u/BTC-brother2018

DOJ details bank-phishing operation that bought search ads to lure victims to fake banking sites

The U.S. Justice Department announced the extradition of a Russian national accused of participating in a large-scale bank-account takeover operation responsible for millions of dollars in losses.

The technique is particularly relevant for beginners: the group allegedly created spoofed domains mimicking real banks and then purchased sponsored search-engine advertisements so people searching for their bank could be directed to fraudulent login pages. Victims entered credentials believing they had reached the real institution.

Search results — especially sponsored results — should not be treated as authentication. For sensitive services such as banks, cryptocurrency exchanges or wallets, use a previously verified bookmark or independently verify the domain rather than trusting an advertisement.

https://www.justice.gov/opa/pr/russian-national-extradited-united-states-bank-account-takeover-fraud-scheme-causing

Tor Browser 15.0.22 released today for high-severity Tor security issues

✅ Confirmed — official Tor Project release, September 9.

The Tor Project released Tor Browser 15.0.22 today, updating the bundled Tor daemon to 0.4.9.12. The underlying Tor release was issued last night specifically to address a series of high-severity security issues. The Tor Project is deliberately withholding most technical details for roughly a week to give users and operators time to patch.

More unusually, Tor says it is still working on additional important security issues and is moving C-tor to a two-week release cadence for now. The next planned release is around September 22, although that could change if another urgent fix is required.

Why it matters: Tor Browser users should update to 15.0.22 as soon as possible rather than waiting for disclosure of the vulnerabilities. Relay and onion-service operators running C-tor should update to 0.4.9.12 as well. The fact that Tor calls the issues high severity, recommends immediate updating, and says more security work is underway makes this especially significant.

https://blog.torproject.org/new-release-tor-browser-15022/

EFF publishes a practical anti-doxxing guide focused on reducing your OSINT footprint

Confirmed — Electronic Frontier Foundation, late August.

EFF has published new guidance on preventing and responding to doxxing, including reviewing breach databases, public records, username reuse, social-media discoverability, data brokers and reverse-image-search exposure.

It specifically explains how attackers can combine small pieces of publicly accessible information into a larger profile using OSINT techniques.

EFF also published a companion incident-response installment on August 31 covering what to do once a doxxing incident is underway.

I have read the rules.

https://www.eff.org/deeplinks/2026/08/doxxing-safety-pt-i-prevention-and-footprint-management

Tor website fingerprinting looks more practical than many older lab studies suggested

A March 8, 2026 paper, “Reality Check for Tor Website Fingerprinting in the Open World,” tested website fingerprinting against a much more realistic background of actual Tor traffic. The researchers built a dataset of 800,000+ traces and reported their best attack reaching about 95.6% precision and 92.2% recall at a 9% monitored-site base rate. Importantly, the attack remained effective despite network jitter, smaller training sets, and changing network conditions.

What changed: website-fingerprinting research has historically been criticized for artificial closed-world experiments, basically, “pick which of these 100 sites the person visited.” This work moves closer to the difficult real-world problem: determining whether a user visited one of a few monitored destinations amid huge amounts of unrelated Tor traffic.

The researchers also found that classifiers relying less heavily on precise timing were surprisingly robust. That reinforces an important concept: encryption hides packet contents, but not necessarily packet direction, burst structure, volume, and sequence. Tor therefore protects what the packets contain much better than it eliminates every observable traffic pattern. Read about it here: 👇

https://arxiv.org/abs/2603.07412

The practical lesson I'd draw is:

Tor hides destinations cryptographically, but encrypted traffic isn't information-free.

Tor remains extremely valuable for anonymity, but users with a threat model involving a sophisticated adversary specifically targeting their Tor activity should treat traffic analysis/website fingerprinting as a legitimate threat, not merely an academic laboratory attack. imo

For the typical person using Tor to prevent websites from learning their IP address, bypass censorship, or reduce ordinary tracking, this paper isn't a reason to stop using Tor.

🐕 Can Dogs Sense When Their Owners Are Coming Home?

Many dog owners claim their dogs somehow know when they're coming home—even before they arrive.

I noticed my lab Daisy was always in the window when I arrived home from work. It didn't matter if I left work early and arrived home at a different time either, she was still in the window waiting. So I thought are dogs somehow phycic? So I searched online and found this study.

Researcher Rupert Sheldrake and Pam Smart studied this phenomenon with a dog named Jaytee. In some of their videotaped experiments, Jaytee's owner returned home at randomly selected times after she had already left, making her return less predictable from her normal routine.

In the randomized experiments, Jaytee reportedly spent about 4% of the main period of his owner's absence at the window, compared with 55% of the period when she was traveling home.

What was Jaytee detecting? A subtle cue we don't understand? Something about his owner's return? Or something else entirely?

Take a look at the study and decide for yourself. 🐶🔮

Sheldrake & Smart — A Dog That Seems to Know When His Owner is Coming Home: Videotaped Experiments and Observations

https://www.sheldrake.org/research/animal-powers/a-dog-that-seems-to-know-when-his-owner-is-coming-home-videotaped-experiments-and-observations

Fake “Claude” desktop app is stealing cryptocurrency wallets and passwords

Confirmed campaign — security researchers; reported September 1.

Researchers have identified RevStealer, a Windows information stealer being distributed through a fake application pretending to provide free access to an Anthropic Claude model. The malware targets data associated with more than 50 cryptocurrency wallet applications, along with browser credentials, password managers, VPN credentials, session data, clipboard contents and documents.

The malware also performs anti-analysis checks and attempts to operate quietly. Researchers found a particularly interesting resilience technique: if its normal command server fails, it can retrieve a replacement address from information stored through a Polygon smart contract.

Why it matters: The bigger beginner lesson isn’t just “avoid this particular fake app.” It is don’t download unofficial cracked/free versions of paid software from random GitHub repositories, advertisements or cloned websites. A wallet-stealing infostealer can compromise far more than one crypto account.

https://www.helpnetsecurity.com/2026/09/01/revstealer-malware-claude-opus-5-github/

https://www.scworld.com/news/revstealer-malware-spread-through-fake-claude-opus-5-download

Fake crypto “AML checkers” are actively trying to drain wallets

Malwarebytes threat research, with continued activity reported today. Malwarebytes documented sites impersonating legitimate cryptocurrency AML-screening services. Instead of merely examining a public address, the fraudulent pages attempt to persuade victims to connect a wallet and approve attacker-generated transactions. A real basic AML check only requires the public wallet address; it does not require your seed phrase, private key, wallet connection, token approval, or transaction signature.

https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet

🔐 Darknet-Questions Is Back — Rebuilt on Discourse

Some of you may remember the original

r/darknet_questions community on Reddit. After the subreddit was banned, I decided not to let years of educational work and community knowledge disappear.

So I've started rebuilding it from the ground up on Discourse, using an older backup of the Wiki I had saved from the original community., and my data I requested from reddit.

🔗Links:

https://darknet-questions.discourse.group/

• Invite Link: https://darknet-questions.discourse.group/invites/K6D58xNgRo

• Android: https://play.google.com/store/apps/details?id=com.discourse

• iPhone/ipad: https://apps.apple.com/us/app/discourse-hub/id1173672076

The new Darknet Questions has the same basic mission as the old community: darkweb education, harm reduction, privacy, OPSEC, scam awareness, and helping beginners learn without getting burned. Also helping the more advanced learn things they might not know.

📚 What we're rebuilding:

Tor & Onion Services — Tor Browser, onion services, troubleshooting, and safety

Privacy & OPSEC — practical security and privacy education

PGP & Encryption — beginner-friendly guides and help

Tails, Whonix & Privacy Tools — tutorials, recommendations, and troubleshooting

Scam & Phishing Awareness — recognizing fake links, impersonators, and common scams

Wiki & Guides — rebuilding and updating the educational resources from the old community

Questions & Discussions — a place where newcomers can ask questions without being afraid to admit they're new

Old members and newcomers are welcome

If you were part of the original r/darknet_questions, I'd love to see you over there again.

And if you've never been part of the community before, you're just as welcome.

This isn't a marketplace. Darknet Questions is an educational community focused on privacy, security, technology, harm reduction, and helping people avoid scams and dangerous mistakes.

The old community may be gone, but the knowledge doesn't have to be.

We're rebuilding. Come join us.

👉 https://darknet-questions.discourse.group/

The Tor Project released Tor Browser 16.010 on August 27. The alpha includes Firefox security updates, a redesigned settings interface, and a newly updated built-in Tor Browser manual accessible through about:manual. Tor explicitly warns that this is a testing release, not the version ordinary or high-risk users should switch to.

This gives a preview of changes that may eventually reach stable Tor Browser, especially the new settings layout covering connectivity, letterboxing, and security levels. For beginners, the important message is: stay on stable Tor Browser unless you specifically want to test alpha builds.

https://blog.torproject.org/new-alpha-release-tor-browser-160a10/

Someone posted a $2,000 XMR bounty for my identity and IP address on Dread

EDIT: Dread user account banned for bounty post (doxxing) Bounty post removed. 8/30/2026

I recently found this post on Dread offering $2,000 in XMR to anyone who could obtain the name and IP address of Reddit user u/BTC-brother2018, my account.

The poster falsely claims that I am a scammer.

I previously moderated an educational darknet-safety community darknet_questions focused on harm reduction, OPSEC, scam awareness, and removing illegal content.

I’m sharing this because offering money to uncover someone’s real identity and location is a serious threat—not ordinary criticism or internet drama. I have reported the relevant activity through the appropriate channels and preserved the evidence.

I am not asking anyone to identify, contact, threaten, or harass the person who posted it. Please do not engage with them. I’m posting this only to document what happened and raise awareness.

I cannot prove that this bounty was connected to the earlier removal of my subreddit, but this is the second bounty that has been posted on dread.