BRIEFOtherlowP38
Colombia bulk SMS panel with 631,543 credits for sale
Colombia (plataforma de SMS masivos)
Detected24 September 2026 · 23:47 UTC
A seller is offering a bulk SMS platform preloaded with 631,543 credits (1 credit = 1 SMS) targeting Colombian numbers. Such panels are typically abused for mass smishing, OTP interception and fraud campaigns against banks and telecom customers. It matters because it provides ready-to-use infrastructure for large-scale SMS fraud in the region, even if the panel itself is not a direct breach.
CategoryOther
Severitylow
Priority score38
Detected24 September 2026 · 23:47 UTC
OtherPriority 68
Doxeo del secretario de Seguridad de la CDMX Omar García HarfuchA user 'GhostVibe' posted on DarkForums a dox targeting Omar García Harfuch, Mexico City's Secretary of Citizen Security, on 10 November 2026. Publishing personal data of a senior law-enforcement/security official exposes targeting, harassment and physical-security risks. Such doxes against high-profile government figures are operationally sensitive and often precede escalation against institutions.OtherPriority 45
Código del botnet bancario Ermac v3.0 filtrado en DarkForumsA DarkForums actor (Bryxhokal) shares a 'cracked tools' release of the Ermac banking botnet, version 3.0, an Android malware family historically used against Latin American and European banks. Wider availability of the builder lowers the barrier for new fraud crews targeting mobile banking customers, especially in Brazil, Mexico and Spain. Defenders in retail banking should anticipate new Ermac-derived overlays and SMS-stealing campaigns.OtherPriority 45
Filtración de logs de chat del grupo de ransomware BlackBastaUser 'Markelok' posted 'BlackBasta Chat logs Leaked' on DarkForums. Internal chat logs of a major ransomware-as-a-service group can reveal victim lists, negotiation tactics, tooling and affiliate identities of high CTI value. This helps defenders anticipate BlackBasta TTPs and identify prior or planned intrusions.OtherPriority 74
Config de credential stuffing dirigido a la teleco chilena VTRA credential-stuffing/cracking configuration aimed at the login of VTR, one of Chile's largest telecom and ISP operators, was posted in DarkForums' Configs section by user 'Mekdural'. Such configs enable automated password-guessing against subscriber and staff accounts, risking account takeover of critical telecommunications infrastructure. This is directly relevant to Latin American critical-infrastructure defenders.OtherPriority 48
Venta de planos de motores de misiles Tomahawk, JASSM y TaurusAn account using the handle 'NobawkeyKostao' is advertising what it claims are top-secret engineering drawings sufficient to manufacture engines for the Tomahawk, JASSM and Taurus cruise missiles, a listing reposted repeatedly across Spear and DarkForums seller sections. If authentic, the material would affect several Western defense programs and export-controlled technology; if fabricated, it indicates fraud aimed at state or broker buyers. Neither authenticity nor attribution has been verified.OtherPriority 38
Publican detalles de explotación de una vulnerabilidad en GenieACSA Cracked.st user (bbxx7) is circulating information on a weakness in GenieACS, the open-source TR-069 auto-configuration server many ISPs use to manage customer routers and CPE at scale. Compromise of an ACS instance can push configuration changes to large subscriber fleets, enabling DNS hijacking, credential capture or mass device reconfiguration. The post is informational rather than an access sale, but telecom operators running exposed GenieACS instances should treat it as an actionable exposure check.