Categories: Cyber Crime

Cybercriminals sell hacked PayPal credentials in underworld

Few days ago  I was surfing on my favorite security web sites and I found an interesting post published by the great security expert Dancho Danchev on Webroot portal that released a profitable e-commerce of credentials related to compromised PayPal accounts.

The security analyst found an underground web site that proposes Paypal account accesses categorizing them on amount of money they retain, the site propose a list of accounts with related balances and offers them for prices between $15 and $20 each one, and propose also accounts with no assets at $2, criminals acquire empty accounts hoping that owner will make deposits soon.

The web site proposed credentials related to accounts of US (1,543) and UK (14) users.

In reality the sale model is more articulated, every account is ranked on different attributes such as the availability of  email address of victim, card confirmation, verified/not verified account, type of account, bank confirmation, first name of the victim, the country of origin and of course the balance.

 

This attributes concur in the evaluating of selling prices, Dancho Danchev on the monetization process implemented by criminals writes:

 “What we’ve got here is a decent example of how these inexperienced cybercriminals are looking for ways monetize the fraudulently obtained data as soon as possible, instead of ‘cashing out’ the accounts by themselves, which could lead to possible risks to their operational security.”

What is really interesting is the complete offer of criminals that provide also an anonymizing service through a built-in Socks5 proxy checker.

SOCKS is an Internet protocol that routes network packets between a client and a server through a proxy server,  SOCKS5 provides also  authentication mechanisms to allow connections to server only to authorized users, in the specific case it is used to interact with the hacked PayPal accounts in anonymous mode.

“These are not publicly obtainable Socks5 servers. Instead, they are compromised malware-infected hosts converted into anonymization proxies, allowing the cybercriminals who are about to “cash out” the hacked PayPal accounts to risk-forward the possibility of getting traced back to the IP of an innocent malware-infected victim.” 

The monitoring of underground web sites and forums is vital in the cybercrime prevention, thanks to their analysis it is possible to detect new criminal trends and establish proper countermeasures, these reports are fundamental for investigation and sharing of result is essential … let’s pay attention to the born of similar E-shops.

Pierluigi Paganini

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

The ASA flaw CVE-2014-2120 is being actively exploited in the wild

Cisco warns customers that a decade-old ASA vulnerability, tracked as CVE-2014-2120, is being actively exploited…

21 minutes ago

DMM Bitcoin halts operations six months after a $300 million cyber heist

The Japanese cryptocurrency platform DMM Bitcoin is closing its operations just six months after a…

8 hours ago

Energy industry contractor ENGlobal Corporation discloses a ransomware attack

ENGlobal Corporation disclosed a ransomware attack, discovered on November 25, disrupting operations, in a filing…

10 hours ago

Poland probes Pegasus spyware abuse under the PiS government

Poland probes Pegasus spyware abuse under the PiS government; ex-security chief Piotr Pogonowski arrested to…

13 hours ago

BootKitty Linux UEFI bootkit spotted exploiting LogoFAIL flaws

The 'Bootkitty' Linux UEFI bootkit exploits the LogoFAIL flaws (CVE-2023-40238) to target systems using vulnerable…

15 hours ago

Tor Project needs 200 WebTunnel bridges more to bypass Russia’ censorship

The Tor Project seeks help deploying 200 WebTunnel bridges by year-end to counter government censorship.…

1 day ago

This website uses cookies.