Exploits, Malware Tooling and AI-Assisted Crime: The Report
Most keyword hits are not offers. Of 93 exploit seller posts using the word 0-day, only 37 were coded as unnamed-exploit claims, and none names a CVE. Tooling ads sell keys and builds, not a detection outcome.
- 37 of 93
- Exploit seller posts using the word 0-day coded as unnamed-exploit claimsThat is a broad code, not one flaw each, and none of the 93 names a CVE. Unit: sampled seller post IDs.
- 27.3%
- 33 of 121 strict malware-tooling offers claim FUDOutside one reposted bundle advert; only 1 states how long it lasts. Unit: sampled offer post IDs.
- 168 of 607
- Distinct texts from seven AI-branded tool searches are offer-typeWormGPT included; the names mostly label an access point or a prompt.
Brandefense / Cybercrime Report 2026 / Exploit Trade Exploits, Malware Tooling and AI-Assisted Crime 1 January-27 October 2026. Dataset v1.0. Collected posts, not a market total. Get The Exploit Trade Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Three Investigations. Unnamed Claims, Subscriptions And AI Labels.
Three investigations ask separate questions of the same collected posts. Counts are post IDs in a Telegram-dominated slice, not offers, sellers or market size.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text and tables as one web page with headings for screen readers and phones.
- 01 What a 0-Day Ad Really Sells: 37 of 93 Are Unnamed-Exploit Claims We read 221 posts coded as exploit offers or requests. Of 93 seller posts saying 0-day, 37 got our broad unnamed-exploit code; none names a CVE. Read online →
- 02 What a Malware Subscription Actually Buys Malware subscription terms sell builds and keys, not a detection outcome. See how six ads meter supply and who carries the risk. Read online →
- 03 What WormGPT and Other AI-Branded Tool Ads Sell In 607 texts from seven AI-branded tool searches, including WormGPT, the names mostly label a site, bot, app or prompt pack, rarely the model underneath. Read online →
- 04 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01Counts are Blackhole-collected post IDs or distinct texts, not offers, sellers, sales, victims or people. One offer can appear in many posts.
- 02Class labels are not comparable across May to July 2026 (taxonomy break). No monthly trend is published; sets-monthly.csv carries a warning column.
- 03Prices are advertised asking terms. A bare dollar sign is not read as USD; no conversion, average or price index is produced.
- 04The 99 catalogue records are purposive and diversity-seeking; they do not estimate prevalence and are not 99 sellers.
- 05No exploit or tool was bought, run or tested; every capability is a text claim.
From Research To Monitoring.
See which new vulnerabilities are being exploited and which of them touch your technology.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.