The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment
Rapid7, Friday, September 11th, 2026
The underground fraud economy is splintering from big marketplaces into specialized Fraud-as-a-Service shops.
Rapid7 analyzes how the underground fraud economy has shifted from centralized marketplaces toward smaller specialized shops offering Fraud-as-a-Service.
Vendors supply stolen credentials, synthetic identity generators, SMTP and VoIP infrastructure, eSIMs and money laundering support, with marketplaces including Xleet, Blackpass, Infodig and Styx each serving different niches.
The fragmentation makes monitoring harder, since no single marketplace gives visibility into the ecosystem. The recommendation is active monitoring across shops, correlating leaked assets internally, and joint working between security, fraud and compliance teams.