菜单
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.
Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
| name | carding-financial-fraud |
| description | Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell. |
| user-invocable | true |
| metadata | {"category":"knowledge-cell","created":"2026-04-05T00:00:00.000Z","last_updated":"2026-04-05T00:00:00.000Z","update_count":0,"confidence":"moderate"} |
Carding and financial fraud represent one of the oldest and most mature cybercriminal ecosystems, encompassing the theft, trade, and monetization of payment card data and financial credentials. The ecosystem spans from initial data theft (via digital skimming, POS malware, phishing, and database breaches) through underground marketplace trading to ultimate monetization via card-not-present (CNP) fraud, money mule networks, and reshipping schemes. The shift toward EMV chip cards largely eliminated traditional card cloning for in-person fraud in developed markets, pushing the ecosystem heavily toward CNP fraud in e-commerce, which now represents the vast majority of card fraud losses globally — estimated at over $30 billion annually.
The digital skimming landscape, dominated by the umbrella term "Magecart," continues to evolve with threat actors injecting malicious JavaScript into e-commerce payment pages through compromised third-party scripts, CMS vulnerabilities, and supply chain attacks. Card shops and carding forums provide the marketplace infrastructure, with BidenCash emerging as a prominent card shop known for large-scale free dumps to attract customers. The Genesis Market takedown in Operation Cookie Monster (April 2023) disrupted a major marketplace for stolen credentials and browser fingerprints, though alternatives rapidly filled the gap.
The fraud ecosystem increasingly overlaps with other cybercriminal domains. Infostealer malware feeds card data and banking credentials directly into fraud pipelines. Business Email Compromise (BEC) operators share techniques and money mule networks with carding groups. SIM swapping enables account takeover for financial fraud and cryptocurrency theft. The emergence of Fraud-as-a-Service (FaaS) platforms has lowered barriers to entry, offering turnkey fraud toolkits, tutorials, and operational support to less sophisticated actors.
| Actor/Entity | Type | Notable Characteristics | Status |
|---|---|---|---|
| BidenCash | Card Shop | Major marketplace; known for marketing via large free card dumps (millions of records); Tor-based | Active |
| Joker's Stash | Card Shop | Formerly dominant card shop; voluntarily retired February 2021 | Defunct |
| BriansClub | Card Shop | Major card shop; was itself breached in 2019 exposing 26M card records | Status unclear |
| Genesis Market | Credential/Bot Market | Sold browser fingerprints and credentials; seized in Operation Cookie Monster April 2023 | Seized |
| Russian Market | Log/Credential Shop | Major marketplace for infostealer logs, RDP access, and card data | Active |
| Magecart Groups | Digital Skimming Collective | Umbrella term for multiple groups conducting web-based card skimming | Active (various) |
| FIN7 | Cybercrime Group | Sophisticated group with ties to POS malware (Carbanak/FIN7 campaigns); members arrested but operations continued | Partially disrupted |
| Scattered Spider | Cybercrime Collective | SIM swapping, social engineering, financial fraud; young Western actors | Active |
| Various BEC Networks | Fraud Operations | West African (Yahoo Boys) and Eastern European networks conducting BEC and romance fraud | Active |
| SIM Swapping Crews | Account Takeover | Loosely organized groups bribing telecom employees or exploiting SS7 | Active |
BidenCash has established itself as a leading card shop through an aggressive marketing strategy of periodically releasing large batches of stolen card data for free — sometimes millions of records at once — to drive traffic and build reputation. These dumps typically contain a mix of fresh and older data across multiple countries. The marketplace operates on Tor and the clear web, selling cards categorized by bank, country, card type, and freshness with a checker service for validity verification.
Digital skimming attacks have grown more sophisticated, with actors increasingly targeting server-side injection to avoid client-side detection tools. Attacks against major e-commerce platforms (Magento, WooCommerce, Shopify third-party apps) continue. The PCI DSS 4.0 requirement 6.4.3 (mandating client-side script integrity monitoring) that took effect in March 2025 represents the industry's response, though compliance and enforcement remain works in progress.
SIM swapping attacks have expanded beyond cryptocurrency theft to target traditional financial accounts, corporate accounts, and even government officials. Techniques include bribing or socially engineering telecom employees, exploiting eSIM provisioning vulnerabilities, and using SS7 protocol weaknesses. Several high-profile arrests of SIM swapping groups have occurred, but the technique remains prevalent due to the fundamental weakness of SMS-based authentication.
| Date | Event | Impact |
|---|---|---|
| 2018 | British Airways Magecart breach | 380,000 card details stolen via injected checkout script; ICO fined BA £20M |
| 2019 | BriansClub breach | 26M stolen card records from the card shop itself were leaked; data shared with banks |
| Feb 2021 | Joker's Stash retirement | Largest card shop voluntarily closed; created market fragmentation |
| Apr 2023 | Operation Cookie Monster (Genesis Market) | FBI-led takedown seized Genesis Market; 119 arrests globally; disrupted bot/fingerprint market |
| 2023-2024 | BidenCash free dumps | Multiple large-scale free releases of stolen card data as marketing; 2M+ cards in single dumps |
| 2024 | PCI DSS 4.0 transition | New requirements for client-side script monitoring; full enforcement March 2025 |
| 2024-2025 | FIN7 members sentenced | Multiple FIN7 members received significant prison sentences in US courts |
| 2024-2025 | Scattered Spider arrests | Several members of the SIM-swapping and social engineering collective arrested by FBI |
Data Theft Methods: The ecosystem has evolved from physical skimming devices and POS RAM scraping malware (2010s) to predominantly web-based digital skimming (Magecart-style JavaScript injection) and mass data theft via infostealer malware. Server-side skimmers that intercept payment data at the application layer are increasingly common, as they evade client-side Content Security Policy (CSP) and script monitoring solutions.
Marketplace Infrastructure: Card shops have moved from forums with manual transactions to automated platforms with APIs, validity checkers (testing cards with small transactions), replacement guarantees (refunds for dead cards), and sophisticated search/filter capabilities. Multi-vendor marketplaces now coexist with single-operator shops. Telegram channels serve as both advertising and direct sales channels.
Monetization: CNP fraud techniques include using residential proxies to match cardholder geolocation, anti-fingerprinting browsers (Multilogin, GoLogin) to evade device fingerprinting, and automated checkout bots for rapid purchases. Gift card purchasing remains a primary cashout method. Cryptocurrency purchasing using stolen cards provides another laundering avenue.
Money Mule Operations: Recruitment of money mules has shifted from in-person "work from home" scams to social media and messaging app recruitment. Professional mule herders manage networks of mules across countries. Mules receive fraudulent funds and forward them, taking a commission. Some operations use cryptocurrency ATMs for rapid conversion.
Identity Fraud (Fullz): Complete identity packages ("fullz") containing name, SSN, DOB, address, email, phone, and sometimes bank credentials trade for $15-$65 depending on credit score and completeness. Synthetic identity fraud — combining real and fabricated data to create new identities — is a growing trend that is harder to detect than traditional identity theft.
Supply Chain: Card data flows from theft (skimming, breaches, infostealers) → aggregation by data brokers → card shop listings → purchase by carders → monetization via CNP fraud or resale. Each stage has specialized actors, and data may pass through multiple intermediaries before final use.
Quality Assurance: Card shops offer "checker" services that validate cards are still active by running small authorization charges. Cards are priced by freshness, bank, type (credit vs. debit), level (Classic, Gold, Platinum, Corporate), and geographic region. Corporate and high-limit cards command premium prices ($20-$100+).
Fraud-as-a-Service: Turnkey fraud packages include phishing kits targeting specific banks, fraud tutorials, pre-configured anti-detect browsers with stolen cookies/fingerprints, residential proxy access, and money mule network access. These services democratize fraud, enabling low-skill operators to conduct sophisticated attacks.
Geographic Patterns: Major carding actor concentrations include Russia/CIS (card shop operators, malware developers), West Africa (BEC, romance fraud, money mules), Southeast Asia (scam compounds, pig butchering operations), and Western countries (SIM swapping, money mule recruitment). Fraud scam compounds in Myanmar, Cambodia, and Laos have drawn international attention for human trafficking elements.
| Tool | Category | Usage |
|---|---|---|
| Magecart skimmers | Data Theft | JavaScript injections into e-commerce checkout pages |
| Anti-detect browsers (Multilogin, GoLogin) | Fraud Tooling | Spoof browser fingerprints to evade fraud detection |
| Residential proxies (911.re successors, various) | Infrastructure | Match cardholder geolocation for CNP fraud |
| SMS interceptors / SS7 tools | Account Takeover | Intercept 2FA codes for bank account takeover |
| Card checker services | Validation | Verify card validity before use |
| Infostealer logs | Data Supply | RedLine, Raccoon, Lumma output feeding card/credential markets |
| POS malware (various) | Data Theft | RAM scraping on point-of-sale terminals (declining) |
| E-commerce bots | Monetization | Automated checkout for rapid fraudulent purchases |
| Telegram bots | Marketplace | Automated card shops and checker services via Telegram |
| Cashout guides/tutorials | Knowledge | Step-by-step fraud methodology documentation |
| Date | Change | Source |
|---|---|---|
| 2026-04-05 | Initial creation with baseline intelligence through early 2025 | Training knowledge |
