Categories: Cyber Crime

Cybercriminals sell hacked PayPal credentials in underworld

Few days ago  I was surfing on my favorite security web sites and I found an interesting post published by the great security expert Dancho Danchev on Webroot portal that released a profitable e-commerce of credentials related to compromised PayPal accounts.

The security analyst found an underground web site that proposes Paypal account accesses categorizing them on amount of money they retain, the site propose a list of accounts with related balances and offers them for prices between $15 and $20 each one, and propose also accounts with no assets at $2, criminals acquire empty accounts hoping that owner will make deposits soon.

The web site proposed credentials related to accounts of US (1,543) and UK (14) users.

In reality the sale model is more articulated, every account is ranked on different attributes such as the availability of  email address of victim, card confirmation, verified/not verified account, type of account, bank confirmation, first name of the victim, the country of origin and of course the balance.

 

This attributes concur in the evaluating of selling prices, Dancho Danchev on the monetization process implemented by criminals writes:

 “What we’ve got here is a decent example of how these inexperienced cybercriminals are looking for ways monetize the fraudulently obtained data as soon as possible, instead of ‘cashing out’ the accounts by themselves, which could lead to possible risks to their operational security.”

What is really interesting is the complete offer of criminals that provide also an anonymizing service through a built-in Socks5 proxy checker.

SOCKS is an Internet protocol that routes network packets between a client and a server through a proxy server,  SOCKS5 provides also  authentication mechanisms to allow connections to server only to authorized users, in the specific case it is used to interact with the hacked PayPal accounts in anonymous mode.

“These are not publicly obtainable Socks5 servers. Instead, they are compromised malware-infected hosts converted into anonymization proxies, allowing the cybercriminals who are about to “cash out” the hacked PayPal accounts to risk-forward the possibility of getting traced back to the IP of an innocent malware-infected victim.” 

The monitoring of underground web sites and forums is vital in the cybercrime prevention, thanks to their analysis it is possible to detect new criminal trends and establish proper countermeasures, these reports are fundamental for investigation and sharing of result is essential … let’s pay attention to the born of similar E-shops.

Pierluigi Paganini

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

6 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

13 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

1 day ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

1 day ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

1 day ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

2 days ago

This website uses cookies.