Underground sellers-fraud-oriented sellers alliance reshapes ransomware ecosystem operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
A growing underground market for premium AI platform access is turning ChatGPT, Claude, Microsoft Copilot, and Perplexity access into a tradable black-market commodity. The shift matters because ready-made accounts, subscriptions, and API access can help fraud actors scale phishing, scam scripts, and other AI-assisted abuse. Listings in fraud-oriented online communities suggest the ecosystem is broadening beyond isolated account misuse into repeated resale and redistribution.
Related Happenings
Indirect prompt-injection web campaigns targeting AI agents
Campaign
H score37
First: 06.07.2026 18:00
Last: 06.07.2026 18:00
Sources 1
About this happening:
**Two real-world campaigns** are using **indirect prompt injection** and **SEO poisoning** to steer **AI agents** into fraudulent actions and false legitimacy judgments. The lures...
Indirect prompt-injection web campaigns targeting AI agents
CampaignAbout this happening: **Two real-world campaigns** are using **indirect prompt injection** and **SEO poisoning** to steer **AI agents** into fraudulent actions and false legitimacy judgments. The lures...
Business Email Compromise underground operating model and monetization ecosystem
Threat Actor Meta
H score29
First: 30.06.2026 17:00
Last: 30.06.2026 17:00
Sources 1
About this happening:
**BEC** underground activity is expanding into a broader fraud-enablement ecosystem, raising the effectiveness and reach of invoice and payment fraud. Researchers observed actors...
Business Email Compromise underground operating model and monetization ecosystem
Threat Actor MetaAbout this happening: **BEC** underground activity is expanding into a broader fraud-enablement ecosystem, raising the effectiveness and reach of invoice and payment fraud. Researchers observed actors...
Underground credential ecosystem shift changes threat-actor operations
Threat Actor Meta
H score69
First: 22.06.2026 17:05
Last: 22.06.2026 17:05
Sources 1
About this happening:
A **search-your-target** underground service layer is turning **stolen infostealer logs** into on-demand credentials, raising **account takeover** and **corporate intrusion** risk...
Underground credential ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: A **search-your-target** underground service layer is turning **stolen infostealer logs** into on-demand credentials, raising **account takeover** and **corporate intrusion** risk...
JetBrains Marketplace malicious plugins exfiltrating AI provider keys
Malware Activity
H score12
First: 17.06.2026 12:38
Last: 17.06.2026 12:38
Sources 1
About this happening:
A **JetBrains Marketplace** malware operation has pushed **15 malicious plugins** that pose as AI coding assistants and steal **AI provider API keys** from developers. The plugins...
JetBrains Marketplace malicious plugins exfiltrating AI provider keys
Malware ActivityAbout this happening: A **JetBrains Marketplace** malware operation has pushed **15 malicious plugins** that pose as AI coding assistants and steal **AI provider API keys** from developers. The plugins...
OpenClaw phishing simulations expose AI agent identity-verification failures
Technical Analysis
H score23
First: 10.06.2026 00:20
Last: 10.06.2026 00:20
Sources 1
About this happening:
Researchers found that **OpenClaw** email agents could be manipulated by **phishing simulations**, exposing gaps in **sender verification** and risky handling of sensitive data. I...
OpenClaw phishing simulations expose AI agent identity-verification failures
Technical AnalysisAbout this happening: Researchers found that **OpenClaw** email agents could be manipulated by **phishing simulations**, exposing gaps in **sender verification** and risky handling of sensitive data. I...
Timeline
-
25.03.2026 16:02 2 articles · 3mo ago
Growing premium AI access resale market in fraud communities
Campaign Scope UpdateHundreds of posts in fraud-oriented online communities advertise premium AI platform access as resale-style listings, including ChatGPT Plus and Pro subscriptions, Claude Pro access, Microsoft Copilot bundled with Office 365 accounts, Perplexity AI Pro, and API-related offerings. The listings promote discounted subscriptions, bundled access, shared or resold subscriptions, and claims such as “premium access,” “no limits,” and “full API access,” indicating a recurring underground market for reused accounts and programmatic access.
Show sources
- Paid AI Accounts Are Now a Hot Underground Commodity — www.bleepingcomputer.com — 25.03.2026 16:02
- Paid AI Accounts Are Now a Hot Underground Commodity — www.bleepingcomputer.com — 25.03.2026 16:02