Fraud Marketplaces Fragment as Smaller Shops Expand Their Role in Cybercrime
Summary
Rapid7 describes how fraud marketplaces such as Xleet, Blackpass, Infodig, and Styx sell stolen accounts, infrastructure, and cashout services, while activity shifts toward smaller shops and alternative channels.
Key points
- Fraud marketplaces supply stolen credentials and personal data, infrastructure, account access, and services that help criminals monetize fraud.
- Xleet sells credentials and infrastructure such as SMTP, web shells, SSH, and RDP access; Blackpass offers accounts and proxy services.
- Styx combines marketplace listings with seller promotion and cashout services, including schemes using payroll, ACH transfers, and refunds.
- Infodig’s inventory includes stealer logs, financial information, PII, and URL-login-password lists that can support account-takeover operations.
- Marketplace offerings also include phone services, eSIMs, company documents, and accounts used in scams and money laundering.
- The ecosystem is fragmenting into smaller, sometimes invitation-only shops and Telegram or peer-to-peer channels.
- Rapid7 recommends coordinated monitoring by security, fraud, and financial-crime teams, followed by investigation, credential resets, and fraud monitoring.
Article Details
- Attack Vectors
- Business email compromise schemes that manipulate customers into transferring funds to fraudster-controlled accounts.
- Account takeover using stolen credentials and target lists, including URL:LOGIN:PASS records.
- Use of compromised email, SMTP, web shell, SSH, RDP, VPN, VoIP, and cPanel access offered through marketplaces.
- Use of stolen or self-registered accounts and stolen or synthetic personal information to create mule accounts, shelf corporations, and gambling accounts.
- Use of foreign or stolen phone numbers to receive or intercept one-time passwords, impersonate IT staff in calls, or register accounts.
- Money laundering through payroll schemes, ACH transfers, refund scams, and online gambling methods such as chip dumping and minimal gameplay.
- Use of stolen or compromised accounts to conduct fraud against financial institutions, streaming services, dating services, casinos, and AI platforms.
- Defensive Notes
- Continuously monitor marketplaces and forums for mentions of organizational assets, leaked accounts, and emerging threats.
- Coordinate security, fraud, financial-crime, and compliance teams to turn marketplace monitoring into actionable intelligence.
- Correlate identified leaked assets with organizational environments and respond quickly with credential resets and fraud monitoring.
- Investigate stolen accounts and strengthen protections against abuse of payment rails, brands, and customers.
- The article recommends analyzing marketplace content and communicating with merchants, including purchasing account samples, to verify offerings and map networks.