Darknet Mentions of Food Delivery Accounts Rose 230%, DarkOwl Reports
Summary
DarkOwl reports a 230% average rise in darknet mentions of food delivery and shopping services, alongside account sales, refund fraud and shopping bots. It says an alleged Instacart account listing was unconfirmed and the company denied a breach.
Key points
- DarkOwl compared mentions of food delivery and shopping services in its darknet database year over year, reporting an average 230% increase; its 2020 data covered only through July.
- The analysis found hacked accounts advertised for $1.50–$10 each and described credential-based account misuse, refund fraud and resale of refund credit.
- A report cited by DarkOwl said 278,531 Instacart accounts were offered for sale, with names, emails, partial card numbers and order histories; DarkOwl could not confirm the offer, and Instacart denied a breach, attributing the data to possible credential stuffing.
- The article describes criminal interest in intercepting service APIs and using automated account-creation scripts and shopping bots to steal high-value Instacart order batches.
- DarkOwl identified multiple active batch-stealer platforms and investigated links between the Ninja Shopper app and online aliases, but the attribution described is not presented as confirmed.
- The article warns that compromised accounts could expose personal and payment information, enable fraudulent purchases and support targeted phishing.
- DarkOwl advises users not to reuse passwords or save payment-card details on these accounts, and to be cautious with links in purported service emails.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2019-2020; 2020 data through the end of July
- Scope
- Darknet and criminal-forum mentions, account sales, refund fraud, and account-abuse methods involving food delivery and personal shopping services.
- Key Statistics
- DarkOwl reported an average 230% increase in darknet mentions of most major food delivery and personal shopping providers between 2019 and 2020; 2020 data covered only through the end of July.
- For DoorDash-related pages collected to date, 33% were observed in 2019 and 67% in 2020.
- Eight vendors on Infinity Market were identified selling hacked accounts associated with DoorDash, Grubhub, and Caviar.
- A report cited by DarkOwl said 278,531 Instacart accounts were offered for sale; DarkOwl could not confirm the offer's scale, and Instacart denied a systems breach.
- DarkOwl found nearly a dozen active Instacart batch-stealer platforms advertising in mid-May.
- Recommendations
- Do not reuse passwords that may already have been compromised.
- Avoid saving credit card information on commercial food delivery and shopping accounts.
- Use heightened caution with email links purportedly sent by food delivery services.
MITRE ATT&CK
T1056 · Input CaptureThe article discusses interception of API traffic to capture customer and payment information.T1078 · Valid AccountsCriminals use compromised food-delivery accounts to place fraudulent orders and request refunds.T1110 · Brute ForceThe article describes credential stuffing using previously compromised information to access Instacart accounts.T1566 · PhishingThe article describes potential targeted phishing emails using account and order details.
People
Vendors
Products
CaviarOf the vendors we looked at, Seamless and Caviar appear to have the most remarkable increase in the number of documents in DarkOwl Vision mentioning compromised accounts, with Instacart, Uber Eats, Just Eat, andDarkOwl Visionat, Seamless and Caviar appear to have the most remarkable increase in the number of documents in DarkOwl Vision mentioning compromised accounts, with Instacart, Uber Eats, Just Eat, and DoorDash close behind.DeliverooInterestingly, DarkOwl also observed PostMates and UK-based Deliveroo food delivery services mentioned in fraud-focused conversations on criminal forums but in less volume than in 2019.Delivery.comGrocery shopping services like Instacart and Delivery.com are equally at risk for this type of criminal behavior.DoorDashof documents in DarkOwl Vision mentioning compromised accounts, with Instacart, Uber Eats, Just Eat, and DoorDash close behind.GrubhubOn the darknet marketplace Infinity Market alone, DarkOwl discovered 8 different vendors selling a mix of hacked mainstream food delivery service accounts, including, DoorDash, Grubhub and Caviar.Instacartsociety is more reliant than ever on personal food delivery and shopping services such as Seamless and Instacart, darknet criminals also have increased their reliance on exploiting these applications for continuedJust Eatin the number of documents in DarkOwl Vision mentioning compromised accounts, with Instacart, Uber Eats, Just Eat, and DoorDash close behind.Ninja HoursIn recent months, there has been a surge in Instacart related batch-stealer apps and many have come and gone, sometimes using slightly varied titles, such as Ninja Hours, Ninja Shoppers and Ninja Shopper.Ninja ShopperIn recent months, there has been a surge in Instacart related batch-stealer apps and many have come and gone, sometimes using slightly varied titles, such as Ninja Hours, Ninja Shoppers and Ninja Shopper.Ninja ShoppersIn recent months, there has been a surge in Instacart related batch-stealer apps and many have come and gone, sometimes using slightly varied titles, such as Ninja Hours, Ninja Shoppers and Ninja Shopper.PostMatesInterestingly, DarkOwl also observed PostMates and UK-based Deliveroo food delivery services mentioned in fraud-focused conversations on criminal forums but in less volume than in 2019.Robô InstacartOthers such as Robô Instacart had a short lifespan on YouTube and Reddit in late May (shown below).SeamlessIn a time when society is more reliant than ever on personal food delivery and shopping services such as Seamless and Instacart, darknet criminals also have increased their reliance on exploiting these applications forShiptIn May, Instacart refunds for upwards of $700 USD, along with Uber Eats for $200 and Shipt for $500, were offered for sale by a user known as @DDsRefundVouches on the popular chat application Telegram.Uber Eatsincrease in the number of documents in DarkOwl Vision mentioning compromised accounts, with Instacart, Uber Eats, Just Eat, and DoorDash close behind.
Tools
batchgrabWith minimal OSINT investigating, DarkOwl analysts uncovered an application in a GitHub repo with a similar name originated two years ago called “batchgrab” from a Brazilian programmer, using the moniker, felix b1scoito.CharlesproxySome of the comments included Charlesproxy and Wireshark as potential solutions.WiresharkSome of the comments included Charlesproxy and Wireshark as potential solutions.