short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
Intelligence firms and US agencies have moved past asking whether criminals use AI. Flashpoint's monthly reporting, a joint NSA and FBI advisory, and two documented intrusion cases show exactly where large language models now sit inside illicit workflows.
Initial access brokers now advertise corporate VPN, RDP and admin credentials alongside active recruitment of employees on messaging apps. Flashpoint's latest insider threat data shows a market that has professionalized faster than most defenses.
A ransomware affiliate posing as a recovery service contacted victims mid-attack, offering decryptors and data deletion for a fee. How the double-dip scam works, the red flags, and what legitimate incident response actually looks like.
Truffle Security re-verified four years of publicly leaked AWS access keys and found 88 percent of them still authenticate, including 768 that grant full control of corporate accounts. Here is what that means for self-hosters running onion infrastructure.
CISA, the FBI and HHS now count more than 500 Medusa victims, over 200 of them in the past year alone. A look at how the group's Tor-hosted leak site works and what it says about the wider 2026 extortion ecosystem.
Compromised maintainer accounts pushed malicious crate versions whose build scripts ran malware at compile time, while trojanized npm packages delivered an AI-assisted Linux backdoor. Here is how these attacks work and why lockfiles matter.
The Android banking trojan ToxicPanda has been updated with 167 remote commands, overlay phishing for 349 financial apps, and a VPN-service trick that cuts victims off from Google Play while it works.
Researchers showed that a man-in-the-middle relay can rewrite the expiry date a POS terminal reads from an expired Visa card, reviving dead plastic for real purchases. We explain the mechanics, why the carding scene noticed, and where the attack stops.
Every uptime percentage on this site now comes from a rolling 7-day window instead of an all-time counter. Here is what changed, why it matters, and how to read any uptime stat.
A year after Operation Deep Sentinel killed Archetyp Market, no credible relaunch has surfaced. Instead the darknet scene scattered into smaller, riskier pieces.
Circuits rotate every ten minutes, introduction points shed load, guards drop. Why one failed probe means almost nothing on Tor - and how we retry before believing it.
A mid-sized market has stopped processing withdrawals for more than a week while still accepting deposits. Staff blame technical issues; veterans suspect a familiar ending.
