Between September 19-20, 2026, multiple threat actors allegedly operated comprehensive fraud-as-a-service marketplaces across dark web platforms including CryptBB, Dread, and DarkForums. The most significant development is the proliferation of the 'Debay' marketplace, which allegedly offers a full spectrum of cybercriminal services including database hacking, SIM swap attacks, social engineering, cryptocurrency drainers, and pig butchering scams. Concurrently, threat actors allegedly advertised stolen Spanish forex trader databases containing personally identifiable information (PII), and the High-Way market allegedly enhanced its operational security features. This activity represents a maturation of dark web criminal infrastructure, with threat actors allegedly providing turnkey solutions for financial crime, data theft, and unauthorized system access. Organizations across all sectors face elevated risk from these alleged comprehensive attack capabilities, particularly those in finance, technology, and cryptocurrency industries.
- Multiple threat actors allegedly advertised the 'Debay' fraud marketplace offering database hacking, SIM swap attacks, social media compromise, cryptocurrency drainers, and pig butchering schemes across CryptBB dark web platform
- Threat actor 'DatabaseMarket' allegedly leaked a database containing PII of 25+ Spanish forex traders including names, email addresses, phone numbers, and IP addresses from 2025-2026
- The High-Way market operator allegedly detailed enhanced security features including PGP encryption, multisig escrow, FROST threshold signatures, and AppArmor confinement for illicit goods trading
- Threat actor 'lilsheepyy' allegedly provided guidance on monetizing system access, databases, and Remote Code Execution (RCE) vulnerabilities through dark web sales channels
- Multiple threat actors allegedly offered cloned credit cards, compromised PayPal accounts, bank logs, and Western Union transfer capabilities via Telegram-based operations
