ZeroFox Daily Deep and Dark Web Intelligence

ZeroFox Daily Deep and Dark Web Intelligence - August 25, 2026

Product Serial: D-2026-08-25a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

Ransomware and Digital Extortion: New leak site entries were posted by multiple threat actor groups, including LockBit 5.0, Rhysida, Storm, CoinbaseCartel, and Booba Project.
Unauthorized Access Marketplace: Threat actors advertised network access to unnamed organizations, including domain user rights allegedly tied to a Sweden-based software company and an auction for root access to a large web analytics service tied to a research platform, on deep and dark web (DDW) forums.
Vulnerability and Tooling Commercialization: Threat actors offered exploits and attack tooling, including source code for a WordPress plugin zero-day, a one-day XSS exploit for Outlook and Zimbra, and a phishing kit named "Fasa" advertised for rent.
Data Dissemination and Telemetry: Threat actors posted several large-scale data sale claims, including over 100 alleged Brazilian data sets and U.S. and EU credential and consumer database listings. Separately, credential intelligence systems ingested over 2 billion combined compromised account credentials (CAC) and botnet CAC over the July 28–August 24, 2026 reporting period.