Cybercriminals sell hacked PayPal credentials in underworld

Few days ago  I was surfing on my favorite security web sites and I found an interesting post published by the great security expert Dancho Danchev on Webroot portal that released a profitable e-commerce of credentials related to compromised PayPal accounts.

The security analyst found an underground web site that proposes Paypal account accesses categorizing them on amount of money they retain, the site propose a list of accounts with related balances and offers them for prices between $15 and $20 each one, and propose also accounts with no assets at $2, criminals acquire empty accounts hoping that owner will make deposits soon.

The web site proposed credentials related to accounts of US (1,543) and UK (14) users.

In reality the sale model is more articulated, every account is ranked on different attributes such as the availability of  email address of victim, card confirmation, verified/not verified account, type of account, bank confirmation, first name of the victim, the country of origin and of course the balance.


This attributes concur in the evaluating of selling prices, Dancho Danchev on the monetization process implemented by criminals writes:

 “What we’ve got here is a decent example of how these inexperienced cybercriminals are looking for ways monetize the fraudulently obtained data as soon as possible, instead of ‘cashing out’ the accounts by themselves, which could lead to possible risks to their operational security.”

What is really interesting is the complete offer of criminals that provide also an anonymizing service through a built-in Socks5 proxy checker.

SOCKS is an Internet protocol that routes network packets between a client and a server through a proxy server,  SOCKS5 provides also  authentication mechanisms to allow connections to server only to authorized users, in the specific case it is used to interact with the hacked PayPal accounts in anonymous mode.

“These are not publicly obtainable Socks5 servers. Instead, they are compromised malware-infected hosts converted into anonymization proxies, allowing the cybercriminals who are about to “cash out” the hacked PayPal accounts to risk-forward the possibility of getting traced back to the IP of an innocent malware-infected victim.” 

The monitoring of underground web sites and forums is vital in the cybercrime prevention, thanks to their analysis it is possible to detect new criminal trends and establish proper countermeasures, these reports are fundamental for investigation and sharing of result is essential … let’s pay attention to the born of similar E-shops.

Pierluigi Paganini

Pierluigi Paganini: Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

This website uses cookies.