Between September 23-29, 2026, multiple threat actors allegedly conducted extensive sales operations across dark web marketplaces, offering stolen financial data, compromised credentials, and fraud services targeting organizations and individuals globally. The activity represents a significant escalation in organized cybercrime infrastructure, with actors claiming to sell tens of thousands of stolen credit cards with validity rates between 90-99%, Remote Desktop Protocol (RDP) access to compromised systems in the US, UK, and Japan, and comprehensive fraud toolkits. The threat actors allegedly targeted major financial institutions including Bank of America, Chase, and payment processors like Square, while also offering over 800 complete identity packages (SSN fullz) and stolen credentials for European and US targets. This coordinated marketplace activity demonstrates the maturation of cybercrime-as-a-service ecosystems and poses immediate risks to financial institutions, enterprises with exposed RDP services, and consumers whose payment card data may be compromised. Organizations should prioritize monitoring for unauthorized transactions, reviewing RDP exposure, and implementing enhanced authentication controls.
- Multiple threat actors allegedly advertised over 52,000 stolen credit cards across dark web marketplaces between September 23-29, 2026, with claimed validity rates of 90-99% and targeting victims in the US, Canada, Brazil, UK, UAE, and other countries.
- Threat actor 'Daksowl' allegedly offered comprehensive fraud services across seven dark web markets, including RDP access to compromised US/UK/Japan systems, SOCKS5 proxies from major ISPs (Comcast, Sprint, AT&T), and stolen credentials for Bank of America and Chase accounts.
- Actors allegedly sold over 800 complete identity packages (SSN fullz) for US victims and fresh Canadian fullz, along with CVV data specifically for carding operations at Square and other payment processors.
- Dark web marketplace 'CryptBB' allegedly hosted a verified seller offering fraud-as-a-service including SIM swap attacks, social media hacking, casino/pig butchering schemes, and cryptocurrency drainers with 24-hour response times.
- Threat actor 'CLOUD9BASE' allegedly distributed credential combo lists targeting Europe and USA via MediaFire, while 'SwipeStore.cx' claimed to sell databases containing payment card data with associated PII including names, addresses, phone numbers, emails, dates of birth, and Social Security Numbers.
