Criminals run halloween sales too

This ad is from a seller of infostealer malware, which quietly collects saved passwords, session cookies, and autofill data from infected devices. There are pricing tiers, lifetime offers, and a link to customer reviews – not unlike the holiday-themed marketing emails you see in your inbox.

What’s not standard is that the top tier includes “tips on spreading” the malware, which means the buyer gets coaching on infecting more people – and stealing more data.

This seller did something that would make any sales or marketing professional proud: they put the year in the discount code so they can compare this year’s campaign performance to previous years and shift their strategy next year depending on which performed better. That’s straight out of the software company marketing playbook.

The difference is that this store sells nothing but misery to non-criminals.

Just like legitimate businesses, criminal storefronts are tracking conversions and running seasonal promotions. And the customers they’re winning are the people targeting your institution and your customers.

“Any purchase higher than 25 leads receives 10 free leads + 1 BANK LOG.”

That’s a volume bonus in action. A bank log is a stolen device log that includes banking access, and here it’s thrown in as a free gift with a purchase, like a tote bag or a toaster.

If a bank log is a freebie, the question for your team is how long one sits in circulation before anyone on your side knows it exists.

The product is a feed of stolen credentials (URL, username, password) harvested by infostealer malware from infected devices. It’s refreshed two or three times a day. The seller promises “no ads or junk.”

Like many subscription businesses, the seller offers a two-week trial, along with tiered pricing and a holiday promotion. The end goal is to entice someone to subscribe long term, increasing the chances that they’ll at least attempt to get into your customers’ accounts – and potentially succeed.

A Halloween sale on a lifetime membership. If the seller is offering an 80% discount, you have to wonder what the regular price is. The only way to find out is to DM the seller, which moves the deal from a channel visible to anyone to a private chat. Telegram and WhatsApp contacts are listed because the seller wants to deal directly with potential customers.

A private chat takes a potential transaction out of whatever spotlight it was in and allows the seller to manipulate pricing and access from one sale to another. And they say there’s no honor among thieves.

A lot of retailers offer holiday-themed specials featuring some version of a buy one, get one sale. Dark Web sellers are no different.

In this example, the listing offers logs (the full haul from an infected device, including passwords, session cookies, and autofill data) and leads on potential victims. Both are sold in bulk, and the post had racked up 660 views when our analysts found it.

Volume pricing means the person buying isn’t targeting just one customer. They’re working through a list, and some of the names on it might be your institution’s customers.

This listing serves as a reminder that fraud losses can come from someone who bought a cheap list and had the willingness – and the patience – to try every name on it.

“Custom docs drawing” is a nice way of saying fake IDs and paperwork made to order. And for Halloween last year, this seller offered a discount with a promo code.

The pumpkin-headed person in a tux is a joke, but the product is deadly serious. The combination of stolen credentials and forged documents is what drives stolen account openings, loan applications, and verification attempts.

On the Dark Web and underground channels, they’re commodities for sale, complete with a holiday-themed discount.

Like a ghost, some passwords continue to haunt us all. Stolen credentials come back, whether through a reused password, a stolen session cookie, or an employee login that was never reset. As a result, a customer’s password from a completely unrelated site can open their online banking account, and a stolen session can skip the MFA prompt entirely.

In this listing, finding out whether those logins belong to your customers is a very small expense, and the lifetime access is the best bargain of all.

For a bank or credit union, that means account takeover can start long before anyone attempts a login at your front door. By then, the credentials have been sitting in a feed, waiting to be brought back to life.

A trick-or-treat bag of candy is easy to fill but hard to enjoy if you can’t get at it.

The same is true for stolen money. Taking is the easier part because stolen cards, stolen credentials, and compromised accounts can all be had for a few bucks. Spending it without getting caught is the more difficult half of the equation because stolen funds are traceable, accounts get frozen, and transactions can be reversed. That’s why this listing exists. Cashing out is a skill that someone can buy, leaving the seller to cover the riskiest part.

For fraud teams, that changes where to look. The theft may happen where you can’t see it, but the cashout has to pass through someone’s account, and that’s where you have the best chance. A new login followed by a new payee, a first-time transfer to a peer-to-peer or wallet, or a newly opened account receiving money with no transaction history can all be signs of a cashout in progress. Payments move fast, so the window is short, and knowing which routes criminals are advertising can help your team figure out which ones to watch.

Limited-time Halloween offer: an extra 20 GB of residential proxy data. Act now! That’s the come-on in this listing, which touts its IP addresses as ideal for “competitor price scraping, managing social media accounts, and ad verification.” Those are the uses the seller says out loud, and “managing social media accounts” is carrying a lot of weight.

A residential proxy routes traffic through a home internet connection, making a fraudster’s login look like it comes from an ordinary customer in the right city or town – which is a signal many controls are designed to trust.

What this person is really selling is the infrastructure that makes stolen credentials usable. Credentials show the attacker has the keys, and the proxies help them look like the owner.

This scammer’s Halloween costume this year is simple and potentially very effective: a “successful” trader.

Scammers masquerade as experts. They could present themselves as a helpful advisor, a friendly voice with a limited-time offer, a cashout guru, “Mark from IT,” or any number of identities designed to build trust. So your customers aren’t necessarily hacked; they might simply be persuaded to send the money themselves.

That’s a hard problem to spot. The transfer is authorized from a real device by a real customer, so the controls designed to catch a stranger in the account don’t flag it. The best defense is an early warning.