Inside the Cybercrime Supply Chain: What Underground Listings Reveal—and What They Don’t

Note

Scope is the visible roles, the work each role performs, the services advertised, and the income or price ranges attached to them. I observed these listings day to day.

Warning

Prices taken from listings are advertised prices. Monthly ranges and pay shares attached to roles are claimed earnings. Neither is a verified transaction volume or a confirmed income.

Important

The listings show the highest income around private tools, large traffic teams, infrastructure ownership, direct insider access, and cash-out infrastructure. The highest stated monthly range is $30,000 to $100,000 or more for owners of top stealers and drainers.

Executive Summary

I observed a market split by role. Coders, sellers, brokers, traffickers, callers, renderers, carders, stuffers, droppers, cash-out operators, and COM insiders each take one part of the chain. The listings show that work, the services on offer, and the ranges attached to both.

Tooling sits at the start. Coders and cryptors build the malware, control panels, and crypting later roles use, while sellers, info brokers, and COM insiders supply logs, accounts, and records. Cash-out operators sit at the end. They move funds through drop accounts, crypto swaps, or merchant shells and return clean money or crypto.

The highest claimed earnings attach to owners of top stealers and drainers, at $30,000 to $100,000 or more per month, and to cash-out infrastructure owners, at $30,000 or more per month. Large traffic teams are claimed at $15,000 to $50,000 or more per month. The listings also show high claimed income for direct insider access and for people who own infrastructure.

How the Chain Fits Together

Tooling -> Infrastructure/Data -> Traffic -> Victim Interaction -> Monetization -> Cash-out

Coders and cryptors sit in tooling, and I observed that later roles depend on stealers, drainers, loaders, botnets, control panels, and related infrastructure. Sellers, info brokers, and COM insiders supply logs, card data, accounts, servers, proxies, and records on people or accounts. Traffickers send targets to phishing sites, stealers, or drainers once those tools are ready. Callers then apply live pressure, take one-time codes, or push stuck payments. Renderers cover KYC or payment proof, and carders, stuffers, droppers, and cash-out operators turn the result into goods and clean funds.

Role Overview

Figures in the pay-model column and the monthly column are claimed earnings. They are not verified income. COM has unit prices and a claimed upper range in the notes below.

Advertised Prices

Tooling, crypting, signing, and evasion

The reduced EDR listing, current as of 04.08 [date format unconfirmed], claims full visibility of attacks in real time, guaranteed license keys, and assistance installing agents. A separate listing offers one license with an original CS 4.13 hash, available until February [date format unconfirmed]. The EV crypt listing says large volume or regular customers can get more favorable conditions, with no figure, and it states a warranty, full delivery, and on-time delivery. The crypt partner's name is redacted in the source.

The premium crypt listing claims a zero leak policy: encryption runs on the buyer's server and the payload is never shared. It says the stub is cleaned and that a guide is provided for automation on the buyer's infrastructure. The Killer AV listing, updated 19.06 [date format unconfirmed], describes a freeze or suspend approach it calls invisible sleep. It says classic killers terminate processes and trigger alerts in the admin panel.

Cobalt Strike listings name CrowdStrike Falcon, Sophos, Microsoft Defender, Kaspersky, and ClamAV. One 4.12 offer includes Shellter 11.1. A related listing describes a bonus video on Shellter setup, AV and EDR bypass with Shellter, and adding a certificate with Shellter. Detection ratios in this section are listing claims.

These rows are advertised prices from tooling, crypting, signing, and evasion listings.

Full list: EDR license vendors (7 items)

• CrowdStrike at $200

• SentinelOne at $200

• Kaspersky EDR at $220

• Trend Micro at $200

• Cortex XDR at $220

• Bitdefender at $200

• ESET Inspect at $200

Full list: premium crypt named products (7 items)

• CrowdStrike

• SentinelOne

• Kaspersky

• Defender

• XDR

• EDR

• AV

Full list: premium crypt payload categories (7 items)

• Red team payloads

• RATs

• Stealers

• Clippers

• Loaders

• Botnets

• Keyloggers

Full list: premium crypt supported formats (5 items)

• x64 and x86 native

• C, C++, Go, Rust, and Nim

• .NET Framework and .NET Core

• exe, dll, and bin conversion

• ps1 wrapping for fileless memory execution

Full list: premium crypt listed results (4 items)

• Static detection at 0 out of 26 on avcheck.net

• 24 hour monitoring

• 7 day monitoring

• Stub updates

Full list: Killer AV named products (19 items)

• Avast

• Norton

• TotalAV

• Bitdefender

• ESET

• McAfee

• Kaspersky

• Quick Heal

• Sophos

• Windows Defender

• CrowdStrike Falcon

• Microsoft Defender for Endpoint

• SentinelOne Singularity

• Kaspersky EDR

• Cortex XDR

• Bitdefender GravityZone Ultra

• Trend Micro Apex One

• VMware Carbon Black Cloud

• Cisco Secure Endpoint

Full list: Cobalt Strike named products (5 items)

• CrowdStrike Falcon

• Sophos

• Microsoft Defender

• Kaspersky

• ClamAV

Phishing and AitM infrastructure

The EH listing calls the product a PaaS platform for AitM attacks. It says the system replaces manual configuration editing, Nginx restarts, individual phishlet builds, and instant detections from security systems. The closed-club listing describes limited private node seats and a community covering Evilginx modifications, SMTP mailers with DKIM spoofing, and spam system techniques. Premium rows are from the Evilginx2 v3.3.Pro 4 Modify listing.

These rows are advertised prices for phishlets, EH platform tiers, and related install listings.

Full list: bank phishlets at $1,000 each (21 items)

• KeyBank

• Regions Bank

• Fifth Third Bank

• Huntington Bank

• BBVA USA

• Citizens Bank

• M&T Bank

• BMO Harris Bank

• First Republic Bank

• Zions Bank

• Webster Bank

• Simmons Bank

• Old National Bank

• Comerica Bank

• First Horizon Bank

• Valley National Bank

• Bank of the West

• First Citizens Bank

• Cadence Bank

• Pinnacle Financial Partners

• Ameris Bank

Full list: additional Evilginx targets with no price in that listing (22 items)

• AOL

• Yahoo

• OKX

• Telegram

• Bybit

• iCloud

• OpenAI

• X.com

• PayPal

• LinkedIn

• Adobe

• Bitget

• Capital One

• La Poste

• Ibank

• Privacy

• Tonkeeper

• Volksbank

• Capitalist

• Discord

• Iamconnected.com

• PortBase

Full list: phishlet categories (83 items)

Bank

• Wells Fargo

• Citi

• BOA

• Chase

• Scotiabank

• Capital One

• Ibank

• Volksbank

• KeyBank

• Regions

• Fifth Third

• Huntington

• BBVA USA

• Citizens

• M&T

• BMO Harris

• First Republic

• Zions

• Webster

• Simmons

• Old National

• Comerica

• First Horizon

• Valley National

• Bank of the West

• First Citizens

• Cadence

• Pinnacle

• Ameris

• Banrisul

• Banco Mercantil

• Banco Original

• BTG Pactual

• Banco Inter

• Chime

• BREX

• PayPal

Crypto and payment

• Binance

• Blockchain

• OKX

• Bybit

• Bitget

• Tonkeeper

• Bitcoinira

• PayPal

• Capitalist

• Polymarket

• Privacy

• Kraken

• Raydium

Mail

• Google

• Office 365

• AOL

• Yahoo

• iCloud

• La Poste

• Mailo

• Migadu

• Kolab Now

• Mailfence

• GMX

• Tutanota

• Runbox

• WEB.DE

• Mail.com

• SendGrid

• Nubo

Social

• Facebook

• Instagram

• Telegram

• X

• LinkedIn

• Discord

• GitHub

Other

• Azure

• Salesforce

• Airbnb

• OpenAI

• Adobe

• PortBase

• Siquando Forum

• Seeweb

• Amazon

Full list: EH platform tier inclusions (10 items)

START Operator

• One active server

• Web panel

• Basic phishlets

• No provided domain or certificate

PRO Red Team

• Unlimited nodes

• Dedicated isolated server profile

• Customizable phishlets

• Role-based access for Admin, Operator, and Analyst

• Corporate SIEM integration

• Personal 24 hour and 7 day support

Full list: EH plus EvilGinx install inclusions (8 items)

• Live installation and setup

• Custom configuration

• Chat support in the EH panel and Telegram

• AnyDesk configuration

• Mandatory screen recording

• Expert guidance

• Comprehensive support

• Personalized approach

PayPal is listed under both Bank and Crypto and payment. I kept that repeat. The category list is an inventory of names. A price above applies only where that same listing states it.

Insider lookup and account services

Rows say Not stated where a listing gives no figure. Two prices are printed as x,xxx and xxxx, and those strings are copied. DoorDash says a bulk discount is available. The Namecheap and GoDaddy listing says the $1,000 base can vary with domain traffic, and it claims domain takedown.

The Verizon lookup listing says buyers can cross-check the data and that tests are accepted. That listing shows no price. The bundle listing claims Verizon services since 2025. It says a test can be done on an alt account the buyer owns, that an escrow middleman is accepted, and that proof of processing will be provided.

Telecom lookups list T-Mobile, Three UK, Vodafone, Lycamobile, Rogers, and Xfinity at $1,000 per lookup, plus a T-Mobile swap at $10,000 and an Xfinity swap at $5,000. A separate Xfinity ISP and mobile listing prices a lookup at $500 and a reset at $800, with a turnaround of 20 to 40 minutes. That listing also names CSA, CPNI, landlines, and locked accounts.

The Roblox terms listing gives a turnaround of 0 to 3 days, usually one day, and says the fee is refunded if the work is not done in 3 days. It claims to be the cheapest available. Checkmark and shielding prices are not stated, and those listings say to ask. The Airbnb listing says buyers and sellers can be searched.

Every figure in this table is an advertised price, except the SIM-swap row, which I recorded under COM as a claimed unit price.

Full list: returned fields by service

Verizon lookup and swap

• Name

• Business names

• Date of birth

• Address on file

• Email

• Phone plan

• Device description

• Rate

• Phone model or IMEI

• SIM or ICCID

• Account number

• Latest bill amount

• Latest bill date

Discord

• Email

• Number if any

• IP login history

• Device IDs if any

• Billing information

• Transaction logs

Gmail, contact listing

• Email

• Number if any

• IP login history

• Device IDs if any

• Billing information

• Transaction logs, including other Google services such as YouTube

Namecheap and GoDaddy

• Email

• Number

• Billing information

• Domain owner first and last name

• Address if found

• IP login history

• Transaction logs

eBay and PayPal

• Full name

• Home address and date of birth

• All linked information

• Payment method

• Recent orders

• IP address

Meta lookup (IG, FB, WP)

• Email

• Phone number

• 2FA status

• Registration date

• Country

• Predicted home location

• Date of birth

• Active status (180 days)

• IPs

• Device and machine list

• Linked accounts

• Private IG stories and posts

• Last active time

• Ad accounts

Roblox lookup and shielding

• Email

• Phone

• Creation date

• Premium expiration dates

• User ID

• More

LinkedIn profile

• Full name

• Email and phone number

• Account notes or violations

• Latest IP, sign up IP, and last activity IP

• Date of last activity

DoorDash

• Full name

• Linked phone number and email

• Orders and total spent

• Last 3 recent orders

• Home address

Epic Games

• Email

• Phone number

• First name and last name

• User ID

• Console currently connected and dates

• Previous link

• Invoices

• Payment method

Gmail lookup

• Phone

• Email

• Backup email

• Backup phone

• Creation date

• Last attempt IP

• Creation IP

• Geolocation

Meta Business Manager

• Business ID

• Owner or managed partner

• User access and roles

• Account team

• Credit line if available

• Billing status

• Risk profile

• Review status

• Linked assets

• IDD diagnostics

• Policy and setup

• More

Google Ads

• Name

• All data

• Campaign ROAS

• CPC

• Campaign structure

• Assets

• Keywords

• Address

• Billing information

• More

Apple

• Email

• Number

• Name

• Address

• Recent orders and order number

• Physical item orders

Cox Mobile and ISP

• Everything on the account

• For mobile: ICCID, IMEI, and everything on the account

• From an email search: everything on the entire account

Full list: lookup and EDR bundle services (15 items)

• Microsoft

• Minecraft

• Instagram

• Facebook

• Discord

• Namecheap

• GoDaddy

• Domain suspensions

• TikTok

• Xbox

• DoorDash

• Uber

• Uber Eats

• Verizon

• More

Full list: UK domain resets at $800 each (13 items)

• worldonline.co.uk

• Tinyworld.co.uk

• Talktalk.net

• Homecall.co.uk

• Tiscali.co.uk

• ukgateway.net

• screaming.net

• homechoice.co.uk

• lineone.net

• toucansurf.com

• Dsl.pipex.com

• pipex.com

• tinyonline.co.uk

Full list: always active services (23 items)

• Meta (IG, FB, WP) lookups

• CenturyLink resets

• LinkedIn lookups

• eBay lookups

• PayPal lookups

• DoorDash lookups

• IG bans, unbans, and shadowban removal

• Cox Mobile and ISP lookups

• Epic Games lookups

• Gmail lookups

• Three UK lookups

• Vodafone lookups

• Virginmedia and O2 lookups and resets

• Earthlink resets

• Apple lookups

• Google Ads lookups

• Airbnb lookups

• Three UK email changes

• Lycamobile lookups

• Roblox terms

• Xfinity lookups and resets

• TikTok lookups

• Venmo lookups

Email resets at $300 each cover Virginmedia, Centurylink, and Earthlink. The X and Twitter listing says the printed price depends on user value and followers.

Listing Examples

The blocks below are reconstructed from listings I observed. Seller names, handles, and contact details are omitted.

Premium crypt listing
Provenance: Advertised price
Claim: FUD and AV or EDR bypass
Named: CrowdStrike, SentinelOne, Kaspersky, Defender, XDR, EDR, AV
Single: $100 for 4 unique copies
Weekly: $750 for 7 days
Monthly: $2,500 for 30 days, with full support and custom stubs
Listed result: static detection 0 out of 26 on avcheck.net

EH platform listing
Provenance: Advertised price
Described as: PaaS for AitM attacks
START Operator: $500 per month
  One active server
  Web panel
  Basic phishlets
  No provided domain or certificate
PRO Red Team: $750 per month
  Unlimited nodes
  Dedicated isolated server profile
  Customizable phishlets
  Roles: Admin, Operator, Analyst
  Corporate SIEM integration
  Personal 24 hour and 7 day support

{
  "service": "DoorDash lookup",
  "input": ["email", "phone number", "order number"],
  "data_returned": [
    "full name",
    "linked phone number and email",
    "orders and total spent",
    "last 3 recent orders",
    "home address"
  ],
  "price": "$350 per lookup",
  "bulk_discount": "Bulk discount is available",
  "provenance": "Advertised price"
}

Analyst observations

The highest printed monthly figures are claimed earnings, not verified income. Owners of top stealers and drainers are listed at $30,000 to $100,000 or more per month. Cash-out infrastructure owners are listed at $30,000 or more per month. Large traffic teams are listed at $15,000 to $50,000 or more per month.

Large dropper services with multi country agents are listed at $15,000 to $40,000 or more per month. Big sellers with their own sources, and underground call center organizers, are listed at $20,000 or more per month. Direct insiders and large lookup services are listed at $5,000 to $20,000 or more per month.

The stealer and drainer line is the only monthly range that prints $100,000. Other high ranges end at "or more" and give no ceiling. The listings also show two upper tiers outside that highest-range group: large stuffer buyback services at $15,000 to $30,000 or more per month, and pros with private self registrations and merchants at $10,000 to $25,000 or more per month.

I group the lower claimed earnings with individual rendering, basic calling, beginner carding, small selling, and early traffic. I group the middle with experienced callers, experienced sellers, gift carding, renderers, droppers, and stuffers. I group the higher claimed earnings with private tooling, top stealers and drainers, large traffic teams, direct insider services, multi country dropper services, and cash-out infrastructure.

I observed prices tracking access, trust, scale, and operational difficulty. The high ranges sit with roles that control scarce access, private tooling, high value traffic, insider requests, or final cash-out infrastructure. This suggests those ranges attach to roles that hold an input other roles buy: a private tool, a direct insider, a traffic team, or the path that returns clean funds. That reading is not a measured profit.

I observed the roles as a chain of inputs. Traffickers start once tools are ready. Carders spend data and logs that sellers supply. Stuffers resell goods already obtained, and droppers receive parcels or transfers, while cash-out operators are the final link.

This suggests roles past tooling, traffic, or cash-out depend on an input the listings do not give them directly. The listings show those handoffs. I did not measure what happens if one role stops.

Defensive Implications

• Crypting, code signing, and Killer AV are sold as services against named endpoint products. A file that carries a signature, or a host where protection was disabled, still needs a behavioral check.

• Traffic is its own role. The listings show Shorts, Reels, TikToks, SEO, Google and Bing Ads, spam, and drainer lures as the way targets reach phishing pages, stealers, and drainers.

• Carrier and mailbox changes are priced work. Listings advertise SIM swaps, mail resets, and lookups, including an Xfinity turnaround of 20 to 40 minutes and a bundle turnaround of 1 to 3 days.

• Cash-out is a dependency. The listings show drop accounts, parcel drops, KYC fronts, mixers, stablecoins, Monero, and merchant shells, and high claimed earnings for people who own that layer.

• The work is priced as separate roles. Detection is more useful at the handoffs between tooling, data, traffic, pressure, and cash-out than at any single role.

Limitations

• Advertised prices and claimed earnings are not verified sales or income.

• These listings are what I see day to day. They are not a full census of the market.

• The dates 04.08, 19.06, and "until February" do not fix a year or a date format.

• Seller reliability is unknown. Warranties, detection counts, and offers of a test are seller statements.

• The same target appears in more than one listing. I kept the Uber, Gmail, Amazon phishlet, and telecom rows separate. The listings do not say they are one offer.

• Some prices are missing, or printed as x,xxx or xxxx. Ranges that end in "or more" have no ceiling.

• COM overlaps info broker work. I kept it as its own area.

Sources and Note

There is a lot here, and this is just from what I see every day. If I missed something, please feel free to correct me by DMing me on X at @_SW64_.

Credits

• https://onion.as/823

• Telegram Groups/Channels