Dark Web Informer's banner

Dark Web Informer

@DarkWebInformer • 223,311 subscribers

One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!

Shorts

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017. Website: Write-up: GitHub: It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su. Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise. Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017. Website: Write-up: GitHub: It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su. Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise. Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

444,138 просмотров

💥RomM (ROM Manager) lets you scan, enrich, browse, and launch your game collection through a clean, responsive interface. With support for multiple platforms, flexible naming schemes, and custom tags. GitHub:

💥RomM (ROM Manager) lets you scan, enrich, browse, and launch your game collection through a clean, responsive interface. With support for multiple platforms, flexible naming schemes, and custom tags. GitHub:

80,580 просмотров

💥OpenOSINT turns OSINT into a terminal-based AI agent. Give it an email, username, domain, IP, or target, and it can chain real tools, pivot on findings, and save a structured report. GitHub: Live Demo:

💥OpenOSINT turns OSINT into a terminal-based AI agent. Give it an email, username, domain, IP, or target, and it can chain real tools, pivot on findings, and save a structured report. GitHub: Live Demo:

29,706 просмотров

💥 arsenal-ng: A Go-based pentest command launcher with 200+ cybersecurity cheat sheets built in. Search commands, fill in arguments, and send them straight to your terminal instead of digging through notes every time. GitHub:

💥 arsenal-ng: A Go-based pentest command launcher with 200+ cybersecurity cheat sheets built in. Search commands, fill in arguments, and send them straight to your terminal instead of digging through notes every time. GitHub:

29,621 просмотров

Must be nice to have that dirty money. I prefer my activity tracker watch tbh. 🤷‍♀️

Must be nice to have that dirty money. I prefer my activity tracker watch tbh. 🤷‍♀️

56,206 просмотров

‼️ A threat actor is selling a NFCRipper tool which allegedly enables NFC relay, card capture, session cloning, and POS/ATM CVM bypass functionalities. They claim it can capture, replay, and manage card data through a centralized web panel for research and testing purposes. nfcripper[.]su

‼️ A threat actor is selling a NFCRipper tool which allegedly enables NFC relay, card capture, session cloning, and POS/ATM CVM bypass functionalities. They claim it can capture, replay, and manage card data through a centralized web panel for research and testing purposes. nfcripper[.]su

43,506 просмотров

A XSS vulnerability took control of BreachForums about an hour and a half ago. It has since been fixed. Credit: Nicotine

A XSS vulnerability took control of BreachForums about an hour and a half ago. It has since been fixed. Credit: Nicotine

48,922 просмотров

Lol, truth!

Lol, truth!

35,358 просмотров

DDoS attack... wait for it.

DDoS attack... wait for it.

100,449 просмотров

Shannon: Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark. GitHub: Features: ▪️Fully Autonomous Operation ▪️Pentester-Grade Reports with Reproducible Exploits ▪️Critical OWASP Vulnerability Coverage ▪️Code-Aware Dynamic Testing ▪️Powered by Integrated Security Tools ▪️Parallel Processing for Faster Results

Shannon: Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark. GitHub: Features: ▪️Fully Autonomous Operation ▪️Pentester-Grade Reports with Reproducible Exploits ▪️Critical OWASP Vulnerability Coverage ▪️Code-Aware Dynamic Testing ▪️Powered by Integrated Security Tools ▪️Parallel Processing for Faster Results

48,788 просмотров

🚨Darcula Phishing-as-a-Service (PhaaS) Platform Integrates Generative AI, Lowering the Barrier for Threat Actors

🚨Darcula Phishing-as-a-Service (PhaaS) Platform Integrates Generative AI, Lowering the Barrier for Threat Actors

61,991 просмотров

‼️ .cz BreachForums was briefly defaced by what looks like a XSS vuln in XenForo. XenForo is a popular forum platform that I have seen used by a lot of actors, most of which I have identified in my Threat-Surface repo on GitHub. Credit to antisocial for sending the video.

‼️ .cz BreachForums was briefly defaced by what looks like a XSS vuln in XenForo. XenForo is a popular forum platform that I have seen used by a lot of actors, most of which I have identified in my Threat-Surface repo on GitHub. Credit to antisocial for sending the video.

17,201 просмотров

Wait for it...🤣

Wait for it...🤣

44,108 просмотров

You probably know a co-worker who does this. 😂

You probably know a co-worker who does this. 😂

19,794 просмотров

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Gmail Creator Pro: The Ultimate Gmail Account Creator Advertised capabilities include: • Human-like typing and random delays • Browser fingerprint and user-agent rotation • Session warming through common websites • Proxy selection and validation • Phone verification skip/bypass attempts • SMS API integration • Multi-language interface support • Auto-save account storage in JSON • Success-rate and account statistics dashboard • ChromeDriver auto-management

Gmail Creator Pro: The Ultimate Gmail Account Creator Advertised capabilities include: • Human-like typing and random delays • Browser fingerprint and user-agent rotation • Session warming through common websites • Proxy selection and validation • Phone verification skip/bypass attempts • SMS API integration • Multi-language interface support • Auto-save account storage in JSON • Success-rate and account statistics dashboard • ChromeDriver auto-management

Dark Web Informer

77,151 просмотров • 22 дней назад

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

Dark Web Informer

70,299 просмотров • 26 дней назад

💥 WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. GitHub: Live Demo:

💥 WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. GitHub: Live Demo:

Dark Web Informer

20,482 просмотров • 7 дней назад

Gmail Infinity Factory: An advanced Gmail account automation engine built on next-generation stealth technology. It leverages CloakBrowser and Playwright with a multi-layer architecture that accurately mimics real human behavior and evades all automated detection systems. Advertised capabilities include: • CloakBrowser and Playwright automation • Browser fingerprint rotation • Human-like mouse and typing behavior • Proxy health checks and automatic rotation • SMS verification provider support • CAPTCHA solver integration • Synthetic identity generation • Gmail, YouTube, and Google Search warmup activity • Encrypted credential storage • Interactive terminal dashboard • Batch account creation workflow

Gmail Infinity Factory: An advanced Gmail account automation engine built on next-generation stealth technology. It leverages CloakBrowser and Playwright with a multi-layer architecture that accurately mimics real human behavior and evades all automated detection systems. Advertised capabilities include: • CloakBrowser and Playwright automation • Browser fingerprint rotation • Human-like mouse and typing behavior • Proxy health checks and automatic rotation • SMS verification provider support • CAPTCHA solver integration • Synthetic identity generation • Gmail, YouTube, and Google Search warmup activity • Encrypted credential storage • Interactive terminal dashboard • Batch account creation workflow

Dark Web Informer

51,022 просмотров • 22 дней назад

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee

Dark Web Informer

46,846 просмотров • 20 дней назад

The Biometric AuthToken Heist: Cracking PINs and Bypassing CE via a Long-Ignored Attack Surface Full writeup:

The Biometric AuthToken Heist: Cracking PINs and Bypassing CE via a Long-Ignored Attack Surface Full writeup:

Dark Web Informer

37,707 просмотров • 19 дней назад

Been there... many times! 😂

Been there... many times! 😂

Dark Web Informer

313,555 просмотров • 6 месяцев назад

💡How DDoS Works But It's 3D

💡How DDoS Works But It's 3D

Dark Web Informer

977,605 просмотров • 1 год назад

RDP Stealer with Windows Defender Bypass

RDP Stealer with Windows Defender Bypass

Dark Web Informer

102,237 просмотров • 2 месяцев назад

‼️ A "Pegasus-Like" zero-click RAT spyware targeting Android and iOS is being sold on a popular cybercrime forum. Threat Actor: xone9to1 Date: 04-02-2026 Category: Malware / Spyware Threat actor is advertising a zero-click RAT spyware claiming to work without APK/IPA installation, compatible with iPhone 17 iOS 26.2 and Android 5 to 16. Features include device information gathering, network and SIM details, live GPS location with history, real-time notification monitoring, call logs, contacts manager, SMS manager with OTP viewer, WhatsApp call and message monitoring, and access to all social media accounts (Google, Facebook, Instagram, Twitter, Telegram, Spotify, etc.). Advanced capabilities include device controls (lock, power off, ringer, brightness), botnet controls with DDoS, file manager with encryption, live surveillance (front/back camera, screen recording, microphone access), keylogger, and banking/crypto stealer modules targeting MetaMask, Trust, Binance, UPI, Apple Pay, Google Pay, and PayPal. A demo video is included as proof of concept.

‼️ A "Pegasus-Like" zero-click RAT spyware targeting Android and iOS is being sold on a popular cybercrime forum. Threat Actor: xone9to1 Date: 04-02-2026 Category: Malware / Spyware Threat actor is advertising a zero-click RAT spyware claiming to work without APK/IPA installation, compatible with iPhone 17 iOS 26.2 and Android 5 to 16. Features include device information gathering, network and SIM details, live GPS location with history, real-time notification monitoring, call logs, contacts manager, SMS manager with OTP viewer, WhatsApp call and message monitoring, and access to all social media accounts (Google, Facebook, Instagram, Twitter, Telegram, Spotify, etc.). Advanced capabilities include device controls (lock, power off, ringer, brightness), botnet controls with DDoS, file manager with encryption, live surveillance (front/back camera, screen recording, microphone access), keylogger, and banking/crypto stealer modules targeting MetaMask, Trust, Binance, UPI, Apple Pay, Google Pay, and PayPal. A demo video is included as proof of concept.

Dark Web Informer

112,529 просмотров • 3 месяцев назад

This is how a Cybercriminal exploits phone calls to steal Data/OTP using IVR. Credit: David Maimon

This is how a Cybercriminal exploits phone calls to steal Data/OTP using IVR. Credit: David Maimon

Dark Web Informer

652,244 просмотров • 2 лет назад

🚨‼️ Poland’s Central Bureau for Combating Cybercrime arrested four alleged members of an organized cybercrime group accused of advanced cyberattacks, digital asset theft, SIM swap attacks, and large-scale money laundering, with operational support from the FBI and HSI. Authorities say the group compromised telecom-linked systems and employee email accounts to take over victims’ phone numbers, access cryptocurrency exchange accounts, and launder stolen funds worth tens of millions of złoty. All four suspects were placed in pre-trial detention and face charges carrying up to 25 years in prison. Per ZachXBT: "The Polish social engineering threat actor Wojtek Kulisz aka 'Merry' appears to have been recently raided by Poland law enforcement along with three other people. While the press release today did not share his name or photo, multiple designer clothes and jewelry items flexed from his public Instagram account 'wojtekk' match items seized during the raid."

🚨‼️ Poland’s Central Bureau for Combating Cybercrime arrested four alleged members of an organized cybercrime group accused of advanced cyberattacks, digital asset theft, SIM swap attacks, and large-scale money laundering, with operational support from the FBI and HSI. Authorities say the group compromised telecom-linked systems and employee email accounts to take over victims’ phone numbers, access cryptocurrency exchange accounts, and launder stolen funds worth tens of millions of złoty. All four suspects were placed in pre-trial detention and face charges carrying up to 25 years in prison. Per ZachXBT: "The Polish social engineering threat actor Wojtek Kulisz aka 'Merry' appears to have been recently raided by Poland law enforcement along with three other people. While the press release today did not share his name or photo, multiple designer clothes and jewelry items flexed from his public Instagram account 'wojtekk' match items seized during the raid."

Dark Web Informer

24,528 просмотров • 24 дней назад

🚨 First VPN Service has been seized by law enforcement

🚨 First VPN Service has been seized by law enforcement

Dark Web Informer

54,735 просмотров • 2 месяцев назад

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Dark Web Informer

97,512 просмотров • 5 месяцев назад

🚨 Multiple users are reporting that Kash Patel’s apparel site is serving a ClickFix-style malware lure. The page appears to mimic a Cloudflare verification check and instructs visitors to run platform-specific commands to “verify” access. Instead, those commands can execute malicious code. On macOS, the observed chain reportedly pulls down an infostealer designed to target Keychain data, browser-stored credentials, session tokens, and cryptocurrency wallet information.

🚨 Multiple users are reporting that Kash Patel’s apparel site is serving a ClickFix-style malware lure. The page appears to mimic a Cloudflare verification check and instructs visitors to run platform-specific commands to “verify” access. Instead, those commands can execute malicious code. On macOS, the observed chain reportedly pulls down an infostealer designed to target Keychain data, browser-stored credentials, session tokens, and cryptocurrency wallet information.

Dark Web Informer

38,839 просмотров • 1 месяц назад

‼️ A threat actor operating under the alias petrushka is selling a phishing-as-a-service (PhaaS) platform called Bluekit. The service offers 40+ phishing templates, Evilginx-based adversary-in-the-middle capabilities, 2FA bypass with geolocation and browser spoofing, antibot cloaking, cookie and credential harvesting, AI voice cloning, and bulletproof hosting with Monero payment support.

‼️ A threat actor operating under the alias petrushka is selling a phishing-as-a-service (PhaaS) platform called Bluekit. The service offers 40+ phishing templates, Evilginx-based adversary-in-the-middle capabilities, 2FA bypass with geolocation and browser spoofing, antibot cloaking, cookie and credential harvesting, AI voice cloning, and bulletproof hosting with Monero payment support.

Dark Web Informer

52,514 просмотров • 2 месяцев назад

YellowKey PoC Demo to Bypass Bitlocker GitHub:

YellowKey PoC Demo to Bypass Bitlocker GitHub:

Dark Web Informer

36,789 просмотров • 2 месяцев назад

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500

Dark Web Informer

47,108 просмотров • 2 месяцев назад

🚨🚨Archetyp Darknet Market, the world's largest Darknet Market, has been seized by law enforcement.

🚨🚨Archetyp Darknet Market, the world's largest Darknet Market, has been seized by law enforcement.

Dark Web Informer

174,645 просмотров • 1 год назад

FuzzBunch: The NSA Tool Leaked by The Shadow Brokers Video Credit:

FuzzBunch: The NSA Tool Leaked by The Shadow Brokers Video Credit:

Dark Web Informer

125,788 просмотров • 9 месяцев назад