exploit[.]inDomain
Reported by 7 independent sources · first reported by Group-IB · last reported
Last reported 12 days ago
What the reports say
14 reports, newest first · the exact sentence from each-
Inside ICMacOS: From an Infostealer to a Persistent RAT“Since early September 2026, ICMacOS has been actively marketed across top-tier Russian-speaking cybercrime forums including XSS, Exploit[.]in, and Rehub, under the persona GlowComa, a financially motivated actor active since January 2026.”
-
Infostealers Are Actively Hunting AI Agents and Developer Keys – Warden Infostealer“Initial announcement and feature breakdown of Warden Stealer on the Exploit[.]in dark web forum.”
-
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure“CyberXero (Dread, HackForums, Exploit[.]in)”
-
Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION“Exploit[.]in Database Reveals the Roots of Today’s Ransomware Ecosystem”
-
Exploit.in Database Reveals the Roots of Today’s Ransomware Ecosystem“Exploit[.]in Database Reveals the Roots of Today’s Ransomware Ecosystem”
-
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories“…distribution framework dubbed Exvicy that has been advertised by a Russian-speaking actor under a malware-as-a-service (MaaS) model on Exploit[.]in since May 26, 2026.”
-
Booking.com Phishing Campaign Targeting Hotels and Customers“…actor operating under the moniker moderator_booking actively promoted a Booking log purchasing service on cybercrime forums, including Exploit[.]in, LolzTeam, and WWHClub.”
-
Viral AI, Invisible Risks: What OpenClaw Reveals About Agentic Assistants“Recent investigations have revealed that malicious actors on the Exploit[.]in forum are actively discussing the deployment of OpenClaw skills to support activities such as botnet operations, as shown in Figure 4.”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“The group actively sought new members through direct messaging and posts on underground forums like RAMP, XSS, and Exploit[.]in.”
-
GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware“Initially emerging in January 2023 on Telegram and Exploit[.]in, GXC Team specialized in developing and selling phishing kits, Android malware, and AI-powered scam tools.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“jsworm registers on the underground forum exploit[.]in.”
-
Treasure trove. Alive and well point-of-sale malware“On July 18, 2019, an announcement about the sale of the source code for MajikPOS (aka MagicPOS) was posted on the underground forum “exploit[.]in” by the user cartonash.”
-
The Fraud Family“NL Multipanel is almost fully based on U-Admin panel, which is offered to a wide range of Exploit[.]in forum (one of the most popular hacker forums) users.”
-
REvil Twins: Ransomware-as-a-Service program“According to a message, that a user, allegedly related to the REvil RaaS program, left in a thread dedicated to REvil RaaS program on exploit[.]in, REvil affiliates get at least 75% from the ransom paid by the victims.”
Indicators reported together
named in the same reports- posh[.]vipin 1 report
- onecause[.]comin 1 report
- raiselysite[.]comin 1 report
- adminmenueditor[.]comin 1 report
- hxxps://ipinfo[.]io/countryin 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2023-38831, CVE-2026-60137, CVE-2026-63030, CVE-2020-1472, CVE-2026-87902, CVE-2024-21412
Thanks — we review every report.