Threat reportThreat IntelligenceTL-2026-4818
2026 Dark Web Threat Trends: Infostealer Credential Markets, Ransomware Splintering, Deepfake KYC Bypass (JINKUSU CAM), Telegram Resilience, SaaS/Identity Breaches
2026 Dark Web Threat Trends (TL-2026-4818), also tracked as DarkOwl 2026 Dark Web Threat Trends, is a medium-severity tracked intrusion set, first published 2026-10-30. It is attributed to ShinyHunters with low confidence, affects Microsoft Microsoft 365 / Entra ID SSO, maps to 16 MITRE ATT&CK techniques (T1078.004, T1110, T1190), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 2ShinyHunters
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-4818
- Threat ID
- TL-2026-4818
- Also known as
- DarkOwl 2026 Dark Web Threat Trends
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- ShinyHunters, The Gentlemen
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, retail, food-service, technology, construction, real-estate
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in 2026 Dark Web Threat Trends
Malware and tooling: AgendaCrypt, LockBit 3.0 - S1202, Starkiller, SystemBC - S9001, The Gentlemen ransomware, vect, EDRStartupHinder, JINKUSU CAM, NetExec, Velociraptor
How 2026 Dark Web Threat Trends works
DarkOwl's 2026 trend report describes five converging underground trends: infostealer-sourced credential markets (2.86B compromised credentials in 2025; 51.7M infostealer packages, up 72%), ransomware fragmentation (146 active groups by June 2026), the ~$15-per-attempt JINKUSU CAM deepfake KYC-bypass kit, Telegram criminal-channel resilience despite 43.5M blocks in 2025, and SaaS/identity breaches such as the ShinyHunters-claimed Panera Bread incident.
This is an aggregate trend record built from a single DarkOwl vendor blog (published 2026-10-30) and corroborated against primary or secondary reporting where available. It contains no CVEs, CVSS scores or network IOCs in the source; severity is an analyst judgment.
Trend 1 - Infostealer credential markets: DarkOwl cites KELA (2.86 billion compromised credentials circulating in criminal markets in 2025) and Constella (51.7 million infostealer packages processed in 2025, up 72%). Stolen logs are bundled into combolists and listed on markets such as Russian Market within about 48 hours. Corporate VPN or identity-provider access sells for roughly $100-$500. Session-cookie theft lets attackers bypass MFA, and the same access feeds vishing, session hijacking and MFA-fatigue attacks against identity providers.
Trend 2 - Ransomware splintering: Black Kite tracked 146 active ransomware groups by June 2026, about double the 2023 count, with 61 new groups in 12 months. The Gentlemen (a RaaS that appears to have splintered from Qilin affiliates; Unit 42 tracking per DarkOwl cites 580 claimed victims in 77 countries by July 2026) is the most prominent new entrant. Check Point's analysis of the leaked 'Rocket' backend describes a Go-based Windows/Linux locker, GPO-based spread, EDR-evasion tooling, NTLM relay, and initial access via exposed edge devices (FortiGate, Cisco) and access brokers. Vect appeared in January 2026 and was offline by mid-April 2026. Global Secret Group surfaced in mid-2026 using leaked LockBit 3.0 code (the LockBit 3.0 'Black' builder leaked in 2022).
Trend 3 - Deepfake KYC bypass: JINKUSU CAM was advertised on DarkForums in April 2026 (reported by the OECD AI Incident Monitor on 2026-04-06). It is an injection pipeline: GPU-accelerated real-time face swapping with facial-mesh tracking, delivered through a virtual camera (OBS or similar) so output appears as ordinary webcam input, plus voice modulation and presets for major crypto exchanges (Binance, Coinbase, Kraken, OKX). Cost is about $15 per attempt. The seller, Jinkusu, is suspected to be the same actor behind the Starkiller phishing kit (February 2026). It defeats passive/active liveness because presentation-attack detection inspects the correct data at the wrong layer of the stack.
Trend 4 - Telegram resilience: Telegram blocked more than 43.5 million channels and groups in 2025 (daily takedowns of 80,000-140,000, peaking above 500,000). Check Point found no meaningful migration to rival platforms; criminals adapt with 'Request to Join' gates, message forwarding between channels and pre-built backup channels. DarkOwl notes roughly 3 million underground Telegram invite links shared over three months, and Discord at about 6% of Telegram volume.
Trend 5 - SaaS/identity breaches: ShinyHunters claimed about 14 million Panera Bread records in early 2026 via Microsoft Entra SSO, in a wider campaign against Okta, Microsoft and Google SSO that used voice phishing. Subsequent reporting put unique affected individuals nearer 5.1 million. Microsoft 365, Google Workspace and Salesforce tenants are the main targets.
Defensive implications: phishing-resistant MFA and device-bound sessions, rapid session revocation, infostealer-log monitoring for corporate domains, SaaS tenant exfiltration monitoring, vishing-resistant help-desk verification, hardened edge devices, and KYC flows with hardware attestation and injection-attack detection.
MITRE ATT&CK techniques used in TL-2026-4818
Initial Access
T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1566.004 Spearphishing Voice
Credential Access
T1110 Brute Force; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1557.001 Name Resolution Poisoning and SMB Relay; T1621 Multi-Factor Authentication Request Generation
defense-impairment
T1484.001 Group Policy Modification; T1685 Disable or Modify Tools
Collection
lateral-movement
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1588.002 Tool; T1650 Acquire Access
Defense Evasion
Affected products and versions in 2026 Dark Web Threat Trends
- Microsoft — Microsoft 365 / Entra ID SSO
Vulnerable versions: Tenants without phishing-resistant MFA or session protection - Google — Google Workspace
Vulnerable versions: Tenants without phishing-resistant MFA or session protection - Salesforce — Salesforce
Vulnerable versions: Tenants targeted via SSO compromise - Various — Webcam-based KYC / liveness verification (crypto exchanges, banks)
Vulnerable versions: Passive/active liveness without injection-attack detection
Remediation for 2026 Dark Web Threat Trends
Immediate actions
- Monitor infostealer-log and combolist exposure for corporate domains and force credential plus session revocation for exposed accounts
- Revoke active SaaS/SSO sessions and refresh tokens for users with exposed credentials
- Brief help desk and staff on voice-phishing attacks targeting Okta, Microsoft Entra and Google SSO codes
- Alert on bulk data exports from M365, Google Workspace and Salesforce tenants
Workarounds
- Conditional access policies restricting sign-in to managed devices and trusted locations
- Velocity and anomaly monitoring on new account creation to catch deepfake-driven KYC bypass
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/passkeys) and device-bound or token-bound sessions
- Harden and patch internet-facing edge devices (VPN, firewall) and remove default management exposure
- Add hardware attestation, injection-attack detection and behavioral biometrics to KYC/onboarding flows
- Deploy EDR with tamper protection and monitor GPO changes for ransomware spread
Timeline of 2026 Dark Web Threat Trends
- Vect ransomware group appears (January 2026; day not stated in source, month-level precision); it is offline by mid-April 2026.
- Starkiller phishing kit released (February 2026, month-level precision); its seller Jinkusu is later suspected to be behind JINKUSU CAM.
- The Gentlemen ransomware claims an attack on Global Group, an India-based construction and real-estate company (per secondary reporting).
- Check Point research on Telegram's 2025 takedowns (43.5M channels/groups blocked) is publicly reported, finding no meaningful migration of cybercriminals to rival platforms.
- OECD AI Incident Monitor records JINKUSU CAM, a ~$15-per-attempt deepfake KYC-bypass kit advertised on DarkForums.
- Vect ransomware group goes offline by mid-April 2026 (approximate date).
- The Gentlemen's internal 'Rocket' backend database is leaked (May 2026, month-level precision), exposing operators, chats and 1,570+ victims.
- Black Kite counts 146 active ransomware groups by June 2026, about double the 2023 figure, with 61 new groups in 12 months; Global Secret Group surfaces mid-2026 using leaked LockBit 3.0 code.
- DarkOwl publishes 'Things That Go Bump in the Dark Web: 2026's Scariest Threat Trends' consolidating the five trends.
Sources cited for 2026 Dark Web Threat Trends
- Things That Go Bump in the Dark Web: 2026's Scariest Threat Trends (DarkOwl)
- Thus Spoke the Gentlemen (Check Point Research)
- Telegram's Crackdown in 2026 and Why Cyber Criminals Are Still Winning (Check Point)
- KYC Bypass-as-a-Service: The $15 Deepfake Threat (JoinBLE)
- AI Deepfake Tools Bypass KYC, Fueling Financial Fraud in Crypto and Banking (OECD AI Incident Monitor)
- ShinyHunters Claims 14M Panera Bread Records Exposed in Data Breach (TechRepublic)
- Panera Bread data breach exposed personal info of 5.1 million customers (CyberInsider)
- Who Are The Gentlemen? (Fortra)
- When the Ransomware Gang Gets Hacked: What The Gentlemen Leak Reveals (Check Point)
- New deepfake tool shows why face alone is no longer proof of identity (Biometric Update)
Detection coverage for TL-2026-4818
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4818 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.