The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment
Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework
Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.
- Fraud-as-a-Service marketplaces sell accounts, stolen PII, infrastructure, and laundering support
- Larger marketplaces dismantled, driving buyers to smaller niche shops and Telegram channels
- MITRE F3 framework introduced in early 2026 to standardize fraud TTP analysis
- BEC schemes used to manipulate customers into transferring funds to fraudster accounts
- Monitoring marketplaces for asset mentions aids early threat detection
- Vendors
- Rapid7
- Malware
- Infostealer
- Organizations
- MITRE
From the original article
11 min read at rapid7.com
Introduction The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces.
By Gal Givon · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.