Stolen account credentials: an empirical comparison of online dissemination on different platforms

Abstract

Account hijacking, i.e. illegitimately accessing someone else's personal online account, is on the rise and affects not only financial accounts, but the full spectrum of online accounts. To gain more insight in the illicit act of online dissemination of stolen account credentials, we systematically examined how such credentials were offered on three different types of online platforms where stolen credentials were disseminated and how offers varied by platform. We used web scrapes of these platforms for our comparative analyses. Our results demonstrate variation by platform in the type of information on accounts and account holders offered, the average asking price for credentials, and rules and services following a transaction. We conclude with policy implications and suggestions for future research based on the criminal event perspective.

Do Offenders [Fraudsters] ‘Collaborate and Listen’? A Quantitative Analysis of Fraudsters’ Decision-making Processes on Active Cybercrime Marketplaces

“…69 Specific to the contextual and situational environment associated with cybercrimes, CEP has helped explain criminality on the Dark Web forums (Madarie et al, 2019). 70 Madarie et al research indicates offenders learn how to maintain anonymity through encryption and garner support from other offenders through the frequency of written positive website ratings and negative website ratings, as previously highlighted in Kigeral's research. 71 Research exploring offenders' interactions with CEP mainly focuses on samples within the physical environment or is limited within the cybercrime ecosystem to certain websites, like classified advertisements and the Dark Web forums.…”

“…71 Research exploring offenders' interactions with CEP mainly focuses on samples within the physical environment or is limited within the cybercrime ecosystem to certain websites, like classified advertisements and the Dark Web forums. 72 Therefore, much less research explains the influence of offenders' decision-making processes among offending victims outside of the physical environment. The inclusion of Buller and Burgoon's IDT helps fulfil this void, specifically with the examination of offenders and offender victims' written text frequency.…”

Criminal clickbait: a panel data analysis on the attractiveness of online advertisements offering stolen data

“…This framework assumes that offenders aim to maximise their rewards while minimising the effort and risk when committing a crime (Loughran et al, 2016;Cornish and Clarke, 2017). Just as the rational choice framework has been embraced by a range of disciplines, so has it been applied to study a range of crimes (Loughran et al, 2016), varying from sexual crimes (Beauregard et al, 2010), burglary (Vandeviver and Bernasco, 2020) and money laundering (Gilmour, 2016) to online stolen data markets (Smirnova and Holt, 2017;Madarie et al, 2019).…”

“…A wide range of online platforms enable the sale of stolen account credentials, varying from mobile chat applications to hacker forums and illicit online marketplaces on the web (Madarie et al, 2019;Hebel et al, 2021). Typical illicit online markets are so-called "darkweb" markets that can only be reached with anonymisation software such as the Tor browser.…”

The Cynicism of Modern Cybercrime: Automating the Analysis of Surface Web Marketplaces

“…Nonetheless, the most prevalent categories are related to stolen credentials and information, extending beyond financial accounts. In this direction, Madarie et al [27] examined how, a diverse set of outlets such as stolen credentials, are disseminated by malicious actors as "account dumps". Their analysis revealed that the illicit dissemination of stolen account credentials covers a broad spectrum of online services, and highlighted Pastebin 3 as one of the main sites used to spread the information.…”