At a Glance Malware type Browser-injected web skimmer Threat actor Unattributed; linked to "The Protocol One" persona Targets Crypto traders using SwapZone and SimpleSwap Delivery vector ClickFix-style lures on Telegram, DarkForums, paste sites Key capabilities Google Sheets C2, address swapping, clipboard hijacking Source Cisco Talos TL;DR Cisco Talos uncovered a crypto-stealing campaign that turns the ClickFix browser attack into a web skimmer.

Date: 17 August 2026Subject: Integrity Technology Group / 永信至诚科技集团股份有限公司Scope: Leaked contracts, technical documentation, personnel data, financial records, exercise material, and reconnaissance artifacts reviewed to date Assessment The Integrity Technology Group leak from February 2026 on DarkForums, exposes a commercial cybersecurity company with capabilities directly relevant to state cyber operations. The files document APT intelligence collection […]

Date: 17 August 2026Subject: Integrity Technology Group / 永信至诚科技集团股份有限公司Scope: Leaked contracts, technical documentation, personnel data, financial records, exercise material, and reconnaissance artifacts reviewed to date Assessment The Integrity Technology Group leak from February 2026 on DarkForums, exposes a commercial cybersecurity company with capabilities directly relevant to state cyber operations. The files document APT intelligence collection […]

Analyse publiée le 3 août 2026 sur CyberThreat Report par Ferenc Frész, basée sur une annonce de vente de données apparue sur le forum DarkForums lors du premier week-end d'août 2026, sous le titre The Magyar Conquest.

Onderzoekers hebben sporen ontdekt op het dark web die mogelijk wijzen op de verkoop van gevoelige informatie van militaire en overheidsinstanties uit Pakistan, Bangladesh en de Verenigde Staten. De initiële aanwijzing kwam van een bericht op DarkForums, waarin een document over een dronepartnerschap tussen Turkije en Pakistan werd aangeprezen, met vermelding van technologieoverdracht, training, gezamenlijk onderzoek en inkoop door Baykar Teknoloji en Pakistan's National Aerospace Science and Technology Park. Het bericht op DarkForums bood geen duidelijkheid over de herkomst, authenticiteit of een mogelijke hack van het document. Echter, een contactidentificatie uit dit bericht bleek opnieu...

DarkForums Regains Control of Original Domain as Operators Announce Infrastructure Recovery: Dark Web recent claims Introduction The underground cybercrime ecosystem is constantly shifting as administrators of illicit forums battle domain seizures, infrastructure disruptions, denial-of-service attacks, and operational security challenges. Every domain migration or recovery may appear insignificant on the surface, but these changes often reveal valuable intelligence about how cybercriminal platforms adapt to survive increasing pressure from law enforcement agencies and cybersecurity researchers.

Introduction: A New Warning Sign From the Underground Cybercrime Economy The underground cybercrime world continues to reveal how valuable advanced software vulnerabilities have become. A newly surfaced post from a dark web intelligence monitoring account claims that a threat actor is attempting to sell a Windows Local Privilege Escalation (LPE) zero-day exploit for $120,000 on the DarkForums marketplace. The alleged vulnerability is described as a powerful Windows flaw capable of allowing attackers to gain SYSTEM-level privileges, the highest level of access available inside the operating system.

Even services built for private conversation sometimes betray themselves. The giveaway is not the content of the messages. Instead, it is the ordinary network infrastructure behind them. Analysts at Covert Security found that the DarkForums Jabber server does not run as a hidden Tor service. Rather, it sits on a normal public IP address. As a result, standard internet-infrastructure search tools can find it with ease.