Cybercriminals Use Telegram Channels to Sell Verified Bank and Fintech Mule Accounts

The report describes an industrialized underground market—primarily on Telegram and dark web forums—offering verified bank accounts, fintech wallets, crypto exchange accounts, forged IDs, and end-to-end laundering services (Mule-as-a-Service). It documents extensive regional activity (e.g., ~250,000 Telegram messages tied to Brazilian "Contas Laranja" and ~100,000 messages referencing Argentina), highlights the use of AI (deepfakes, voice cloning, automated account warming, adaptive smurfing) to bypass KYC/AML controls, lists an .onion forum IoC, and recommends active dark‑web monitoring and upgraded identity/behavioral defenses.