# TRUSTMARKET Phishing Campaign Expands to Chileautos and New International Platforms

> CronUp CTI identified TRUSTMARKET, a multi-brand phishing operation active for at least six months that abuses legitimate marketplace/rental messaging to establish a transactional pretext before redirecting victims to brand-impersonating credential-harvesting kits. The campaign has expanded to Chileautos (Chile) and now spans 11+ platforms across the Americas, Europe, and Asia, using domains patterned on transactional keywords (verification, payout, confirmation).

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2019
- **ID:** TL-2026-2019
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TRUSTMARKET is a phishing operation documented by CronUp Ciberseguridad on 2026-08-14 that CronUp classifies under a technique it calls TTPH (Trusted Transaction Phishing). Rather than relying on cold email lures, the operators abuse the legitimate in-platform messaging systems of marketplace, classifieds, real-estate, and mobility apps to contact users who are already mid-transaction (a buyer, seller, renter, or rider). The message introduces a plausible transactional pretext tied to that context — payment confirmation, fund receipt, sale validation, identity verification, account confirmation, shipment confirmation, or fund release — and directs the victim to an external, off-platform link to 'complete' the step. That link resolves to a brand-impersonating phishing kit, visually and structurally themed to the specific platform, which captures the victim's login and/or payment credentials.

The full operational chain, as documented by CronUp, is: legitimate platform -> in-platform messaging/comment -> transactional context -> social engineering -> payment/verification/payout pretext -> external redirect -> brand impersonation -> phishing kit -> credential capture.

CronUp assesses the campaign has been active for at least six months as of the report date and has expanded well beyond a single brand. The newest confirmed target is Chileautos, Chile's largest automotive marketplace, observed via the domain chileautos.veriify937.icu. Including Chileautos, CronUp has mapped TRUSTMARKET infrastructure impersonating 11 other platforms: eBay and Zillow (United States), Poshmark and Depop (fashion resale marketplaces, US/UK), Vinted (Lithuania), Kleinanzeigen (Germany), Marktplaats (Netherlands), Booking.com (Netherlands, travel), BlaBlaCar (France, rideshare), Carousell (Singapore), and Fincaraíz (Colombia, real estate). This spans e-commerce, C2C resale, real estate, travel, and mobility verticals across Latin America, North America, Europe, and Asia.

The domain infrastructure follows a highly consistent naming convention: a brand token (e.g. 'ebay', 'vinted', 'kleinanzeigen') combined or chained with transactional keywords such as verification, validation, confirmation, payment, payout, receivefunds, soldconfirm, ordersupport, checkout, and approveprocedure, registered across a wide spread of generic and low-cost TLDs (.shop, .click, .info, .help, .cyou, .cfd, .sbs, .icu, .one, .biz, .app, .world). CronUp also documents a set of TRUSTMARKET-fingerprinted domains (shared kit architecture and naming pattern) that are not yet mapped to a specific impersonated brand, suggesting either staging infrastructure or brands not yet identified.

The phishing kits themselves are multilingual, brand-specific in presentation, but architecturally reusable across brands — the same kit skeleton is re-skinned per target platform. CronUp notes the presence of Russian-language comments and artifacts inside the kit codebase, which it treats explicitly as an infrastructure-correlation signal rather than an attribution claim: the report states this does not permit attributing the operation to a Russian state or criminal actor, only that it is useful for clustering related infrastructure (a pattern CronUp has separately observed in unrelated phishing campaigns using Russian-hosted bulletproof infrastructure). No specific threat actor, group name, or nation-state sponsor is identified.

CronUp's recommended defensive posture is to move away from tracking individual domain IOCs — which rotate rapidly given the low-cost, disposable registration pattern — toward tracking the TTP itself: correlating infrastructure via DNS, TLS certificates, ASN, hosting provider, registrar, nameservers, favicon hashes, and phishing-kit HTML/JS fingerprints, and monitoring for new domain registrations combining a target brand name with transactional keywords.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1588.002 Obtain Capabilities: Tool
- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1204.001 User Execution: Malicious Link
- T1056.003 Input Capture: Web Portal Capture
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1657 Financial Theft

## Sources

- [Phishing en Chileautos revela expansión de campaña TRUSTMARKET hacia nuevas plataformas y países](https://www.cronup.com/phishing-en-chileautos-revela-expansion-de-campana-trustmarket-hacia-nuevas-plataformas-y-paises/)
- [Phishing Avanzado, BEC y Abuso de Plataformas Legítimas: La Evolución del Riesgo para las Organizaciones](https://www.cronup.com/phishing-avanzado-bec-y-abuso-de-plataformas-legitimas-la-evolucion-del-riesgo-para-las-organizaciones/)
- [MITRE ATT&CK: Phishing (T1566)](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK: Phishing: Spearphishing via Service (T1566.003)](https://attack.mitre.org/techniques/T1566/003/)
- [MITRE ATT&CK: Impersonation (T1656)](https://attack.mitre.org/techniques/T1656/)
- [MITRE ATT&CK: Acquire Infrastructure: Domains (T1583.001)](https://attack.mitre.org/techniques/T1583/001/)
- [MITRE ATT&CK: Input Capture: Web Portal Capture (T1056.003)](https://attack.mitre.org/techniques/T1056/003/)
- [MITRE ATT&CK: Financial Theft (T1657)](https://attack.mitre.org/techniques/T1657/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2019