Rolladen Planet Data Sale, Windows 0-Day, and New macOS RAT Detected

SOCRadar’s Dark Web Team has identified multiple new underground listings this week, including a customer database sale linked to Rolladen Planet, a German retailer, alongside new tools for Windows and macOS and a modular macOS Remote Access Trojan. The alleged Rolladen Planet database sale is priced at $600 and the listing claims to contain extensive PII and business data, including names, contact details, addresses, VAT IDs and internal customer numbers.

In addition, a new listing for Flex Stealer describes a fully managed service that can harvest browser data, game platform credentials, session tokens and cryptocurrency wallets, and can host secondary payloads such as miners or RATs. According to the threat actor, a separate 0-day Windows Local Privilege Escalation exploit is on sale for $45,000 and is claimed to work on Windows 10 and 11, Windows Server 2019 through to Windows Server 2025 with updates considered.

A macOS RAT is also advertised, described as modular and WebSocket‑driven for x86_64 and ARM64, with pricing of $2,000 for a single module or $5,000 for the full three-module set, plus optional persistence features.