GhostSocks Proxy Malware Developer Doxxed — February 2026
The Lumma RAT operators publicly doxxed the developer of the GhostSocks proxy-malware service in February 2026 — a notable example of cybercriminals doxxing each other.
- Real name
- Address
- Photographs
- Family details
The Lumma RAT operators publicly doxxed the developer of the GhostSocks proxy-malware service in February 2026, posting the developer's real name, home address, photographs, and family details to a public underground forum. The operation appears to have been retaliation for a business dispute between the two threat groups.
The case is a notable reminder that even malware authors get doxxed. The same techniques that target executives, creators, and ordinary internet users work just as well against people who built the doxxing infrastructure in the first place. Personal-data exposure is a universal risk — no one is above it.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →