2026 Dark-Web Trends: Stolen Credentials, Ransomware Splintering and Deepfake KYC Kits
Summary
DarkOwl’s 2026 roundup describes reused infostealer credentials, splintering ransomware crews, a reportedly marketed deepfake KYC kit, resilient criminal Telegram channels and identity-led SaaS data theft, with mitigation advice.
Key points
- KELA tracked 2.86 billion compromised credentials circulating in criminal markets in 2025; Constella processed 51.7 million infostealer packages, up 72%.
- Infostealer logs can contain session cookies that may bypass MFA, along with saved passwords and other sensitive data; the article says logs can be tested and listed quickly.
- Black Kite counted 146 active ransomware groups by June 2026. The article describes affiliate movement between groups, use of leaked LockBit 3.0 code and extortion crews that skip encryption.
- A threat actor reportedly advertised JINKUSU CAM on DarkForums in April 2026 for about $15 per KYC bypass attempt; the kit was described as enabling real-time face swapping and voice modulation.
- Check Point reported that Telegram blocked more than 43.5 million channels and groups in 2025, while criminals adapted with backup channels, join gates and forwarded messages.
- Threat actors reportedly use vishing, session hijacking or MFA fatigue to access SSO and export data from SaaS tenants. Data tied to around 14 million Panera Bread customers was reportedly advertised, with a threat actor linking it to ShinyHunters.
- The article recommends monitoring exposed credentials and sessions, tracking actors beyond ransomware brand names, strengthening identity checks, watching criminal channels and mapping SaaS/vendor exposure.
Article Details
- Event Type
- Overview of 2026 cyber threat trends involving stolen credentials, ransomware groups, deepfake-enabled identity fraud, criminal messaging channels, and SaaS data theft.
- Impact
- The article describes stolen credentials and session cookies being resold and used to access corporate services; ransomware groups fragmenting and rebranding; a reportedly advertised kit for attempting KYC bypasses with synthetic faces; criminal channels reappearing after takedowns; and attackers using compromised identity access to export data from SaaS tenants. Data tied to around 14 million Panera Bread customers was reportedly advertised on criminal forums, with a threat actor linking it to ShinyHunters.
MITRE ATT&CK
T1078 · Valid AccountsThe article describes attackers logging in with compromised identity access and valid sessions.T1550.004 · Web Session CookieThe article says stolen session cookies can be used to bypass MFA and access services.T1555.003 · Credentials from Web BrowsersThe article describes infostealer logs containing saved browser passwords.T1566.004 · Spearphishing VoiceVishing is identified as a method used to compromise identity access.T1621 · Multi-Factor Authentication Request GenerationMFA fatigue is identified as a method used to compromise identity access.
Threat Actors
GLOBAL SECRET GROUPThe article says the group surfaced in mid-2026 using leaked LockBit 3.0 code.ShinyHuntersA threat actor reportedly linked data advertised on criminal forums, including data tied to around 14 million Panera Bread customers, to ShinyHunters; the article does not confirm the attribution.The GentlemenThe article reports that the ransomware group grew out of a former Qilin affiliate after a commission dispute. Unit 42 credited the group with 580 claimed victims across 77 countries by July 2026.VectThe article identifies Vect as a ransomware brand that appeared in January 2026; its leak site was offline by mid-April.
Malware
Vendors
GoogleThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.MicrosoftThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.SalesforceThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.
Products
DiscordOver three months, Check Point found about 3 million Telegram invite links shared underground, while Discord made up under 6% of that volume.Google WorkspaceThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.Microsoft 365 Apps for EnterpriseThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.SalesforceThreat actors compromise identity access through vishing, session hijacking or MFA fatigue against single sign-on, then move into SaaS tenants such as Microsoft 365, Google Workspace and Salesforce to export data.SimpleXOne group that moved to SimpleX returned to Telegram when its followers didn’t follow.TelegramThe Haunted Messenger: Telegram’s Undying Channels