Podcasts
Autoshop Marketplaces
PatrickStash
Active Since
March 2022
Dark Web or Clear Web
Dark Web and Clear Web
PatrickStash began being mentioned on cybercrime forums as a viable option for carders in March 2022.
The site’s forum representative is very active in advertising the shop, touting automatic refunds, live statistics, and sellers in a range of countries as their USPs. On this note, the PatrickStash forum account regularly puts out recruitment calls for new vendors to sell to them, garnering a generally positive response.
PatrickStash has two categories, Cards and Cards NoVBV (short for Verified By Visa, now called 3D-Secure, an additional security layer meant to protect against online payment fraud). Despite its overtly Irish theme, the site is more likely to originate from Russia, or at least targets its advertising towards that audience.
Related Content
Knowledge Base
2easy
2Easy specializes in the sale of “logs” - data that is stored in the web browser, such as site credentials, cookies, and autofill form data - which can be used to digitally impersonate an individual.
Knowledge Base
Bahira
Bahira has generated buzz in both Russian and English-speaking dark web spaces and boasts the sale of both card details and dumps (the information encoded onto a card's magnetic stripe and used to make physical clones).
Knowledge Base
BidenCash
BidenCash specializes in the sale of payment card data. In spite of the use of his name and image, it is highly unlikely to be associated with the President of the United States.
Knowledge Base
BlackPass
BlackPass specializes in stolen login details needed to hijack e-commerce accounts rather than card details. Some accounts have PII associated with them such as the victim’s name, country, ZIP code, and phone number.
Knowledge Base
BriansClub
With earliest estimates placing its inception at 2014, BriansClub is the oldest autoshop on this list and sells a range of fraud products, including CVVs, fullz (card details packaged with additional cardholder information such as date of birth and social security number), and dumps.
Knowledge Base
Genesis
On April 5 2023, the Genesis market was seized as part of the international law enforcement crackdown dubbed “Operation Cookie Monster". The site had specialized in the sale of “browser fingerprints”.
Knowledge Base
RussianMarket
RussianMarket specializes in the sale of “logs”, CVVs, dumps and RDP access. Unsurprisingly, it is suspected to be of Russian origin.
