H2 https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-failures-caused-by-recent-windows-updates/

New Everstake Ransomware leak site 👇 http://everstakewfma6sxdpshoq4ebtnqamsxnajrtzu2cflai77kfup5kzyd[.]onion Credit: fbgwls245 (X)

🚨 High-stakes poker players targeted with malware that exposed their cards An attacker compromised the update systems of popular poker tools Jurojin and IntuitiveTables to distribute MeshAgent remote-access malware to selected users. The malware allowed the attacker to view and control infected computers, potentially revealing players’ hole cards in real time. It activated only when usernames matched a hard-coded list of high-stakes targets, helping it remain undetected. ⠀ One professional player discovered the infection after a Claude AI agent noticed MeshAgent running in the background. He later identified 11 screen-capture events during poker sessions and estimated that he lost around $30,000. Players and investigators estimate that the suspected cheater stole between $1.5 million and $4 million across major poker platforms. However, the individual accused by the poker community has not been charged with a crime. ⠀ Jurojin confirmed that tampered updates were selectively delivered between June 2025 and January 2026. CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players, while GGPoker introduced screen protection, anomaly detection and a ban on third-party poker tools. Source: https://www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/

🚨🇮🇳 Vijay Sales allegedly compromised, super administrator access and millions of records offered for sale An actor using the handle "shinymontanna" is selling alleged super administrator access to the internal systems of Vijay Sales, a major Indian electronics retailer, for $25,000. The listing claims access to over 3 million order records, information on 15,000 employees, and billing records for approximately 140,000 vendors. The advertised access reportedly includes customer information, payment and bank transfer records, inventory, financial reports, and internal applications, with read, write, and export permissions. Screenshots showing administrative dashboards and super administrator permissions have been published. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇧🇪 Belgian lawyers' registry data offered for sale, over 122,000 records exposed An actor known as "RedStone" is selling data allegedly obtained from AVOCATS, the official registry covering Belgium's 26 French-speaking bar associations. The advertised dataset contains 122,116 records, including information on approximately 10,600 lawyers, 43,548 unique email addresses, 17,174 phone numbers, and 53,452 addresses. Beyond registry information, the actor claims to possess data from 13,585 member portal accounts, including private notification emails and partially masked mobile numbers. The seller also advertises persistent access to the registry through an active session. A 1,000-record sample has been released, with the full dataset available to interested buyers. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New ransomware leak site: Syntax Dark Web: http://syntaxun5qjrkctaalxhrlibiczo7nke5latuukggyqte2oy5iwpn7qd[.]onion

🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418 Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition. The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required. ⠀ • CVSS: 8.6 • Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication • Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1 • Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 ⠀ Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

🚨 VirusTotal Enterprise account upgrades advertised for $800 using alleged administrator access An actor known as "Zerrix" is offering to upgrade personal VirusTotal accounts to Enterprise using what they claim is access to a group administrator account. The service reportedly unlocks file downloads, advanced search capabilities, a private API key, Retrohunt, and Livehunt. The actor is charging $800 in cryptocurrency and claims the upgrades avoid the risks associated with leaked API keys or compromised accounts. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 AGSI Computer allegedly breached, 5,000 customer and business records leaked AGSI Computer, a French IT services company based in Saint-Ouen-l'Aumône, has been targeted by the actor "4me1", who has published a dataset allegedly obtained from the company's systems. The files contain customer and business contact information, including names, company details, email addresses, phone numbers, and physical addresses. Sales leads, project inquiries, and internal customer management records are also included. The actor dates the alleged breach to October 29, 2026, and has made the data available for download. Claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Telegram username going for $150,000.

Different Stages of OpSec: Stage 1 - Blissful Ignorance: Believe Everything Stage 2 - Growing Awareness: Question Everything Stage 3 - Healthy Skepticism: Trust, but Verify Stage 4 - Zero Trust: Never Trust, Always Verify Stage 5 - Constant Vigilance: Trust No One, Verify Everything Stage 6 - Total Paranoia: Assume Everything Is Compromised