Cannibal Carders

Group-IB details an investigation into fake underground card shops that impersonate legitimate carding marketplaces to defraud buyers and spread malware. Analysts identify three major fake-shop networks (UniFake, JokerMantey, SPAGETTI), quantify domain counts and cryptocurrency transactions (SPAGETTI: >3,000 domains and >9,200 incoming transactions totaling ≈$1.2M), and show that SPAGETTI distributed the Taurus infostealer which exfiltrates browser data, crypto-wallet credentials and more; the report includes domains, IPs, and wallet indicators and discusses detection/attribution challenges.