Multiple dark web marketplaces, primarily DOC-SHOP and associated platforms, are allegedly conducting large-scale operations selling stolen financial credentials, personally identifiable information (PII), and compromised account access targeting US financial institutions, retail chains, airlines, and payment services. The significance of this activity lies in the comprehensive nature and scale of the alleged data inventory, which reportedly includes over 36,000 complete identity records, 26,000+ fullz packages, 5,600+ bank credentials, and 2,400+ compromised retail accounts. These marketplaces allegedly provide threat actors with ready access to tools and data necessary for identity theft, financial fraud, and account takeover attacks. The timing is critical as these operations appear to be actively maintained with daily updates, suggesting ongoing credential harvesting campaigns. Organizations in the financial services, retail, and travel sectors should prioritize credential monitoring, implement enhanced authentication controls, and educate customers about account security to mitigate the risk of fraud stemming from these alleged compromised datasets.
- DOC-SHOP marketplace allegedly advertises over 36,200 comprehensive identity records (SSN + DOB + DL + Bank Account + Employer), 26,645 fullz records, and 5,655 bank credentials targeting major US financial institutions including Citibank, Chase, Bank of America, American Express, and Capital One
- Multiple threat actors (dcshp, Dcshp, cvvFather, WIZARD'S SHOP) are allegedly operating interconnected marketplaces selling stolen credit card data, bank logs, PayPal accounts, SSNs, passports, driver's licenses, and RDP access across clearnet and Tor infrastructure
- Alleged compromised accounts span major US retailers and service providers including Best Buy, Costco, Verizon, Delta Airlines, Southwest Airlines, Hilton, Ticketmaster, and PayPal, with inventory reportedly exceeding 2,466 shop accounts
- CryptBB-hosted marketplaces (Debay) allegedly offer fraud-as-a-service including SIM swapping, social engineering, cryptocurrency drainers, database hacking, and email compromise services with 24-hour response times
- The alleged threat actor motivation is financial gain through credential trafficking, identity theft facilitation, and enabling downstream fraud operations targeting US consumers and financial institutions
