Threat reportPhishingTL-2026-3964
Classiscam-linked actors abuse open banking account-linking to validate stolen credentials
Classiscam-linked actors abuse open banking account-linking (TL-2026-3964), also tracked as The Checker You Pay For, is a medium-severity phishing campaign, first published 2026-10-20. It has no confirmed attribution, affects Unnamed (per Group-IB) Spend-management platform with open-banking, maps to 9 MITRE ATT&CK techniques (T1056.003, T1090, T1111), and is covered by 9 detection rules and 4 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3964
- Threat ID
- TL-2026-3964
- Also known as
- The Checker You Pay For, Open banking checker abuse
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, fintech, ecommerce, consumers
- Target regions
- united states of america, Global
- Detection rules
- 9
- Indicators of compromise
- 4
Malware and tooling in Classiscam-linked actors abuse open banking account-linking
Malware and tooling: Classiscam
How Classiscam-linked actors abuse open banking account-linking works
Group-IB reports that Classiscam-linked fraudsters abused a spend-management platform's open-banking account-linking flow as a free 'checker' for stolen bank and card credentials, at roughly USD 0.30-1.00 per link billed to the platform. The same platform's notification rails delivered Poshmark-impersonation phishing that harvested card data, OTPs and balances.
Group-IB Fraud Protection (Yuan Huang and Alexander Grabko, 'The Checker You Pay For', published 2026-10-20) describes a two-stage abuse of a legitimate spend-management platform that Group-IB does not name. The platform was not the fraud target. It was the fraudsters' infrastructure tool.
Stage 1 is phishing delivery. In late April 2026 the actors created accounts on the platform and used its payment-notification and email rails to send messages impersonating Poshmark payment notifications. The lure claimed funds were being held pending identity verification and used shortened links to fake verification pages. Poshmark itself was not compromised; it was only impersonated. The forms captured names, card details, phone numbers, email addresses, billing addresses, OTPs, card balances and payment-wallet access.
Stage 2 is credential validation. The actors fed the harvested bank and card credentials into the platform's open-banking account-linking flow, which is backed by third-party open banking aggregators. A successful link confirmed that the credentials were valid and that the account was funded. The aggregator billed the platform an estimated USD 0.30-1.00 per link, so the actors tested credentials at no cost to themselves. Group-IB's illustrative estimate for a platform with 1 million annual billable links at a 0.5-1% fraud rate is USD 2,500-5,000 per year in aggregator cost, plus reputational and regulatory exposure.
The operators adapted their tradecraft. Early on they used many disposable email accounts from one or a few devices. After detection they moved to one account per device. They routed traffic through VPNs, proxies, data-center ranges, residential IPs and hosting services. They cleared cookies and used private browsing to appear as separate devices. Device-fingerprint and geo-fingerprint clustering tied the phishing and card-testing accounts to the same hardware: device identity [496-] on April 27, and [524-] on April 28, which was linked to six accounts of each type. After Group-IB's engagement the client cut fraudulent-account blocking time from several hours to under one minute and stopped over 230 accounts in May 2026 before activation.
The sources do not publish domains, IPs or hashes, so the IOCs below are behavioral and device-level indicators only. Group-IB recommends monitoring three pre-transaction points: account creation, first outbound message, and first bank or card link attempt. It also recommends rate-limiting new accounts, scanning outbound links, capping link attempts per device, and reconciling aggregator invoices against expected demand.
MITRE ATT&CK techniques used in TL-2026-3964
Credential Access
T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception
Command and Control
Execution
Initial Access
Resource Development
Reconnaissance
Impact
Defense Evasion
Affected products and versions in Classiscam-linked actors abuse open banking account-linking
- Unnamed (per Group-IB) — Spend-management platform with open-banking account-linking and notification features
Vulnerable versions: Unspecified; abuse of legitimate functionality - Open banking aggregators — Account-linking / open banking aggregator services billed per link
Vulnerable versions: Unspecified; abuse of legitimate functionality - Poshmark — Poshmark marketplace (brand impersonated, not compromised)
Remediation for Classiscam-linked actors abuse open banking account-linking
Immediate actions
- Flag disposable-email signups, repeated device/geo fingerprints and automated signup rhythm at account creation
- Rate-limit and reputation-gate outbound messages from new accounts and scan outbound links against phishing and domain intelligence before delivery
- Cap bank/card link attempts per device and require step-up verification for new or low-trust accounts
Workarounds
- Add friction (verification delay, manual review) to account linking for accounts that message strangers shortly after signup
Longer-term hardening
- Treat pre-payment actions (signup, first message, first link) as first-class fraud signals using device, behavior, email and graph analysis
- Reconcile open-banking aggregator invoices against expected link demand to catch volume anomalies
- Document detection and prevention controls ahead of scam-prevention regulation (Australia SPF, US Nacha 2026 amendments, UK APP reimbursement)
Timeline of Classiscam-linked actors abuse open banking account-linking
- Late April 2026: Group-IB discovers the campaign, in which payment-notification systems of a spend-management platform are abused to distribute Poshmark-impersonation phishing (exact start day not stated; date approximated to the month)
- Device identity [496-] is associated with both phishing and card-testing accounts
- Device identity [524-] is linked to six phishing accounts and six card-testing accounts
- May 2026: after Group-IB engagement, the client's fraudulent-account blocking time drops from several hours to under one minute and over 230 accounts are stopped before activation (exact day not stated; date approximated to the month)
- Cybersecurity News reports the Group-IB findings
- Group-IB publishes 'The Checker You Pay For' describing the open-banking checker abuse and recommended detections
Sources cited for Classiscam-linked actors abuse open banking account-linking
- The Checker You Pay For (Group-IB Fraud Protection)
- Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent
- Classiscam Scam-as-a-Service Operations (The Hacker News, background on Group-IB's Classiscam research)
- Classiscam Scam-as-a-Service raked in $64.5 million (The Hacker News)
- 2026 Nacha Rule Change: Proactive Fraud Monitoring of ACH Now a Requirement (Outseer)
- The Scams Prevention Framework legislation passes Parliament (Gilbert + Tobin)
Detection coverage for TL-2026-3964
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3964 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.