# 2026 Dark Web Threat Trends: Infostealer Credential Markets, Ransomware Splintering, Deepfake KYC Bypass (JINKUSU CAM), Telegram Resilience, SaaS/Identity Breaches

> DarkOwl's 2026 trend report describes five converging underground trends: infostealer-sourced credential markets (2.86B compromised credentials in 2025; 51.7M infostealer packages, up 72%), ransomware fragmentation (146 active groups by June 2026), the ~$15-per-attempt JINKUSU CAM deepfake KYC-bypass kit, Telegram criminal-channel resilience despite 43.5M blocks in 2025, and SaaS/identity breaches such as the ShinyHunters-claimed Panera Bread incident.

- **Published:** 2026-10-30T10:13:33Z
- **Last reviewed:** 2026-10-30T10:13:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4818
- **ID:** TL-2026-4818
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is an aggregate trend record built from a single DarkOwl vendor blog (published 2026-10-30) and corroborated against primary or secondary reporting where available. It contains no CVEs, CVSS scores or network IOCs in the source; severity is an analyst judgment.

Trend 1 - Infostealer credential markets: DarkOwl cites KELA (2.86 billion compromised credentials circulating in criminal markets in 2025) and Constella (51.7 million infostealer packages processed in 2025, up 72%). Stolen logs are bundled into combolists and listed on markets such as Russian Market within about 48 hours. Corporate VPN or identity-provider access sells for roughly $100-$500. Session-cookie theft lets attackers bypass MFA, and the same access feeds vishing, session hijacking and MFA-fatigue attacks against identity providers.

Trend 2 - Ransomware splintering: Black Kite tracked 146 active ransomware groups by June 2026, about double the 2023 count, with 61 new groups in 12 months. The Gentlemen (a RaaS that appears to have splintered from Qilin affiliates; Unit 42 tracking per DarkOwl cites 580 claimed victims in 77 countries by July 2026) is the most prominent new entrant. Check Point's analysis of the leaked 'Rocket' backend describes a Go-based Windows/Linux locker, GPO-based spread, EDR-evasion tooling, NTLM relay, and initial access via exposed edge devices (FortiGate, Cisco) and access brokers. Vect appeared in January 2026 and was offline by mid-April 2026. Global Secret Group surfaced in mid-2026 using leaked LockBit 3.0 code (the LockBit 3.0 'Black' builder leaked in 2022).

Trend 3 - Deepfake KYC bypass: JINKUSU CAM was advertised on DarkForums in April 2026 (reported by the OECD AI Incident Monitor on 2026-04-06). It is an injection pipeline: GPU-accelerated real-time face swapping with facial-mesh tracking, delivered through a virtual camera (OBS or similar) so output appears as ordinary webcam input, plus voice modulation and presets for major crypto exchanges (Binance, Coinbase, Kraken, OKX). Cost is about $15 per attempt. The seller, Jinkusu, is suspected to be the same actor behind the Starkiller phishing kit (February 2026). It defeats passive/active liveness because presentation-attack detection inspects the correct data at the wrong layer of the stack.

Trend 4 - Telegram resilience: Telegram blocked more than 43.5 million channels and groups in 2025 (daily takedowns of 80,000-140,000, peaking above 500,000). Check Point found no meaningful migration to rival platforms; criminals adapt with 'Request to Join' gates, message forwarding between channels and pre-built backup channels. DarkOwl notes roughly 3 million underground Telegram invite links shared over three months, and Discord at about 6% of Telegram volume.

Trend 5 - SaaS/identity breaches: ShinyHunters claimed about 14 million Panera Bread records in early 2026 via Microsoft Entra SSO, in a wider campaign against Okta, Microsoft and Google SSO that used voice phishing. Subsequent reporting put unique affected individuals nearer 5.1 million. Microsoft 365, Google Workspace and Salesforce tenants are the main targets.

Defensive implications: phishing-resistant MFA and device-bound sessions, rapid session revocation, infostealer-log monitoring for corporate domains, SaaS tenant exfiltration monitoring, vishing-resistant help-desk verification, hardened edge devices, and KYC flows with hardware attestation and injection-attack detection.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1078.004 Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1621 Multi-Factor Authentication Request Generation
- T1110 Brute Force
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1550.004 Web Session Cookie
- T1685 Disable or Modify Tools
- T1484.001 Group Policy Modification
- T1684.001 Impersonation
- T1650 Acquire Access
- T1588.002 Tool
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service

## Sources

- [Things That Go Bump in the Dark Web: 2026's Scariest Threat Trends (DarkOwl)](https://www.darkowl.com/blog-content/things-that-go-bump-in-the-dark-web-2026s-scariest-threat-trends/)
- [Thus Spoke the Gentlemen (Check Point Research)](https://research.checkpoint.com/thus-spoke-the-gentlemen/)
- [Telegram's Crackdown in 2026 and Why Cyber Criminals Are Still Winning (Check Point)](https://blog.checkpoint.com/research/telegrams-crackdown-in-2026-and-why-cyber-criminals-are-still-winning/)
- [KYC Bypass-as-a-Service: The $15 Deepfake Threat (JoinBLE)](https://joinble.io/blog/kyc-bypass-as-a-service-deepfake-fraud)
- [AI Deepfake Tools Bypass KYC, Fueling Financial Fraud in Crypto and Banking (OECD AI Incident Monitor)](https://oecd.ai/en/incidents/2026-04-06-c4a3)
- [ShinyHunters Claims 14M Panera Bread Records Exposed in Data Breach (TechRepublic)](https://www.techrepublic.com/article/news-panera-bread-data-breach/)
- [Panera Bread data breach exposed personal info of 5.1 million customers (CyberInsider)](https://cyberinsider.com/panera-bread-data-breach-exposed-personal-info-of-5-1-million-customers/)
- [Who Are The Gentlemen? (Fortra)](https://www.fortra.com/blog/gentlemen-ransomware-what-you-need-know)
- [When the Ransomware Gang Gets Hacked: What The Gentlemen Leak Reveals (Check Point)](https://blog.checkpoint.com/research/when-the-ransomware-gang-gets-hacked-what-the-gentlemen-leak-reveals-about-modern-ransomware-risk/)
- [New deepfake tool shows why face alone is no longer proof of identity (Biometric Update)](https://biometricupdate.com/202604/new-deepfake-tool-shows-why-face-alone-is-no-longer-proof-of-identity)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4818