One Million Stolen Credit Cards Hit The Dark Web
A Russian cyber criminal group called AllWorld.Cards has released 1 million stolen credit cards on the Dark Web and now hundreds of thousands of active credit card payment credentials are freely available to criminals.
The incident is aimed at promoting AllWorld.Cards, a new cyber criminals’ Dark Website for selling payment credentials online to test the resources for free before eventually paying for the new service. Researchers at threat intelligence firm first Cyble noticed the leak during routine monitoring of Dark Web marketplace.
Cyble released a post detailing their findings. The cards were all stolen between 2018 and 2019, according to the advertisements. The leaked cards include information such as credit card numbers, expiration dates, CVV, name, country, state, city, address, ZIP code, emails, and phone numbers.
This leaves the victims susceptible not only to financial theft, but to identity fraud, phishing, and social engineering.
AllWorld.Cards appears to be a relatively new player to the market for selling stolen credit-card data on the Dark Web, according to Cyble. “Our analysis suggests that this market has been around since May 2021 and is available on a Tor channel as well,” according to the post.
The black market for stolen credit cards is a massive illegal business, with cyber criminals getting their hands on card data in a number of ways.
In the last six months of 2020 alone, threat actors offered more than 45 million compromised cards for sale in underground credit-card markets monitored by security firm Cybersixgill. These cards are then used by cyber criminals to make online purchases, including buying gift cards, that are hard to track back to them. There is some uncertainty about how many of the cards are actually still active and available for cyber criminals to use. Cyble researchers noted that threat actors claimed that 27 percent, according to a random sampling of 98 cards, are still active and can be used for illegal purchasing.
To protect yourself you need to contact one or other credit reporting firm to initiate a fraud alert, which in turn is legally obligated to share your notice with others - it is free.
CyberSixGill: CNBC: Oodaloop: Threatpost: BlackLake Security:
You Might Also Read:
