ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 17, 2026

Product Serial: D-2026-08-17a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including ShinyHunters, Clop, Rhysida, and LeakedData.
Unauthorized Access Marketplace: Threat actor "Toton" advertised AnyDesk access with domain-user rights allegedly tied to an unnamed UK-based financial-services organization on the deep and dark web (DDW) forum DarkForums.
Vulnerability and Tooling Commercialization: Threat actor "grantall" auctioned three alleged SQL injection vulnerabilities in OpenCart plugins on the Russian-language DDW forum Exploit.
Vulnerability: An authentication-bypass vulnerability in Apple macOS Screen Sharing (CVE-2026-65400) was reported to be exploited by threat actors.
Data Dissemination and Telemetry: Forums hosted several breach and data sale claims referencing major organizations—including data sets allegedly tied to National Grid, SafePal, and CoFoundersLab, plus internal Azure employee databases from three global corporations advertised by "TheHatman." Separately, credential intelligence systems ingested over 1.7 billion combined compromised account credentials (CAC) and botnet CAC during the July 20 to August 16, 2026 reporting period.