The criminal classroom is open and enrollment is surging. Radware's research into underground hacking forums found that new tutorial output roughly doubled over the past year — and the curriculum has shifted hard toward direct financial fraud. The researchers analyzed 8,870 tutorial posts across 24 deep- and dark-web forums published between December 2022 and April 2026, and after removing reposts, the dataset held 3,034 unique hacking and fraud guides. The headline finding: the forums are no longer just recycling old tricks. They are producing new ones — and your phone number and social accounts are the prime targets.
An underground hacking tutorial is a how-to guide published on deep- or dark-web forums that teaches criminal techniques — card theft and cash-out, phishing, account takeover, offensive security methods. Radware's study, reported by Help Net Security on July 14, 2026, treated these tutorials as a dataset: 8,870 posts narrowed to 3,034 unique guides after deduplication, tracked over more than three years. The point of studying them is not to learn the crimes but to see where criminals are investing their teaching effort — because what gets taught today gets attempted tomorrow.
| Period | New tutorials / month | Trend |
|---|---|---|
| Through 2024 | ~45 | Collapsed output |
| Early–mid 2025 | ~45 | Flat |
| Late 2025 → 2026 | 110–140 | Roughly doubled |
"New tutorial output collapsed through 2024 to roughly 45 first-time publications a month and stayed flat into mid-2025. From late 2025, it roughly doubled, to between 110 and 140 new tutorials a month across 2026," the researchers noted. And crucially, the forums are not just recycling a fixed set of old techniques — they are producing genuinely new ones.
Source: Radware research, via Help Net Security, July 14, 2026.
The subject mix changed as output grew. Carding — the theft and fraudulent use of payment card data, plus the cash-out techniques that convert stolen data into money — grew from 19% of tutorials in 2024 to 38% in 2026, making it the largest category in the dataset. Over the same period, black-hat SEO and affiliate manipulation fell from 33% to 13%. Offensive security and phishing also gained share.
The direction is unmistakable: away from traffic manipulation and toward direct financial fraud. And the guides are getting more complete — many now teach multiple stages of fraud in one document, covering both the techniques used to gain access to accounts and the methods used to monetize stolen credentials. By teaching the break-in and cash-out sides side by side, tutorial authors are giving readers the complete playbook, not just a few random tricks.
Of the tutorials that named a specific victim brand or platform, telecom and social media were the most frequently referenced sectors — together accounting for nearly two-thirds of industry-tagged content. The report links that focus to the role these services play in fraud operations:
This is the part that reaches past corporate security teams and into your pocket: the underground curriculum is explicitly organized around the two things most people carry everywhere — a phone number and a social identity.
Radware found that AI is making it easier to produce convincing underground tutorials. Two of the three case studies in the report involved AI-assisted content creation or repackaging — including an AI-generated catalog of attack techniques whose author used hidden content and engagement requirements to build reputation within a hacking forum, and public security research rewritten and republished under a threat actor's name to manufacture false authority. Researchers say newer agentic AI tools could narrow the remaining gap, since many fraud guides still depend on the precise sequence and timing needed to exploit business logic in online applications.
There is a reputation economy underneath all of this, too. Radware found that among tutorials reposted at least 10 times, 79% were distributed through coordinated campaigns run by a single account or hidden premium members — repost volume is as much a measure of promotion as of community interest, with authors publishing to build credibility or to promote paid criminal services.
When the underground's biggest growth category is carding and its most-targeted sectors are telecom and social media, the defensive lesson is personal, not just corporate. Your phone number is an attack surface. Practical steps:
BreachHunter — Ingenious AI's attack-surface platform — is built for exactly this threat model: finding the exposed accounts, credentials, and entry points attackers actually target before they are used against you. Get early access on WhatsApp.
1. Radware found new underground tutorial output went from ~45/month to…
2. Which category grew from 19% to 38% of tutorials?
3. Why are telecom and social media the most-targeted sectors in these tutorials?
4. Your bank offers SMS codes or an authenticator app. Given this research, you should…
5. High repost counts on underground tutorials mostly indicate…
Radware analyzed 8,870 tutorial posts across 24 deep- and dark-web forums published between December 2022 and April 2026. After removing reposts, the dataset contained 3,034 unique hacking and fraud guides.
New tutorial output collapsed through 2024 to roughly 45 first-time publications a month and stayed flat into mid-2025. From late 2025 it roughly doubled, reaching between 110 and 140 new tutorials a month across 2026.
Carding is the theft and fraudulent use of payment card data, plus the cash-out techniques that turn stolen data into money. It grew from 19% of underground tutorials in 2024 to 38% in 2026, reflecting a shift from traffic manipulation toward direct financial fraud.
Together they account for nearly two-thirds of industry-tagged tutorial content. Phone numbers receive two-factor authentication codes, which enables SIM-swap and account-takeover attacks; social accounts carry identity, reputation, and access to other people — all useful for fraud and cash-out.
Yes, at the margin. Radware found AI-assisted content creation or repackaging in two of three case studies, including an AI-generated catalog of attack techniques. Researchers say newer agentic AI tools could narrow the remaining gap on complex business-logic exploits.