short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
The third version of the German-language fraud forum Crimenetwork ended like its predecessors: with a seizure banner on its domain. The BKA's August action against c-network.to follows a May arrest on Mallorca and a March prison sentence, and fits a pattern in which every relaunch of the brand has collapsed faster than the last.
Attackers used leaked GitHub developer tokens to push a credential-stealing payload as litellm v1.107.0 to PyPI and Docker Hub on October 21, 2026 — the project's second pipeline compromise of 2026, after March's TeamPCP backdoor. Cloud keys, Kubernetes secrets and AI API keys were among the targeted data.
Two alleged leaders of the ShinyHunters data-theft and extortion group have been taken into custody weeks apart: a 24-year-old in the Netherlands and an 18-year-old detained in Jordan. Reports that the detainee in Jordan is cooperating with the FBI remain unverified.
Police in Greece, Romania, Spain and the United Kingdom seized the KillSec ransomware group's leak site and five servers on 30 September 2026 and arrested three suspects. Europol says the suspected administrator is a 16-year-old from Romania and links the group to around 1,000 attacks and an estimated EUR 4 million in damages.
Former NCA investigator Paul Chowles stole 50 bitcoins from a 2017 seizure that were then worth about GBP 60,000 and about GBP 4.4 million by sentencing. On 30 September 2026 he was ordered to repay GBP 1,810,678.93. The case is a study in insider risk within a seizure chain.
Interpol's Operation Serengeti III brought together investigators from 20 African countries and the United States. Two months of coordinated enforcement produced 1,462 arrests, 10,909 disrupted networks and more than USD 105 million recovered.
Tor Browser 15.0.25, released on 12 October 2026, backports security fixes from Firefox 158 onto the Tor userbase, alongside updates to Tor 0.4.9.14, NoScript and OpenSSL. Here is what the release actually changes, why it lands in step with Mozilla's advisory, and the update routine that matters.
In a 14-page submission to the European Commission for the 2027 EU Counterfeit and Piracy Watch List, Spain's football league asked for four consumer VPN providers to be named. The stated basis is not VPN use itself but affiliate marketing guides that instruct users to bypass geo-blocks and court-ordered blocking.
Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained a hardware implant hidden behind the display, capturing 24-word recovery phrases during setup and transmitting wallet keys over a mobile network. According to Bitquery, unconfirmed by Ledger, suspected losses reach $93.2 million across 315 wallets on six chains; Tether has frozen roughly $10 million in USDT.
A joint operation by North Macedonia's cybercrime unit and the FBI has led to the arrest of a 20-year-old alleged operator of the OLVX cybercrime marketplace, which reportedly generated more than $500,000 in illicit sales of stolen data and login credentials. Investigators also examined evidence tied to his Telegram activity, including a refund-fraud group he allegedly ran.
PHP shipped out-of-band releases today for two critical use-after-free bugs enabling unauthenticated remote code execution. Sites running PHP - especially onion services - should update and restart all workers now.
The blockchain-analytics firm says an external actor used AI-driven “offensive agentic techniques” to access its systems and internal tools, exposing user IDs, names, email addresses and role labels. Investigation content and credentials were not accessed, according to the company.
