Recorded Future Details Tajin Group’s Phishing, Payment Fraud and Money-Laundering Network
Summary
Recorded Future analyzes Tajin Group’s criminal services on Chinese-language Telegram marketplaces, documenting payment-card fraud and laundering activity, use of anonymous Telegram accounts, and the group’s evolving partnerships and operations.
Key points
- Recorded Future describes Tajin Group as a Chinese-speaking criminal group involved in phishing, payment-card theft, financial fraud and money laundering.
- The group moved from Dabai Guarantee to Xinbi Guarantee and advertised services to other threat actors through Telegram channels.
- Researchers found evidence that the group bought and sold more than 100 Telegram usernames and multiple anonymous phone numbers, which may help obscure its operators.
- The report links Tajin Group to misuse of payment services and gift cards to launder funds obtained through stolen payment-card information.
- Researchers describe alleged schemes involving victims’ payment cards and high-value purchases, while noting that some operational details could not be independently confirmed.
- The report says the group’s operations face competition, unreliable suppliers and tighter financial controls, and assesses that it may seek new platforms and cash-out methods.
Article Details
- Publisher
- Recorded Future
- Scope
- Tajin Group's phishing, payment card fraud, money laundering, guarantee-marketplace activity, and use of anonymous Telegram identities.
- Sample Size
- BIN analysis: 552 card-checker records, approximately 405 unique, covering November 2023 through July 2026.
- Key Statistics
- Tajin Group claimed to have deposited 208,848 USDT on Xinbi Guarantee; the report states that most comparable vendors deposit only a few hundred to a thousand USDT.
- Analysis of two TON address transaction histories identified purchases and sales of more than 100 Telegram usernames and multiple phone numbers.
- Of 65 banned BIN prefixes reviewed, 46 appeared in the Payment Fraud Intelligence BIN Review data.
- Among 195 observations with a 3DS result, 141 failed authentication and 54 processed without 3DS.
- Tajin Group advertised a 45% payout for Selfridges gift cards delivered to its email inbox, with a maximum single transaction of £1,000.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//payae[.]cc/QTTb209 | Specific payment link for a Tajin Group-operated CCAvenue merchant account named MOON ENTERPRISE TRADING LLC, used in its carding and money laundering scheme. |
| URL | hxxps[:]//payae[.]cc/Qwpf734 | Specific payment link for a Tajin Group-operated CCAvenue merchant account named SUNWEL ENTERPRISE TRADING LLC, used in its carding and money laundering scheme. |
MITRE ATT&CK
Threat Actors
Vendors
CCAvenueTajin Group conducts extensive testing involving payment cards belonging to multiple countries on the financial platforms CCAvenue and Geidea.GeideaTajin Group conducts extensive testing involving payment cards belonging to multiple countries on the financial platforms CCAvenue and Geidea.Network InternationalMeanwhile, Geidea and Network International’s payment gateway (N-Genius) allow merchants to generate unique and secure payment links via email, SMS, or social media platforms such as WhatsApp, Facebook, and Instagram,SelfridgesFinancial Theft by Using Geidea UAE, Selfridges, and N-Genius
Products
CCAvenue UAEThe channel advertises multiple methods to launder money, including three payment gateway systems: CCAvenue UAE, gift cards, and Paypage.China Eastern Airlines applicationInstruct the victim to download the China Eastern Airlines application, register an account using the victim’s phone number, and complete the facial scan and real-name verification.Dabai Guaranteethat advertises and provides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee.Fragment Marketof Tajin Group have sold and bought at least 100 Telegram usernames and multiple phone numbers from Fragment Market, a platform that facilitates the buying and selling of virtual, anonymous phone numbers and TelegramGeidea UAEFinancial Theft by Using Geidea UAE, Selfridges, and N-GeniusN-GeniusFinancial Theft by Using Geidea UAE, Selfridges, and N-GeniusTelegramfrom the perspective of Tajin Group, a third-party vendor that advertises and provides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee.Xinbi Guaranteeprovides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee.
Countries
BangladeshBangladeshBelgiumBelgiumBotswanaIreland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.Canadaand regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania,ChileVietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus,ChinaICBC: Industrial and Commercial Bank of China (icbc.com[.]cn)ColombiaCurrently supported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya,CyprusChile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, andDenmarkPhilippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine,EcuadorColombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, ElEgyptAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.El SalvadorEcuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.EstoniaTürkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, PuertoGermanyinclude: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico,GhanaMexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.GreeceSri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco,GuatemalaPeru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.Hong KongAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.IndiaAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.IrelandSouth Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, ElJapanAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.Kenyathe UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, theMalaysiaMalaysiaMauritiusRomania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.MexicoGermany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana,MoroccoGreece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique,MozambiqueMorocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.PakistanAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.PeruTaiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala,PhilippinesCurrently supported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya,Portugalthe UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the CzechPuerto RicoEstonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.RomaniaCanada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius,South AfricaCurrently supported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya,Sri LankaCurrently supported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya,SwedenCanada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic,Switzerlandcountries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden,Türkiyethe Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia,TaiwanLanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru,ThailandAll cards from the Middle East, the US, Pakistan, India, Thailand, Hong Kong, Japan, and Egypt are banned.the Czech RepublicPortugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico, Mozambique, Guatemala, and others.UAEaccept UnionPay, VISA, Mastercard, JCB, and Apple Pay; exploit 2D, 3D, and other payment gateways; and UAE Dirhams and electronic gift cards for their financial theft and money-laundering operations.UkraineDenmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal, Sweden, Romania, Mexico, Estonia, Ukraine, Morocco, Peru, Cyprus, Botswana, El Salvador, the Czech Republic, Mauritius, Ghana, Puerto Rico,United Kingdomsupported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya, Portugal,United Statesdisabled; small-amount test withdrawals are performed during the control-bypass process - please notify us in advance in the event that withdrawals fail.VietnamCurrently supported countries and regions include: the Philippines, Sri Lanka, Vietnam, South Africa, Colombia, the UK, Switzerland, Canada, Germany, Türkiye, Denmark, Greece, Taiwan, Chile, Ireland, Ecuador, Kenya,
Industries
banksactivities of Tajin Group, guarantee marketplaces, and their third-party vendors can negatively impact banks, fund transfer services providers, cryptocurrency exchanges, and individuals vulnerable to scam andcryptocurrency exchangesand their third-party vendors can negatively impact banks, fund transfer services providers, cryptocurrency exchanges, and individuals vulnerable to scam and fraud-related campaigns.fund transfer services providersGroup, guarantee marketplaces, and their third-party vendors can negatively impact banks, fund transfer services providers, cryptocurrency exchanges, and individuals vulnerable to scam and fraud-related campaigns.