Classiscam-style scammers abuse a fintech spend-management platform to send phishing and validate stolen bank credentials

Linha do tempo

1. gbhackers.com ↗ · pub. 20/10/2026 08:20 · coletado 20/10 09:00 primeiro registro

   Classiscam-style scammers abuse a fintech spend-management platform to send phishing and validate stolen bank credentials

   ler a análise desta fonte ocultar

   Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications in late April 2026. Investigators assessed it as consistent with Classiscam, a scam-as-a-service operation that uses Telegram bots to generate marketplace impersonation pages. Group-IB blocked more than 230 fraudulent accounts in May 2026.

   Technical Details

   • Operators inserted victims' email addresses into the legitimate platform. Its notification system then delivered messages claiming buyers had paid for marketplace purchases, so no attacker-controlled mail infrastructure was needed.
   • One lure impersonated Poshmark. It showed a "paid" expense notification, said funds were on hold pending identity verification, and used a shortened link to a counterfeit Poshmark page. The research does not indicate that Poshmark's systems were compromised.
   • The phishing pages used countdown timers to pressure marketplace sellers outside the platform's customer base into submitting names, addresses, card details, balances and one-time passcodes. Some variants also asked for payment-wallet access or internet-banking credentials.
   • A second layer abused the platform's open-banking integration. Login-based account linking, supplied through an aggregator, returned live balances and transaction history, showing whether credentials worked and whether the account held funds. Checking ran in real time alongside phishing, so captured OTPs could be used immediately.
   • Devices tied to phishing notifications were also linked to card-testing accounts. On April 27, one device identity was associated with two phishing and two testing accounts. The next day, another supported six of each.
   • Operators first used disposable emails and a limited device pool. After blocking increased, they moved to apparently separate device identities, consistent with cookie clearing or private browsing. VPNs, proxies, hosting networks and residential addresses limited IP-based blocking.
   • The platform absorbed credential-checking costs through aggregator charges. Controls focused on unauthorized spending could miss the activity because victims' losses occurred elsewhere.

   Remediation

   • Detect abuse at three intervention points: account creation, the first outbound message, and the first bank-account or card link.
   • Look for disposable email addresses, repeated device fingerprints, automated registration rhythms, rapid recipient invitations and immediate linking attempts.
   • Use device fingerprinting, behavioral analysis, network intelligence and graph analysis to connect seemingly independent phishing and testing accounts.
   • Do not rely on IP-based blocking alone.