GhostSocks Proxy Malware Developer Doxxed — February 2026
The Lumma RAT operators publicly doxxed the developer of the GhostSocks proxy-malware service in February 2026 — a notable example of cybercriminals doxxing each other.
- Real name
- Address
- Photographs
- Family details
The Lumma RAT operators publicly doxxed the developer of the GhostSocks proxy-malware service in February 2026, posting the developer's real name, home address, photographs, and family details to a public underground forum. The operation appears to have been retaliation for a business dispute between the two threat groups.
The case is a notable reminder that even malware authors get doxxed. The same techniques that target executives, creators, and ordinary internet users work just as well against people who built the doxxing infrastructure in the first place. Personal-data exposure is a universal risk — no one is above it.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary DoxxScan™ to see if their identity is exposed in the breaches we cover.
Were you affected by this breach?
See exactly what an attacker can piece together from your email, username, or handle. Free first scan, no credit card.
Try DoxxScan — 72hr free trial →
