Rapid7 maps the shift from large fraud marketplaces to fragmented shops

Rapid7 has published research on the fraud economy, describing a move away from large, well-known marketplaces towards smaller, specialised storefronts on Telegram, the dark web and niche forums. The company points to Fraud-as-a-Service shops such as Xleet, Blackpass, Infodig and Styx, which sell stolen accounts, PII, SMTP and VoIP infrastructure, eSIMs and cashout services.

The report notes that MITRE introduced its Fraud Fighting Framework in early 2026 to help organisations map adversarial tactics, and argues that security, fraud and financial crime teams need to monitor these marketplaces together to catch threats early.