Loading story…
Threat actors advertised multiple items on underground forums, including an alleged leak of a “Wendy’s International Franchise Database.” The dataset was described as containing franchise/location records (names, addresses, emails, coordinates) and operational metadata (hours, ordering/pickup/delivery flags, venue status, timezone/locale), with some records reportedly updated as recently as February 2026. Reporting also highlighted alleged exposure of technical and integration details, including Worldpay configuration elements (Apple Pay/Google Pay merchant IDs), Stripe pk_live publishable keys, and a Sentry DSN, which could increase risk via telemetry manipulation and infrastructure inference; the leak was also linked to a shared multi-brand ordering stack, with QikServe cited as likely underlying infrastructure, and no public confirmation from Wendy’s or the platform provider at the time of publication.
Separately, a threat actor listing advertised a low-cost ($30) alleged WhatsApp exploit/script claiming cross-platform disruption on Android and iOS, including app crash triggers, group chat freezing, and “call/video call bombing,” plus other spam/disruption features. The seller claimed the tool could be run without a VPS and with only a virtual number connection, suggesting low barriers to use and potential for nuisance/availability attacks against WhatsApp users if the claims are valid.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-23, reporting on the alleged Wendy’s dataset said the exposed material appeared current through February 2026 and may include Worldpay configuration data, Stripe publishable keys, and a Sentry DSN. At the time of reporting, no public acknowledgment had been issued by Wendy’s US, Wendy’s UK, or The Access Group.
On 2026-02-23, SOCRadar published findings on several newly observed forum posts, including the alleged Wendy’s franchise database leak, the WhatsApp exploit listing, and two AI-themed services marketed for illicit use: “Origin GPT” and an automated AI outbound-calling platform. The report highlighted their potential use in hacking assistance, phishing, voice fraud, and social engineering.
By 2026-02-23, threat intelligence researchers observed a dark web forum post advertising a $30 script that allegedly crashes WhatsApp on Android and disrupts iOS chats, with added features such as call/video-call bombing and “pair spam.” The seller claimed the tool could be run via Termux on Android and operated using only a virtual phone number.
On 2026-02-22, a threat actor allegedly posted and offered for download a dataset described as the “Wendy’s International Franchise Database.” The listing claimed exposure of franchise operational data, contact and location details, and technical configuration material including payment integration information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026
A hacktivist scraped and published **~500,000+ payment records** tied to consumer “stalkerware” services operated by the Ukrainian company **Struktura**, exposing customer email addresses and partial payment details. The leaked transactions include purchases for phone-tracking and monitoring brands such as **uMobix**, **Geofinder**, and **Peekviewer** (formerly *Glassagram*), and also reference transactions associated with other surveillance apps like **Xnspy**. The incident highlights ongoing security weaknesses in the commercial surveillance ecosystem, where operators’ poor security practices repeatedly expose sensitive customer—and often victim—data. Separately, mobile threat research reported a new Android malware family, **GhostChat**, distributing malicious APKs that impersonate popular chat apps (including **WhatsApp**) to intercept messages, steal credentials, and exfiltrate contacts and media by injecting code into the app process. While both stories involve mobile-user risk, the GhostChat activity is a distinct malware campaign and not directly related to the stalkerware payment-record leak; the stalkerware reporting also contextualizes the Struktura/uMobix exposure within a broader pattern of **dozens of stalkerware vendors** being hacked or leaking data since 2017, including multiple high-profile incidents in 2025 affecting victims’ messages, photos, call logs, and location data.
Jun 29, 2026