DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

1. Credit Card Theft – Card Data Extraction Process Hacker memory analysis reveals that DarkTortilla RAT targets credit card information, including card numbers, expiration dates, and card types. Key Strings Observed: cardnumberencrypted – Encrypted card numbers. expirationmonth – Expiration...

Adamantium-Thief

🔓 Adamantium-Thief Get chromium based browsers: passwords, credit cards, history, cookies, bookmarks, autofill. Chrome 80 is supported! Need firefox passwords decryptor? 🌿 Examples: 🔑 Get passwords from browsers: Stealer.exe PASSWORDS 💳 Get credit cards from browsers: Stealer.exe CREDITCARDS 🕘 Ge...

memscan

memscan Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space Memory/Process Scanner Written by Matt Lewis, NCC Group 2014 Updated by Tom Watson, NCC Group 2015 Thanks to Jesse Bullock for lots of great ideas Released as open source by NCC Gro...

Malicious code in saeka (PyPI)

Source: kam193 67507c9821e48c6f8284a142ae4788a9624ea608f782bf254573dae4936e7a04 The package is a mass credit card checker: it checks if credit card data are real and active by abusing real online retail services. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete...

MAL-2026-17877 Malicious code in saeka (PyPI)

When a user invokes the card-checking feature, saeka sends the supplied card number, expiration month and year, and CVV as a single value to https://uncoder.eu.org/cc-checker/api.php using an HTTP POST. The package description does not disclose this external recipient or the transfer of complete...

VulnCheck KEV: CVE-2026-4394

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field input.4 in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail method in the GFFieldCreditCard class outputting the card type value...

Convincing Free Mobile phishing emails appear after data breach

Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account detail...

Convincing Free Mobile phishing emails appear after data breach

Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account detail...

Old-School Credit Card Scams Are Far From Dead

In an era of increasingly sophisticated AI-fueled scams, a retro threat may be lurking in your mailbox...

Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card Records

Gambit Security found AI agents breached 27 companies, stole 600,000 credit card records and installed payment skimmers across compromised retail sites...

CVE-2026-94292

A flaw was found in Epiphany GNOME Web. The autofill visibility check only tests an element's on-screen size and fails to detect form fields hidden via CSS properties such as display:none, visibility:hidden, or opacity:0. A malicious web page can include hidden form fields that are silently...

ICE Is Buying Access to Credit Card Records

Through data brokers, ICE is buying the information you provided to open a credit card...

We found 120 fake Walmart stores trying to steal your credit card

Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV. The sites have no connection to Walmart. They're part of a netwo...

AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android

Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack path combining "unrealistic browser-malware concepts with a real browser capability" to turn it into a working ransomware technique that runs entirely inside the browser on both...

CVE-2026-4394

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field input.4 in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail method in the GFFieldCreditCard class outputting the card type value...

WS-2019-0480

Stream-combine v2.0.2 contains malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server if your application has Content Security Policy set you a...

The Race Is on to Keep AI Agents From Running Wild With Your Credit Cards

AI agents may soon be buying your stuff for you. The FIDO Alliance has teamed up with Google and Mastercard to try to ensure that shopping in the near future isn't a complete disaster...

Scalable and Verifiable Federated Learning for Cross-Institution Financial Fraud Detection

The global financial ecosystem confronts a critical asymmetry: while fraud syndicates operate as borderless, distributed networks, banking institutions remain constrained by regulatory data silos, limiting visibility into cross-institutional threat patterns under strict privacy laws such as GDPR...

EUVD-2026-19990

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field input.4 in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail method in the GFFieldCreditCard class outputting the card type value...