Dark Web Informer - Cyber Threat Intelligence

A threat actor claims to be selling live, authenticated admin panel access to a major US Non-Emergency Medical Transportation (NEMT) platform, advertising real-time control over operations rather than a static dump.

A threat actor claims to have compromised TuID Digital, the digital identity platform operated by Uruguayan state-owned telecom Antel, by obtaining the API key stored alongside internal files on Antel’s server backend.

A threat actor describing themselves as specializing in “stealing medical data” claims to have breached Mexican clinical lab Laboratorios CEFLO, releasing the dataset for free out of stated retaliation after the lab allegedly ignored a paid pentest offer.

A threat actor claims to be selling a customer database from a Belgian sports/fitness business (gym branding visible in the post as “ANIMO”), advertising it as containing 105,000 customers with full IBAN banking details. The seller is offering tiered pricing with $90 per 1,000 customers or $8,500 for the full dataset.

A threat actor claims to have re-dumped the moreideas.ae database, stating this version is “more juicy than before” and dating the breach to May 2026

A threat actor claims to have leaked a database from Indonesia’s Ministry of Energy and Mineral Resources (Kementerian ESDM), specifically the list of distributors for general commercial business entities of fuel oil for the second semester of 2025

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

A newly disclosed remote access trojan (RAT) is quietly turning a built-in Windows feature into a credential-harvesting weapon, and what makes it particularly worrying is that it never has to touch your phone to steal codes meant for it.

When most people picture a darknet drug bust, they imagine cinematic scenes of hooded figures and underground servers. The reality, as a New South Wales Police operation revealed this week, looks a lot more mundane: a quiet street in Sydney's southwest, a 6:40am knock on the door, and a hard drive holding the keys to a multimillion-dollar bitcoin wallet.

The Apache Software Foundation has released security updates to address several vulnerabilities in Apache HTTP Server, including a critical double-free memory corruption flaw that can lead to denial-of-service and potentially remote code execution.

Palo Alto Networks warned customers today that a critical unpatched vulnerability in PAN-OS is being actively exploited in attacks targeting internet-exposed firewalls.

Weaver E-cology RCE Flaw Actively Exploited via Exposed Debug API

CVE-2026-0073: Zero-Click RCE Flaw in Android's Wireless ADB Bypasses Authentication

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

Certificate authorities sit at the foundation of online trust. So when one of the largest, DigiCert, gets hacked through a fake screenshot in a customer support chat, it is worth paying attention.

On May 1, 2026, CISA added CVE-2026-31431, better known as "Copy Fail," to its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies have until May 15 to patch under BOD 22-01. Everyone else should read that deadline as a strong hint.

There's something uniquely unsettling about a cybersecurity company getting hacked. It's the digital equivalent of a locksmith calling to say someone picked their front door. This week, Trellix joined that uncomfortable club, confirming that attackers gained unauthorized access to a portion of its internal source code repository.

On April 29, CVE-2026-41940 was disclosed: a critical pre-authentication bypass in cPanel/WHM that lets remote attackers skip the login flow entirely and gain elevated access. Within 24 hours, it was already being weaponized. Censys watched the fallout in real time.

When the Defenders Become the Attackers: Two U.S. Cybersecurity Pros Sentenced in BlackCat Ransomware Case

The Fall of Versus: How a 380,000-User Dark Web Marketplace Met Its End in a Colombian Extradition