Stolen Crypto Accounts Trade for $105 on Dark Web as Phishing Tactics Evolve
Compromised cryptocurrency accounts now fetch between $60-$400 on dark web marketplaces, with SecureList identifying Telegram as the preferred exfiltration channel for hackers. Attackers increasingly bypass email delivery—plagued by delays and blocks—in favor of Telegram bots that provide instant, untraceable data transfers.
Phishing kits now deploy three core components: counterfeit login pages, data processing scripts, and attacker contact details. Advanced operators leverage legitimate platforms like Google Forms and GitHub as camouflage, while admin panel uploads persist for high-value targets.
The cybersecurity landscape reveals shifting tactics: disposable Telegram bots enable real-time alerts, while PHP scripts remain prevalent for email-based theft. This underground economy thrives on stolen credentials from major exchanges including Binance, Coinbase, and Bybit.
