Between September 15-16, 2026, multiple threat actors allegedly orchestrated a coordinated financial crime operation across dark web marketplaces, offering stolen payment card data, compromised bank credentials, and personally identifiable information (PII) affecting major financial institutions and payment platforms globally. The operation allegedly involves at least 10 distinct threat actors selling non-VBV credit cards, bank login credentials with active balances, complete identity packages (fullz), and fraudulent money transfer services across platforms including PayPal, Apple Pay, Google Pay, CashApp, and major U.S. banks. The scale of compromised data allegedly includes over 52,000 SSN-based records, 13,544 bank credential entries, and 3,264 compromised retail accounts from a single marketplace (DOC-SHOP). The actors allegedly claim to bypass two-factor authentication (OTP) and offer automated fraud tools with replacement guarantees. This represents a significant escalation in organized financial cybercrime with immediate implications for financial institutions, payment processors, and consumers across North America, Europe, and Asia. Organizations should immediately review fraud detection systems, implement enhanced transaction monitoring, and alert customers to potential account compromise indicators.
- Multiple threat actors allegedly selling stolen credit card data (non-VBV cards, Track 1/Track 2 dumps with CVV) and bank login credentials with active balances across all major U.S. financial institutions including Bank of America (2,309+ entries), Chase (2,782+ entries), Wells Fargo (1,665+ entries), and USAA (1,010+ entries)
- Actors allegedly offering automated fraud tools claiming to bypass OTP/two-factor authentication with 'AUTO ADD CC NO OTP REQUIRED' capabilities for major payment platforms (Apple Pay, Google Pay, PayPal, CashApp, Zelle)
- DOC-SHOP marketplace allegedly advertising 52,675 SSN-based identity records including fullz packages with SSN+DOB+DL+bank routing numbers, 297 passports, 204 driver's licenses, and 106 IDs, representing massive PII compromise
- Threat actors allegedly operating coordinated money laundering services claiming conversion rates of $50 input to $1,000 output across CashApp, PayPal, Apple Pay, Western Union, and cryptocurrency platforms
- Global targeting scope allegedly spanning United States, United Kingdom, Canada, Germany, France, Italy, Poland, Netherlands, Spain, Austria, and Australia with actors claiming 5+ years operational history and daily inventory updates
