Criminals exploited a legitimate spend-management platform to validate stolen bank logins, harvest financial data and send thousands of marketplace-themed phishing alerts each day, Group-IB says.
Hackers have been abusing a legitimate spend-management platform to verify stolen bank logins at scale, according to a report this month by Group-IB that described a fraud pattern with implications for open-banking security. The researchers said criminals used the service’s account-linking process to test whether stolen credentials still worked, while also taking advantage of its notification systems to push phishing messages that appeared to come from a trusted online marketplace.
The technique is notable because it turns a normal financial control into a criminal tool. When a user linked an external bank account through an open-banking aggregator, the platform returned balances and transaction histories, allowing attackers to quickly determine which stolen logins were valid and whether the associated accounts held money. Group-IB said that in many cases the verification step would ordinarily cost a platform a small fee for each successful connection, but the attackers obtained those results without bearing that expense themselves.
Group-IB said the abuse was paired with a separate phishing campaign that emerged in late April 2026, when the platform reported that its payment-notification and email systems were being used to send fake alerts to thousands of people a day. Fraudsters set up accounts with disposable email addresses and sent messages posing as Poshmark, claiming that a sale required identity verification. Those messages pointed to counterfeit marketplace pages with countdown timers and forms designed to collect personal details, card information and, in some cases, banking credentials and one-time passcodes.
Investigators linked the phishing and credential-testing activity through shared device fingerprints recorded on April 27 and 28, suggesting that the same operators were running both schemes at once so that newly harvested verification codes could be used quickly. Group-IB said the behaviour resembled Classiscam, a scam-as-a-service operation, although it stopped short of definitive attribution. The researchers later said the platform cut the time needed to block suspicious accounts from several hours to less than a minute and stopped more than 230 fraudulent accounts during May 2026.
For financial platforms, the episode underscores a gap that can appear before any transfer is attempted: abuse can begin at account-linking, notifications or billing, long before transaction monitoring flags movement of money. Group-IB’s advice is to watch for repeated bank-linking attempts from newly created accounts, unusual notification spikes and rising verification costs that do not match legitimate customer activity. Banks and fintech companies, the report suggests, should treat unexplained connections and sudden fee increases as possible indicators of credential stuffing or phishing infrastructure rather than merely operational noise.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
