The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

What it is

Rapid7's profile of four active Fraud-as-a-Service (FaaS) marketplaces — Xleet (first observed 2022), Blackpass (formerly Paysell, Russian-operated, targets Western/US accounts), Infodig, and Styx (active since 2023, Telegram-based) — plus the MITRE Fraud Fighting Framework (F3), released early 2026.

How it works

Each marketplace specializes differently. Xleet sells stolen credentials with proof (screenshots, confirmation emails), SMTP/mailer access for evading email filters, and Cpanel/web shell/SSH/RDP/VoIP access. Blackpass sells RDP credentials and proxy services for IP masking, with an account inventory skewed toward regional banks and neo-banks (self-reg accounts command the highest prices due to setup labor). Infodig's accounts section is currently depleted (supply issues) but it pivoted to a new "ULP" (URL:LOGIN:PASS) section for bulk account-takeover targeting; its phone-infrastructure offering was discontinued entirely in late 2025. Styx operates as a hybrid marketplace/forum with a freemium model (free manuals to attract novices, paid private sections for high-value content), sells eSIMs/VoIP/compromised VPNs, and is notable for advertised "cashout" services spanning payroll schemes, ACH transfers, and refund scams across multiple banks. MITRE F3 maps these activities to ATO-heavy TTPs but, per the post, stops at the monetization stage and doesn't address needed cross-team collaboration.

Preconditions / Affected

Relevant to financial institutions, gambling/dating/streaming platforms, and any org whose customer accounts, SMTP/VoIP infra, or brand could be resold. Risk is heightened for orgs with self-registration flows (highest-value stolen asset category) and those exposed to BEC-style fund transfers.

What to do

The post's concrete recommendations: security teams should stop monitoring in isolation and directly integrate with internal fraud and compliance/financial-crime units; analysts should actively engage threat actors (purchase sample accounts, review posted images/video) to map seller networks and verify legitimacy before deploying countermeasures; and organizations should correlate leaked-asset findings against their own environments and respond via credential resets plus fraud monitoring to cut ATO and laundering losses.

Caveats

Rapid7 explicitly flags that MITRE F3, despite modeling adversary TTPs well, does not sufficiently address the cross-departmental collaboration it argues is necessary — the framework alone is incomplete as a countermeasure.