Scammers have weaponized a legitimate spend-management platform to send phishing messages and validate stolen financial credentials, turning trusted payment infrastructure into an operational part of fraud instead of attacking it directly.
Group-IB documented the activity within a client environment after the platform reported suspicious payment notifications in late April 2026.
According to the supplied research, Group-IB blocked more than 230 fraudulent accounts in May 2026. Onboarding-stage detection reduced blocking time from hours to under a minute.
Investigators assessed the activity as consistent with Classiscam, a scam-as-a-service operation that uses Telegram bots to generate marketplace impersonation pages and harvest payment information.
Group-IB’s related research describes an ecosystem where operators supply phishing templates and infrastructure to affiliates conducting the scams.
Instead of sending fraudulent emails through attacker-controlled infrastructure, operators inserted victims’ email addresses into the legitimate platform.
Its notification system then delivered messages claiming that buyers had paid for marketplace purchases.
One lure impersonated Poshmark, presenting a “paid” expense notification and claiming that funds remained on hold pending identity verification a shortened link directed recipients to a counterfeit Poshmark page.
Poshmark was impersonated; the research does not indicate that its systems were compromised.
The phishing pages displayed countdown timers to pressure sellers into submitting names, addresses, card details, balances, and one-time passcodes.
Some variants also requested payment-wallet access or internet-banking credentials.
GroupIB Researchers said that, the campaign targeted marketplace sellers outside the platform’s customer base, exploiting legitimate messaging and bank-account linking features.
The operation’s second layer abused the platform’s open-banking integration to test stolen credentials.
Login-based account linking, supplied through an aggregator, returned live balances and transaction history.
Fintech Platforms Abused
Unlike manually entering routing and account numbers, this process could establish whether banking credentials worked and whether an account contained funds.
Researchers observed checking alongside phishing in real time, allowing captured one-time passcodes to be used immediately.
Devices associated with phishing notifications were also linked to card-testing accounts, connecting delivery and validation within the same operation.
On April 27, one device identity was associated with two phishing accounts and two testing accounts. The following day, another identity supported six accounts of each type.
Shared device and geographic fingerprints indicated a common physical device behind these identities.
Operators initially created multiple accounts using disposable email addresses and a limited device pool.
After blocking increased, they shifted toward apparently separate device identities, consistent with cookie clearing or private browsing.
VPNs, proxies, hosting networks, and residential addresses further obscured activity, limiting the usefulness of IP-based blocking alone.
The platform also absorbed credential-checking costs through aggregator charges. However, conventional controls focused on unauthorized spending could overlook the operation because victims’ financial losses occurred elsewhere.
The research identifies three intervention points: account creation, the first outbound message, and the first bank-account or card link.
Disposable addresses, repeated device fingerprints, automated registration rhythms, rapid recipient invitations, and immediate linking attempts can expose abuse before money moves.
Graph analysis connects these signals, revealing relationships between seemingly independent phishing and testing accounts.
Group-IB’s Fraud Protection documentation describes device fingerprinting, behavioral analysis, network intelligence, and graph-based investigation capabilities that support this approach.
The case illustrates why fintech defenses must monitor infrastructure misuse, not merely transactions that directly generate financial losses.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
