Dark Web Informer's banner

Dark Web Informer

@DarkWebInformer • 245,968 subscribers

One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!

Shorts

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017. Website: Write-up: GitHub: It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su. Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise. Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017. Website: Write-up: GitHub: It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su. Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise. Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

446,178 просмотров

Get outta my way bitch. 🤣

Get outta my way bitch. 🤣

31,154 просмотров

💥OpenOSINT turns OSINT into a terminal-based AI agent. Give it an email, username, domain, IP, or target, and it can chain real tools, pivot on findings, and save a structured report. GitHub: Live Demo:

💥OpenOSINT turns OSINT into a terminal-based AI agent. Give it an email, username, domain, IP, or target, and it can chain real tools, pivot on findings, and save a structured report. GitHub: Live Demo:

30,849 просмотров

💥 arsenal-ng: A Go-based pentest command launcher with 200+ cybersecurity cheat sheets built in. Search commands, fill in arguments, and send them straight to your terminal instead of digging through notes every time. GitHub:

💥 arsenal-ng: A Go-based pentest command launcher with 200+ cybersecurity cheat sheets built in. Search commands, fill in arguments, and send them straight to your terminal instead of digging through notes every time. GitHub:

30,177 просмотров

DDoS attack... wait for it.

DDoS attack... wait for it.

100,465 просмотров

‼️ A threat actor is selling a NFCRipper tool which allegedly enables NFC relay, card capture, session cloning, and POS/ATM CVM bypass functionalities. They claim it can capture, replay, and manage card data through a centralized web panel for research and testing purposes. nfcripper[.]su

‼️ A threat actor is selling a NFCRipper tool which allegedly enables NFC relay, card capture, session cloning, and POS/ATM CVM bypass functionalities. They claim it can capture, replay, and manage card data through a centralized web panel for research and testing purposes. nfcripper[.]su

44,543 просмотров

A XSS vulnerability took control of BreachForums about an hour and a half ago. It has since been fixed. Credit: Nicotine

A XSS vulnerability took control of BreachForums about an hour and a half ago. It has since been fixed. Credit: Nicotine

48,922 просмотров

Shannon: Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark. GitHub: Features: ▪️Fully Autonomous Operation ▪️Pentester-Grade Reports with Reproducible Exploits ▪️Critical OWASP Vulnerability Coverage ▪️Code-Aware Dynamic Testing ▪️Powered by Integrated Security Tools ▪️Parallel Processing for Faster Results

Shannon: Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark. GitHub: Features: ▪️Fully Autonomous Operation ▪️Pentester-Grade Reports with Reproducible Exploits ▪️Critical OWASP Vulnerability Coverage ▪️Code-Aware Dynamic Testing ▪️Powered by Integrated Security Tools ▪️Parallel Processing for Faster Results

49,757 просмотров

Lol, truth!

Lol, truth!

35,387 просмотров

🚨Darcula Phishing-as-a-Service (PhaaS) Platform Integrates Generative AI, Lowering the Barrier for Threat Actors

🚨Darcula Phishing-as-a-Service (PhaaS) Platform Integrates Generative AI, Lowering the Barrier for Threat Actors

62,024 просмотров

💥 Cariddi: Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more GitHub:

💥 Cariddi: Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more GitHub:

10,610 просмотров

Wait for it...🤣

Wait for it...🤣

44,118 просмотров

‼️ .cz BreachForums was briefly defaced by what looks like a XSS vuln in XenForo. XenForo is a popular forum platform that I have seen used by a lot of actors, most of which I have identified in my Threat-Surface repo on GitHub. Credit to antisocial for sending the video.

‼️ .cz BreachForums was briefly defaced by what looks like a XSS vuln in XenForo. XenForo is a popular forum platform that I have seen used by a lot of actors, most of which I have identified in my Threat-Surface repo on GitHub. Credit to antisocial for sending the video.

17,348 просмотров

You probably know a co-worker who does this. 😂

You probably know a co-worker who does this. 😂

19,795 просмотров

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Inside the Teenage Hacker Mafia Terrorizing the Internet Teenage hackers stole millions, disrupted Las Vegas casinos, breached major corporations, and eventually turned against each other. A Data War documentary explores The Com, a loosely connected online community associated with groups like Scattered Spider, LAPSUS$, and ACG. The documentary examines how activities ranging from SIM swapping and ransomware escalated into kidnappings, swatting, and extremist connections, exposing the darker side of an increasingly dangerous cybercriminal network.

Inside the Teenage Hacker Mafia Terrorizing the Internet Teenage hackers stole millions, disrupted Las Vegas casinos, breached major corporations, and eventually turned against each other. A Data War documentary explores The Com, a loosely connected online community associated with groups like Scattered Spider, LAPSUS$, and ACG. The documentary examines how activities ranging from SIM swapping and ransomware escalated into kidnappings, swatting, and extremist connections, exposing the darker side of an increasingly dangerous cybercriminal network.

Dark Web Informer

27,657 просмотров • 2 дней назад

In 2004, German police uncovered a hard drive containing numerous disturbing and graphic photographs. Hidden within the images was a mysterious man whose face had been digitally distorted into a swirling pattern to conceal his identity. This is the story of Mr. Swirl. You can find more information about this piece of shit and additional details about the case here:

In 2004, German police uncovered a hard drive containing numerous disturbing and graphic photographs. Hidden within the images was a mysterious man whose face had been digitally distorted into a swirling pattern to conceal his identity. This is the story of Mr. Swirl. You can find more information about this piece of shit and additional details about the case here:

Dark Web Informer

42,819 просмотров • 6 дней назад

‼️ Sharjah Police in the UAE, working with the Ministry of Interior, dismantled four interconnected international cybercrime networks during an operation called "End of Battle." Authorities arrested 33 suspects from 12 nationalities, including key leaders. The networks were involved in hacking, money laundering, cryptocurrency wallet theft, fraud, extortion, data trafficking, and violent assaults. The operation reportedly protected more than 30 organizations worldwide, secured assets worth over AED 65 billion, seized more than AED 200 million, and investigated over 3,000 digital wallets. The criminal networks used encrypted platforms that changed every eight hours to evade detection.

‼️ Sharjah Police in the UAE, working with the Ministry of Interior, dismantled four interconnected international cybercrime networks during an operation called "End of Battle." Authorities arrested 33 suspects from 12 nationalities, including key leaders. The networks were involved in hacking, money laundering, cryptocurrency wallet theft, fraud, extortion, data trafficking, and violent assaults. The operation reportedly protected more than 30 organizations worldwide, secured assets worth over AED 65 billion, seized more than AED 200 million, and investigated over 3,000 digital wallets. The criminal networks used encrypted platforms that changed every eight hours to evade detection.

Dark Web Informer

18,147 просмотров • 3 дней назад

Average malware analyst after 14 hours in Ghidra. 🤣

Average malware analyst after 14 hours in Ghidra. 🤣

Dark Web Informer

46,594 просмотров • 12 дней назад

🚨‼️The Darkest Web: Inside the internet’s most hidden corners to save kids THIS DOCUMENTARY DEALS WITH CHILD SEXUAL ABUSE AND CONTAINS SCENES WHICH VIEWERS MAY FIND DISTURBING. An extraordinary global team of undercover officers takes on a nearly impossible mission: infiltrating the darkest corners of the internet to rescue vulnerable children and bring hope where it once seemed impossible. Credit:

🚨‼️The Darkest Web: Inside the internet’s most hidden corners to save kids THIS DOCUMENTARY DEALS WITH CHILD SEXUAL ABUSE AND CONTAINS SCENES WHICH VIEWERS MAY FIND DISTURBING. An extraordinary global team of undercover officers takes on a nearly impossible mission: infiltrating the darkest corners of the internet to rescue vulnerable children and bring hope where it once seemed impossible. Credit:

Dark Web Informer

183,907 просмотров • 2 месяцев назад

🚨 Teenagers suspected of leading ransomware group arrested in international operation Authorities from nine countries have disrupted KillSec, a ransomware group linked to almost 1,000 attacks worldwide. ⠀ A 16-year-old is suspected of serving as the group’s administrator and main operator. Another suspected developer recently turned 18 and was a minor during several of the alleged offenses. ⠀ The operation resulted in: • Three arrests • Eight searches in Spain, Greece, the UK and Romania • Five servers seized • KillSec-operated domains seized • At least 110 TB of stolen data secured ⠀ KillSec allegedly exploited poorly secured access points, particularly cloud storage, to steal sensitive data. Victims were threatened with publication unless they paid a ransom. The investigation remains ongoing.

🚨 Teenagers suspected of leading ransomware group arrested in international operation Authorities from nine countries have disrupted KillSec, a ransomware group linked to almost 1,000 attacks worldwide. ⠀ A 16-year-old is suspected of serving as the group’s administrator and main operator. Another suspected developer recently turned 18 and was a minor during several of the alleged offenses. ⠀ The operation resulted in: • Three arrests • Eight searches in Spain, Greece, the UK and Romania • Five servers seized • KillSec-operated domains seized • At least 110 TB of stolen data secured ⠀ KillSec allegedly exploited poorly secured access points, particularly cloud storage, to steal sensitive data. Victims were threatened with publication unless they paid a ransom. The investigation remains ongoing.

Dark Web Informer

39,010 просмотров • 17 дней назад

💡How DDoS Works But It's 3D

💡How DDoS Works But It's 3D

Dark Web Informer

979,581 просмотров • 2 лет назад

Been there... many times! 😂

Been there... many times! 😂

Dark Web Informer

313,555 просмотров • 9 месяцев назад

This is how a Cybercriminal exploits phone calls to steal Data/OTP using IVR. Credit: David Maimon

This is how a Cybercriminal exploits phone calls to steal Data/OTP using IVR. Credit: David Maimon

Dark Web Informer

653,254 просмотров • 2 лет назад

Gmail Creator Pro: The Ultimate Gmail Account Creator Advertised capabilities include: • Human-like typing and random delays • Browser fingerprint and user-agent rotation • Session warming through common websites • Proxy selection and validation • Phone verification skip/bypass attempts • SMS API integration • Multi-language interface support • Auto-save account storage in JSON • Success-rate and account statistics dashboard • ChromeDriver auto-management

Gmail Creator Pro: The Ultimate Gmail Account Creator Advertised capabilities include: • Human-like typing and random delays • Browser fingerprint and user-agent rotation • Session warming through common websites • Proxy selection and validation • Phone verification skip/bypass attempts • SMS API integration • Multi-language interface support • Auto-save account storage in JSON • Success-rate and account statistics dashboard • ChromeDriver auto-management

Dark Web Informer

77,914 просмотров • 3 месяцев назад

RDP Stealer with Windows Defender Bypass

RDP Stealer with Windows Defender Bypass

Dark Web Informer

102,237 просмотров • 5 месяцев назад

‼️ A "Pegasus-Like" zero-click RAT spyware targeting Android and iOS is being sold on a popular cybercrime forum. Threat Actor: xone9to1 Date: 04-02-2026 Category: Malware / Spyware Threat actor is advertising a zero-click RAT spyware claiming to work without APK/IPA installation, compatible with iPhone 17 iOS 26.2 and Android 5 to 16. Features include device information gathering, network and SIM details, live GPS location with history, real-time notification monitoring, call logs, contacts manager, SMS manager with OTP viewer, WhatsApp call and message monitoring, and access to all social media accounts (Google, Facebook, Instagram, Twitter, Telegram, Spotify, etc.). Advanced capabilities include device controls (lock, power off, ringer, brightness), botnet controls with DDoS, file manager with encryption, live surveillance (front/back camera, screen recording, microphone access), keylogger, and banking/crypto stealer modules targeting MetaMask, Trust, Binance, UPI, Apple Pay, Google Pay, and PayPal. A demo video is included as proof of concept.

‼️ A "Pegasus-Like" zero-click RAT spyware targeting Android and iOS is being sold on a popular cybercrime forum. Threat Actor: xone9to1 Date: 04-02-2026 Category: Malware / Spyware Threat actor is advertising a zero-click RAT spyware claiming to work without APK/IPA installation, compatible with iPhone 17 iOS 26.2 and Android 5 to 16. Features include device information gathering, network and SIM details, live GPS location with history, real-time notification monitoring, call logs, contacts manager, SMS manager with OTP viewer, WhatsApp call and message monitoring, and access to all social media accounts (Google, Facebook, Instagram, Twitter, Telegram, Spotify, etc.). Advanced capabilities include device controls (lock, power off, ringer, brightness), botnet controls with DDoS, file manager with encryption, live surveillance (front/back camera, screen recording, microphone access), keylogger, and banking/crypto stealer modules targeting MetaMask, Trust, Binance, UPI, Apple Pay, Google Pay, and PayPal. A demo video is included as proof of concept.

Dark Web Informer

118,856 просмотров • 6 месяцев назад

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow Published: June 1st, 2026 PoC: One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

Dark Web Informer

71,789 просмотров • 3 месяцев назад

The Teenagers Who Hacked Las Vegas In September 2023, slot machines froze, hotel doors stopped working, and MGM Grand employees were forced to use pen and paper. The disruption lasted for days and reportedly cost MGM around $100 million. The attackers were linked to Scattered Spider, a young hacker group known for using social engineering to gain access to corporate networks. The MGM breach became one of the most high-profile casino cyberattacks in recent history, showing how effective social engineering can be even against major organizations.

Dark Web Informer

13,438 просмотров • 16 дней назад

How Hackers Stole $1,000,000,000 From Banks

How Hackers Stole $1,000,000,000 From Banks

Dark Web Informer

27,374 просмотров • 1 месяц назад

🚨🇩🇪 Archetyp Darknet Market operator charged over €330M darknet drug trade German prosecutors charged a 31-year-old man accused of founding and administering Archetyp Market, once described as the world’s largest darknet marketplace for illegal drugs. Authorities say the platform processed around 2.3 million orders between November 2022 and its June 2025 shutdown, generating an estimated €330 million in sales. Archetyp allegedly had more than 600,000 customer accounts, around 3,000 professional vendors, and 17,000 listings for cocaine, heroin, fentanyl, methamphetamine, cannabis, prescription drugs, and other substances. The suspect allegedly collected a 5% commission and other fees, earning around €20 million. He was arrested (video) in Barcelona during Operation Deep Sentinel and later extradited to Germany. Authorities have seized nearly €10 million in cryptocurrency, cash, and luxury vehicles. He faces up to 15 years in prison if convicted.

🚨🇩🇪 Archetyp Darknet Market operator charged over €330M darknet drug trade German prosecutors charged a 31-year-old man accused of founding and administering Archetyp Market, once described as the world’s largest darknet marketplace for illegal drugs. Authorities say the platform processed around 2.3 million orders between November 2022 and its June 2025 shutdown, generating an estimated €330 million in sales. Archetyp allegedly had more than 600,000 customer accounts, around 3,000 professional vendors, and 17,000 listings for cocaine, heroin, fentanyl, methamphetamine, cannabis, prescription drugs, and other substances. The suspect allegedly collected a 5% commission and other fees, earning around €20 million. He was arrested (video) in Barcelona during Operation Deep Sentinel and later extradited to Germany. Authorities have seized nearly €10 million in cryptocurrency, cash, and luxury vehicles. He faces up to 15 years in prison if convicted.

Dark Web Informer

41,175 просмотров • 2 месяцев назад

Gmail Infinity Factory: An advanced Gmail account automation engine built on next-generation stealth technology. It leverages CloakBrowser and Playwright with a multi-layer architecture that accurately mimics real human behavior and evades all automated detection systems. Advertised capabilities include: • CloakBrowser and Playwright automation • Browser fingerprint rotation • Human-like mouse and typing behavior • Proxy health checks and automatic rotation • SMS verification provider support • CAPTCHA solver integration • Synthetic identity generation • Gmail, YouTube, and Google Search warmup activity • Encrypted credential storage • Interactive terminal dashboard • Batch account creation workflow

Gmail Infinity Factory: An advanced Gmail account automation engine built on next-generation stealth technology. It leverages CloakBrowser and Playwright with a multi-layer architecture that accurately mimics real human behavior and evades all automated detection systems. Advertised capabilities include: • CloakBrowser and Playwright automation • Browser fingerprint rotation • Human-like mouse and typing behavior • Proxy health checks and automatic rotation • SMS verification provider support • CAPTCHA solver integration • Synthetic identity generation • Gmail, YouTube, and Google Search warmup activity • Encrypted credential storage • Interactive terminal dashboard • Batch account creation workflow

Dark Web Informer

51,736 просмотров • 3 месяцев назад

🚨🚨Archetyp Darknet Market, the world's largest Darknet Market, has been seized by law enforcement.

🚨🚨Archetyp Darknet Market, the world's largest Darknet Market, has been seized by law enforcement.

Dark Web Informer

174,645 просмотров • 1 год назад

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Dark Web Informer

98,003 просмотров • 8 месяцев назад

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution Video Credit: Gaurav Bhattacharjee

Dark Web Informer

47,445 просмотров • 3 месяцев назад