Most keyword hits are not offers. Of 93 exploit seller posts using the word 0-day, only 37 were coded as unnamed-exploit claims, and none names a CVE. Tooling ads sell keys and builds, not a detection outcome.
Counts are post IDs in a Telegram-dominated slice, not offers, sellers or market size.
Each finding below is stated in its own unit, with the limit that comes with it. The investigations give the full reasoning and the evidence records.
Offered object across all 221 classified exploit offers and requests (n=221).
| Offered object | Records | Share of 221 |
|---|---|---|
| Unnamed 0-day claim | 57 | 25.8% |
| Other or mixed object | 44 | 19.9% |
| Mass-exploitation tool | 36 | 16.3% |
| Web shells or access result | 31 | 14.0% |
| Exploit-feed subscription | 12 | 5.4% |
| Commercial, not exploit-related | 11 | 5.0% |
| Unlicensed or shared-tool bundle | 8 | 3.6% |
| Exploit kit or builder | 6 | 2.7% |
| Checker or scanner only | 4 | 1.8% |
| Course | 4 | 1.8% |
| Repackaged public PoC | 3 | 1.4% |
| Named product, no CVE | 3 | 1.4% |
| Private exploit, CVE named | 2 | 0.9% |
Examine selected 0-day, AI-branded, FUD, lifetime, fresh and private claims. Each example keeps the recorded wording beside its evidence limits.
Explore the claim and evidence cards →Each investigation answers a different question from the same collected posts. Start with the main one, then follow the question that matters to your team.
Of 93 seller posts that use the word 0-day, 37 were coded as unnamed-exploit claims and none names a CVE. For the rest, the word is sales vocabulary on tools, bundles and menus.
Read the investigation →Selected crypter, loader, RAT and panel ads meter supply by file, day or month. Written seller promises are rare, so on the advertised terms the buyer carries the detection decay.
Read the investigation →In 607 texts from seven AI-branded tool searches, including WormGPT, the names mostly label a site, bot or app, or a prompt for a mainstream assistant. The ads rarely show what model runs underneath.
Read the investigation →These are implications of what the posts say, not measured control results. Each one points to a different decision.
Treat a 0-day label as an unverified claim: only 37 of 93 exploit seller posts using the word were coded as unnamed-exploit claims, and none gives a CVE. Ask whether the post names a version, a CVE or checkable detail, and check for a vendor advisory or CISA catalogue entry before acting.
Prioritise public web and CMS software by exposure, not by label. It is the largest stated target class in the records (43.0%), and tools and web shells make up 56 of 193 seller posts.
Favour behaviour-based detection over hash or packer signatures: wrappers are rebuilt often and sold separately from the payload.
Treat AI accounts and API keys like other credentials, do not rely on brand-name blocklists (names float and collide), and treat unknown AI apps and bots as untrusted software.
See which new vulnerabilities are being exploited and which of them touch your technology.
See how it works →Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
182 exploit seller posts (193 minus 11 off-topic) in a stratified sample of 700 classified Blackhole posts, 1 Jan-27 Oct 2026. Of these, 93 use 0-day or zero-day in any form, and none gives a CVE. Only 37 were coded as unnamed-exploit claims, a broad code that also covers research services, multi-exploit lists and chains.
The rest are menus and other goods (25), mass tools (12), unlicensed/shared-tool bundles (8), feeds (5), kits (3) and 3 other items.
Read the report, open the evidence records and reuse the charts with their source and limits.
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
