# Dark Web Identity-Theft Ecosystem: $0.95 Fullz, STORM Infostealer-as-a-Service, and Scam-as-a-Service Marketplaces

> A Malwarebytes Labs investigation documents a maturing dark web criminal economy where complete US identity packages ('fullz' with name, SSN, DOB, and address) sell for as little as $0.95 on 9-Digits Market, the subscription-rented STORM infostealer harvests browser credentials, session cookies, and crypto wallets via server-side decryption, and forums such as DarkForums, BreachForums, Exploit, and XSS broker turnkey scam and social-engineering kits. Researchers counted 7,500+ compromised datasets totalling 8.4 billion+ records listed since the start of 2026.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0919
- **ID:** TL-2026-0919
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Labs conducted a 48-hour investigation into the dark web identity-theft and fraud-as-a-service ecosystem and found a low-friction, commoditized criminal supply chain. At the data layer, dedicated identity markets such as 9-Digits Market liquidate complete US 'fullz' identity sets — full name, Social Security Number (SSN), date of birth (DOB), and address — for as little as $0.95 per set, low enough that fraud is profitable at scale. Aggregator forums concentrate the supply: DarkForums hosts more than 115,000 members and over 1,200 small-and-medium breach listings (approximately 63 pages at 20 listings per page), while BreachForums has accumulated 700+ compromised database listings (about 37 pages at 20 entries per page) since the start of 2026. Russian-language professional forums Exploit and XSS, the WWH community, and the Link-Base directory round out the marketplace tier. In aggregate, Malwarebytes researchers identified 7,500+ compromised datasets containing 8.4 billion+ records listed since early 2026, with breach listings naming organizations including SoundCloud, ADT, Hallmark, Amtrak, Vimeo, and Instagram.

At the tooling layer, the ecosystem is powered by malware-as-a-service. The STORM infostealer (documented separately by Varonis Threat Labs) is rented on a tiered subscription — $300 for a 7-day demo, $900/month standard, and $1,800/month for a team license bundling 100 operator seats and 200 builds. STORM steals saved usernames and passwords, autofill data, session cookies, Google account tokens, stored payment/credit-card details, browsing history, and cryptocurrency wallets from both browser extensions and desktop apps. It targets Chromium and Gecko-based browsers (Chrome, Edge, Firefox, Waterfox, Pale Moon), pulls session data from Telegram, Signal, and Discord, steals documents from user directories, and captures screenshots across multiple monitors. Its defining innovation is server-side decryption: rather than decrypting Chrome-protected data on the victim endpoint (which generates antivirus-detectable behavior), STORM ships the encrypted browser files to operator-controlled infrastructure for remote decryption, evading endpoint telemetry. Operators connect their own VPS to STORM's central servers, and stolen Google Refresh Tokens paired with a geographically matched SOCKS5 proxy let attackers restore victim sessions and bypass multi-factor authentication. Builds keep harvesting even after a subscription lapses. One observed STORM intrusion against a US-based computer exfiltrated 87 username-and-password combinations.

The downstream impact is large-scale identity theft and fraud. The US Federal Trade Commission (FTC) received more than 1.15 million identity-theft reports in the first three quarters of 2025. With fullz priced below a dollar, a compromised SSN enables fraudsters to open credit lines, file fraudulent tax returns, obtain medical services, and impersonate victims across government and legal systems for years. This record documents the ecosystem for defenders: the marketplaces and forums to monitor, the STORM infostealer TTPs to detect, and the credential-and-identity exposure that downstream fraud depends on.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.003 Virtual Private Server
- T1588.001 Malware
- T1587.001 Malware
- T1650 Acquire Access
- T1059.001 PowerShell
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1113 Screen Capture
- T1213 Data from Information Repositories
- T1082 System Information Discovery
- T1553 Subvert Trust Controls
- T1556 Modify Authentication Process
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1078 Valid Accounts
- T1566 Phishing
- T1657 Financial Theft

## Sources

- [Inside the dark web: stolen identities for 95¢, malware, and scams-for-hire](https://www.malwarebytes.com/blog/threat-intel/2026/06/inside-the-dark-web-stolen-identities-for-95%c2%a2-malware-and-scams-for-hire)
- [The silent “Storm”: New infostealer hijacks sessions, decrypts server-side](https://www.varonis.com/blog/storm-infostealer)
- [The silent “Storm”: New infostealer hijacks sessions, decrypts server-side (BleepingComputer)](https://www.bleepingcomputer.com/news/security/the-silent-storm-new-infostealer-hijacks-sessions-decrypts-server-side/)
- [Storm Infostealer Sold as Service, Targets Browsers, Wallets and Accounts](https://hackread.com/storm-infostealer-sold-as-service-browsers-wallets/)
- [New 'Storm' Infostealer Remotely Decrypts Stolen Credentials](https://www.infosecurity-magazine.com/news/storm-infostealer-remotely/)
- [Storm infostealer bypasses Chrome encryption, targets crypto wallets (SC Media)](https://www.scworld.com/brief/storm-infostealer-bypasses-chrome-encryption-targets-crypto-wallets)
- [Your tax forms sell for $20 on the dark web (Malwarebytes)](https://www.malwarebytes.com/blog/privacy/2026/03/your-tax-forms-sell-for-20-on-the-dark-web)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0919