JDARMY BREAK Knowledge Base
type: Dataset
description: Business Risk Enumeration & Avoidance Knowledge
version: 2.31.0
date modified: 2026-06-29T05:52:23.000Z
language: en

Process Automation
type: Risk
break id: R0001
stix type: x-break-risk
definition: Includes but is not limited to automated registration, login, shopping, coupon collection, lottery, and task completion — using unintended application operations to accelerate or schedule specific workflows.
description: There are two mainstream approaches to implementing process automation: one is to reverse-engineer the business workflow and data transmission protocol, then write automated scripts to send requests; the other is to manipulate the business access terminal (e.g., browser, mobile app) and replay pre-recorded workflow actions.
complexity: advanced
influence: Exploits platform promotional benefits and occupies resources intended for legitimate users.
keywords: Process Automation
keywords: workflow automation
keywords: task automation
keywords: automation bot
keywords: scripted user actions
keywords: OAT-006 Expediting
keywords: expediting
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Emulator Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Headless Browser Detection
mitigated by: HOOK Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: IP Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Account Ban
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Traffic Encryption
mitigated by: Transport Protocol Encryption
mitigated by: Request Data Encryption
mitigated by: Response Data Encryption
mitigated by: Custom Transport Protocol
mitigated by: Biometric Identification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Data Parsing Interference
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Reducing Returns
mitigated by: Virtual Machine Detection
citation: OWASP Automated Threat: OAT006 Expediting
updated: 2026-06-11
version: 1
related cases: Selling Game Bots for Over 5 Million Yuan Leads to Criminal Sentence
related cases: Game Cheat Developer Wen Sentenced for Automating Unfair Gameplay
related cases: Automated Crawler Attack on Government Server Causes System Paralysis

Protocol-Level Automation
type: Risk
break id: R0001-001
stix type: x-break-risk
definition: Refers to programs that automatically send network protocol requests.
description: By reverse-engineering the business workflow and data transmission protocol, automated scripts are written to send requests.
complexity: advanced
influence: Exploits platform promotional benefits and occupies resources intended for legitimate users.
keywords: Protocol-Level Automation
keywords: API automation
keywords: request automation
keywords: protocol bot
keywords: direct API calls
keywords: HTTP request scripting
keywords: headless automation
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Biometric Identification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Business-Level Honeypot
mitigated by: Data Parsing Interference
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT-011 Scraping
updated: 2026-06-11
version: 1
related cases: When Handshakes Tell the Truth: Detecting Web Bad Bots via TLS Fingerprinting
related cases: Login Replay Attack Example: Eavesdropper Impersonates User Without Decryption
related cases: Foot Bath Shop Replay Attack Analogy: Repeating Valid Requests to Deceive Systems
related cases: Cloudflare Finds 31% of APIs Are Shadow APIs

Automated Simulator
type: Risk
break id: R0001-002
stix type: x-break-risk
definition: Refers to simulator programs that mimic normal user behavior to automatically send network protocol requests.
description: By manipulating the business access terminal (e.g., browser, mobile app), pre-recorded workflow actions are replayed repeatedly.
complexity: advanced
influence: Exploits platform promotional benefits and occupies resources intended for legitimate users.
keywords: Automated Simulator
keywords: UI automation
keywords: client automation
keywords: device farm bot
keywords: click bot
keywords: emulator farm
keywords: RPA bot
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Emulator Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Account Ban
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Business-Level Honeypot
mitigated by: Return Fake Data (Data Poisoning)
mitigated by: Data Parsing Interference
mitigated by: Single-Device Login
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT-020 Account Aggregation
updated: 2026-06-11
version: 1
related cases: China's First 'AI Game Cheat' Case: Simulating Player Actions to Cheat
related cases: SEO Rank Manipulation Black Market: Exploiting Emulators for Fake Clicks to Deceive Search Engines
related cases: Criminalization of Game Cheats: Legal Disputes over Simulated Manual Operation Scripts

Automated Login Risk
type: Risk
break id: R0001-003
stix type: x-break-risk
definition: The identity authentication login process can be automated, creating security risks.
description: Automated login risk refers to the use of automated scripts, bots, or software to execute the login process, potentially involving a range of security threats and issues.
complexity: intermediate
influence: Can lead to credential cracking (R0032), credential stuffing (R0032-001), and other cyberattacks; can also be used for automated account seasoning (R0034) and third-party account aggregation (R0037), making it a priority defense target.
keywords: Automated Login Risk
keywords: login automation
keywords: bot login
keywords: scripted login
keywords: credential stuffing
keywords: brute force login
keywords: automated sign-in
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Credential Reuse Detection
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Single-Device Login
mitigated by: Proxy Detection
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
citation: Credential stuffing - Wikipedia
updated: 2026-06-10
version: 1
related cases: Nanjing Yuhuatai Court Concludes Credential Stuffing Case Involving Personal Information Infringement
related cases: C0882
related cases: C0883
related cases: C0884

Coupon Enumeration
type: Risk
break id: R0002
stix type: x-break-risk
definition: Bulk enumeration of coupon codes, redemption codes, discount codes, and other promotional voucher credentials.
description: Voucher numbers are generated by some rule-based sequence or guessable algorithm. Through brute-force enumeration or algorithm cracking, voucher numbers can be obtained in bulk for further exploitation.
complexity: basic
influence: Exploits platform promotional benefits and occupies resources intended for legitimate users.
keywords: Coupon Enumeration
keywords: coupon code brute force
keywords: voucher brute force
keywords: promo code guessing
keywords: voucher cracking
keywords: code enumeration
keywords: OAT002 Token Cracking
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Numerical Obfuscation
mitigated by: Numerical Indexing
mitigated by: Response Status Obfuscation
mitigated by: Resource ID Encryption
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT002 Token Cracking
updated: 2026-06-11
version: 1
related cases: Research on Coupon Code Enumeration Vulnerabilities in E-Commerce Platforms
related cases: Shanghai Crackdown on Consumer Voucher Fraud Leads to 18 Arrests
related cases: Shanghai Putuo Dismantles Criminal Gang Exploiting Fake Orders to Defraud Platform Subsidies
related cases: Merchant Sentenced for Defrauding Government-Issued Consumer Vouchers

Malicious Flash Sale Grabbing
type: Risk
break id: R0003
stix type: x-break-risk
definition: Using automated means to grab goods or services during flash sales.
description: Also known as malicious order snatching. Refers to bad actors using technical means such as purchase-grabbing software to maliciously snatch time-limited, limited-quantity discounted goods on e-commerce platforms, disrupting normal market order and consumer shopping experience. These tools simulate human operations such as login, clicking, and order submission to achieve automated purchasing.
complexity: intermediate
influence: Exploits platform promotional benefits, disrupts normal platform operations, and degrades the ordering and shopping experience for legitimate users.
keywords: Malicious Flash Sale Grabbing
keywords: flash sale bot
keywords: purchase bot
keywords: scalping bot
keywords: drop bot
keywords: auto checkout bot
keywords: order snatching
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Increasing Business Resources
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Request Data Encryption
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
mitigated by: Device Profiling
mitigated by: Access Control
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Reducing Returns
citation: Four convicted for making and selling Lalamove plug-ins; over 20,000 drivers reportedly banned for plug-in use...
updated: 2026-06-13
version: 1
related cases: Zhejiang Shaoxing AI Face-Swap Moutai Scalping Case
related cases: Ningbo, Zhejiang: Illegal Flash Sale Software Used to Snatch Limited Goods for Profit
related cases: Jiangsu Nantong Sentencing for Sniping and Rush-Purchase Software Development
related cases: Scalper Buys Personal Information and Uses AI Face Swapping to Buy Moutai
related cases: Sichuan Deyang Police Crack Down on Ticket Scalping Bots for Scenic Spot Admissions
related cases: Jiangxi Xiajiang Police Crack Down on Script Scalper Supply Chain
related cases: Jiangxi Man Sentenced to 11 Months for Scalping Train Tickets Using Ticket-Snatching Software

Instant Bid Sniping
type: Risk
break id: R0003-001
stix type: x-break-risk
definition: Placing a bid at the first possible moment to obtain limited or flash-sale goods or services through unfair means.
description: Using unfair methods to obtain limited or flash-sale goods, services, or discounts — typically via third-party scripts or auxiliary tools. Sometimes relies on third-party intelligence to pre-leak interface information. Usually requires process automation capabilities (R0001).
complexity: intermediate
influence: Exploits platform promotional benefits and disrupts legitimate user ordering.
keywords: Instant Bid Sniping
keywords: instant snipe bot
keywords: first-bid automation
keywords: purchase sniping
keywords: drop sniping
keywords: buyout bot
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Request Data Encryption
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Access Control
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT005 Scalping
updated: 2026-06-13
version: 1
related cases: GitHub Project: Online Auction Fraudulent Bid Bot Detection
related cases: Sniping Attack in Auction Process Allows Attackers to Manipulate Bids
related cases: FH6 Auction House Sniper

Auction Sniping
type: Risk
break id: R0003-002
stix type: x-break-risk
definition: Placing a bid on goods or services at the last minute.
description: Using automated means to place a bid at the last minute, often completing a transaction at minimal cost. The principle is the same as instant bid sniping (R0003) but the goal differs: auction sniping aims to be the last valid bid before the deadline to obtain goods at the lowest possible price, while instant bid sniping aims to be the first bid after the sale starts to secure limited discounted items. Auction sniping typically requires process automation (R0001).
complexity: intermediate
influence: Transaction prices are too low, resulting in insufficient profit margins. Disrupts legitimate user ordering.
keywords: Auction Sniping
keywords: auction sniper
keywords: sniping bot
keywords: last-second bidding
keywords: bid sniper
keywords: eBay sniping
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Contractual Clause Restrictions
mitigated by: Security Deposit Mechanism
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT013 Sniping
updated: 2026-06-13
version: 1
related cases: Forza Horizon 5 Community Flags Auction Sniper Automation Software Issues
related cases: GEETEST Reveals Strategies and Detection Methods for Auction Sniping Bots
related cases: Just So Everyone Knows What Auction Sniping Is
related cases: OAT-013 Sniping
related cases: Auction Fraud Detection: Human or Robot?

Bot Scalping Risk
type: Risk
break id: R0003-003
stix type: x-break-risk
definition: Bots refer to the practice of seizing, misappropriating, or manipulating scarce resources through illegitimate means, especially using automated crawler techniques.
description: Using automated scripts or crawler tools to register large numbers of fake accounts, simulating transaction activity and fictitious purchases to seize scarce resources on the platform — such as limited-edition goods or purchase eligibility — preventing legitimate users from having a fair chance.
complexity: intermediate
influence: Disrupts legitimate user ordering.
keywords: Bot Scalping Risk
keywords: scalper bot
keywords: grabbing bot
keywords: inventory scalping
keywords: limited-drop bot
keywords: mass purchase bot
keywords: OAT-005 Scalping
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Increasing Business Resources
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Data Parsing Interference
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: Measures for the Supervision and Administration of Online Transactions
updated: 2026-06-13
version: 1
related cases: Nearly 4,000 People Involved and 70 Million Yuan at Stake: Zibo Police Bust Fake Review Ring

Unfair Resource Seizure
type: Risk
break id: R0003-004
stix type: x-break-risk
definition: Unfair resource seizure risk refers to individuals or organizations using illegitimate means to compete for and seize limited resources, violating fair competition principles and potentially causing unfair resource distribution and system abuse.
description: Specific illegitimate means include but are not limited to: using bot programs to rapidly submit large numbers of requests the moment resources become available; using malicious software to attack target systems; exploiting system vulnerabilities to bypass normal allocation mechanisms; submitting false personal or application information to deceive the system.
complexity: intermediate
influence: May lead to unfair resource distribution, system overload, and escalating malicious competition.
keywords: Unfair Resource Seizure
keywords: resource grabbing
keywords: slot grabbing
keywords: inventory hoarding
keywords: eligibility hoarding
keywords: automated resource seizure
keywords: denial of inventory
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Increasing Business Resources
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: OWASP Automated Threat: OAT-021 Denial of Inventory
updated: 2026-06-13
version: 1
related cases: Shanghai Police Dismantle Criminal Gang Using Automated Software to Scalp and Resell Medical Appointments
related cases: Chengdu Police Crack Down on "Online Scalpers" Illegally Hoarding Hospital Appointments
related cases: Hangzhou Police Seize 3 Tons of Counterfeit West Lake Longjing Tea Worth 120 Million Yuan
related cases: Tianjin Miandoudou Fined RMB 1 Million for One-Click Product Data Migration Software
related cases: A Study of the Ticket Scalping App Ecosystem in China
related cases: Scalper Detection in Geriatric Medical Services in China
related cases: A Scalping Anomaly Detection Method Based on Mobile Internet Traffic Data

Fake Shipment
type: Risk
break id: R0004
stix type: x-break-risk
definition: Fake shipment refers to a merchant or individual who, knowing that goods have not actually been shipped, deliberately provides false shipping information to the buyer in order to deceive or evade responsibility.
description: Fake shipment is one of the common fraud tactics in e-commerce or offline transactions. It typically involves: hiding the true status of goods (e.g., damaged, out of stock, or delayed); evading responsibility by sending unrelated items or empty packages after payment; substituting low-quality goods to reduce costs; or making false promises through misleading promotional tactics.
complexity: basic
influence: Damages buyers' legitimate rights and interests and disrupts normal platform operations.
keywords: Fake Shipment
keywords: false shipment
keywords: fake tracking number
keywords: empty box scam
keywords: false fulfillment
keywords: phantom shipping
keywords: shipment fraud
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Store Penalty
mitigated by: User Profiling
mitigated by: Contractual Clause Restrictions
mitigated by: Legal Action
mitigated by: Security Deposit Mechanism
mitigated by: Complaint and Reporting Channel
mitigated by: Multi-Instance Detection
citation: Measures for the Supervision and Administration of Online Transactions
updated: 2026-06-13
version: 1
related cases: Trackable Logistics but Vanished Package: 'Phantom Parcel' Scheme Unravels a Billion-Yuan Fraud Ring
related cases: Code-word ordering and empty parcel shipping: exploiting consumer vouchers for 400,000 yuan, 12 charged with fraudulent redemption
related cases: Minor Sentenced for Online Store Fraud via Fake Shipments
related cases: Live-Stream Fake Traffic, Bait-and-Switch, and Empty Parcel Brushing: SAMR Flags Click Farming Schemes
related cases: Online Stores Mail Empty Packages to Inflate Sales; Couriers Stuff Waste Paper for Trackable Shipments
related cases: Coded Orders and Empty Packages: 12 Indicted for ¥400,000 Coupon Fraud Scheme

Promotional Activity Cheating
type: Risk
break id: R0005
stix type: x-break-risk
definition: Using large numbers of accounts to complete platform promotional activities for profit.
description: After obtaining a large number of platform accounts, automatically completing platform promotional activities (including check-ins, tasks, red packet grabbing, coupon collection, flash sales, group buying, etc.). Account sources typically include bulk registration by black market operators (R0030), credential stuffing (R0032-001), credential cracking (R0032), or purchasing from black markets. Completing activities requires process automation capabilities (R0001).
complexity: intermediate
influence: Exploits platform promotional benefits and prevents legitimate users from participating in activities.
keywords: Promotional Activity Cheating
keywords: promo abuse
keywords: promotion abuse
keywords: campaign abuse
keywords: activity farming
keywords: incentive abuse
keywords: bonus abuse
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Reducing Returns
mitigated by: ROOT/Jailbreak Detection
mitigated by: Debugger Detection
mitigated by: Virtual Machine Detection
citation: What Does Promotional Activity Cheating Mean?
updated: 2026-06-11
version: 1
related cases: Little Swan Dongshan Store Hit by 70 Million Yuan Pricing Error Exploit
related cases: Lyu’s Fake Return Fraud of Over 4 Million Yuan Against Kans
related cases: Yangpu District Shopping Mall Parking Fee Fraud via Points Arbitrage
related cases: Pinduoduo System Vulnerability Exploited for Nearly 10 Million Yuan
related cases: Post-00s Xiaoya Falsely Returned Goods to Scam 130,000 Yuan, Sentenced to 2 Years

Bulk Fake Account Manipulation
type: Risk
break id: R0005-001
stix type: x-break-risk
definition: Using large numbers of accounts to perform likes, favorites, shares, comments, etc. to influence platform ranking metrics and profit.
description: After obtaining a large number of platform accounts, automatically performing likes, favorites, shares, comments, and other functions to influence platform ranking metrics, enabling unfair competition and profit. Account sources typically include bulk registration (R0030), credential stuffing (R0032-001), credential cracking (R0032), or purchasing from black markets. Requires process automation capabilities (R0001).
complexity: advanced
influence: Enables unfair competition through inflated positive ratings.
keywords: Bulk Fake Account Manipulation
keywords: engagement fraud
keywords: bulk account farming
keywords: fake engagement
keywords: like farm
keywords: comment farm
keywords: account farm
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Voice CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: Rate Limiting
mitigated by: Multi-Factor Authentication
mitigated by: SMS Verification
mitigated by: Phone Voice Verification
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Risk Address Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Account Ban
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: IP Profiling
mitigated by: Device Profiling
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Web Access Proxy Detection
mitigated by: Network Proxy Detection
mitigated by: Legal Action
mitigated by: Reducing Returns
mitigated by: ROOT/Jailbreak Detection
citation: What Is the Purpose of Fake Followers? How to Remove Fake Followers?
updated: 2026-06-11
version: 1
related cases: Douyin Cracks Down on "Main–Alt Account" Matrix Cheating
related cases: Shandong Zaozhuang Police Crack Major "Online Water Army" Case
related cases: Paid Posting and Fake Reviews: Two 'Online Water Army' Operatives Sentenced
related cases: Police Uncover the Gray Industry Chain Behind Bot-Driven Trending Topics
related cases: Inside the Internet Water Army Industry: Selling Followers and Tiered Comment Packages
related cases: Douyin Enforces New Rules to Crack Down on "Main and Sub-Account" Traffic Manipulation, Banning Multiple Million-Follower Accounts
related cases: Inside the 'Online Water Army' Gray Market: Pay to Boost Likes, Shares, and Comments
related cases: Over 20 Million Fake Reviews Busted — 'Cash for Good Ratings' Scheme Ruled Illegal
related cases: Using Cheats to Farm Song Plays for Easy Monthly Income? Lawyer Says Speculators May Face Fraud Charges

Fake Viral Referral
type: Risk
break id: R0005-002
stix type: x-break-risk
definition: Using large numbers of accounts to complete referral/viral growth activities for profit.
description: Also called 'new user acquisition cheating'. After obtaining a large number of platform accounts, automatically completing referral and recommendation tasks for profit. Account sources typically include bulk registration (R0030). Requires process automation capabilities (R0001).
complexity: advanced
influence: Exploits platform promotional benefits.
keywords: Fake Viral Referral
keywords: referral fraud
keywords: invite fraud
keywords: referral farming
keywords: new user acquisition fraud
keywords: invite bot
keywords: referral abuse
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Reducing Returns
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
citation: Running a Viral Marketing Campaign? Don't Overlook the Anti-Cheating Component
updated: 2026-06-11
version: 1
related cases: Onion Group's KOC Model Collapses: Recruitment-Driven Pyramid Scheme Leads to Business Implosion
related cases: Cloud Pay Sentenced for Pyramid Scheme via Agent and Infinite Fission Model

False Advertising
type: Risk
break id: R0006
stix type: x-break-risk
definition: False advertising refers to the practice in commercial activities where operators use advertisements or other methods to make false statements about goods or services that do not match actual content, causing customers or consumers to be misled.
description: False advertising commonly involves: exaggerating product performance or effects; fabricating customer reviews or usage experiences; marking up prices then offering fake discounts; fabricating sales volumes to create a false impression of popularity; inventing scientific research or data to lend credibility; hiding additional fees; using fraudulent certification labels or awards; making unfair or inaccurate comparisons with competitors; using misleading images or advertisements; and deliberately concealing product defects.
complexity: basic
influence: Consumers are misled into believing products have official endorsements or superior performance, affecting their purchasing decisions.
keywords: False Advertising
keywords: misleading advertising
keywords: deceptive marketing
keywords: bait advertising
keywords: fake claims
keywords: ad misrepresentation
keywords: truth-in-advertising violation
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: User Profiling
mitigated by: Account Penalty
mitigated by: Contractual Clause Restrictions
mitigated by: Legal Action
citation: Anti-Unfair Competition Law of the People's Republic of China
updated: 2026-06-13
version: 1
related cases: Hubei Xiangyang Reports Qiai 'Wellness Cigarettes' for Suspected False Advertising
related cases: Beijing Guanyou Shikong Digital Technology Fined 230,000 Yuan for False Game Advertising
related cases: Chongqing Police Dismantle Aphrodisiac Fraud Ring Posing as Medical Experts
related cases: Chengdu Chenghua Hanhou Medical Cosmetology Hospital Fined ¥409,800 for False Advertising of Cosmetic Procedure Results
related cases: False Advertising Case of a Metal Products Company in Chengdu
related cases: Multiple Real Estate Livestreamers in Inner Mongolia Banned for False and Exaggerated Promotions That Misled Consumers
related cases: Hainan Man Sentenced for Fraud via Fake Second-Hand Billiard Cue Ads
related cases: Shenzhen Cracks Down on AI Accounts for Exaggerated Claims and Marketing

Unauthorized Plugin Promotion
type: Risk
break id: R0007
stix type: x-break-risk
definition: Conducting promotions through plugin-type applications or plugins attached to application clients.
description: Unauthorized promotional plugins can be implemented in three modes: as an add-on attached to a browser or application client; by hijacking traffic on the access terminal and intercepting/redirecting specific traffic; or as a third-party tool or website (e.g., price comparison or cashback sites) conducting illegal promotions.
complexity: advanced
influence: Causes economic losses to the platform and customer attrition.
keywords: Unauthorized Plugin Promotion
keywords: affiliate toolbar
keywords: promo extension abuse
keywords: browser extension promotion
keywords: toolbar hijacking
keywords: unauthorized affiliate plugin
keywords: shopping assistant plugin
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Penalty
citation: Rule Guide: Interpretation of Rules on "Unauthorized Plugin Promotion"
updated: 2026-06-13
version: 1
related cases: Illegal Production and Sale of WeChat Plug-in 'Mini-Tools' Leads to Prison Terms and Fines for Two Individuals
related cases: Browser Plugin Hijacks Traffic: Baidu Sues Operator and Wins Compensation
related cases: Jiangsu Police Dismantle Forced Pop-up Operation for Illegal Computer System Control
related cases: Taobao Sues 'Shopping Party' Price Comparison Plugin for Unfair Competition, Claiming 3.2 Million Yuan
related cases: Browser Plugin Hijacks Web Traffic, Baidu Sues; Shanghai Tech Firm Ordered to Pay 830,000 Yuan for Unfair Competition
related cases: Illegal Control of Computer Information Systems: Software Bundled with Malicious Plugin Installer

Third-Party Price Comparison
type: Risk
break id: R0007-001
stix type: x-break-risk
definition: While a user is browsing a normal product detail page, providing price comparisons for the same product from competing websites.
description: Typical unauthorized promotional plugins exist as browser extensions, as well as app add-on plugins. While reasonable price comparison benefits market activity and saves consumer spending, incomplete or intentionally biased comparisons can cause economic losses or customer attrition — for example, comparing different brands, different models, or different service tiers.
complexity: advanced
influence: Causes economic losses to the platform and customer attrition.
keywords: Third-Party Price Comparison
keywords: price comparison extension
keywords: shopping comparison plugin
keywords: comparison toolbar
keywords: price checker plugin
keywords: affiliate comparison widget
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Penalty
mitigated by: Data Obfuscation
citation: Chrome Extensions Documentation
updated: 2026-06-13
version: 1
related cases: JD.com sends SMS warning users not to use third-party price comparison tools or plugins
related cases: Report on Unfair Competition Cases Involving Browser Extensions
related cases: Unfair Competition Case Involving the 'Shengqianzhao' Price Comparison Plugin

Access Link Hijacking
type: Risk
break id: R0007-002
stix type: x-break-risk
definition: Hijacking users' normal access requests and illegally redirecting them to other sites, cashback pages, or promotional pages.
description: Using viruses, trojans, malicious plugins, unauthorized bundled software, forced homepage setting, browser hijacking, page hijacking, search engine manipulation, or user information tampering to hijack normal traffic. Or during normal browsing, hijacking website traffic by modifying URL parameters or using pop-ups/floating windows.
complexity: advanced
influence: Causes economic losses to the platform and customer attrition.
keywords: Access Link Hijacking
keywords: link hijacking
keywords: affiliate hijacking
keywords: URL hijack
keywords: browser redirect hijack
keywords: traffic hijack
keywords: link interception
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Penalty
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: Software Extensions, Technique T1176 - MITRE ATT&CK
updated: 2026-06-13
version: 1
related cases: Alipay App Wake-up Strategy Hijacking Case
related cases: Daqing Police Crack Nation's First Telecom Operator DNS Hijacking Case
related cases: First Case of Traffic Hijacking via Smart Router Gateways
related cases: Fu Moumou and Huang Moumou Computer Information System Destruction Case (Supreme People's Court Guiding Case No. 102)
related cases: Guangxi Gongcheng Traffic Hijacking Case
related cases: Casino Job Leads to a Lucrative Scheme: He Launched a Traffic Hijacking Service
related cases: Shanghai Pudong Court Issues China's First Verdict in a Traffic Hijacking Case
related cases: Webpage Keeps Redirecting Automatically? You Might Be Facing Traffic Hijacking

Unauthorized Promotional Redirection
type: Risk
break id: R0007-003
stix type: x-break-risk
definition: While a user is browsing a normal product detail page, providing information that induces the user to purchase from another page.
description: Typical unauthorized promotional plugins exist as browser extensions, as well as app add-on plugins. The main tactic is to present more attractive or better-value product information when a user views a product, or to guide users to download a client through cashback or commission-sharing schemes.
complexity: advanced
influence: Causes economic losses to the platform and customer attrition.
keywords: Unauthorized Promotional Redirection
keywords: promo redirect
keywords: forced affiliate redirect
keywords: shopping redirect
keywords: traffic redirection
keywords: commission redirection
keywords: offer redirect
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Penalty
citation: Chrome Extensions Documentation
updated: 2026-06-13
version: 1
related cases: Unfair Competition Case Involving the 'Shengqianzhao' Price Comparison Plugin
related cases: MIIT Cracks Down on Malicious “Shake-to-Jump” Ads During 618 Shopping Festival
related cases: Chongqing Police Dismantle 'Video QR Code Injection' Scheme for Aiding Information Network Crimes
related cases: Jiangsu Police Dismantle 'Traffic Hijacking' Computer Information System Sabotage Case in Internet Cafes
related cases: Nanjing Police Dismantle Ground Promotion Flyer Ring Serving Overseas Telecom Fraud Compounds
related cases: Malicious Merchants Use Fake QR Code Ads to Redirect Users to Counterfeit Product Pages
related cases: Douyin Streamer Detained After Displaying Pornographic QR Code During Livestream
related cases: Douyin Streamer Detained for Cross-Platform Traffic Redirection to Overseas Accounts via VPN
related cases: Chongqing Dismantles “Video QR Injection” Scheme: QR Codes Embedded in Short Videos to Drive Gambling and Pornography Traffic

Unauthorized Plugin Cashback
type: Risk
break id: R0007-004
stix type: x-break-risk
definition: While a user is browsing a normal product detail page, the plugin label displays cashback information for that product.
description: Typical cashback plugins exist as browser extensions, as well as app add-on plugins and third-party apps or websites. The main tactic is to obtain the affiliate commission for a product when a user views it, then share a portion of that commission back to the user as cashback.
complexity: advanced
influence: Causes economic losses to the platform and customer attrition.
keywords: Unauthorized Plugin Cashback
keywords: cashback extension
keywords: rebate plugin
keywords: shopping rebate app
keywords: commission sharing plugin
keywords: affiliate cashback
keywords: cashback toolbar
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Penalty
citation: Chrome Extensions Documentation
updated: 2026-06-13
version: 1
related cases: Report on Unfair Competition Cases Involving Browser Extensions
related cases: Maiduo Mall Pyramid Scheme Case
related cases: Can a no-threshold referral-rebate plugin constitute pyramid scheme crime?
related cases: Uncovering the Yunji Pin Pyramid Scheme: How 'Consumer Rebates' Defrauded 300 Million People

Ad Fraud
type: Risk
break id: R0008
stix type: x-break-risk
definition: Manipulating digital advertising through fake clicks or impressions, or maliciously consuming advertising resources.
description: Forging or maliciously consuming click counts or impression counts for advertising projects, causing financial losses to advertisers. This generally involves ad network fraud or malicious actions by competitors. Ad network fraud typically includes inflating click or impression counts. Competitors typically maliciously click links to exhaust advertising budgets, increasing total advertiser spend.
complexity: basic
influence: Financial losses to advertisers.
keywords: Ad Fraud
keywords: invalid traffic
keywords: IVT
keywords: media fraud
keywords: advertising fraud
keywords: ad spend abuse
keywords: traffic fraud
keywords: OAT-003
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
citation: OWASP Automated Threat: OAT003 Ad Fraud
updated: 2026-06-13
version: 1
related cases: Live-Stream Fake Traffic, Bait-and-Switch, and Empty Parcel Brushing: SAMR Flags Click Farming Schemes
related cases: Manually Operating 800 Phones to Generate Fake Traffic for E-Commerce Livestreams: Online Water Army Gang Busted
related cases: Douyin Platform Crackdown on Pornographic Gambling Referral, Proxy Reporting, and Fake Traffic Leads to Arrest of 162 Suspects
related cases: Tongli IP | Exploring Anti-Unfair Competition Law Approaches to Platform Governance of Traffic Fraud
related cases: Cyber Police Bust 'Online Water Army' Fake Traffic Case
related cases: Huang et al. Exploiting Ad Settlement Loopholes to Defraud Advertising Fees
related cases: DECAF: Detecting Mobile In-App Ad Fraud
related cases: AlfScan-X: Detecting Ad Attribution Laundering Fraud

Ad Link Hijacking
type: Risk
break id: R0008-001
stix type: x-break-risk
definition: Tampering with advertising links to change the ultimate beneficiary of the ad promotion.
description: Using browser plugins or applications to hijack product links or ad links, converting a user's direct product visit into a visit through an affiliate promotion link to earn commissions. Or hijacking and tampering with existing affiliate promotion links to change the ultimate beneficiary and intercept commissions.
complexity: intermediate
influence: Financial losses to advertisers or affiliate promoters.
keywords: Ad Link Hijacking
keywords: affiliate link hijacking
keywords: commission hijacking
keywords: link rewriting
keywords: affiliate theft
keywords: attribution hijack
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Cheat/Plugin Detection
citation: Software Extensions, Technique T1176 - MITRE ATT&CK
updated: 2026-06-13
version: 1
related cases: Jiangsu “Traffic Hijacking” Computer Information System Sabotage Case
related cases: Thai Supreme Court Establishes Judicial Principles on Affiliate Commission Callback Hijacking

Click Fraud
type: Risk
break id: R0008-002
stix type: x-break-risk
definition: Click fraud refers to artificially generated fake click behavior through fraudulent means, typically occurring in the digital advertising space.
description: This behavior is designed to mislead advertising systems into recording fictitious ad click counts to obtain improper revenue or inflate ad performance metrics. Fake clicks may be generated through automated scripts, bots, click farms, and similar means rather than genuine user intent.
complexity: intermediate
influence: May cause harm to advertisers, ad platforms, and the entire digital advertising ecosystem.
keywords: Click Fraud
keywords: fake clicks
keywords: PPC fraud
keywords: pay-per-click fraud
keywords: click bot
keywords: click farm
keywords: invalid clicks
mitigated by: Identity Authentication (Login)
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Silent CAPTCHA
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Profiling
mitigated by: Proxy Detection
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
citation: OWASP Automated Threat: OAT-003 Ad Fraud
updated: 2026-06-13
version: 1
related cases: Improving Click Fraud Detection with Real-Time Data Fusion in IEEE 2008 Research
related cases: Legal Discussion on the Illegality of Using Click Software to Fraudulently Click Others' Ads
related cases: Guangzhou's First Fraud Case Involving Cheating Software Simulating Manual Clicks to Fabricate Traffic
related cases: Yu et al. Contract Fraud Case (Guiding Case No. 1480)
related cases: Click Fraud Detection in Pay-Per-Click Streams of Online Advertising Networks
related cases: Ad Click Fraud Detection: A Study of Machine Learning and Deep Learning Approaches

Fake App Installs
type: Risk
break id: R0008-003
stix type: x-break-risk
definition: Fake installs refer to fraudulently simulating or faking user installation behavior for an application or software to obtain false install counts or active user numbers.
description: Fake install methods include using automated scripts, bots, or virtual accounts to simulate large numbers of user installs, or using other technical means to generate large volumes of fake app install records in a short time. This can cause app stores and advertisers to misjudge the true value and popularity of an app.
complexity: intermediate
influence: Financial losses to advertisers or affiliate promoters.
keywords: Fake App Installs
keywords: install fraud
keywords: mobile install fraud
keywords: fake CPI installs
keywords: app install bot
keywords: install farm
keywords: attribution fraud
mitigated by: Identity Authentication (Login)
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Silent CAPTCHA
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Profiling
mitigated by: Proxy Detection
citation: OWASP Automated Threat: OAT-003 Ad Fraud
updated: 2026-06-13
version: 1
related cases: BotSpot: A Hybrid Learning Framework to Uncover Bot Install Fraud in Mobile Advertising
related cases: Botspot++: A Hierarchical Deep Ensemble Model for Bots Install Fraud Detection in Mobile Advertising
related cases: Shanghai Putuo District Phone Farming Fraud Case for Ad Promotion Fees
related cases: Machine Advertising Analyzes Sources of App Install Fraud
related cases: Fraudlogix Breaks Down Mobile App Install Fraud Techniques
related cases: LinkedIn Article Reveals Hidden Losses from Fake Installs

Impression Fraud
type: Risk
break id: R0008-004
stix type: x-break-risk
definition: Charging impression fees for ad materials that have not generated exposure or have not completed valid exposure.
description: For example, a media outlet places multiple display ads in the same ad slot and charges the advertiser for multiple ad impressions.
complexity: intermediate
influence: Financial losses to advertisers.
keywords: Impression Fraud
keywords: impression stuffing
keywords: view fraud
keywords: display ad fraud
keywords: fake impressions
keywords: ad stacking
keywords: impression inflation
mitigated by: Device Fingerprinting
mitigated by: Silent CAPTCHA
mitigated by: Risk Control Strategy
mitigated by: Biometric Identification
mitigated by: Data Profiling
mitigated by: Access Source Tracking
citation: OWASP Automated Threat: OAT-003 Ad Fraud
updated: 2026-06-13
version: 1
related cases: Man Arrested for Operating Over 1,000 Phones to Manipulate Views and Comments
related cases: Henan Yuzhou Court Sentences Defendant in Livestream Traffic Fraud Case
related cases: Hangzhou Jiefu Culture Media Fined RMB 200,000 for False Livestream Product Performance Claims
related cases: Criminal Gang Providing Fake Reviews for Over 4,000 Online Stores Busted
related cases: Multiple Illegal Cases Filed and Investigated: SAMR Reports Disposition of Issues Exposed at the '3·15' Gala
related cases: Impression Fraud in Mobile Advertising

Traffic Attribution Fraud
type: Risk
break id: R0008-005
stix type: x-break-risk
definition: A cheating method targeting CPA/CPS traffic that disguises organic traffic as channel traffic to obtain channel traffic commissions.
description: Fraudulent ad channel operators collect large amounts of device and user information, then directly send click information from different devices to the advertiser's ad click log server. If some organic traffic happens to convert within a certain time window, the activation log server records the corresponding device activation and attributes it to the fraudulent channel operator. This method of sending false information to disguise organic traffic as channel traffic can be applied at many stages, such as faking server click behavior or faking tracking code events.
complexity: advanced
influence: Financial losses to advertisers or affiliate promoters.
keywords: Traffic Attribution Fraud
keywords: attribution fraud
keywords: click injection
keywords: click spamming
keywords: organic hijacking
keywords: last-click hijack
keywords: CPA fraud
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Silent CAPTCHA
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Biometric Identification
mitigated by: Proxy Detection
mitigated by: Legal Action
citation: OWASP Automated Threat: OAT-003 Ad Fraud
updated: 2026-06-13
version: 1
related cases: Legal Risk Analysis of Click Fraud and Attribution Fraud
related cases: A Major Insurer's Ad Fraud Prevention Case
related cases: Jiangsu Police Uncover Traffic Hijacking Case Involving Computer System Sabotage

Malicious Benefit Abuse
type: Risk
break id: R0009
stix type: x-break-risk
definition: Malicious benefit abuse (coupon abuse) refers to obtaining illegitimate gains by excessively exploiting merchant promotional policies or activities.
description: Merchants run coupon collection, points, discounts, rebates, and giveaway activities to attract new users, boost sales, or increase user engagement. Malicious benefit abuse refers to attackers exploiting loopholes in merchant activities — including but not limited to: quantity limit failures, time limit failures, and eligibility restriction failures — to excessively (often through automated means) obtain more benefits, causing significant financial losses to merchants.
complexity: basic
influence: Causes significant financial losses to platforms and merchants.
keywords: Malicious Benefit Abuse
keywords: coupon abuse
keywords: promo abuse
keywords: offer abuse
keywords: bonus abuse
keywords: discount abuse
keywords: incentive abuse
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Reducing Returns
citation: 2024 H1 Internet Black-Grey Industry Research Report
updated: 2026-06-13
version: 1
related cases: Exploiting Platform Loopholes for Fraudulent Gains: 'Petty Theft' May Lead to Criminal Charges
related cases: New 'Wool-Pulling' Fraudulent Ordering Scam Drains Idle Taobao Store Deposits
related cases: Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
related cases: Refund-Only Scam Nets 4 Million Yuan from Merchants, Fraudster Sentenced to 6 Years
related cases: Shanghai Putuo Police Detain Woman for Fabricating Hotel Hygiene Claims
related cases: Exploiting Refund Time Gap for 'Wool Pulling'
related cases: Henan Du Fake Transaction Coupon Abuse Case
related cases: Shanghai Yangpu Procuratorate Handled a Virtual-Number Scheme Defrauding E-Commerce New-User Coupons and Referral Rewards

Unauthorized Third-Party Top-Up Services
type: Risk
break id: R0010
stix type: x-break-risk
definition: Providing low-price top-up services that bypass official legitimate recharge channels.
description: Obtaining low-cost top-up resources through promotional, non-compliant, or illegal means, and offering top-up services externally.
complexity: basic
influence: Affects the normal operations and profitability of game operators.
keywords: Unauthorized Third-Party Top-Up Services
keywords: gray-market top-up
keywords: proxy recharge
keywords: unofficial recharge
keywords: third-party recharge
keywords: cheap top-up
keywords: recharge arbitrage
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Legal Action
citation: Crackdown on Cyber Black-Grey Market: Putuo Prosecution Recovers 100 Million in Proxy Recharge Case
updated: 2026-06-13
version: 1
related cases: Shanghai Police Investigate Illegal Currency Exchange Using Online Game Tokens
related cases: 12 Players Face Criminal Charges for Illegal Top-Ups, Sega and Square Enix Lose Over 1 Billion Yen
related cases: Beware: Discounted Utility Bill Payments Used as Money Laundering Front, Leading to One-Year Prison Sentence
related cases: Using Mobile Phone Slow-Recharge Services to Launder Money for Gambling Crime Syndicates
related cases: Black-market gang offering discounted membership top-ups dismantled by police

Account Reselling
type: Risk
break id: R0011
stix type: x-break-risk
definition: Account reselling refers to individuals or organizations obtaining large numbers of internet platform accounts through illegal means and then trading them for sale.
description: These accounts can be from social media, email, online games, e-commerce, and other internet services. Account resellers typically obtain accounts through various means including illegal hacking, malware attacks, and social engineering. Once obtained, they sell them to buyers on the dark web or specific online forums.
complexity: intermediate
influence: Disrupts normal platform operations. Poses threats to user privacy and security, and may lead to account abuse, information leakage, and identity theft.
keywords: Account Reselling
keywords: account marketplace
keywords: stolen account sales
keywords: account trafficking
keywords: account shop
keywords: aged accounts
keywords: credentials for sale
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Account Penalty
citation: Valid Accounts - MITRE ATT&CK T1078
updated: 2026-06-13
version: 1
related cases: Xiangtan Police Crack Case Involving Stolen Online Accounts Sold for Profit
related cases: Gray market schemes in the ChatGPT boom: selling accounts and courses mostly gimmicks
related cases: MPS Reveals Typical Case in 'Account Shutdown' Operation: Insider Collusion with Account Traffickers in Telecom Fraud
related cases: Shanghai Police Dismantle Game Account Factory, Case Value Exceeds 2 Million Yuan
related cases: Jiangsu Dismantles 'Account Factory': Illegally Obtained Citizen Data Used to Register and 'Fatten' Accounts for Sale
related cases: Selling Accounts Lands Man in Prison: Huaiyuan Prosecutor Details Social Media Account Resale Case Under PRC’s “Aiding Cybercrime” Law
related cases: Guangzhou Police Dismantle Family-Run Gang Abusing Stolen 12306 Accounts to Scalp Train Tickets

Game Account Reselling
type: Risk
break id: R0011-001
stix type: x-break-risk
definition: Reselling stolen accounts or game accounts containing special resources.
description: Reselling stolen game accounts or game accounts containing special resources to convert virtual assets into cash.
complexity: basic
influence: Affects the normal operations and profitability of game operators.
keywords: Game Account Reselling
keywords: game account trading
keywords: account flipping
keywords: leveled account sales
keywords: boosted account sale
keywords: RMT accounts
mitigated by: Multi-Factor Authentication
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Account Penalty
citation: Shanghai's First Batch Game Account Registration Case: Is Mass Account Creation Illegal?
updated: 2026-06-13
version: 1
related cases: Tianjin Dismantles Entire Criminal Chain of Game Account Trading Fraud Ring
related cases: Qufu Police Crack Novel Personal Information Infringement Case, Arresting Man Trading in Stolen Game Accounts
related cases: Man Reselling Game Accounts Leads to a 30-Million-Yuan Case
related cases: Cheat Tool Alters 'Premium' Attributes as Black Market Targets Game Account Trading
related cases: Resale of a Game Account and Subsequent Recovery Leads to Theft Conviction

Account Privilege Reselling
type: Risk
break id: R0011-002
stix type: x-break-risk
definition: Paid privilege reselling refers to individuals or organizations obtaining paid services, privileges, or entitlements through illegal means and then reselling them to others.
description: This may include obtaining paid software, membership accounts, subscription services, or special permissions through malicious means, then selling them to others at a lower price or through illegally obtained channels.
complexity: basic
influence: Causes economic losses to legitimate users and service providers.
keywords: Account Privilege Reselling
keywords: subscription sharing resale
keywords: membership resale
keywords: premium account resale
keywords: entitlement resale
keywords: shared premium accounts
keywords: privilege arbitrage
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Single-Device Login
mitigated by: Contractual Clause Restrictions
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Valid Accounts - MITRE ATT&CK T1078
updated: 2026-06-13
version: 1
related cases: FBI Warns of Account Takeover Fraud via Impersonation of Financial Institution Support Staff
related cases: Customer Account Takeover: A Multi-Billion Dollar Problem
related cases: Illegal Purchase of Personal Information to Redeem Credit Card Points for Resale Profit

Cheating Tools / Game Hacks
type: Risk
break id: R0012
stix type: x-break-risk
definition: Cheating tools refer to illegal programs or script code used in computer games or software, designed to give users unfair advantages or modify program functionality.
description: Generally includes: cheat programs providing capabilities beyond normal gameplay such as auto-aim and wall hacks; automation scripts that automatically perform specific tasks like resource collection or quest completion without player involvement; and speed hacks that modify game speed to allow faster movement or actions.
complexity: intermediate
influence: Disrupts the normal operating logic of the application, thereby affecting normal platform operations.
keywords: Cheating Tools / Game Hacks
keywords: game cheats
keywords: cheat client
keywords: hack tool
keywords: trainer
keywords: mod menu
keywords: aimbot
keywords: wallhack
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Account Penalty
mitigated by: Anomalous Access Behavior Detection
citation: NetClean 2025 | Police Crack Down on Game Cheat Tools
updated: 2026-06-13
version: 1
related cases: Shanghai Police Dismantle a Game Cheat Black-Market Chain
related cases: Two Post‑90s Sentenced for Earning Tens of Millions Selling Game Cheats
related cases: Game Streamer Profits 3 Million Yuan from Selling Cheats, Placed Under Criminal Coercive Measures
related cases: Where Winds Meet Cheat Case Cracked: One Arrested for Illegal Profit of Tens of Thousands of Yuan
related cases: First National "AI Cheat" Case: Principal Offender Sentenced
related cases: The AI Cheat That Frustrated FPS Players Finally Faced Legal Consequences
related cases: Self-Developed Game Cheat Earns 200,000 Yuan, Developer Sentenced to Three Years

Red Packet Grabbing Bot
type: Risk
break id: R0012-001
stix type: x-break-risk
definition: Using cheating tools/scripts to automatically grab red packets in a fraudulent manner.
description: Mainly used in red packet features of social apps or games such as WeChat and QQ. These tools help users grab red packets the moment they are sent, typically by monitoring chat records and auto-clicking. When a red packet is detected, the tool immediately clicks to grab it at a speed far exceeding human capability.
complexity: intermediate
influence: Undermines platform fairness and disrupts normal user activity order.
keywords: Red Packet Grabbing Bot
keywords: red envelope bot
keywords: hongbao bot
keywords: auto red packet
keywords: packet sniping bot
keywords: WeChat red packet bot
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Account Penalty
citation: Old Wine in New Bottles: Accessibility Service Abuse by Mobile AI Agents and Unfair Competition
updated: 2026-06-13
version: 1
related cases: "WeChat Auto Red Packet" Developer Zhangshang Yuanjing Ordered to Pay 4.75 Million Yuan
related cases: Baihao's 'Red Packet Hunter' Auto-Grab Software Ordered to Pay 700,000 Yuan Compensation
related cases: Changsha Police Dismantle WeChat Red Packet Gambling Ring Using Auto-Grab Cheats, 11 Arrested
related cases: Programmer Yang Lin Sentenced for Developing Red Packet Snatching Cracked App

Game Cheating Software
type: Risk
break id: R0012-002
stix type: x-break-risk
definition: Game cheating software refers to illegal software or scripts used in video games to gain unfair advantages, modify game content, or manipulate game rules.
description: Includes: cheat programs providing capabilities beyond normal gameplay such as auto-aim, wallhacks, and infinite lives; scripts and macros that automatically execute specific operations like auto-casting or auto-resource collection; speed hacks; external modifiers that change game files or memory data; and gold/item generators that create fake in-game currency or items.
complexity: intermediate
influence: Undermines game fairness and in-game economies, harms legitimate player experience, and may cause account, item, and platform revenue losses.
keywords: Game Cheating Software
keywords: aimbot
keywords: wallhack
keywords: ESP hack
keywords: macro cheat
keywords: speed hack
keywords: memory editor
keywords: mod menu
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Account Penalty
citation: Shanghai Pudong Dismantles Illegal Game Account Sales Gang
updated: 2026-06-13
version: 1
related cases: Two Post‑90s Sentenced for Earning Tens of Millions Selling Game Cheats
related cases: Sichuan Police Crack Nation's First DMA Cheat Case for Game for Peace
related cases: Game Streamer Profits 3 Million Yuan from Selling Cheats, Placed Under Criminal Coercive Measures
related cases: Three Men Sentenced for Reselling Game Cheat Access Codes at a Markup
related cases: Developing and Selling Game Cheats? Sheqi Court Sentences Defendants!
related cases: Tech-Savvy Individual Sentenced for Developing and Selling Game Cheats, Illegally Profiting Over One Million Yuan
related cases: First Game Cheat Case for Tencent's Delta Force Cracked
related cases: First-Instance Verdict in China's Largest 'PUBG' Cheat Case
related cases: Global Largest Game Cheat Case Cracked: Amount Involved Reaches Hundreds of Millions of Yuan
related cases: C0905

Ad Blocking
type: Risk
break id: R0013
stix type: x-break-risk
definition: Preventing advertisements from displaying on web pages or applications.
description: Free content providers typically insert ads into content or before content viewing to generate revenue. Ad blockers typically exist as browser plugins or applications that block ad display, reducing the impact of ads on content viewers or allowing viewers to skip ads and access free content directly. While this improves the viewer experience, from the content operator's perspective, providing free content without earning revenue affects the stability and sustainability of free content provision.
complexity: intermediate
influence: Revenue loss for content providers.
keywords: Ad Blocking
keywords: ad blocker
keywords: content blocking
keywords: ad filtering
keywords: anti-ad plugin
keywords: banner blocker
keywords: pre-roll blocker
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Cheat/Plugin Detection
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
updated: 2026-06-11
version: 1
related cases: Blocking Web Page Elements with the AdGuard Browser Extension
related cases: Measuring and disrupting anti-adblockers using differential execution analysis
related cases: CV-Inspector: Towards Automating Detection of Adblock Circumvention
related cases: The ad wars: retrospective measurement and analysis of anti-adblock filter lists
related cases: Ad-blocking: A study on performance, privacy and counter-measures
related cases: Adversarial: Perceptual Ad Blocking Meets Adversarial Machine Learning

Inventory Denial
type: Risk
break id: R0014
stix type: x-break-risk
definition: Exhausting the inventory of goods or services without completing a purchase or transaction.
description: By placing large numbers of orders without paying, driving all products in a merchant's store to zero inventory so the merchant has nothing to sell. Additionally, bulk adding items to cart or placing unpaid orders can be used to probe a merchant's inventory levels or actual purchase prices. While not necessarily aimed at exhausting inventory, the harm caused is the same or greater.
complexity: basic
influence: Common in commercial competition. Once inventory is exhausted, other users can no longer purchase the goods.
keywords: Inventory Denial
keywords: denial of inventory
keywords: cart hoarding
keywords: cart stuffing
keywords: inventory hoarding
keywords: stock locking
keywords: reservation abuse
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Anomalous Access Behavior Detection
citation: OWASP Automated Threat: OAT021 Denial of Inventory
updated: 2026-06-11
version: 1
related cases: Yulin Car Owner Blocked from Buying Auto Insurance by Unauthorized 'Locked Order'
related cases: Inner Mongolia Su et al. Producing and Selling Counterfeit Sunflower Seeds Case
related cases: Hangzhou Xiaoshan Online Pharmaceutical Wholesaler Price Gouging Case

Malicious Negative Reviews
type: Risk
break id: R0015
stix type: x-break-risk
definition: Using false reviews to damage the reputation of a person or product.
description: Using malicious comments, reviews, ratings, reports, or downvotes to damage the reputation, score, or credibility of other users or merchants.
complexity: basic
influence: Similar to black market metric manipulation (R0016) but different in nature. Metric manipulation has generally become an illegal commercial activity where operators inflate ratings for profit. Malicious reviews, however, are motivated by the intent to damage other users' or merchants' reputation and credibility — typically driven by pure malice or competitive business motives.
keywords: Malicious Negative Reviews
keywords: review bombing
keywords: negative review attack
keywords: fake bad reviews
keywords: rating sabotage
keywords: reputation attack
keywords: review extortion
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Malicious Content Detection
mitigated by: Identity Authentication (Login)
citation: OWASP Automated Threat: OAT016 Skewing
updated: 2026-06-11
version: 1
related cases: "Your Negative Review Has Been Deleted"—Who Did It? This Group Made 900,000 RMB by Fabrication
related cases: Student sued for negative review sparks debate on boundary between fair criticism and defamation
related cases: High School Student Recruits Apprentices to Extort Merchants: "Professional Bad Review" Gang Operation
related cases: Man Sentenced to 8 Months for 712 Malicious Food Delivery Refund Scams
related cases: Nine Defendants Sentenced for Paid Negative Review Deletion Services
related cases: Li Sentenced for Profiting Over 30,000 Yuan by Removing Negative Reviews for a Fee
related cases: Yangzhou Company Convicted for Paid Deletion of Negative Reviews, Illegal Business Operations

Metric Manipulation / Ranking Fraud
type: Risk
break id: R0016
stix type: x-break-risk
definition: Interfering with certain application metrics by repeatedly clicking links, sending requests, or submitting forms.
description: Automatically and repeatedly clicking, requesting, or submitting content to influence application-based metrics such as frequency and/or rate counts and measurements. Includes ranking fraud, like farming, comment farming, etc. Metrics may be visible to users (e.g., betting odds, likes, market/dynamic pricing, visitor counts, vote results, reviews) or hidden (e.g., application usage statistics, business performance metrics).
complexity: basic
influence: Causes platform display results to lose objectivity and fairness, degrading user experience.
keywords: Metric Manipulation / Ranking Fraud
keywords: ranking manipulation
keywords: engagement fraud
keywords: metric gaming
keywords: skewing
keywords: social proof fraud
keywords: vote manipulation
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Identity Authentication (Login)
mitigated by: Traffic Encryption
mitigated by: Anomalous Access Behavior Detection
citation: OWASP Automated Threat: OAT016 Skewing
updated: 2026-06-11
version: 1
related cases: Tunyan Network Sues Huoyi Network Over App Store Delisting After Rank-Manipulation Campaign for 'Qu Guandan' Game
related cases: CAC Shuts Down Over 400 Sites and Platforms for Traffic Manipulation
related cases: MPS Releases Typical Cases of Online Water Army Manipulating Metrics and Controlling Comments
related cases: Jiangsu Suqian: Zong and Others Used Bot Farm Software to Inflate Livestream and Fan Circle Metrics
related cases: Xingyuan App for Celebrity Traffic Manipulation Sealed, Raked in Over 8 Million Yuan in Half a Year
related cases: Changsha County Police Dismantle Online Click Farm Ring Involving Over 40 Million Yuan
related cases: CAC Shuts Down Over 400 Fake Traffic Websites and Platforms
related cases: Cyber Police Dismantle Massive Traffic-Farming Online Water Army
related cases: CAC Releases App Governance Rules Banning Fake Rankings, Inflated Metrics, and Manipulated Reviews

Fake Viewer Count Inflation
type: Risk
break id: R0016-001
stix type: x-break-risk
definition: Using illegitimate means or software to artificially inflate the visitor count of a live stream room or personal space, creating a false impression of high traffic, ultimately influencing platform recommendation algorithms.
description: Also called 'fake audience' or 'ghost viewers'. Typically refers to using software, bots, or crowdsourcing to artificially increase metrics such as page views, likes, comments, and online viewer counts for a web page or live stream room, thereby influencing the platform's scoring and recommendation or ranking of that space.
complexity: intermediate
influence: Undermines platform fairness and interferes with ranking algorithms.
keywords: Fake Viewer Count Inflation
keywords: viewbotting
keywords: viewer bot
keywords: fake audience
keywords: ghost viewers
keywords: live view inflation
keywords: stream view bot
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
mitigated by: Behavioral CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Emulator Detection
mitigated by: Cloud Phone Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Authentication (Login)
mitigated by: Identity Security Audit
mitigated by: Account Penalty
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
citation: Methods and Strategies for Inflating TikTok Live Stream Viewer Counts
updated: 2026-06-11
version: 1
related cases: Keqiao Police Dismantle 'Live Stream Idle Viewer Farming' Part-Time Job Scam
related cases: Yanggu Police Dismantle Online Water Army Hubs Using Group-Control Devices to Inflate Livestream Viewer Numbers
related cases: CCTV 3·15 Gala Exposes Cloud-Controlled Systems Artificially Inflating Livestream Engagement
related cases: Ordinary Video Gains 3 Million Views Overnight: Shaanxi Police Expose Fake Traffic Scam
related cases: Supreme People's Procuratorate Disclosed Luoyang's 150-Million-Yuan Click-Farming Platform False Advertising Case
related cases: How Fake Viewers, Followers, and Bots Are Used in Livestreams: Operational Methods and Platform Logic
related cases: Douyin Live Streaming Popularity Tricks: Introducing Third-Party Tools Like "Terracotta Warriors" to Inflate Data

Bulk Following
type: Risk
break id: R0016-002
stix type: x-break-risk
definition: Using illegitimate means or software to bulk-follow other users, ultimately influencing platform recommendations.
description: Also called 'mass following'. Typically refers to using software, bots, or crowdsourcing to have a user bulk-follow other users, thereby influencing the platform's scoring and recommendation or ranking of that user.
complexity: intermediate
influence: Undermines platform fairness and interferes with ranking algorithms.
keywords: Bulk Following
keywords: mass following
keywords: follow bot
keywords: follow farm
keywords: bulk follow
keywords: follower manipulation
keywords: social graph inflation
mitigated by: Human Verification Technology
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Resource Access Restriction
mitigated by: User Profiling
mitigated by: Device Profiling
mitigated by: Proxy Detection
citation: OWASP Automated Threat: OAT-016 Skewing
updated: 2026-06-11
version: 1
related cases: Over 150,000 Fake Accounts Farmed to Provide Fake Likes and Followers—Click Farm Ring Busted
related cases: Python-based Weibo bulk following and mutual following
related cases: Python Script for Automated Bulk Following on Instagram
related cases: Tampermonkey Script for Bulk Unfollowing on Weibo
related cases: CCTV Investigation: Rapid Follower Growth Tricks Using Mutual Follows and Likes to Fake Traffic

Fake Transactions
type: Risk
break id: R0017
stix type: x-break-risk
definition: Obtaining benefits through invalid transactions.
description: Merchants complete large numbers of fake transactions to obtain platform merchant discounts/rebates, or to inflate product positive review counts at low cost. Methods generally include 'order A, ship B' schemes or directly shipping empty packages.
complexity: intermediate
influence: Exploits platform merchant discounts/rebates. Enables unfair competition through inflated positive ratings.
keywords: Fake Transactions
keywords: fake orders
keywords: sham transactions
keywords: wash trading
keywords: empty package fraud
keywords: transaction brushing
keywords: order laundering
mitigated by: Quantity Limiting
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
citation: Case Study: Operating a Money Laundering Platform for Cyber Black-Grey Market Merchants
updated: 2026-06-13
version: 1
related cases: Supermarket 'Collusion' Click Farming to Defraud Subsidies: Shanghai Police Crack 'Order A Ship B' Scam
related cases: Chain Supermarket Colludes to Defraud E-Commerce Platform of Over 1.2 Million Yuan
related cases: Guangzhou Police Dismantle New-Type Fraud Gang Exploiting E-Commerce Promotions
related cases: Dropshipping Merchant Fined by Court for Fabricating Invoices and Purchase Contracts
related cases: Man Sentenced for Fraudulently Selling App Memberships on Second-Hand Platform
related cases: Prosecution Team Breaks Down Typical E-Commerce Fraud Schemes: How to Avoid the Traps
related cases: Shanghai Police Crack Down on Return Shipping Insurance Fraud via Fictitious Transactions

Order Brushing
type: Risk
break id: R0017-001
stix type: x-break-risk
definition: Merchants completing bulk low-cost or fake orders to inflate transaction volume or improve ratings.
description: Merchants complete large numbers of low-cost transactions to obtain platform merchant discounts/rebates, or to inflate product positive review counts at low cost. Methods generally include hiring buyers or maliciously listing low-value items to complete bulk transactions.
complexity: intermediate
influence: Undermines fair competition principles on the platform; in some cases exploits platform merchant discounts/rebates.
keywords: Order Brushing
keywords: brush orders
keywords: sales brushing
keywords: fake order farming
keywords: transaction inflation
keywords: review brushing
keywords: merchant boosting
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
citation: Interim Provisions on Anti-Unfair Competition in Cyberspace
updated: 2026-06-13
version: 1
related cases: Yunhe, Zhejiang Dismantles Massive Online Water Army Click-Farming Operation
related cases: Jiangxi Man Sentenced for Building Fake Order Platform, Earning 7.8 Million Yuan
related cases: Man in Xunwu Sentenced for Brushing and Fake Review Operations on Overseas Amazon Platform
related cases: Guangzhou Cross-Border E-Commerce Bonded Warehouse Click-Farm Tax Fraud Verdict Announced
related cases: Fictitious Online Store Transactions to Defraud Return Shipping Insurance Case
related cases: Shanghai Changning Procuratorate Handled an Online Store Click-Farming Case Defrauding Platform Subsidies

Subsidy Fraud
type: Risk
break id: R0017-002
stix type: x-break-risk
definition: Defrauding platform or government subsidies, rewards, or promotional funds through fabricated transactions, forged data, or other fraudulent means.
description: Exploiting loopholes in platform subsidy policies to claim subsidy funds that should not be obtained, through methods such as fake transactions, order brushing, or fabricating user activity. Common tactics include: hiring brushers to create fake transaction records; using multiple accounts to repeatedly claim subsidies; running ghost rides or fake orders on ride-hailing or food delivery platforms to defraud subsidies; e-commerce sellers buying from themselves to exploit platform merchant discounts and rebates.
complexity: intermediate
influence: Causes financial losses to platforms and governments, undermines fair competition, and distorts market resource allocation.
keywords: Subsidy Fraud
keywords: promotion subsidy fraud
keywords: rebate fraud
keywords: incentive fraud
keywords: merchant subsidy abuse
keywords: fake ride subsidy
keywords: bonus fraud
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
citation: Black Market Big Data: 2025 Global E-Commerce Fraud Risk Research Report
citation: Hiring Order Brushers and Recruiting Insiders to Defraud E-Commerce Platform Subsidies: 9-Person Gang Caught
updated: 2026-06-13
version: 1
related cases: Shanghai Police Crack Down on “Wool-Gathering” Scheme: Fake Orders Defrauded Platform of Over 1.2 Million Yuan in Subsidies
related cases: Ningbo Yinzhou Police Crack Government Voucher Cash-Out Fraud Ring
related cases: Shanghai's First Government Voucher Subsidy Fraud Verdict: Dicos Store Manager Cashes Out ¥137,000
related cases: Guangxi Pingxiang Uncovers Export Tax Refund Fraud Case
related cases: Guangdong Dongguan Section Chief Sentenced to 13 Years for Fabricating Documents to Defraud Over 10 Million in State Subsidies
related cases: Qingdao PhD Indicted for Defrauding High-Tech Enterprise Subsidies of 2.1 Million Yuan
related cases: Shanghai Yangpu Procuratorate Handled a Virtual-Number Scheme Defrauding E-Commerce New-User Coupons and Referral Rewards
related cases: Shanghai Changning Procuratorate Handled an Online Store Click-Farming Case Defrauding Platform Subsidies

Merchant Cash-Out and Fake Transaction Fraud
type: Risk
break id: R0017-003
stix type: x-break-risk
definition: Merchants use fake orders, circular transactions, or abnormal refunds to cash out and transfer funds.
description: Merchant cash-out and fake transaction fraud uses fake orders, circular transactions, linked accounts, or abnormal refunds to convert payment rails and platform subsidies into cash. Attackers may coordinate as merchants and buyers. The fraud pollutes transaction data, increases payment channel risk, and may trigger anti-money-laundering obligations. Risk control needs to link merchants, buyers, devices, funds, and fulfillment evidence.
complexity: intermediate
influence: Fake transactions cause subsidy and fee losses, increase payment channel risk, and may support cash-out or money laundering.
keywords: merchant cash-out fraud
keywords: fake transaction
keywords: circular transaction
keywords: refund cash-out
keywords: payment fraud
mitigated by: Payment Account and Merchant Onboarding Review
mitigated by: Transaction Risk Monitoring
mitigated by: Refund and Dispute Risk-Control Strategy
citation: PCI Data Security Standard
updated: 2026-06-22
version: 1
related cases: C1710
related cases: C1711
related cases: C1712

Search Result Manipulation
type: Risk
break id: R0018
stix type: x-break-risk
definition: Interfering with search engine results by providing invalid or illegal data.
description: Boosting the ranking of a keyword by mass-searching it, or creating associations between keywords by mass-searching them together.
complexity: intermediate
influence: Interferes with the fair ranking mechanism of search engine results, or disrupts intelligent suggestions and related results for normal search keywords.
keywords: Search Result Manipulation
keywords: search ranking manipulation
keywords: search spam
keywords: query bombing
keywords: SEO manipulation
keywords: keyword boosting
keywords: SERP manipulation
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
citation: Search Results Severely Disrupted by SEO Manipulation: Experts Say Google Is Dying
citation: Review of 40 Consumer Scandals from 315 Hot Search: Seven Industry Scandals Exposed
updated: 2026-06-11
version: 1
related cases: US Government Websites Hit by SEO Poisoning Attack
related cases: Malware-Driven E-Commerce Fraud: Black-Hat SEO Fraud Rings Targeting Japan
related cases: 360 Search Fined 2 Million Yuan for Publishing False and Illegal Advertisements
related cases: Shansuitui's '10,000-Keyword Dominance' Baidu Search Manipulation Case

Unauthorized Account Sharing
type: Risk
break id: R0019
stix type: x-break-risk
definition: Illegally selling or sharing paid account privileges that support multi-device login to others.
description: Malicious actors exploit the ability to log into accounts on multiple devices simultaneously, selling accounts with paid privileges to multiple people at low prices to profit from the price difference. The platform's multi-device login feature is intended for a single user with multiple devices, not for different users sharing the same privileges. Instead of earning multiple paid subscriptions, the platform earns only one while black market operators profit from the price arbitrage.
complexity: basic
influence: Causes economic losses to the platform.
keywords: Unauthorized Account Sharing
keywords: account sharing resale
keywords: shared account marketplace
keywords: password sharing abuse
keywords: multi-user subscription abuse
keywords: household bypass
keywords: shared premium accounts
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Account Penalty
mitigated by: Resource Access Restriction
mitigated by: Anomalous Access Behavior Detection
citation: Breaking the Account Theft-Breeding-Sale Black Market: Strengthening Legal and Technical Defenses
updated: 2026-06-11
version: 1
related cases: Court Ruling: 2 Million Yuan Fine for Sharing Video Membership Accounts
related cases: Man Sentenced for Selling Access to Pornographic App Accounts
related cases: Man Sentenced for Reselling Dating Site Member Accounts
related cases: Shared Video Account Service Ordered to Pay 2 Million Yuan in Damages

Content Compliance Risk
type: Risk
break id: R0020
stix type: x-break-risk
definition: User-generated content compliance risk refers to the risk that content created by users on a platform may violate regulations, ethics, or platform policies, potentially leading to legal liability, reputational damage, or other compliance issues.
description: Causes include: illegal content — users may post content that is illegal, infringing, or involves others' privacy; policy violations — user-generated content may violate platform usage policies such as malicious attacks, hate speech, or obscene content; intellectual property infringement — users may use others' intellectual property without permission; and misinformation — users may deliberately post false or misleading information.
complexity: basic
influence: May lead to legal liability, reputational damage, user loss, advertiser loss, and regulatory risk, negatively impacting the platform's long-term development.
keywords: Content Compliance Risk
keywords: UGC compliance
keywords: content moderation risk
keywords: policy violation content
keywords: trust and safety
keywords: platform compliance
keywords: content governance
mitigated by: Data Desensitization (Masking)
mitigated by: Sensitive Data Removal
mitigated by: Malicious Content Detection
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
citation: 2024 National Cyberspace Administration Cracks Down on Illegal Online Content
updated: 2026-06-13
version: 1
related cases: Kuaishou Penalized for Failure to Remove Illegal Information
related cases: Quark Platform Fined 500,000 Yuan for Displaying Pornographic Information
related cases: Kuaishou Fined and Apologizes Repeatedly for Vulgar Content
related cases: Blogger Sentenced for Profiting from Unauthorized Derivative Works Using Unreleased Game Content
related cases: Wuhan Police Announce Typical Case of Online Disinformation About Heavy Rain
related cases: University Student Sentenced for Distributing Child Obscene Videos via Hidden Networks

Spam Content
type: Risk
break id: R0021
stix type: x-break-risk
definition: Spam content risk refers to low-quality, fraudulent, or inappropriate content generated on a platform that may violate platform rules, cause user experience issues, and create compliance risks.
description: Causes of spam content risk include malicious users posting false information, advertising abuse, mass spamming, low-quality comments, as well as inadequate platform oversight and incomplete review mechanisms.
complexity: basic
influence: Spam content risk may lead to degraded user experience, reputational damage to the platform, loss of advertisers and users, and regulatory sanctions, negatively impacting the platform's long-term development.
keywords: Spam Content
keywords: content spam
keywords: spam posts
keywords: low-quality spam
keywords: comment spam
keywords: junk content
keywords: spam generation
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Data Profiling
mitigated by: Proxy Detection
mitigated by: Complaint and Reporting Channel
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Account Penalty
citation: OWASP Automated Threat: OAT-017 Spamming
updated: 2026-06-11
version: 1
related cases: China accused of flooding social media with spam to crowd out coverage of lockdown protests
related cases: Product spam on YouTube: A case study
related cases: FTC Sues Experian for CAN-SPAM Act Violations
related cases: A Survey of Machine Learning Applications in Spam Filtering by Major Email Providers
related cases: A Literature Review on Social Media Spam Detection and Classification Systems

Content Infringement
type: Risk
break id: R0022
stix type: x-break-risk
definition: User-generated content infringement risk refers to the risk that content created by users on a platform may infringe on others' intellectual property rights, including but not limited to copyright, trademark rights, or patent rights, leading to potential legal liability.
description: The main causes of infringement risk include users using others' text, images, audio/video, and other intellectual property content without authorization, or including content similar to others' trademarks, as well as the platform's failure to effectively monitor and prevent infringing behavior.
complexity: basic
influence: User-generated content infringement risk may lead to legal liability, reputational damage to the platform, harm to rights holders' interests, and loss of users and advertisers, negatively impacting the platform's long-term development.
keywords: Content Infringement
keywords: copyright infringement
keywords: trademark infringement
keywords: IP infringement
keywords: infringing content
keywords: pirated content
keywords: rights violation
mitigated by: Contractual Clause Restrictions
mitigated by: Compliance Governance
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Complaint and Reporting Channel
citation: Copyright Law of the People's Republic of China
updated: 2026-06-13
version: 1
related cases: Shanghai Customs Seizes Masks Infringing Minions Animation Copyright
related cases: Kang Piyao v. Baotou Xincheng Yizhuo Real Estate Development Co., Ltd. – Copyright Ownership and Infringement Dispute
related cases: Man Sentenced in Shaoxing for Selling Pirated Music Bundled on USB Drives
related cases: Zhang and Sun Operate Aggregation Apps Using Pirate Links to Disseminate Audiovisual Works

Content Theft
type: Risk
break id: R0023
stix type: x-break-risk
definition: Refers to the unauthorized or unpermitted use, copying, distribution, or display of text, images, audio/video, and other content created by others.
description: Content theft has many causes, including lack of original creativity, commercial competition, profit motives, lack of legal awareness, technical convenience, circumventing security measures, lack of ethical standards, and social media sharing culture. Some individuals or organizations may choose to steal others' work to quickly obtain content, and the development of the internet and digital technology has made copying and distributing content increasingly easy.
complexity: basic
influence: If content theft is not identified and penalized in a timely manner, it will undermine the motivation of original content creators, leading to a race to the bottom.
keywords: Content Theft
keywords: content scraping
keywords: copy-paste theft
keywords: content piracy
keywords: unauthorized reposting
keywords: content cloning
keywords: plagiarized content
mitigated by: Electronic File Seal
mitigated by: Contractual Clause Restrictions
mitigated by: Threat Intelligence
mitigated by: Digital Watermark/Text Watermark
mitigated by: Return Fake Data (Data Poisoning)
mitigated by: Legal Action
citation: Copyright Law of the People's Republic of China
updated: 2026-06-13
version: 1
related cases: China's First Cross-Platform E-Commerce Image Theft Penalty
related cases: Web Novel Scraping Case: Li Sentenced for Writing Crawler Scripts to Steal Novels
related cases: Woman's Photos Stolen and Maliciously Edited into Pornographic Group, Photo Thief Receives Administrative Penalty
related cases: SPP Releases Typical Case Involving Image Theft Infringement
related cases: Mini-program piracy operation leads to criminal copyright infringement convictions for two individuals
related cases: Beijing's First AI Copyright Infringement Criminal Case Sentenced
related cases: Beijing Internet Court Reports on Short-Video Copyright Case Handling

Malicious Traffic Diversion
type: Risk
break id: R0024
stix type: x-break-risk
definition: Malicious traffic diversion through user-generated content refers to attackers tampering with, forging, or abusing user-generated content such as reviews and social shares to deceive users, redirect traffic, or achieve other malicious purposes.
description: Causes include: fake reviews and ratings to attract user clicks; social media abuse by fabricating fake shares and likes to redirect traffic; fabricating user activity to make certain content appear more popular; comment section abuse by posting false information; and using malicious tags or keywords to boost search rankings for specific content.
complexity: basic
influence: Malicious traffic diversion through user-generated content may lead to fake traffic, economic losses, decreased user trust, brand reputation damage, and negative impacts on community health.
keywords: Malicious Traffic Diversion
keywords: traffic hijacking
keywords: click diversion
keywords: review hijacking
keywords: SEO spam redirection
keywords: malicious redirection
keywords: engagement bait diversion
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
citation: OWASP Automated Threat: OAT-017 Spamming
updated: 2026-06-11
version: 1
related cases: Online Streamer Sentenced for Using Insults to Drive Traffic
related cases: Shanghai Police Crack Down on Illegal Traffic Diversion in Cyber Underground Markets
related cases: Hackers Divert Platform Users to Unlicensed Medical Aesthetic Clinics via Illegal Traffic Scheme
related cases: Sichuan Liangshan Police Crack Down on Short-Video-Driven Counterfeit Local Specialty Scam
related cases: Fujian Police Report Multiple Telecom Fraud Traffic-Funneling Rings Dismantled
related cases: Individuals Posing as Delivery Riders to Stage Sob Stories for Traffic Fined
related cases: Staged ‘Testing Strangers’ Honesty’ with a 280,000 Yuan LV Bag Leads to Penalty for Fake Content
related cases: Netizen Stitches Video to Fabricate “Guangzhou Train Station Flooded” Rumor for Traffic and Follower Growth, Penalized

Malicious User Poaching
type: Risk
break id: R0025
stix type: x-break-risk
definition: Poaching sponsors, customers, and streamers.
description: Using comments, private messages, and other means to contact the platform's sponsors, customers, or streamers with the intent of redirecting them to other platforms.
complexity: basic
influence: Disrupts normal platform operations, exposes users to fraud risks, and negatively impacts the company's normal operations.
keywords: Malicious User Poaching
keywords: user poaching
keywords: customer poaching
keywords: streamer poaching
keywords: off-platform solicitation
keywords: deal stealing
keywords: sponsor poaching
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
updated: 2026-06-11
version: 1
related cases: Shanghai Police Crack Down on Illegal Traffic Diversion in Cyber Underground Markets
related cases: Sales Manager Poached Clients for 1.38 Million Yuan, Multiple Suspects Arrested for Trade Secret Infringement
related cases: The Last 100-Meter Logistics Brawl: Cainiao Stations Lose Clients to Poaching
related cases: Wulingyuan Visitor Center Project Undermined: Toilet Left Exposed After Wall Demolished

Prohibited and Illegal Products
type: Risk
break id: R0026
stix type: x-break-risk
definition: Merchants listing invalid, malicious, or illegal product content.
description: Merchants list invalid, malicious, or illegal product content to sell non-compliant or illegal goods, or to achieve purposes such as defamation, disruption, traffic diversion, or fraud.
complexity: basic
influence: Disrupts normal system operations, exposes users to fraud risks, and creates compliance risks for the company's normal operations.
keywords: Prohibited and Illegal Products
keywords: prohibited items
keywords: banned goods
keywords: illegal listings
keywords: restricted products
keywords: contraband sales
keywords: non-compliant goods
mitigated by: Contractual Clause Restrictions
mitigated by: Credit Level Restriction
mitigated by: Security Deposit Mechanism
mitigated by: Compliance Governance
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Complaint and Reporting Channel
mitigated by: Store Penalty
mitigated by: Legal Action
mitigated by: Access Control
citation: What Are Prohibited Products on Taobao?
updated: 2026-06-11
version: 1
related cases: WeChat Enforcement Notice on Personal Accounts Promoting Prohibited Goods
related cases: SPP Releases Typical Case on Manufacturing and Selling Counterfeit Goods: Pan et al. Producing and Selling Substandard Fire Extinguishers
related cases: SPP Releases Typical Case of Manufacturing and Selling Counterfeit Goods: He Mouzhong et al. Producing and Selling Substandard Electrical Wires
related cases: Fenyang Tianlang E-Commerce Co., Ltd. Fined for Online Product Descriptions Not Matching Actual Goods
related cases: Huzhou Police Crack Down on Counterfeit Apparel Sold via Douyin Livestreams

Web Scraping Risk
type: Risk
break id: R0027
stix type: x-break-risk
definition: Scraping data provided by an application (product details, prices, inventory, reviews, etc.) for subsequent use. Scraping may occur in real time or more periodically.
description: Collecting accessible data and/or processed output from an application. Some scraping may use fake or stolen accounts, or access information without authentication. Scraping tools collect responses from static web pages/API interfaces and extract data from them, or decompile apps to parse static resources.
complexity: intermediate
influence: Scraped business data may not cause actual losses to a company until it reaches a certain scale, but once scraped data reaches sufficient scale, it can be used for commercial competition or to analyze company operations in detail, causing significant business harm — for example, analyzing GMV or specific user groups.
keywords: Web Scraping Risk
keywords: data scraping
keywords: screen scraping
keywords: content scraping
keywords: web crawler abuse
keywords: API scraping
keywords: data harvesting
keywords: OAT-011
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Data Parsing Interference
mitigated by: Data Obfuscation
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Multi-Instance Detection
citation: OWASP Automated Threat: OAT011 Scraping
updated: 2026-06-11
version: 1
related cases: Jiangsu Taicang Police Use Big Data Models to Catch Web Crawlers in Piracy Cases
related cases: Beijing Chaoyang Police Bust Internet Company Using Crawlers to Steal Livestream Data, 23 Detained
related cases: Two Defendants Sentenced for Illegally Scraping E-Commerce Data Using Crawler Technology
related cases: Crawler Criminalization Case: Shanghai Company Convicted for Bypassing Anti-Crawling Measures to Scrape Public Data
related cases: Zhejiang "StarChain Data Case": AI Crawlers Illegally Harvested 530 Million Citizen Records for Resale
related cases: Sentencing Issues in Web Crawler Crimes: Analysis of 88 Sample Cases
related cases: Web Scraping Overreach Cannot Escape Legal Boundaries: Supreme People's Court Clarifies Criminal Prosecution for Illegal Data Scraping

Data Exfiltration Risk
type: Risk
break id: R0028
stix type: x-break-risk
definition: Data exfiltration risk refers to obtaining sensitive data stored in an application through public/non-public interfaces, insider threats, or third-party leaks.
description: Application interfaces may return data structures beyond what is displayed on the frontend — such as addresses, ID numbers, and phone numbers. Users can access public server interfaces to obtain sensitive data (fuzzy username search, bulk adding users with secondary accounts), interact with other users to obtain sensitive data (bulk messaging users with secondary accounts), or enumerate IDs to obtain all private data.
complexity: intermediate
influence: Sensitive data leakage typically occurs alongside issues such as unmasked data, privilege escalation vulnerabilities, and unauthenticated interfaces. In the current environment of strict data security regulation, this may cause serious compliance risks.
keywords: Data Exfiltration Risk
keywords: data leakage
keywords: sensitive data exposure
keywords: data theft
keywords: bulk data extraction
keywords: information disclosure
keywords: unauthorized data access
keywords: exfiltration
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Identity Security Audit
mitigated by: Data Desensitization (Masking)
citation: 500 Million XX User Records Leaked, XX Called In for Regulatory Interview
updated: 2026-06-11
version: 1
related cases: Huang and Others Illegally Obtained CHSI Academic Credentials for Sale
related cases: A data exfiltration and remote exploitation attack on consumer 3D printers
related cases: Exploiting Internet of Things Protocols for Malicious Data Exfiltration Activities
related cases: Frequent Data Breach Incidents: Entities Involved Span Daily Life and Production, Maximum Fine of 1 Million Yuan
related cases: Equifax Fined $700 Million for Massive Data Breach
related cases: Acer Suffers Breach: 160GB of Sensitive Data Leaked in Hacker Attack

Denial of Service Risk
type: Risk
break id: R0029
stix type: x-break-risk
definition: Slowing down or stopping business responses by sending large numbers of requests to a server or exploiting server vulnerabilities.
description: Also known as DoS. A denial of service attack is when an attacker causes a target machine to stop providing services. Consuming network bandwidth is only a small part of denial of service attacks — any action that causes trouble for the target, suspends services, or crashes the host qualifies as a denial of service attack.
complexity: intermediate
influence: Causes business denial of service and affects user access.
keywords: Denial of Service Risk
keywords: DoS
keywords: service disruption
keywords: request flooding
keywords: resource exhaustion
keywords: availability attack
keywords: OAT-015
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Improving Service Availability
mitigated by: Adding Computing Resources
mitigated by: DDoS Protection
mitigated by: Front-End CDN
mitigated by: Business System Optimization
mitigated by: Time Limiting
mitigated by: Identity Authentication (Login)
citation: OWASP Automated Threat: OAT-015 Denial of Service
updated: 2026-06-13
version: 1
related cases: Operation PowerOFF Seizes 53 DDoS Domains and Arrests 4 Individuals
related cases: Wan'an Public Security Cracks a DDoS Hacking Case
related cases: Real-Time Detection of Slow HTTP/2 Denial-of-Service Attacks
related cases: An Empirical Study of Slow HTTP DoS Attack Vulnerabilities on Web Servers
related cases: Macroscopic Characterization of Large-Scale DoS Ecosystems
related cases: DNS DDoS Amplification Attack Detection Using Multi-Layer Perceptron

SMS Resource Exhaustion
type: Risk
break id: R0029-001
stix type: x-break-risk
definition: Bulk requesting SMS verification codes and controlling the recipients to exhaust the application's SMS verification code resources while disrupting legitimate users.
description: Sending SMS verification code requests to the same phone number to cause disruption or denial of service, or sending SMS verification codes to large numbers of phone numbers to exhaust service resources. In cases where the content can be controlled, this can also trigger fraud.
complexity: intermediate
influence: Exhausts platform SMS verification code resources, creates a denial of service attack against the server, and causes disruption and denial of service to specific phone number recipients.
keywords: SMS Resource Exhaustion
keywords: SMS bombing
keywords: OTP flooding
keywords: verification code bombing
keywords: SMS flood
keywords: OTP exhaustion
keywords: SMS abuse
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
citation: What to Do When SMS Verification Code Interface Is Under Malicious Attack?
updated: 2026-06-13
version: 1
related cases: Negative Review Triggers SMS Bombing: Malicious Code and Privacy Databases Freely Available
related cases: 1,000 SMS Bombs Per Minute: Guangxi's First SMS Bombing Case Cracked
related cases: Hangzhou Police Crack First Illegal SMS Bombing Software Case, Two Suspects Detained
related cases: SMS Bombing Attacks Target Baidu and Nine Other Apps via Exploited Interfaces
related cases: Winter Shield: Police Dismantle SMS Bombing Service Chain, Leaving Cybercrime Nowhere to Hide
related cases: When Verification Codes Became a Harassment Tool: Who Was Behind It?
related cases: Fengze Court Hears 'Call You to Death' Software Supply Chain Case
related cases: Shanxi Cyber Police Strike Back at Online Criminal Activities

Resource Exhaustion Attack
type: Risk
break id: R0029-002
stix type: x-break-risk
definition: Also known as malicious resource consumption attacks, the goal is to exhaust the target system's resources — such as computing power, storage space, network bandwidth, or other system resources — to paralyze, slow down, or prevent the system from providing normal services.
description: Possible scenarios include: network bandwidth attacks flooding the target network; compute resource exhaustion through computationally intensive requests; storage resource exhaustion by uploading large volumes of invalid or large files; TCP connection attacks (SYN flood); and database resource attacks through mass database queries.
complexity: intermediate
influence: Causes service unavailability, performance degradation, reliability impact, and financial losses due to malicious resource consumption.
keywords: Resource Exhaustion Attack
keywords: resource depletion
keywords: application-layer DoS
keywords: compute exhaustion
keywords: bandwidth exhaustion
keywords: storage exhaustion
keywords: SYN flood
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: SMS Verification
mitigated by: Improving Service Availability
mitigated by: Increasing Business Resources
mitigated by: Terminal Abnormal Environment Detection
mitigated by: IP Intelligence
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Proxy Detection
mitigated by: Legal Action
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
citation: OWASP: OAT-015 Denial of Service
updated: 2026-06-13
version: 1
related cases: Osmosis Chain Liquidity Pool Drain Vulnerability Incident
related cases: Domain Hit by DDoS and CC Attacks Leading to Resource Exhaustion
related cases: Rampart Defense System Against Web Application CPU-Exhaustion Attacks
related cases: RECUR Attack: Resource Exhaustion via Recursive Entropy-Guided Counterfactual Exploitation and Reflection
related cases: Runtime Detection of CPU-Exhaustion DoS Attacks
related cases: Adversarial Defense Against Bandwidth Depletion DDoS Attacks

CC Attack
type: Risk
break id: R0029-003
stix type: x-break-risk
definition: Performing a denial of service attack on a system by constructing large numbers of normal business requests.
description: By analyzing each type of business request and targeting requests that are computationally expensive for the server, sending large numbers of forged requests to saturate all server computing resources.
complexity: intermediate
influence: Causes business denial of service and affects user access.
keywords: CC Attack
keywords: HTTP flood
keywords: challenge collapsar
keywords: layer 7 DoS
keywords: application flood
keywords: web request flood
keywords: CC flood
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Improving Service Availability
mitigated by: Time Limiting
mitigated by: Identity Authentication (Login)
citation: OWASP Automated Threat: OAT-015 Denial of Service
updated: 2026-06-13
version: 1
related cases: KillNet Group Leverages CC-Attack Script for DDoS Campaigns
related cases: HTTP Flood Mitigation: A Metadata-Based Detection Approach
related cases: Real-Time Detection and Defense Algorithm for CC Attacks Based on Information Entropy
related cases: Packet-Based Detection of Challenge Collapsar Attack Traffic

Distributed Denial of Service
type: Risk
break id: R0029-004
stix type: x-break-risk
definition: Distributed Denial of Service (DDoS) is a network attack that uses multiple attackers (or multiple attack sources) to simultaneously attack a target system, rendering it unable to provide normal services.
description: DDoS attacks typically aim to push the target system's network bandwidth, computing resources, or other critical resources to their limits, causing service unavailability. Attack types include: network layer attacks (UDP flood, ICMP flood, SYN/ACK attacks); transport layer attacks (SYN flood); application layer attacks (HTTP request flood, Slowloris); and reflection/amplification attacks.
complexity: intermediate
influence: Causes service unavailability, performance degradation, reliability impact, and financial losses due to resource consumption.
keywords: Distributed Denial of Service
keywords: DDoS
keywords: botnet attack
keywords: reflection attack
keywords: amplification attack
keywords: UDP flood
keywords: application-layer DDoS
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Improving Service Availability
mitigated by: Terminal Abnormal Environment Detection
mitigated by: IP Intelligence
mitigated by: Resource Access Restriction
mitigated by: Proxy Detection
mitigated by: Legal Action
citation: Understanding and Responding to Distributed Denial-of-Service Attacks - CISA
updated: 2026-06-13
version: 1
related cases: Analysis of DDoS Attacks Against 911 Emergency Services
related cases: FBI Dismantles IoT Botnets Behind Massive DDoS Attacks
related cases: Beijing Haidian DDoS Attack Platform Case
related cases: Operation PowerOFF Seizes 53 DDoS Domains and Arrests 4 Individuals
related cases: Authorities Dismantle World's Largest IoT DDoS Botnet
related cases: Legal Regulation of DDoS Attacks

Fake Registration
type: Risk
break id: R0030
stix type: x-break-risk
definition: Registering fake accounts using false identities for subsequent abuse.
description: Using an application's account registration process to register accounts with false identity data.
complexity: intermediate
influence: These accounts are subsequently abused for generating spam, money laundering, spreading malware, reputation manipulation, pranks, and distorting SEO, reviews, and surveys.
keywords: Fake Registration
keywords: fake signup
keywords: account creation fraud
keywords: synthetic registration
keywords: spam account creation
keywords: identity spoof registration
keywords: OAT-019
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Email Verification
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Invitation Code Mechanism
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: OWASP Automated Threat: OAT019 Account Creation
updated: 2026-06-13
version: 1
related cases: Chongqing “4·01” Cross-Provincial VAT Invoice Fraud: Registering “Fake Enterprises” Using Others’ Identities
related cases: Over 100 Villagers' Identities Misused for Business License Registration in Dawu County, Hubei Province
related cases: Henan Shangqiu: Organizing Ground Promoters to Guide Passersby in Assisting WeChat Registration for Criminal Use Leads to Sentencing
related cases: Shandong Zibo Police Bust Massive Illegal Bulk Registration and Sale of WeChat Accounts
related cases: Scalpers Use Automated Scripts to Mass-Register Accounts for Snatching Sneakers and Concert Tickets
related cases: Man Born in the 1990s Sentenced for Registering 200,000 Fake Accounts to Fraudulently Obtain Over 20,000 Cans of Milk Powder
related cases: Jiangxi Netizen Penalized for Bulk Purchasing Virtual Phone Numbers to Register and Sell App Accounts for Illegal Profit
related cases: Couple Falsely Registered for Civil Service Exams 758 Times, Court Convicts

Bulk Account Registration
type: Risk
break id: R0030-001
stix type: x-break-risk
definition: Bulk registering accounts for subsequent abuse.
description: Using an application's account registration process to create accounts in bulk, sometimes also filling in profile information.
complexity: advanced
influence: These accounts are subsequently abused for generating spam, money laundering, spreading malware, reputation manipulation, pranks, and distorting SEO, reviews, and surveys.
keywords: Bulk Account Registration
keywords: mass registration
keywords: account farming
keywords: signup bot
keywords: bulk signup
keywords: account factory
keywords: registration bot
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: OWASP Automated Threat: OAT019 Account Creation
updated: 2026-06-13
version: 1
related cases: Guangzhou Police Dismantle Telecom Insider Ring for Mass WeChat Account Registration
related cases: Zibo Police Dismantle Massive Illegal Social Account Registration and Trafficking Ring
related cases: Shanghai's First Verdict in Programmatic Bulk Real-Name Game Account Registration Case
related cases: Tang XX Used 'Changyou Registration Bot' for Mass Game Account Creation
related cases: Tencent Warns Users Against Bulk Malicious Registration of WeChat Accounts
related cases: City's First Case: Prosecutors Unravel Scheme of Mass Game Account Registration with Real-Name Verification
related cases: Shandong Dismantles Massive Black-Gray Industry Ring: Over 3,000 Phones Auto-Registering WeChat Accounts

Third-Party Account Risk
type: Risk
break id: R0030-002
stix type: x-break-risk
definition: Using third-party account federated login to bypass existing identity verification systems.
description: Many sites have strict identity verification systems for creating user identities, such as SMS verification codes and real-name authentication. However, when logging in via third-party identity providers like WeChat or Weibo, excessive trust in the third party without strict identity verification allows bulk registration of spam accounts (R0030-001) on the third party to bypass the strict identity verification system.
complexity: intermediate
influence: Bypasses existing identity verification systems, causing defense mechanisms to fail.
keywords: Third-Party Account Risk
keywords: federated login abuse
keywords: social login abuse
keywords: OAuth abuse
keywords: third-party SSO abuse
keywords: IdP trust abuse
keywords: social signup bypass
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
citation: What Is Third-Party Account Login? What Are Its Benefits?
updated: 2026-06-13
version: 1
related cases: Barracuda Warns of Surging Advanced OAuth Phishing Attacks Exploiting Protocol Flaws to Hijack Accounts
related cases: Microsoft Exposes Threat Actors Abusing OAuth Applications for Automated Financial Attacks
related cases: Microsoft Warns: OAuth Redirect Abuse Leads to Phishing and Malware Distribution
related cases: Analysis and Prevention of Recent OAuth Vulnerability Exploits

Overseas Number Registration
type: Risk
break id: R0030-003
stix type: x-break-risk
definition: Using overseas phone numbers to register accounts and bypass domestic real-name authentication requirements for phone numbers.
description: Many sites have strict identity verification systems, such as SMS verification codes. However, when registering with overseas phone numbers, excessive trust in overseas numbers without strict identity verification allows bulk registration (R0030-001) of large numbers of spam accounts to bypass the strict identity verification system.
complexity: intermediate
influence: Bypasses existing identity verification systems, causing defense mechanisms to fail.
keywords: Overseas Number Registration
keywords: foreign number signup
keywords: international SIM registration
keywords: overseas phone registration
keywords: cross-border number signup
keywords: non-domestic SIM abuse
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Account Penalty
citation: Telephone User Real Identity Information Registration Regulations
updated: 2026-06-13
version: 1
related cases: City's First Case: Prosecutors Unravel Scheme of Mass Game Account Registration with Real-Name Verification

Inactive Number Registration
type: Risk
break id: R0030-004
stix type: x-break-risk
definition: Inactive number registration refers to using phone numbers that have not been put into market use or activated to falsely register internet platform accounts or conduct other online activities.
description: Inactive number registration generally exploits vulnerabilities in the registration process for inactive number verification, or uses insiders at companies or carriers to obtain verification codes. This method has zero cost since no physical SIM card is needed, allowing criminals to hide their identities online and massively abuse platform resources for fake follower/metric inflation, spreading false information, and online fraud.
complexity: advanced
influence: Risks mainly manifest in disrupting normal internet order, potential social engineering attacks, challenges from new cybercrime patterns, and economic and reputational impacts on users and platforms.
keywords: Inactive Number Registration
keywords: unused number registration
keywords: unactivated SIM signup
keywords: dormant number abuse
keywords: carrier insider registration
keywords: silent number signup
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
mitigated by: Vulnerability Remediation
citation: Shanghai's First Batch Game Account Registration Case: Is Mass Account Creation Illegal?
updated: 2026-06-13
version: 1
related cases: Hackers colluded with telecom employees to register and resell WeChat accounts, involving millions in illicit gains
related cases: China's First Inactive SIM SMS Hijacking Case: Using Unactivated SIMs to Register Accounts
related cases: Telecom Insider Sells Dormant Numbers, Aiding Telecom Fraud

Virtual Number Registration
type: Risk
break id: R0030-005
stix type: x-break-risk
definition: Virtual number registration refers to using virtual phone numbers to falsely register internet platform accounts or conduct other online activities.
description: Besides the four major carriers, China has many virtual network operators (MVNOs) that purchase voice, SMS, and data services from the major carriers and resell them under their own branding. These are commonly called 'virtual cards' by black market operators. Virtual card number prefixes are fixed (162, 165, 167, 170, 171). Compared to physical SIM cards, virtual cards have two advantages: low cost (often zero monthly fee) and low barrier (one ID card can be used to register dozens of cards across different MVNOs).
complexity: basic
influence: Bulk registration with virtual numbers may lead to online service abuse, including online fraud and false information spreading, damaging platform credibility and user security.
keywords: Virtual Number Registration
keywords: virtual SIM signup
keywords: MVNO registration abuse
keywords: burner number signup
keywords: VoIP number registration
keywords: virtual phone number abuse
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Notice on Cleaning Up Fraud-Related Phone Cards, IoT Cards, and Associated Internet Accounts
updated: 2026-06-13
version: 1
related cases: Ningbo Jiangbei Dismantles a Full-Chain "Virtual Number Factory"
related cases: Shanghai Mall Parking Points Case: License Plate Bound to 1,000+ Phone Numbers to Register Fake Users and Defraud Parking Fees
related cases: Guangxi Baise Yu Gang Ethnic Asset Unfreezing Fraud Case
related cases: Man Sentenced in Zhaoqing for Reselling WeChat Accounts
related cases: Guixi Court Convicts Individual for Registering Company to Facilitate Cybercrime
related cases: Shanghai Yangpu Procuratorate Handled a Virtual-Number Scheme Defrauding E-Commerce New-User Coupons and Referral Rewards

IoT SIM Card Registration
type: Risk
break id: R0030-006
stix type: x-break-risk
definition: IoT SIM card registration refers to using IoT SIM cards to falsely register internet platform accounts or conduct other online activities.
description: IoT SIM cards are phone cards specifically designed for IoT terminal devices to provide connectivity. By default they do not have SMS sending/receiving capability, which must be applied for at the time of purchase.
complexity: basic
influence: Bulk registration with IoT SIM cards may lead to online service abuse, including online fraud and false information spreading, damaging platform credibility and user security.
keywords: IoT SIM Card Registration
keywords: IoT SIM abuse
keywords: machine-to-machine SIM signup
keywords: M2M SIM registration
keywords: data-only SIM abuse
keywords: IoT card signup
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Notice on Cleaning Up Fraud-Related Phone Cards, IoT Cards, and Associated Internet Accounts
updated: 2026-06-13
version: 1
related cases: Jiaxing Yuhe Culture Media Exposed for Bulk Registering Short-Video Accounts Using IoT SIMs
related cases: Double 11 Investigation: IoT SIM Card Abuse on E-Commerce Platforms Under Tightened Regulations
related cases: Anti-Telecom Fraud Law Explicitly Bans Illegal Trading, Renting, and Lending of IoT SIMs
related cases: Europol Dismantles SIM Farm Network Tied to 49 Million Fake Accounts

Interceptor Card Registration
type: Risk
break id: R0030-007
stix type: x-break-risk
definition: An 'interceptor card' refers to a setup where both the card device and the SIM card are in the hands of a legitimate user, but the card vendor has pre-installed a backdoor in the device that can intercept SMS verification codes received by the user's phone.
description: Interceptor cards require that the legitimate device holder has not registered for the black market operator's target online service, otherwise the black market operator cannot use it for fake registration. To achieve this, interceptor cards primarily target three types of devices: phones exported overseas, low-to-mid-range phones, and children's smartwatches — because users of these devices (overseas users, elderly people, and children) are unlikely to have registered for the target services.
complexity: basic
influence: Fake registration may lead to online service abuse, including online fraud and false information spreading, damaging platform credibility and user security.
keywords: Interceptor Card Registration
keywords: SMS interception device
keywords: interceptor SIM setup
keywords: verification code interception
keywords: backdoored handset registration
keywords: SMS relay device
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Notice on Cleaning Up Fraud-Related Phone Cards, IoT Cards, and Associated Internet Accounts
updated: 2026-06-13
version: 1
related cases: Shanghai's First Case: Criminal Sentencing for Bulk Real-Name Game Account Registration

Sub-Account Abuse
type: Risk
break id: R0031
stix type: x-break-risk
definition: Business account systems that have a sub-account concept but manage sub-accounts loosely, leading to account abuse.
description: Some business systems have very strict account registration requirements but are lax about sub-account creation, and sub-accounts have all the same capabilities as the parent account. Black market operators can bypass strict account registration and identity authentication policies by bulk-generating sub-accounts.
complexity: intermediate
influence: Sub-account abuse bypasses account registration and identity authentication policies.
keywords: Sub-Account Abuse
keywords: sub account abuse
keywords: bulk sub-account creation
keywords: child account abuse
keywords: secondary account abuse
keywords: sub-account farming
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Identity Security Audit
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
citation: What Are the Drawbacks and Risks of Taobao Store Sub-Accounts?
citation: Alipay Vulnerability Exposed: Multiple Sub-Accounts Linked Without User Knowledge
updated: 2026-06-11
version: 1
related cases: SEC Issues Risk Alert on Master/Sub-Account Misuse
related cases: Sub-Account Security Vulnerabilities in IoT Management Platforms
related cases: Cloudflare Launches Account Abuse Protection
related cases: State-Owned Bank Managers Misappropriated Reserve Funds

Account Takeover
type: Risk
break id: R0032
stix type: x-break-risk
definition: Stealing login credentials through trojans, phishing, and other means.
description: There are two typical types of login credentials: authentication credentials used to log in (primarily username/password, but also one-time passwords, SMS verification codes, biometric features, etc.); and session maintenance credentials used to maintain login state (typically cookies, but also session IDs, nonces, JSON Web Tokens, etc.).
complexity: advanced
influence: Grants the attacker persistent account access and operational permissions on the corresponding website or application.
keywords: Account Takeover
keywords: ATO
keywords: account hijacking
keywords: account compromise
keywords: stolen account
keywords: account theft
mitigated by: Multi-Factor Authentication
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Zero-Knowledge Proof
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Real-Name Identity Verification
mitigated by: Email Digital Certificate
mitigated by: Data Hiding
mitigated by: Password Complexity Requirements
mitigated by: ROOT/Jailbreak Detection
mitigated by: HTTPS Digital Certificate
mitigated by: Fake Call Detection
citation: OWASP Automated Threat: OAT007 Credential Cracking
updated: 2026-06-13
version: 1
related cases: Three Sentenced for Stealing 370,000 Yuan in Tips by Hacking Accounts
related cases: Google TAG Discloses Phishing and Cookie Theft Campaign Targeting YouTube Creators
related cases: To Recover Players' Accounts, They Even Fake Online Romance with Account Thieves
related cases: Bypassing Passwords Entirely: Tencent Assists in Dismantling a Massive Account Theft Ring Involving Over 30 Million Yuan
related cases: Trojan Account Theft and Impersonation Scam: Three Suspects Criminally Detained by Nanshan Police in Shenzhen
related cases: Credential Stuffing Gang Steals 12,900 Accounts, Involving Nearly 10 Million Yuan

Credential Stuffing
type: Risk
break id: R0032-001
stix type: x-break-risk
definition: Testing the validity of stolen account credentials in the current system through bulk login attempts.
description: Testing a list of stolen authentication credentials against the current system's authentication mechanism to determine whether users have reused the same login credentials. Stolen usernames (usually email addresses) and passwords may have been obtained directly from another application, purchased on criminal markets, or obtained from publicly available breach data dumps. Unlike credential cracking, credential stuffing does not involve any brute force or numerical guessing.
complexity: advanced
influence: Through unrestricted credential stuffing, attackers may gain access to many users who have reused credentials from other systems, causing losses to those users through further operations.
keywords: Credential Stuffing
keywords: combo list attack
keywords: credential reuse attack
keywords: account checker
keywords: combo checker
keywords: bulk login attempts
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Password Complexity Requirements
citation: OWASP Automated Threat: OAT008 Credential Stuffing
updated: 2026-06-13
version: 1
related cases: GM Hit by Credential Stuffing Attack Exposing Car Owner Personal Data
related cases: Jiangsu Yancheng Police Dismantle Credential Stuffing Account Theft Ring
related cases: Talent Outreach Disguised as Illegal Credential Stuffing: Nationwide Registered Architects Targeted
related cases: Company Ordered to Pay 350,000 Yuan for Data Obtained via Credential Stuffing
related cases: Nanjing Yuhuatai Court Concludes Credential Stuffing Case Involving Personal Information Infringement
related cases: Credential Stuffing Attack to Obtain Credit Information Constitutes a Crime
related cases: Guancheng Hui District Court in Zhengzhou Sentences Defendant in Credential Stuffing Personal Information Theft Case

Password Spraying
type: Risk
break id: R0032-002
stix type: x-break-risk
definition: Attempting to log in by trying one or a few common weak passwords against a large number of accounts to obtain valid credentials.
description: Unlike credential brute force which enumerates passwords for a single account, password spraying fixes one or a few common passwords and tries them against a large number of different user accounts to discover accounts using that weak password. This approach avoids triggering account lockout mechanisms that would result from multiple failed attempts on a single account.
complexity: advanced
influence: Through unrestricted credential attacks, attackers may gain access to users with weak passwords on the current system, causing losses through further operations.
keywords: Password Spraying
keywords: password spray
keywords: common password attack
keywords: low-and-slow password attack
keywords: one-password-many-accounts
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Password Complexity Requirements
citation: OWASP Automated Threat: OAT007 Credential Cracking
updated: 2026-06-13
version: 1
related cases: 15 Suspects Arrested in Payment Account Takeover Case Cracked by Cyber Police
related cases: Door-Gap Squeezing and Password Guessing: Gongshu Police Crack Theft Case
related cases: Beijing Police Dismantle Credential Stuffing Attack Exploiting Website Vulnerability
related cases: Yantai Police Crack Case of Stolen Payments Due to Weak Passwords
related cases: Self-Developed Decryption Program Used Over 2.18 Million Times by Others

Credential Brute Force
type: Risk
break id: R0032-003
stix type: x-break-risk
definition: Attempting to log in by brute-forcing a list of possible passwords for a specific account to obtain valid credentials.
description: Using brute force, dictionary (word list), and guessing attacks against the application's authentication process to identify the weak credentials used by a specific account — for example, enumerating a user's password.
complexity: advanced
influence: Through unrestricted credential attacks, attackers may gain access to users with weak passwords on the current system, causing losses through further operations.
keywords: Credential Brute Force
keywords: password brute force
keywords: login brute force
keywords: dictionary attack
keywords: password guessing
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Password Complexity Requirements
citation: OWASP Automated Threat: OAT007 Credential Cracking
updated: 2026-06-13
version: 1
related cases: Credential Brute-Force Attack on a Beijing Education Company's Academic Scheduling System Leads to Data Breach
related cases: Credential Brute-Force Attack in the Canva Data Breach
related cases: Analysis of Brute-Force Attacks Against SSH Servers
related cases: CAUDIT: Mitigating SSH Brute-Force Attacks Through Continuous Auditing
related cases: Beijing Education Company’s Scheduling System Breached via Password Brute-Force, Leading to Data Leak
related cases: Cracking User Passwords with Hashcat in HTB Perfection Machine
related cases: CISA Alert: Cyber Attackers Targeting U.S. Organizations with Password Spraying

Verification Code Brute Force
type: Risk
break id: R0032-004
stix type: x-break-risk
definition: Attempting to log in by brute-forcing verification codes to obtain valid credentials.
description: Verification code brute force risk refers to attackers attempting to break verification codes by continuously trying various possibilities to gain access to a system or account. Causes include: weak verification code design; lack of security protections such as frequently changing codes or lockout mechanisms; reuse of the same verification code across multiple locations; and inadequate verification code generation algorithms.
complexity: intermediate
influence: Defeats verification-code protections, allowing attackers to take over accounts, bypass login checks, or trigger subsequent fraud operations.
keywords: Verification Code Brute Force
keywords: OTP brute force
keywords: SMS code brute force
keywords: one-time password brute force
keywords: 2FA code brute force
keywords: verification code guessing
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Biometric Identification
mitigated by: Proxy Detection
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Brute Force - MITRE ATT&CK T1110
updated: 2026-06-13
version: 1
related cases: GSM Hijacking and SMS Sniffing Used to Steal Verification Codes for Fraud
related cases: WordPress App Builder Plugin OTP Brute Force Vulnerability (CVE-2024-9302)
related cases: Keycloak Separates Password and OTP Brute-Force Protection to Prevent OTP Bypass Attacks
related cases: Brute-Force Attacks on SMS Verification Codes for IoT Device Account Takeover
related cases: OTP Brute-Force Attack Payload Lists Published on GitHub

Ghost Stores
type: Risk
break id: R0033
stix type: x-break-risk
definition: Ghost stores refer to stores that exist on physical or online platforms but are effectively closed, abandoned, or unable to operate normally due to poor management, poor operations, poor sales performance, or other reasons.
description: On online platforms, especially e-commerce platforms, merchants may sometimes stop operating or go long periods without updating products and services, yet their stores remain active. These abandoned or non-functioning stores are sometimes called 'ghost stores'.
complexity: basic
influence: May lead to the store being unable to provide normal services, declining product quality, and potential inability to process returns or provide after-sales service.
keywords: Ghost Stores
keywords: zombie store
keywords: abandoned storefront
keywords: inactive merchant store
keywords: dead store
mitigated by: Contractual Clause Restrictions
mitigated by: Risk Control Strategy
mitigated by: User Profiling
citation: SAMR 2024 Online Market Regulation Campaign
updated: 2026-06-13
version: 1
related cases: SEC Suspends Trading in 255 Dormant Shell Companies
related cases: SEC Suspends Trading in 379 Dormant Shell Companies in a Single Day
related cases: Finding a “Money-Making Scheme” in “Zombie Stores”
related cases: Too Many Zombies: Exploring Challenges and Motivations for (Not) Deleting Unused Online Accounts

Merchant Disappearance / Runaway
type: Risk
break id: R0033-001
stix type: x-break-risk
definition: A merchant suddenly becomes unreachable after operating on the platform for a period of time.
description: Some disappearances may be caused by sudden circumstances or poor management, while others are deliberate — either to evade platform responsibilities or to cold-shoulder buyer complaints.
complexity: basic
influence: May lead to the store being unable to provide normal services, inability to process returns, or lack of after-sales service.
keywords: Merchant Disappearance / Runaway
keywords: merchant absconding
keywords: seller disappearance
keywords: merchant runaway
keywords: seller absconding
keywords: merchant exit scam
mitigated by: Real-Name Identity Verification
mitigated by: Contractual Clause Restrictions
mitigated by: Security Deposit Mechanism
citation: SAMR Advances 2024 Online Market Supervision Special Action
updated: 2026-06-13
version: 1
related cases: Photo Studio Anniversary Recharge Scam Ends in Closure and Flight, Professional Closer Sentenced
related cases: Shanghai's First Professional Store Closer Tao Sentenced to 5 Years for Zero-Yuan Gym Takeover and Fleecing
related cases: Multiple Ningbo Professional Store Closers Sentenced for Fraud in Prepaid Consumer Scam
related cases: Qinghai Decoration Firm Absconds After Low-Price Renovation Contracts, Suspects Sentenced
related cases: Chengdu Qingyang Police Dismantle Small-Loan Fraud Ring Preparing to Abscond with Funds
related cases: Yueqing Employee Convicted for Absconding with Company Funds
related cases: Gym Owner Tao Sentenced for Taking Over Multiple Stores and Absconding with Funds
related cases: Business Closures and Absconding Dominate Prepaid Consumption Disputes

Automated Account Seasoning
type: Risk
break id: R0034
stix type: x-break-risk
definition: Using automated means to improve account credibility.
description: Using automated activities on stolen accounts or bulk-registered accounts to reduce account risk scores or improve account credibility — for example, automated reviews, comments, posts, and transactions.
complexity: advanced
influence: Automated account seasoning typically needs to be combined with other business risk scenarios to monetize, such as benefit abuse, flash sale grabbing, and metric manipulation.
keywords: Automated Account Seasoning
keywords: account warming
keywords: account farming
keywords: reputation farming
keywords: trust score boosting
keywords: account nurturing
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Debugger Detection
mitigated by: Certificate Pinning (SSL Pinning)
citation: OWASP Automated Threat: OAT-019 Account Creation
updated: 2026-06-13
version: 1
related cases: Inmate Recounts Myanmar Scam Camp: Raising Accounts with Beauty Videos, Beaten with Electric Batons for Bans
related cases: Illegal Acquisition of Personal Data to Run an 'Account Farming Factory'
related cases: Two Men Illegally Obtained Over 3 Million Personal Records to Farm and Sell Accounts in 'Love and Deepspace'
related cases: Huaxi Procuratorate: Organizing Phone Number Trading and Douyin Account Operations Leads to Conviction
related cases: Over 200 Million Unverified Accounts Tied to Massive Black-Market Account Farming Platform Busted by Jiangsu Police
related cases: Account Warming Crosses Legal Red Line, Leads to Prison Sentence
related cases: WeChat Account Farming and Resale to Overseas Fraud Rings
related cases: Beijing Police Dismantle a Criminal Gang Providing 'Account Farming' and Other Underground Cyber Services

Login Credential Reuse
type: Risk
break id: R0035
stix type: x-break-risk
definition: Copying a user's session credentials (session cookies) to another device to bypass the login process and directly reuse the user's identity.
description: A common method is to obtain user cookies to enable automated password-free login. Many account vendors sell accounts by providing only login cookies rather than credentials — known as CK trading. CK trading can bypass SMS verification code login and prevents buyers from changing passwords, enabling multiple resales of the same account.
complexity: intermediate
influence: Bypasses MFA multi-factor authentication mechanisms in the login process, or enables a single account to log in on multiple devices.
keywords: Login Credential Reuse
keywords: session hijacking
keywords: cookie reuse
keywords: session cookie reuse
keywords: stolen session
keywords: session token reuse
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Anomalous Access Behavior Detection
mitigated by: Access Control
citation: Session Hijacking Attack - OWASP
citation: Steal Web Session Cookie - MITRE ATT&CK T1539
updated: 2026-06-13
version: 1
related cases: Nanjing Yuhuatai Court Concludes Credential Stuffing Case Involving Personal Information Infringement
related cases: Cookie Theft to Business Email Compromise: Attackers Use AiTM Phishing Sites as Entry Point
related cases: Credentials Still the 'Achilles' Heel'? Cisco's Latest Report Reveals New Threats from Old Attack Patterns
related cases: Nanjing Yuhuatai District Court Concludes Credential Stuffing Personal Information Infringement Case

Login Credential Theft
type: Risk
break id: R0035-001
stix type: x-break-risk
definition: Stealing user identity credentials to impersonate the user's identity for access.
description: Credential theft is a form of credential reuse. Credential reuse more often refers to a voluntary process of copying and reusing credentials; credential theft refers to a user's identity credentials being stolen by a hacker for use elsewhere to impersonate the user's login.
complexity: intermediate
influence: Many account systems do not invalidate existing login sessions after a password change, meaning that with stolen or reused cookies, a hacker can maintain persistent login access to the target user's account.
keywords: Login Credential Theft
keywords: credential theft
keywords: session theft
keywords: cookie theft
keywords: token theft
keywords: account credential theft
mitigated by: Multi-Factor Authentication
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Anomalous Access Behavior Detection
mitigated by: Access Control
citation: Nearly 1,000 Data Breaches in Q1 2023, Affecting 1,204 Companies Across 38 Industries
citation: Credential Stuffing Prevention Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
related cases: Microsoft Discloses Tycoon2FA AiTM Phishing Kit Operating at Scale
related cases: Slack Flaw Allowed Attackers to Force User Redirects and Steal Session Cookies
related cases: Exploiting XSS to Steal Cookies for Admin Session Hijacking

Multi-Factor Authentication (MFA) Bypass
type: Risk
break id: R0036
stix type: x-break-risk
definition: Cracking or bypassing multi-factor authentication factors during the identity verification process.
description: Obtaining MFA verification factors through brute force enumeration — such as cracking SMS verification codes, last digits of ID numbers, email verification codes, or OTP tokens; or exploiting flaws in the authentication process — such as forging trusted device fingerprints or requesting non-MFA login pages — to bypass MFA verification.
complexity: advanced
influence: Will bypass existing MFA multi-factor authentication mechanisms, leading to account compromise.
keywords: Multi-Factor Authentication (MFA) Bypass
keywords: MFA bypass
keywords: 2FA bypass
keywords: two-factor bypass
keywords: OTP bypass
keywords: authentication factor bypass
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: One-Time Password
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: HTTPS Digital Certificate
mitigated by: Certificate Pinning (SSL Pinning)
citation: Exposing Multi-Factor Authentication (MFA) Bypass Techniques
updated: 2026-06-11
version: 1
related cases: Penetration Testing with the 2FA Bypass Phishing Toolkit: Evilginx2
related cases: Technical Breakdown: HackerOne Two-Factor Authentication Bypass Vulnerability
related cases: Phishing-as-a-Service Platform EvilProxy Bypasses Two-Factor Authentication
related cases: Google Disrupts Large-Scale Phishing Campaign: Session Cookie Theft Bypasses MFA
related cases: Session Hijacking 2.0: The Latest Attack Bypassing MFA
related cases: Microsoft 365 MFA Bypass Incident
related cases: 2FA Bypass Attack Using MitM Phishing Kits
related cases: Research on MFA Bypass Attack Techniques
related cases: A Survey of MFA Bypass Attack Techniques

MFA Fatigue Attack
type: Risk
break id: R0036-001
stix type: x-break-risk
definition: MFA fatigue attack refers to hackers repeatedly sending push notification approval requests after obtaining login credentials, tricking users into granting account access. Eventually, users approve the notification out of fatigue or inattention.
description: The hacker continuously triggers login approval request push notifications to the victim's device. The victim is initially confused and has about 30% trust. The attacker then uses social engineering to contact the victim, posing as an IT administrator and claiming the system has a problem that requires approving the notification to stop the pushes. The victim's trust rises to about 80% because they believe a real IT admin would know about the issue so quickly and know their name and department. Many employees then comply with the 'fake admin's' instructions.
complexity: advanced
influence: Will bypass existing MFA multi-factor authentication mechanisms, leading to account compromise.
keywords: MFA Fatigue Attack
keywords: push bombing
keywords: MFA prompt bombing
keywords: push fatigue attack
keywords: notification fatigue attack
keywords: push spam attack
mitigated by: Human Verification Technology
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Time Limiting
mitigated by: Facial Recognition
mitigated by: Device Profiling
mitigated by: Access Control
mitigated by: Security Awareness Training
citation: Nearly 1,000 Data Breaches in Q1 2023, Affecting 1,204 Companies Across 38 Industries
updated: 2026-06-11
version: 1
related cases: Uber and Cisco Breaches via Push Bombing
related cases: MFA Fatigue Attacks in Cloud Environments
related cases: Uber MFA Fatigue Attack Incident
related cases: Attackers Combine Fake IT Support Calls with MFA Fatigue Attacks

MFA Bypass Risk
type: Risk
break id: R0036-002
stix type: x-break-risk
definition: The risk that attackers use technical means to bypass multi-factor authentication (MFA) security protection and directly obtain authenticated session access.
description: MFA bypass risk refers to attackers using AiTM adversary-in-the-middle attacks, MFA fatigue attacks, SIM swapping, session token theft, and other methods to bypass MFA security verification and directly obtain authenticated session access. MFA has long been considered a critical line of defense for account security, but with the evolution of attack techniques, MFA is no longer an insurmountable barrier. Key attack paths include: ① AiTM attacks: intercepting authentication flows through reverse proxies to steal post-MFA session cookies; ② MFA fatigue attacks: pushing massive MFA verification requests to targets, forcing users to accidentally confirm due to fatigue; ③ SIM swapping: using social engineering to transfer victim phone numbers to attacker-controlled SIM cards to receive SMS verification codes; ④ Session token theft: stealing session cookies stored in browsers through infostealers; ⑤ MFA credential phishing: collecting both passwords and real-time 2FA tokens through phishing pages simultaneously. According to the CrowdStrike 2026 Global Threat Report, 82% of cyber attacks use no malware but instead bypass MFA through identity and session token theft.
complexity: advanced
influence: Directly causes account security defenses to be breached, enterprise core systems and data can be accessed without authorization, and traditional MFA protection becomes ineffective.
keywords: MFA Bypass Risk
keywords: MFA bypass
keywords: 2FA bypass
keywords: MFA fatigue
keywords: push bombing
keywords: AiTM
keywords: session token theft
mitigated by: Multi-Factor Authentication
mitigated by: SIM Card Security Verification
mitigated by: Credential Reuse Detection
mitigated by: Endpoint Detection and Response
citation: CrowdStrike 2026 Global Threat Report
citation: CISA MFA Implementation Guidance
updated: 2026-06-11
version: 1
related cases: C1312
related cases: C1313
related cases: C1314
related cases: C1315
related cases: C1316
related cases: C1317

Third-Party Account Aggregation
type: Risk
break id: R0037
stix type: x-break-risk
definition: Using a third-party application as a proxy to centrally manage account credentials for multiple applications.
description: Compiling credentials and information from multiple application accounts into another system. A single user can use this aggregation application to consolidate information from multiple applications, or consolidate information from multiple users of a single application — for example, e-commerce migration tools or ticket-grabbing applications.
complexity: intermediate
influence: For users, there is a risk of sensitive information leakage; for the system, there is a risk of platform data loss and increased system request pressure.
keywords: Third-Party Account Aggregation
keywords: account aggregator
keywords: account aggregation app
keywords: multi-account manager
keywords: credential vaulting
keywords: account pooling
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Anomalous Access Behavior Detection
citation: OWASP Automated Threat: OAT020 Account Aggregation
updated: 2026-06-11
version: 1
related cases: Jiangsu Yancheng Police Dismantle Credential Stuffing Account Theft Ring
related cases: Selling Ticket-Snatching Tools Is Illegal! Suspect Arrested!
related cases: Guangdong Criminal Gang Built Illegal Payment Aggregation Platforms to Provide Settlement Services for Overseas Online Gambling
related cases: Zhejiang Tailong Bank's Aggregate Payment App 'TaiHuiShou' Flagged for Unauthorized Personal Data Collection

QR Code Login Fraud
type: Risk
break id: R0038
stix type: x-break-risk
definition: Exploiting the mechanism of mobile app QR code scanning to authorize web login, enabling fraudulent login.
description: Business mobile apps often support external QR code scanning for app launch and auto-login for convenience and promotion purposes. An attacker only needs to copy the QR code from the business web login page and send it to a victim. Once the victim scans the QR code, the attacker gains web-side account access for the victim.
complexity: intermediate
influence: The user's account is logged into by the attacker.
keywords: QR Code Login Fraud
keywords: QR login hijacking
keywords: QR code phishing
keywords: quishing login
keywords: QR auth abuse
keywords: QR code hijacking
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
citation: Mass QQ Accounts Stolen: QR Code Login Hijacked and Recorded by Black Market Groups
updated: 2026-06-11
version: 1
related cases: Black-market gang used 'scan QR code to get free eggs' to trick users into scanning and logging in for account theft
related cases: QRLJacking: Session Hijacking via QR Code Login Exploitation
related cases: OWASP/QRLJacking: QR Code Login Hijacking Attack Framework
related cases: QR Code Phishing Study: An Empirical Investigation of Phishing Attacks via QR Codes
related cases: Impact Analysis and Simulation of QR Code Phishing Attacks Using QRLJacker
related cases: Bilibili Streamer Destroys Viewer's Account Over Expired Membership

Negative Public Opinion
type: Risk
break id: R0039
stix type: x-break-risk
definition: Negative public opinion risk refers to the potential threat to the reputation and image of an individual, organization, brand, or other entity due to the spread of negative information among the public.
description: This negative information may be true, exaggerated, or even false, but it spreads widely through the internet and social media, potentially causing negative impacts on the affected party. Causes include: false information spreading; social media bombs with large volumes of negative comments flooding in a short time; exposure of misconduct; product or service quality issues; and personal behavior of public figures or executives.
complexity: basic
influence: Harms include reputational damage to individuals, organizations, or brands, potentially leading to loss of trust, business damage, legal issues, and declining employee morale, forcing affected parties to take crisis management and brand maintenance measures.
keywords: Negative Public Opinion
keywords: reputation crisis
keywords: brand reputation damage
keywords: online backlash
keywords: adverse publicity
keywords: social media outrage
mitigated by: Compliance Governance
mitigated by: Threat Intelligence
mitigated by: Complaint and Reporting Channel
mitigated by: PR Crisis Response
citation: Reputation and Its Risks
updated: 2026-06-13
version: 1
related cases: Xiangtan Police Dismantle Cyber-Enabled Mafia-Like Groups Extorting via Negative Public Opinion
related cases: China's Ministry of Public Security Deploys Crackdown on Cyber-Enabled Mafia-Like Crimes Including Negative Public Opinion Extortion
related cases: Gang Sentenced for Extortion After Fabricating Negative Publicity to Demand Deletion Fees
related cases: College Student Fabricated False Information Causing Online Public Sentiment, Received Criticism and Education
related cases: Supreme People's Procuratorate Releases Typical Cases on Punishing News Blackmail and Fake News Crimes
related cases: Yantai Police Dismantle Online Water Army Defaming Huawei and Li Auto, 12 Arrested

Carding Attack
type: Risk
break id: R0040
stix type: x-break-risk
definition: Verifying the validity of stolen payment card credentials through bulk login authentication.
description: Using a merchant's complete login credential verification process to validate stolen payment cards or accounts. Since the value of stolen accounts is unknown, carding attacks can be used to assess payment card value. The source of credential data may be third-party application breaches, third-party payment channel leaks, or purchases from black markets.
complexity: intermediate
influence: Payment card or account credential information is stolen.
keywords: Carding Attack
keywords: carding
keywords: card testing attack
keywords: credit card testing
keywords: payment card testing
keywords: stolen card validation
keywords: BIN attack
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Forced Password Reset
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
citation: OWASP Automated Threat: OAT001 Carding
updated: 2026-06-11
version: 1
related cases: FraudBlocker Identifies and Blocks a Coordinated Carding Attack
related cases: PayPal Warns of Surge in Carding Attacks Driving Global Losses
related cases: Indusface Exposes the Verification and Monetization Chain of Card Cracking Attacks
related cases: US Jewelry Retailer Hit by Carding Attack, Facing Payment Gateway Blacklist Risk
related cases: BigCommerce Merchant Hit by Unstoppable Persistent Carding Attack
related cases: Analysis of Emerging Credential Stuffing Attacks Involving AI Agents

Card Cracking
type: Risk
break id: R0041
stix type: x-break-risk
definition: Obtaining valid payment information by enumerating different missing start/expiry dates and security codes.
description: Brute-forcing the start/expiry dates and security codes (CSC) of payment cards, also known as CVN2, CVC, CV2, or CID. The results of a carding attack (R0040) can be used to assess payment card or account value, while the results of card cracking (R0041) can be used for actual payments.
complexity: intermediate
influence: Payment card or account payment information is stolen.
keywords: Card Cracking
keywords: CVV brute force
keywords: credit card cracking
keywords: card security code guessing
keywords: expiry date brute force
keywords: CVV enumeration
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Forced Password Reset
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
citation: OWASP Automated Threat: OAT010 Card Cracking
updated: 2026-06-11
version: 1
related cases: Global Credit Card Fraud Losses Continue to Climb
related cases: F5 Defends Against Gift Card Cracking Attacks
related cases: Enumeration Attack Definition and Payment Card Cracking Mechanism
related cases: OWASP Defines Payment Card Cracking as an Automated Threat
related cases: Newcastle University Discloses a Distributed Guessing Attack Against Online Card Payments

Fake Inventory
type: Risk
break id: R0042
stix type: x-break-risk
definition: An e-commerce seller deliberately claims to have stock of a product when they do not actually have sufficient inventory.
description: Fake inventory generally serves a few purposes: first, attracting users with extremely low prices or popular items, then claiming out-of-stock and redirecting users to other products; second, creating fake inventory to attract orders, then fulfilling them through reselling or other means.
complexity: basic
influence: The first type of fake inventory creates a poor shopping experience for users, who may feel deceived; the second type may cause delayed shipments or users paying high prices for low-value goods, negatively impacting user experience.
keywords: Fake Inventory
keywords: phantom inventory
keywords: false stock listing
keywords: inventory spoofing
keywords: out-of-stock bait
keywords: fake stock
mitigated by: Contractual Clause Restrictions
mitigated by: Credit Level Restriction
mitigated by: Security Deposit Mechanism
mitigated by: Risk Control Strategy
mitigated by: Store Penalty
citation: How Are Tmall Sellers Penalized for Fake Inventory?
updated: 2026-06-11
version: 1
related cases: 800,000 Jin of Eggs Vanished Over 4 Years: A Theft Case Exposes Blind Spots in Fundamental Analysis
related cases: Exposed: Top 100 Counterfeit Livestream Sales
related cases: Guizhou Bainian Yuanzhi Liquor Falsified Inventory Tax Evasion Case
related cases: Thailand Seizes Counterfeit Goods Across Cross-Border and Online Channels

Stolen Card Payment
type: Risk
break id: R0043
stix type: x-break-risk
definition: Using the identity from a stolen payment card or another user's account to complete transactions.
description: Using the identity from a stolen payment card or another user's account to complete transactions. This is generally used to conceal the attacker's identity or reduce the risk of bulk order fraud being intercepted by risk controls. Login credentials come from carding attacks (R0040), and payment information comes from card cracking (R0041).
complexity: advanced
influence: Payment identity is impersonated.
keywords: Stolen Card Payment
keywords: unauthorized card payment
keywords: fraudulent card payment
keywords: third-party card use
keywords: card-not-present fraud
keywords: CNP fraud
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Password Complexity Requirements
citation: Ping An Bank Credit Card Strengthens Tech Empowerment, 'Black Hawk Eye' Deters Financial Black-Grey Market
updated: 2026-06-11
version: 1
related cases: Zhaolian Finance’s Third-Party Collector Used Unregistered SIM Cards for Harassment
related cases: Shenzhen Futian Police Crack Down on Fraud-Linked Illicit SIM Supply Chain
related cases: China's First Case Against a Telecom Operator for Upstream Telecom Fraud: Yuante Company Provided "Black SIM Cards"
related cases: MPS Reports “Clean Net” Operation Results: Over 30 Million Illicit SIMs Seized in Three Years

Stolen Card Fraud
type: Risk
break id: R0043-001
stix type: x-break-risk
definition: Using funds from a stolen payment card or another user's account to purchase goods or cash out.
description: Using stolen payment card or account login credentials and payment information to misappropriate or steal funds. In addition to conventional purchases/services/withdrawals, profits can also be made through refunds. Login credentials come from carding attacks (R0040), and payment information comes from card cracking (R0041).
complexity: advanced
influence: Funds in the payment card or account are misappropriated or stolen.
keywords: Stolen Card Fraud
keywords: card fraud
keywords: credit card fraud
keywords: unauthorized purchases
keywords: stolen payment method abuse
keywords: card-not-present fraud
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Password Complexity Requirements
citation: OWASP Automated Threat: OAT012 Cashing Out
updated: 2026-06-11
version: 1
related cases: Guangzhou Police Bust New Credit Card Fraud Ring: Cards Cloned in 125 Seconds
related cases: Zhoukou Suspects Coercively Processed for Stealing Store Alipay Funds
related cases: China's Supreme Court Rules Banks Must Compensate for Unauthorized Card Transactions
related cases: Man Sentenced to 5 Years for Impersonating Bank Staff and Cashing Out ¥75,000 with Stolen Credit Card
related cases: Bank Card Stolen and Drained — Gaochang Police Crack the Case, Recover Assets, and Return ¥34,000 in Losses
related cases: Cracking Down on Bank Card Crimes: Ministry of Public Security Releases Eight Typical Cases

Transfer Fraud
type: Risk
break id: R0044
stix type: x-break-risk
definition: Deceiving others into making transfers using high-fidelity spoofed accounts, or forging transfer records.
description: Typically involves two scenarios: deceiving the payee and deceiving the payer. Deceiving the payee generally involves forging transaction records or using untrustworthy third parties as guarantors. Deceiving the payer generally involves creating high-fidelity spoofed payee accounts to induce payment.
complexity: advanced
influence: Financial loss to the payee or payer.
keywords: Transfer Fraud
keywords: fake transfer receipt
keywords: spoofed payment proof
keywords: wire transfer scam
keywords: bank transfer fraud
keywords: payment confirmation forgery
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Additional Identity Authorization
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
citation: Threat Hunter Anti-Money Laundering Intelligence Assists Financial Institutions in Risk Governance
updated: 2026-06-11
version: 1
related cases: Man Uses Fake Transfer Screenshots to Scam Over 21,000 Yuan, Arrested Same Day
related cases: Guangzhou Liwan Police Crack Fake Transfer Screenshot Delivery Fraud Case
related cases: Nanchang Xihu Court Fake Transfer Screenshot Fraud Case
related cases: Man Arrested for Scamming with Fake Transfer Records
related cases: Man Detained in Mao County, Sichuan for Defrauding Over 20,000 Yuan Using Fake Transfer Screenshots
related cases: Woman Sentenced for Repeated Fraud Using Fake Transfer Records
related cases: Photo-Editing Trickery: Man in Qinzhou Scams Pawnshops Three Times with Fake Transfer Screenshots
related cases: Earn Thousands a Day Just by Transferring Money? Beware of Becoming a Money Laundering Accomplice
related cases: Beijing Fraud Case: Victim Transfers Nearly One Million Yuan, Gets a 'Surprise' 24 Hours Later

Points Theft
type: Risk
break id: R0045
stix type: x-break-risk
definition: Misappropriating non-monetary benefits from a stolen payment card or another user's account.
description: Using stolen payment card or account login credentials and payment information to misappropriate or steal non-monetary benefits. Login credentials come from carding attacks (R0040), and payment information comes from card cracking (R0041).
complexity: advanced
influence: Non-monetary benefits in the payment card or account are misappropriated or stolen.
keywords: Points Theft
keywords: loyalty points theft
keywords: reward points theft
keywords: points hijacking
keywords: account points abuse
keywords: loyalty balance theft
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
citation: Stealing Mileage Points and Credit Card Fraud: How 'Black Ticket Agents' Operate
citation: Li Chen's Mileage Card Fraudulently Used by Over Ten People
updated: 2026-06-11
version: 1
related cases: Fans Steal Air Miles from Actor Wu Lei and Other Celebrities
related cases: Foshan Man’s Credit Card Compromised Abroad After Clicking Fake Bank Points Redemption Link
related cases: SPD Bank Mastercard Cardholders Hit by Overseas Fraud, Receive Point Compensation
related cases: Sichuan Mianyang Police Dismantle Cross-Province Mobile Points Redemption Fraud Ring
related cases: MPS Criminal Investigation Bureau Warns Against 'Points Expiration' Scams

Points Redemption Reselling
type: Risk
break id: R0045-001
stix type: x-break-risk
definition: An illegal profit-making scheme that uses other people's points for personal gain.
description: Fraudsters obtain other people's points through various means, then use those points for redemptions, and resell the redeemed gifts or services for profit.
complexity: intermediate
influence: Disrupts market order and infringes on consumer rights.
keywords: Points Redemption Reselling
keywords: points resale
keywords: reward redemption fraud
keywords: loyalty resale
keywords: redeemed goods reselling
keywords: points arbitrage
mitigated by: Multi-Factor Authentication
mitigated by: Additional Identity Authorization
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Ping An Bank Credit Card Upgrades Black Market Crackdown: 'Black Hawk Eye' Precision Strike
citation: Li Chen's Mileage Card Fraudulently Used by Over Ten People
updated: 2026-06-11
version: 1
related cases: Ctrip Supplier Illegally Redeemed Miles for Tickets, Leaving Passenger Under Investigation
related cases: Former Employee Sentenced for Stealing Mall Points and Cashing Out
related cases: Former Employee Sentenced to 16 Months for Stealing 3.7 Million Loyalty Points
related cases: Group Defrauded Tmall of 700 Million Birthday Points and Cashed Out Over 6 Million Yuan, Prosecuted
related cases: Criminal Ring Profits Millions Annually by Flipping Credit Card Points via POS Machines
related cases: Scalpers Emerge: Large Certificates of Deposit and Credit Card Points Become Resale Business

Minor Age Verification Bypass
type: Risk
break id: R0046
stix type: x-break-risk
definition: Bypassing minor identification mechanisms through identity forgery.
description: Bypassing minor identification mechanisms by using real or forged adult identities, including using adult ID cards, facial recognition, fingerprints, and other biometric data.
complexity: intermediate
influence: Minor identification mechanisms become ineffective.
keywords: Minor Age Verification Bypass
keywords: underage verification bypass
keywords: age gate bypass
keywords: minor protection bypass
keywords: adult identity borrowing
keywords: anti-addiction bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Facial Recognition
citation: Promoting Juvenile Crime Prevention and Governance: SPP Releases Typical Cases
updated: 2026-06-11
version: 1
related cases: City's First Case: Prosecutors Unravel Scheme of Mass Game Account Registration with Real-Name Verification
related cases: NPC Deputy Proposes Mandatory Facial Recognition Login for Adult Gamers
related cases: Game Fined 100,000 Yuan for Failing to Integrate Real-Name Authentication System
related cases: 15-Year-Old Boy Uses Mother's Identity to Top Up Games
related cases: Minors Bypass Game Real-Name Verification via Purchased QQ Accounts
related cases: Game Company Ordered to Pay 800,000 Yuan for Selling Bilibili Game Accounts and SMS-Code Services to Bypass Anti-Addiction Controls
related cases: Virtual ID Number Generators Found Online Can Bypass Anti-Addiction Systems
related cases: Illegal Services Offer 'Face Recognition Bypass' to Help Minors Evade Game Authentication
related cases: Crackdown on Underground Syndicate Renting and Selling Accounts and Providing Proxy Face-Scanning for Minors

CAPTCHA Bypass
type: Risk
break id: R0047
stix type: x-break-risk
definition: Passing human-machine tests through automated means.
description: Typically involves passing Turing tests (challenges used to distinguish machines from humans) in an automated manner. In addition to traditional image and audio CAPTCHAs, mini-games or arithmetic challenges may also be used. Commonly used during bulk automated operations to bypass human verification. With the advancement of AI technology, using computer vision and deep learning to automatically recognize CAPTCHAs has become a mainstream attack method. Beyond automated CAPTCHA solving, bypasses can also be achieved by altering the device environment or using third-party scripts to circumvent mouse movement trajectories, touch pressure, 3D gyroscope, and other behavioral biometric checks.
complexity: advanced
influence: Human-machine identification mechanisms become ineffective.
keywords: CAPTCHA Bypass
keywords: captcha solving
keywords: captcha cracking
keywords: automated captcha solving
keywords: human verification bypass
keywords: captcha farm
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: OWASP Automated Threat: OAT009 CAPTCHA Defeat
updated: 2026-06-11
version: 1
related cases: The 'Kuai a Da Ti' AI CAPTCHA-solving Platform Case
related cases: Chen Used Crawler Software to Help Scalpers Grab Damai Tickets Instantly
related cases: Wu and Li Convicted for Bypassing Security Measures to Scrape Data
related cases: Guangdong Shantou Chen Moucai Used AI to Bypass Douyin Facial Recognition Case
related cases: Anhui Hefei Police Crack Province's First Facial Recognition Crime Case
related cases: Modern Image CAPTCHA Security and Underground CAPTCHA-Solving Services

Facial Recognition Bypass
type: Risk
break id: R0048
stix type: x-break-risk
definition: Bypassing facial recognition by forging or tampering with facial data or related authentication data.
description: Bypassing facial recognition by forging or tampering with facial data or related authentication data. Common attack techniques include: using deepfake technology to synthesize live facial images, image replacement, injecting custom videos or images into the camera data stream, hijacking the camera or facial recognition app, and tampering with transmission packets. Commonly used in login, payment, and other processes, or as one of the factors in multi-factor authentication.
complexity: advanced
influence: Facial recognition mechanisms become ineffective, leading to unauthorized login, payment, and other risks.
keywords: Facial Recognition Bypass
keywords: face unlock bypass
keywords: liveness bypass
keywords: deepfake face spoofing
keywords: presentation attack
keywords: face spoofing
mitigated by: API Signature Verification
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: Face Analysis Technology Evaluation: Presentation Attack Detection - NIST
updated: 2026-06-13
version: 1
related cases: Bank of Communications depositor loses ¥400,000 after face recognition bypassed
related cases: Bank of Communications Depositor Li Hong Loses Nearly 430,000 Yuan to Fake Facial Recognition Theft
related cases: Jiangsu Police Uncover Face-Swap Software Scam for Unblocking WeChat Accounts
related cases: Video Injection Attack Detection: Countering Virtual Camera Bypass in Remote Biometric Systems

Proxy Login / Proxy Order Placement
type: Risk
break id: R0049
stix type: x-break-risk
definition: Using a device environment to assist logging into another person's account, or using an account to assist others in placing orders.
description: Using a device environment to assist logging into another person's account, or using an account to assist others in placing orders. Typically done to bypass device risk controls or reduce account risk scores, enabling login, order placement, and other operations.
complexity: advanced
influence: Device/account risk identification mechanisms become ineffective.
keywords: Proxy Login / Proxy Order Placement
keywords: account renting
keywords: proxy purchasing
keywords: assisted order placement
keywords: remote account login
keywords: account proxying
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Additional Identity Authorization
mitigated by: Identity Security Audit
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Anomalous Access Behavior Detection
citation: Proxy Ordering Black Market Invades Global E-Commerce: In-Depth Analysis of New Arbitrage and Fraud
updated: 2026-06-13
version: 1
related cases: Exploiting Ordering Loophole via Proxy Purchasing to Illegally Profit Over One Million Yuan
related cases: Buying 'Proxy Ordering' Discounts May Constitute Aiding a Crime: Two Individuals Exploited Ordering Loopholes to Illegally Profit Over One Million Yuan
related cases: Underground Proxy Ordering Rings Exploit Leaked Payment Card Data for Purchases
related cases: Ride-hailing black market uses virtual numbers to register or hijack accounts for low-price proxy ordering
related cases: College Students' National Subsidy Quotas Targeted by Scalpers, Mass Proxy Ordering to Exploit Platform Discounts

Risk Device Identification Bypass
type: Risk
break id: R0050
stix type: x-break-risk
definition: Modifying a real device's device information to deceive applications and lower the device risk score.
description: Scenarios include: the operating system running the app has been rooted, the app runs while being hooked, the app runs under a debugger, or the security certificate between the app and server has been replaced. Common risk device environments also include: injection via Hook frameworks such as Xposed/Frida, app cloning tools, device control systems, and tampering with device fingerprint information.
complexity: advanced
influence: May cause security processes within the application to be broken and data to be forged.
keywords: Risk Device Identification Bypass
keywords: device fingerprint spoofing
keywords: device ID spoofing
keywords: device risk spoofing
keywords: root cloaking
keywords: environment spoofing
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Device Fingerprinting
citation: Cross-Border Fraud Risk: Analysis of Transnational Black-Grey Market Crime Patterns Driven by High Profits
updated: 2026-06-13
version: 1
related cases: Five Suspects Charged with Developing and Selling Software to Bypass Bank Biometrics
related cases: Bypassing Facial Recognition: How Should Financial Institutions Defend Against New Types of Telecom Fraud from the Black Market?
related cases: National Cybersecurity Alert Warns of AI-Powered CAPTCHA Bypass Attacks

Virtual Device Identification Bypass
type: Risk
break id: R0050-001
stix type: x-break-risk
definition: Simulating a real device through software to facilitate subsequent abuse.
description: Running applications via cloud phones, cloud servers, virtual machines, emulators, anti-fingerprint browsers, and similar means.
complexity: intermediate
influence: May cause security processes within the application to be broken and data to be forged.
keywords: Virtual Device Identification Bypass
keywords: emulator detection bypass
keywords: virtual machine bypass
keywords: cloud phone bypass
keywords: anti-detect browser
keywords: device emulation spoofing
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
citation: MASTG-KNOW-0031: Emulator Detection - OWASP
updated: 2026-06-13
version: 1
related cases: Tianjin Police Dismantle Virtual Device Operation Aiding Overseas Telecom Fraud Ring
related cases: AI-Based Detection of SIM Box Bypass Fraud
related cases: How Fraudsters Mask Their Traces in International Bypass Fraud
related cases: Waydroid Emulator Detection Bypass Feature Request
related cases: A Test Case for Bypassing Emulator Detection Using Frida and Termux

Application Reverse Engineering
type: Risk
break id: R0051
stix type: x-break-risk
definition: Restoring an application's source code or runtime logic through reverse engineering.
description: For web applications, WeChat mini-programs, and Android apps, source code can be directly or easily restored, exposing all application processing logic. For iOS apps, reverse analysis can be performed using tools such as class-dump, Hopper, and IDA. When security policies are implemented on the client side, there is a risk of them being cracked or bypassed.
complexity: advanced
influence: May cause security processes within the application to be broken and data to be forged.
keywords: Application Reverse Engineering
keywords: app reversing
keywords: APK decompilation
keywords: source code recovery
keywords: binary analysis
keywords: reverse app logic
mitigated by: API Signature Verification
mitigated by: Client Application Hardening
mitigated by: iOS Application Hardening
mitigated by: H5/Mini-Program Hardening
mitigated by: Desktop Application Hardening
mitigated by: Client-Side Anti-Tampering
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: What Is Reverse Engineering?
updated: 2026-06-13
version: 1
related cases: Java Decompilation Offensive and Defensive Practices: Exposing Code Leakage Risks and 5 Core Protection Techniques
related cases: iOS App Hardening Whitepaper: IPA Encryption, Decompilation Defense, and Source-less Obfuscation
related cases: Hands-on Frida Reverse Engineering: Bypassing Android App License Verification Step by Step
related cases: Claude Code Source Code Leak: An In-Depth Analysis of Community Reverse Engineering Techniques
related cases: C# Decompilation-Based Software Cracking Method
related cases: Hacker Reverse-Engineered Software to Control 180,000 Cameras for Voyeurism, Profited 800,000 Yuan, Sentenced to 5 Years
related cases: Changsha Semiconductor Executive Sentenced for Downloading Core Technical Materials and Infringing Trade Secrets
related cases: Guangdong Communications Administration Penalizes Apps Violating Personal Information Protection Rules

Application Traffic Interception
type: Risk
break id: R0051-001
stix type: x-break-risk
definition: Restoring an application's request structure and monitoring response data through packet capture.
description: Packet capture involves intercepting, replaying, editing, and saving data packets sent and received over the network. Through packet capture, an application's request methods and structure can be analyzed to enable business logic reconstruction, simulation, and process automation as a substitute for the client (R0001).
complexity: advanced
influence: May cause security processes within the application to be broken and data to be forged.
keywords: Application Traffic Interception
keywords: packet capture
keywords: MITM proxy
keywords: request replay
keywords: traffic sniffing
keywords: API interception
mitigated by: API Signature Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Data Desensitization (Masking)
citation: MASTG-TEST-0244: Missing Certificate Pinning in Network Traffic - OWASP
updated: 2026-06-13
version: 1

HTTP Request Analysis
type: Risk
break id: R0051-002
stix type: x-break-risk
definition: Restoring an application's request structure and monitoring response data through packet capture.
description: For applications that transmit data using text-based protocols such as HTTP/HTTPS, a man-in-the-middle can be used to capture sent and received data, thereby reconstructing the application's execution logic to enable automated operations.
complexity: intermediate
influence: May cause security processes within the application to be broken and data to be forged.
keywords: HTTP Request Analysis
keywords: HTTP packet capture
keywords: HTTPS interception
keywords: request inspection
keywords: API request analysis
keywords: man-in-the-middle proxy
mitigated by: API Signature Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
citation: Complete HTTP Request Analysis
updated: 2026-06-13
version: 1
related cases: Reverse Engineering API Encryption and Decryption Analysis
related cases: Android Reverse Engineering – Packet Capture Analysis and Tooling Overview
related cases: HTTPS Interception Weakens TLS Security
related cases: SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

Low Price, High Shipping
type: Risk
break id: R0052
stix type: x-break-risk
definition: A seller lists products at a relatively low price but compensates for the cost gap by inflating shipping fees.
description: This strategy may make products appear competitively priced to attract shoppers, but the seller actually earns more profit through excessive shipping charges.
complexity: basic
influence: Shoppers may purchase items without noticing the high shipping fees, leading to a poor experience; for the platform, inflated shipping fees from sellers may damage the platform's reputation.
keywords: Low Price, High Shipping
keywords: shipping fee scam
keywords: inflated shipping charges
keywords: price plus shipping manipulation
keywords: postage padding
keywords: hidden shipping markup
mitigated by: Contractual Clause Restrictions
mitigated by: Credit Level Restriction
mitigated by: Risk Control Strategy
mitigated by: Store Penalty
citation: Gaoyou Court Press Conference on Combating Telecom and Cyber Fraud
updated: 2026-06-11
version: 1
related cases: CCTV Exposes a Free Smartband Cash-on-Delivery Scam
related cases: Fujian Electromechanical Company Inspection Reveals Inflated Transport Costs for Civil Explosive Products
related cases: Shanghai Lawyer Shares Dispute Over Including Prepaid Postage in Turnover for Illegal Business Operations Case
related cases: Douyin Removes Abnormally Low-Price Presale Stores
related cases: Freight Forwarders Lure Shippers with Low Rates, Then Demand High Ransom Fees Before Vanishing with Funds

Malicious User Harassment
type: Risk
break id: R0053
stix type: x-break-risk
definition: A seller uses improper means to continuously and intentionally harass users.
description: May include but is not limited to frequent solicitation, false advertising, threats, intimidation, and persistent harassing messages. More severe cases include mailing razor blades or cash-on-delivery packages to users. Many cases arise from transaction disputes, such as coercing users to retract negative reviews or retaliating against users who file complaints.
complexity: basic
influence: May cause distress and a poor experience for users.
keywords: Malicious User Harassment
keywords: buyer harassment
keywords: seller harassment
keywords: threatening messages
keywords: targeted harassment
keywords: abusive contact
mitigated by: User Information Tokenization
mitigated by: Virtual Phone Number
mitigated by: Credit Level Restriction
mitigated by: Store Penalty
citation: How Does Taobao Determine Buyer Harassment? What Are the Penalties?
updated: 2026-06-11
version: 1
related cases: Negative Review Triggers SMS Bombing: Malicious Code and Privacy Databases Freely Available
related cases: Xi'an Man's Contact Info Maliciously Disclosed and Harassed After Traffic Accident
related cases: Shandong Man Sentenced for Repeatedly Insulting and Threatening Cousin Over Wife Harassment
related cases: Controlling Malicious Call Software Constituted the Crime of Disrupting Computer Information Systems
related cases: China Construction Bank Credit Card Holders Frequently Targeted by Third-Party Debt Collection Agencies
related cases: 315 Special Report Exposes Virtual Operators Illegally Selling SIM Cards Used for Malicious Harassment
related cases: Taobao Says Paying to Delete Negative Reviews Will Lead to Immediate Store Closure

Malicious Returns
type: Risk
break id: R0054
stix type: x-break-risk
definition: A buyer returns goods not for legitimate reasons, but to disrupt the seller or platform, or to gain improper benefits.
description: A buyer purchases high-value, large, or scarce items with the intent to disrupt or damage, then initiates a return as soon as the goods arrive or before they arrive, causing financial loss or reputational damage to the seller through high return rates. Alternatively, a buyer uses the 7-day no-questions-asked return policy on high-value items after using them, causing depreciation, then colluding with insiders to purchase the depreciated item.
complexity: basic
influence: Consumes the seller's profits, inventory, reputation, or supply chain costs.
keywords: Malicious Returns
keywords: return abuse
keywords: refund abuse
keywords: serial returns abuse
keywords: friendly fraud returns
keywords: return policy abuse
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Buyer Uses Courier Tracking Number for Malicious Refund of Nearly 40,000 Yuan, Faces Fraud Charges
updated: 2026-06-13
version: 1
related cases: Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
related cases: Exploiting '7-Day No-Reason Return' Policy: Swapping Phones with Dummy Units Leads to Detention
related cases: 476 Orders Refunded Without Return: Woman in Taizhou Exploits Platform Loophole to Scam 250,000 Yuan
related cases: Fengxian Prosecutors Handled a 17-Year-Old's Fake Return Fraud Case Involving More Than 4 Million Yuan
related cases: Man Sentenced for Repeated Malicious Orders and Refund-Only Claims

Bulk Refunds
type: Risk
break id: R0054-001
stix type: x-break-risk
definition: Placing bulk orders through the same or different accounts and initiating illegitimate bulk returns or refunds.
description: Using automated or manual means to place large numbers of orders or high-value orders, then bulk-canceling and requesting refunds, maliciously consuming supply chain costs or causing the seller's return rate to rise.
complexity: intermediate
influence: Disrupts the seller's normal operations, causing supply chain losses or a drop in ratings and rankings.
keywords: Bulk Refunds
keywords: mass refunds
keywords: bulk cancellation fraud
keywords: refund bombing
keywords: order cancellation abuse
keywords: refund abuse at scale
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Tai'an Announces Typical Cases of Combating New Telecom and Cyber Crimes
updated: 2026-06-13
version: 1
related cases: Man Repeatedly Requests Refund-Only for Online Purchases, Maliciously Places Over 2,700 Orders Against 900+ Merchants
related cases: AI-Faked Rotten Fruit Images Used to Abuse Refund-Only Claims
related cases: Man Sentenced for 2,700+ Malicious Orders Abusing Refund-Only Rules to Disrupt Online Stores
related cases: Man Sentenced for Malicious Order Cancellations Causing Over 540,000 Yuan in Losses
related cases: Beijing Woman Detained for Repeatedly Swapping Used Clothes in Online Purchase Refund Scam
related cases: What 225 'Abnormal' Return-and-Refund Successes Reveal
related cases: Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud

Return Fraud
type: Risk
break id: R0054-002
stix type: x-break-risk
definition: A buyer returns a counterfeit, used, empty, incomplete, or substitute item instead of the original purchased product.
description: The returned item is not the actual item that was shipped — such as returning a counterfeit or a different product (buy A, return B). The quantity of returned items differs from what was actually shipped, including empty packages.
complexity: basic
influence: Causes financial loss to the platform or seller.
keywords: Return Fraud
keywords: refund fraud
keywords: wardrobing
keywords: returning counterfeit item
keywords: buy and return switch
keywords: empty box return
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Legal Action
citation: January Digital Retail: Taobao Flash Sale Challenges Instant Retail Dominance, Three Sheep Resumes Streaming
updated: 2026-06-13
version: 1
related cases: Shanghai Police Crack Down on Return Shipping Insurance Fraud via Fictitious Transactions
related cases: Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
related cases: Makeup Artist Detained After 1,036 Swapped Returns Totaling ¥890,000
related cases: ChaPanda, Wallace, and Other Brands Hit by Empty Delivery Package Incidents
related cases: Shanghai Qingpu Court Hears Online Refund Fraud Case Involving Empty Packages and Free Gifts
related cases: Guangzhou Liwan Court Tried a 'Buy Genuine, Return Fake' Fraud Case Involving More Than 890,000 Yuan

Flash Return Arbitrage
type: Risk
break id: R0054-003
stix type: x-break-risk
definition: Placing an order to receive gifts, vouchers, or discounts, then immediately canceling the order to extract the benefits.
description: A targeted fraudster may stockpile large numbers of accounts and monitor platform or merchant promotions in real time. Upon finding a profitable opportunity, they place bulk orders via automation, extract coupons, gifts, or other benefits, and then immediately cancel the orders for profit.
complexity: intermediate
influence: Causes financial loss to the platform and sellers.
keywords: Flash Return Arbitrage
keywords: buy-cancel arbitrage
keywords: promo abuse refund
keywords: gift with purchase abuse
keywords: voucher extraction
keywords: instant refund arbitrage
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Legal Action
citation: Exploiting Platform Flash Refund Rules: Order Brushing and Faking Returns Constitutes Fraud
updated: 2026-06-13
version: 1
related cases: Exploiting 'Instant Refund' Policy to Swap Counterfeits for Authentic Goods for Profit
related cases: Buyer Exploits 'Refund-Only' Loophole in Repeated 'Wool-Pulling' Incident
related cases: Pinduoduo Billion-Yuan Subsidy Coupon Exploit Incident
related cases: Man Sentenced for 2,700+ Fraudulent Refund-Only Claims via Malicious Ordering
related cases: Corporate Insider Exploits Rebate Loophole via Fake Order Scam
related cases: Refunded but Rewarded: A Study on Double-Dipping Attacks Against Cashback Reward Engines

Malicious Refusal of Delivery
type: Risk
break id: R0054-004
stix type: x-break-risk
definition: A buyer refuses to accept goods for retaliatory or disruptive purposes, occupying or consuming the seller's supply chain resources and causing financial loss.
description: A typical malicious attack scenario: a buyer purchases large items such as appliances, electronics, construction materials, or tires, then goes unreachable or refuses delivery when the courier arrives, occupying and consuming the seller's supply chain costs.
complexity: basic
influence: Causes supply chain losses to the seller.
keywords: Malicious Refusal of Delivery
keywords: delivery refusal abuse
keywords: reject-on-delivery abuse
keywords: failed delivery sabotage
keywords: malicious non-acceptance
mitigated by: Quantity Limiting
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Legal Action
citation: Ministry of Public Security Announces Top 10 Financial Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1
related cases: Courier Rejects Main Product but Keeps Free Gifts, Profiting 380,000 Yuan and Receiving Prison Sentence
related cases: Supervisor Embezzles 297 Phones via COD Refusal Scheme
related cases: Man Sentenced to 3.5 Years for Defrauding Online Merchants by Posing as Consumer
related cases: Courier Sentenced to 2 Years 10 Months for Illegally Profiting 380,000 Yuan Through Gift Scam
related cases: Woman Exploits Pinduoduo Loophole by Refusing Partial Delivery to Claim Full Refund

Unauthorized Discount Purchase
type: Risk
break id: R0055
stix type: x-break-risk
definition: Zero-price or below-cost purchases resulting from business logic errors or misconfigured prices and coupons.
description: This attack may be discovered accidentally, but is more likely the result of an attacker probing at scale through automated bulk cart additions, modifying submitted amounts or quantities, or collecting and stacking coupons. After discovering a vulnerability, attackers typically exploit it while simultaneously publicizing it to achieve safety in numbers and conceal their identity, causing greater losses to the platform or merchant.
complexity: basic
influence: Causes significant financial losses to the platform and merchants.
keywords: Unauthorized Discount Purchase
keywords: price glitch abuse
keywords: zero dollar order
keywords: below-cost purchase fraud
keywords: coupon stacking abuse
keywords: underpriced order exploit
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Legal Action
mitigated by: Account Ban
citation: Financial Weekly: Over 4 Million Financial Black-Grey Market Practitioners in China
updated: 2026-06-13
version: 1
related cases: Exploiting Platform Loopholes for Fraudulent Gains: 'Petty Theft' May Lead to Criminal Charges
related cases: Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
related cases: Shanghai Police Crack Down on “Wool-Gathering” Scheme: Fake Orders Defrauded Platform of Over 1.2 Million Yuan in Subsidies
related cases: Supermarket Delivery Driver Sentenced for Abusing 30,000+ Virtual Phone Numbers to Obtain New-User Subsidies and Delivery Fees
related cases: Illicit "Coupon Scalping" Case: Using Cheat Software to Place Low-Price Orders for Profit
related cases: Exploiting Loopholes to 'Earn' 1 Million Yuan: Should Security Personnel Take the Blame?
related cases: Woman Exploits Supermarket Loophole for 18 Months of Zero-Dollar Shopping, Defrauds ¥250,000

Coupon Restriction Bypass
type: Risk
break id: R0055-001
stix type: x-break-risk
definition: Restricted coupons are claimed or used outside of their intended restrictions.
description: Two scenarios: first, non-public coupons, coupons claimable under specific conditions, or coupons issued to specific groups are claimed without meeting the restrictions; second, coupons restricted to specific usage scenarios or conditions are used outside those restrictions. Restrictions include: specific time windows, specific user groups, specific product pairings, specific price thresholds, coupon stacking limits, and more.
complexity: basic
influence: Exploits platform marketing activity benefits, causing financial losses to the platform.
keywords: Coupon Restriction Bypass
keywords: coupon abuse
keywords: promo code abuse
keywords: coupon eligibility bypass
keywords: voucher restriction bypass
keywords: coupon stacking bypass
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
citation: OWASP Automated Threat: OAT002 Token Cracking
updated: 2026-06-13
version: 1
related cases: Shanghai Crackdown on Consumer Voucher Fraud Leads to 18 Arrests
related cases: Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
related cases: Shanghai Police Uncover Restaurant Scheme Using Remote IP Spoofing to Fraudulently Obtain Consumer Vouchers and Subsidies
related cases: POS Terminal Voucher Cash-Out Scheme Involving 6.55 Million Yuan Leads to 102 Arrests

Fake Reviews
type: Risk
break id: R0056
stix type: x-break-risk
definition: A seller purchases fake positive reviews to boost product reputation or search ranking weight.
description: Sellers collude with buyers through low-price orders, empty package shipments, or virtual deliveries to generate fake transactions and bulk positive reviews, boosting store credibility or product rankings.
complexity: basic
influence: Undermines platform fairness and distorts ranking algorithms.
keywords: Fake Reviews
keywords: review fraud
keywords: shill reviews
keywords: paid reviews
keywords: review manipulation
keywords: astroturfing
mitigated by: Risk Control Strategy
mitigated by: Device Fingerprinting
mitigated by: Malicious Content Detection
mitigated by: Legal Action
mitigated by: Account Ban
citation: Ji'an Dismantles Order Brushing and Fake Review Black Industry Chain
updated: 2026-06-13
version: 1
related cases: Jiangsu Special Rectification on Fake Reviews and Click Farming Announced
related cases: Eight Individuals Convicted of False Advertising for Organizing Fake Reviews and Sales
related cases: Fuzhou Click Farming Case: Four Convicted of False Advertising
related cases: Luoding Brushing and Click-Farming Case: Organizing Fake Transactions Convicted as Illegal Business Operations
related cases: Lianyungang Click Farming Case: Two Convicted of False Advertising
related cases: Nanjing Medical Aesthetics Clinic Fined for Fake Reviews and Transaction Fraud
related cases: Sichuan's First Public Interest Litigation Case on Fake Online Reviews

Category / Brand Miscategorization
type: Risk
break id: R0057
stix type: x-break-risk
definition: A seller deliberately lists products under incorrect categories or brands to gain more exposure and attract buyers.
description: This behavior may involve false advertising, misleading consumers, and disrupting market order, violating platform rules and business ethics. Miscategorized products may mislead consumers during search and browsing, showing them products that do not match their actual needs. It can cause category confusion, making product displays and search results on the platform disorganized and unclear. By deliberately placing products in inappropriate categories, sellers may attempt to gain an unfair competitive advantage and make their products more prominent in search results.
complexity: basic
influence: The platform may face criticism from consumers and other merchants due to miscategorized products, damaging the platform's reputation and credibility.
keywords: Category / Brand Miscategorization
keywords: category spoofing
keywords: brand spoofing
keywords: misclassified listing
keywords: wrong category listing
keywords: brand mislabeling
mitigated by: Credit Level Restriction
mitigated by: Automated Malicious Text Detection
mitigated by: Risk Control Strategy
mitigated by: User Profiling
mitigated by: Complaint and Reporting Channel
mitigated by: Store Penalty
citation: Review of 40 Consumer Scandals from 315 Hot Search: Seven Industry Scandals Exposed
updated: 2026-06-11
version: 1
related cases: Consequences of Incorrect Product Category Assignment for JD.com Merchants
related cases: Douyin Store Dropshipping Guide: Key Rules for Category Mismatch Violations
related cases: Douyin Store Miscategorization Leads to Tag Confusion and Low Ratings
related cases: Chengdu Internet Court Upheld Platform Penalty Against Merchant Misclassifying Product Category
related cases: High-Frequency Violation for New Sellers: Category Misplacement

Price Fraud
type: Risk
break id: R0058
stix type: x-break-risk
definition: An operator uses false or misleading pricing forms or price tactics to deceive or induce consumers or other operators into transactions.
description: The following pricing behaviors or price tactics are recognized as price fraud: 1. False pricing. 2. Dual pricing. 3. Deceptive pricing. 4. Vague or exaggerated pricing. 5. False discounts. 6. Failure to mark prices on clearance items. 7. Failure to truthfully disclose gift conditions. 8. Hidden price conditions. 9. Fabricated original prices. 10. Failure to honor price commitments. 11. Fabricated comparison prices. 12. Price-quality mismatch. 13. False claims of 'government-set prices'.
complexity: basic
influence: Creates significant compliance risks for the platform and increases the volume of customer complaints.
keywords: Price Fraud
keywords: deceptive pricing
keywords: bait pricing
keywords: false discounts
keywords: dual pricing
keywords: price deception
mitigated by: Contractual Clause Restrictions
mitigated by: Credit Level Restriction
mitigated by: Security Deposit Mechanism
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Store Penalty
mitigated by: Legal Action
citation: CCTV Cracks Down on Medical Aesthetics Black Market in 2025: Will Channel Chaos End in 2026?
updated: 2026-06-11
version: 1
related cases: Shangluo Investigates Six Hotels for Suspected Pricing Violations
related cases: Mengyu Aerospace Science Education Base (Hainan Wenchang) Co., Ltd. Price Fraud Case
related cases: Yan'an Yonghui Supermarket Xuanyuan Avenue Branch Price Fraud Case
related cases: Beijing Ximei Medical Aesthetics Clinic Price Fraud Case
related cases: Jinjiang Hotel Fined for Fabricated “Strikethrough Price” Fraud
related cases: Guangdong Shantou Hotel Investigated for Listing Prices Far Above Actual Transaction Prices
related cases: Nanjing Hotel Price Fraud Case

Trade Secret Leakage
type: Risk
break id: R0059
stix type: x-break-risk
definition: An employee discloses a company's trade secrets or sensitive information to third parties without authorization, or uses such information for personal or others' gain.
description: Scenarios include but are not limited to: departing employees taking sensitive information for competitive use, competitors stealing business or research results, internal employees leaking secrets out of dissatisfaction or greed, external attackers obtaining credentials through social engineering or cyberattacks to steal information, and employees inadvertently leaking sensitive data when using unauthorized cloud services or storage devices.
complexity: basic
influence: May cause serious financial losses, reputational damage, and legal liability for the company.
keywords: Trade Secret Leakage
keywords: confidential information leak
keywords: business secret leak
keywords: IP theft
keywords: proprietary information disclosure
keywords: insider leak
mitigated by: Data Loss Prevention
mitigated by: Security Awareness Training
mitigated by: Digital Watermark/Text Watermark
mitigated by: Internal Review Mechanism
mitigated by: Employee Penalty
mitigated by: Legal Action
mitigated by: Video Surveillance
mitigated by: Access Control System
citation: Anti-Unfair Competition Law of the PRC - National Laws and Regulations Database
updated: 2026-06-11
version: 1
related cases: First Case: Streamer Jailed for Leaking Honor of Kings Skins for Profit
related cases: Apple Sues Former iOS Engineer Aude Over Leaks of Unreleased Products and Sensitive Information
related cases: State-Owned Enterprise Employee Coerced into Espionage Abroad, Leaking Classified Information
related cases: Lao Gan Ma Trade Secret Theft Case
related cases: Xi'an Police Crack Major Trade Secret Infringement Case
related cases: C0764

Money Laundering Risk
type: Risk
break id: R0060
stix type: x-break-risk
definition: Using legitimate trading platforms to conduct illegal transactions in order to transfer money.
description: Many gambling websites establish storefronts on legitimate trading platforms and use virtual goods delivery or empty package shipments to process deposits for gamblers. Pornographic scam websites redirect visitors attempting to purchase premium services to legitimate trading platforms to order virtual goods such as phone cards, fuel cards, or VIP vouchers, but never provide the premium services, causing a sharp increase in customer complaints against the legitimate platform.
complexity: advanced
influence: Creates significant compliance risks for the platform and increases the volume of customer complaints.
keywords: Money Laundering Risk
keywords: transaction laundering
keywords: trade-based money laundering
keywords: TBML
keywords: merchant laundering
keywords: washing illicit funds
mitigated by: API Signature Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Access Control
citation: Further Crackdown on Financial Black-Grey Market: Industry Faces Comprehensive Rectification
updated: 2026-06-11
version: 1
related cases: Luohu's First Self-Money Laundering Case: 8 Million Yuan Fraudulently Obtained and Transferred Multiple Times, Leading to Conviction
related cases: Shiyan, Hubei Dismantles a 'Running Points Money Laundering' Gang Involving Over 20 Million Yuan
related cases: Supreme People's Court Typical Case: Wang and Others Used Virtual Currency to Transfer Telecom Fraud Proceeds
related cases: Jincheng Arrests 21 in 380 Million Yuan USDT Money Laundering Case
related cases: Large-Scale Money Laundering Gang Conducted Mobile Laundering While Driving, Linked to Over 2,000 Fraud Cases Across 25 Provinces and Cities
related cases: Supreme People's Court Typical Case: Zhu Provided Bank Cards for Paofen Money Laundering and Received Administrative-Criminal Linked Treatment

Cryptocurrency Money Laundering Risk
type: Risk
break id: R0060-001
stix type: x-break-risk
definition: The risk of using the anonymity and decentralized nature of cryptocurrencies to conduct money laundering through coin mixing, cross-chain transfers, and other means.
description: Cryptocurrency money laundering risk refers to criminals using Bitcoin, Ethereum, and other cryptocurrencies to launder funds. Main methods include: (1) Coin mixing services: using mixers like Tornado Cash to obscure fund flows and break transaction traceability. (2) Cross-chain bridge transfers: using cross-chain bridges to move funds between different blockchains to increase tracking difficulty. (3) Decentralized exchanges (DEX): using DEXs for KYC-free token swaps to evade anti-money laundering scrutiny from centralized exchanges. (4) Privacy coins: using Monero, Zcash, and other privacy coins to further conceal transaction information. (5) NFT money laundering: using fake NFT transactions to transfer funds. (6) OTC trading: converting cryptocurrency to fiat currency through over-the-counter trading. This risk poses serious threats to financial platforms, payment platforms, and e-commerce platforms, especially in scenarios involving virtual goods transactions.
complexity: advanced
influence: Platforms face anti-money laundering compliance risks, regulatory penalties, and reputational losses, and may be exploited as money laundering channels by criminals.
keywords: Cryptocurrency Money Laundering Risk
keywords: crypto AML
keywords: crypto laundering
keywords: mixers
keywords: tumblers
keywords: chain hopping
keywords: DeFi laundering
keywords: privacy coins
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: Risk Control Strategy
mitigated by: Legal Action
mitigated by: Compliance Governance
citation: AML Issues in Cryptocurrency and Blockchain Technology
citation: Trends in Cryptocurrency Anti-Money Laundering Regulation
updated: 2026-06-11
version: 1
related cases: C1134
related cases: C1135
related cases: C1136
related cases: C1137
related cases: C1138
related cases: C1139

Recycled Phone Number Takeover
type: Risk
break id: R0061
stix type: x-break-risk
definition: A new phone number holder gains access to the previous holder's account through password recovery or SMS verification code login mechanisms.
description: A typical malicious attacker can collude with insiders at telecom operators to obtain expired phone numbers in bulk, enabling large-scale account takeovers. Major domestic telecom operators now provide phone number verification APIs that can determine whether a number has been reassigned or expired, allowing platforms to check phone number status accordingly.
complexity: basic
influence: Leads to platform user accounts being impersonated.
keywords: Recycled Phone Number Takeover
keywords: reassigned number takeover
keywords: phone number recycling attack
keywords: SMS login takeover
keywords: number reassignment hijack
keywords: ATO via recycled number
mitigated by: Friend-Assisted Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Phone Number Intelligence
mitigated by: Data Profiling
citation: Cyber Black-Grey Market Approaches 100 Billion Yuan: Personal Information Leakage Is the Root Cause
updated: 2026-06-11
version: 1
related cases: Beijing Resident's New Mobile Number Logs Directly into Stranger's Cloud Drive Account
related cases: User Accidentally Logs into Late Singer Coco Lee's NetEase Cloud Music Account via Recycled Phone Number
related cases: Anhui Police Warn: Canceling a Mobile Number Is Like Selling Yourself, Sparking Debate
related cases: User Buys Recycled Phone Number, Receives Debt Collection Messages and Calls for a Year
related cases: Beijing Youth Daily Tests 21 Apps for Account Re-binding Difficulties, Exposing Gaps in Secondary Number User Rights

Illegal Cash-Out
type: Risk
break id: R0062
stix type: x-break-risk
definition: Converting funds into a more convenient or valuable form through fraudulent transactions, using the extracted funds for illegal or prohibited purposes.
description: Refers to converting one form of funds into another more usable or valuable form. This typically involves converting non-cash assets such as credit card limits, points, coupons, or virtual currencies into cash. For example, some people may use a credit card to purchase returnable goods and then return them for cash. Others may sell virtual currencies on trading platforms to convert them into cash.
complexity: intermediate
influence: Causes financial losses and compliance risks for the platform.
keywords: Illegal Cash-Out
keywords: fraudulent cash-out
keywords: cash-out fraud
keywords: illicit fund extraction
keywords: balance laundering
keywords: arbitrage cashout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Tighter Credit Card Fund Controls: Further Crackdown on Illegal Cash-Out
updated: 2026-06-13
version: 1
related cases: Nearly 10 Billion Yuan Involved: China's First Illegal Cash-Out Case Using Merchant QR Codes Cracked, 21 Arrested
related cases: Man Sentenced for Processing Over 9.25 Million Yuan via Fake Installment Payment Transactions
related cases: Supreme People's Procuratorate Discloses Ningbo Consumer Voucher Subsidy Fraud Administrative Supervision Case
related cases: Shanghai Police Crack Consumer Voucher Fraud Cases Involving Fake Transactions
related cases: Amount Involved Exceeds 6 Billion Yuan! Chongqing Police Crack Credit Card Cash-Out Case Using Repayment App
related cases: POS Machine Cash-Out and Credit Card Repayment Scheme Leads to Eight-Year Prison Sentence
related cases: Woman Racks Up Over 400,000 Yuan in Debt via Phone Rentals; Police Crack First 'Rent-to-Loan' Illegal Business Case
related cases: Criminal Gang Sentenced for Cashing Out Over 200,000 Yuan via Digital RMB Accounts in Four Days

Credit Card / Loan Cash-Out
type: Risk
break id: R0062-001
stix type: x-break-risk
definition: Exploiting platform mechanisms to cash out credit card limits or shopping loans.
description: Exploiting platform business process vulnerabilities to withdraw shopping loans to a bank card, or colluding between buyers and sellers to fake shipments and extract shopping loan funds.
complexity: intermediate
influence: Causes financial losses and compliance risks for the platform.
keywords: Credit Card / Loan Cash-Out
keywords: credit limit cash-out
keywords: shopping loan cash-out
keywords: loan arbitrage
keywords: synthetic purchase cash-out
keywords: fake merchant cash-out
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Stronger Supervision on Credit Card Fund Use and Cash-Out Violations
updated: 2026-06-13
version: 1
related cases: Credit Card Cash-Out Loan to Help in an Emergency Turns IOU into 'Waste Paper'
related cases: Beijing No. 2 Intermediate Court Reports on Loan Diversion Cases Involving Financial Institutions
related cases: Chongqing Police Crack Credit Card Payoff App Cash-Out Scheme
related cases: Why Loaning Funds Obtained Through Credit Card Cash Advances Is Not a Private Lending Arrangement
related cases: Man in His 20s Sentenced for 4.7 Million Yuan Alipay Huabei Cash-Out Scheme
related cases: Uncovering the Black Market Chain Behind Huabei Cash-Outs
related cases: Multiple Banks Prohibit Credit Card Cash-Out for Gold Speculation

Illegal Points Cash-Out
type: Risk
break id: R0062-002
stix type: x-break-risk
definition: Obtaining points through illegal means or converting points into cash in violation of terms of service.
description: Illegal points cash-out may include: a) Fabricated transactions: creating fake transactions to earn points, such as using one's own credit card at one's own store, then canceling the transactions while retaining the points. b) Exploiting system vulnerabilities: using loopholes to obtain extra points without actual spending. c) Buying and selling points: purchasing others' points and reselling them at a higher price, or selling goods redeemed with points at full market price.
complexity: intermediate
influence: Causes financial losses and compliance risks for the platform.
keywords: Illegal Points Cash-Out
keywords: points cashout
keywords: loyalty points laundering
keywords: reward points arbitrage
keywords: points monetization abuse
keywords: points resale fraud
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
citation: Case Study: Operating a Money Laundering Platform for Cyber Black-Grey Market Merchants
updated: 2026-06-13
version: 1
related cases: Former Employee Sentenced to 16 Months for Stealing 3.7 Million Loyalty Points
related cases: Scalpers Emerge: Large Certificates of Deposit and Credit Card Points Become Resale Business
related cases: Nearly 10 Billion Yuan Involved: China's First Illegal Cash-Out Case Using Merchant QR Codes Cracked, 21 Arrested
related cases: Cashier Steals Mall Loyalty Points Worth Over 100,000 Yuan, Sentenced to Three Years
related cases: Two Individuals Forged 500 Receipts, Used Photo Editing Software to Rack Up Millions of Points for Profit, Shanghai Police: Arrested
related cases: Coupon scalpers cash out government vouchers for over 180,000 yuan, court rules it constitutes fraud
related cases: China's First Illegal Cash-Out Case Using Merchant QR Codes

Duplicate Product Listings
type: Risk
break id: R0063
stix type: x-break-risk
definition: A seller excessively lists the same or similar products in their store, resulting in duplicate product listings and redundant inventory.
description: Duplicate listings generally include: products with highly similar titles, images, key attributes, or descriptions. Listing the same product separately by different colors, sizes, bundles, or specifications is generally considered duplicate listing.
complexity: basic
influence: Degrades the shopping experience and may cause transaction loss; occupies platform search and recommendation resources, damaging the platform's reputation.
keywords: Duplicate Product Listings
keywords: duplicate listings
keywords: listing spam
keywords: duplicate SKU listings
keywords: repeat listings
keywords: catalog spam
mitigated by: Risk Control Strategy
mitigated by: Store Penalty
mitigated by: Contractual Clause Restrictions
citation: What Is Duplicate Product Listing?
updated: 2026-06-11
version: 1
related cases: AliExpress Duplicate Listing Cases and Penalty Rules
related cases: AliExpress Duplicate Listing Determination Standards
related cases: Tmall Cracks Down on Duplicate Product Listings
related cases: Temu Cracks Down on Duplicate Listings
related cases: Taobao Duplicate Listings Caused Store Restriction on Publishing Products
related cases: Penalties for Duplicate Listings on Taobao
related cases: Consequences and Resolution of Duplicate Listings on Taobao
related cases: Tmall Tightens Rules on Duplicate Listings with New Fines
related cases: Strictest Cross-Border E-Commerce Rule: Duplicate Listings to Lose All Exposure

Order-Splitting Arbitrage
type: Risk
break id: R0064
stix type: x-break-risk
definition: Exploiting shipping thresholds, price differences, or bundled gift items by placing abnormal combined orders and then canceling part of the order to extract benefits.
description: Many trading platforms offer free shipping above a certain amount, tiered discounts, gifts, or rebates. Attackers first build up an order to meet the benefit threshold, then return some or all of the items to extract the benefit.
complexity: basic
influence: Extracts platform or merchant discounts and rebates.
keywords: Order-Splitting Arbitrage
keywords: split order abuse
keywords: partial cancellation arbitrage
keywords: free shipping abuse
keywords: gift threshold abuse
keywords: cart splitting exploit
mitigated by: Threat Intelligence
mitigated by: Risk Control Strategy
mitigated by: Device Fingerprinting
citation: Black Market Big Data: 2025 Global E-Commerce Fraud Risk Research Report
citation: The Paper: E-Commerce Sellers Trapped by Order Padding
updated: 2026-06-11
version: 1
related cases: Procurement Splitting to Circumvent Public Bidding
related cases: Singles' Day Cart-Stuffing Arbitrage Drives High Return Rates for Brands
related cases: Insurance Self-Insurance Policy Arbitrage Case
related cases: Malicious Ordering to Coerce Merchants into Paying Settlement Fees
related cases: Malicious Refund-Only Abuse Disrupts Online Store Operations and Leads to Sentence
related cases: C0643

Employee Error Risk
type: Risk
break id: R0065
stix type: x-break-risk
definition: Potential security risks arising from employee negligence, improper operations, or lack of security awareness when handling information, using technical tools, or performing tasks, which may lead to accidental disclosure of sensitive information.
description: Common risk scenarios caused by employee negligence or improper operations include: password leakage (employees saving passwords in insecure locations, using weak passwords, or sharing passwords, leading to account compromise); malware infection (clicking malicious links, downloading suspicious attachments, or visiting unsafe websites); data loss from misoperations (accidentally deleting, modifying, or mishandling sensitive data); unauthorized data access (employees inadvertently accessing sensitive information outside their work scope); and device loss or theft (lost or stolen mobile devices such as laptops or phones leading to sensitive information exposure).
complexity: basic
influence: These risks may include data breaches, system failures, network intrusions, and other security vulnerabilities, causing potential financial losses and reputational damage to the organization.
keywords: Employee Error Risk
keywords: human error risk
keywords: employee negligence
keywords: accidental data exposure
keywords: operational mistake
keywords: misconfiguration by staff
mitigated by: Multi-Factor Authentication
mitigated by: Additional Identity Authorization
mitigated by: Identity Security Audit
mitigated by: Employee Penalty
mitigated by: Access Control
mitigated by: Data Loss Prevention
mitigated by: Database Auditing
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Compliance Governance
mitigated by: Adding Approval Processes
mitigated by: Anomalous Access Behavior Detection
mitigated by: Network Segmentation Technology
citation: Insider Threat Mitigation Guide - CISA
updated: 2026-06-13
version: 1
related cases: C0644
related cases: C0645
related cases: C0646
related cases: C0647

In-Platform Message Harassment
type: Risk
break id: R0066
stix type: x-break-risk
definition: Using the platform's messaging mechanism to send harassing messages to others.
description: Unlike text content risks, message harassment is carefully crafted to evade keyword blacklists and may not trigger the platform's keyword alerts. Message harassment is a widespread risk. Some platforms allow users to configure which groups of people can send them messages, which is an effective defensive strategy.
complexity: basic
influence: Causes significant disruption to platform customer service or merchants; in severe cases may lead to user churn or physical harm.
keywords: In-Platform Message Harassment
keywords: in-app message harassment
keywords: DM harassment
keywords: private message abuse
keywords: message spam abuse
keywords: offensive direct messages
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Malicious Content Detection
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Identity Security Audit
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
citation: Protecting Personal Information: Internet Platforms Pilot 'Privacy Numbers' in Advertising
updated: 2026-06-11
version: 1
related cases: C0648
related cases: C0649
related cases: C0650
related cases: C0651
related cases: C0652

File or Document Theft
type: Risk
break id: R0067
stix type: x-break-risk
definition: The potential threat of unauthorized individuals or organizations obtaining, copying, distributing, or using confidential files or documents, which may include business plans, customer data, contracts, financial reports, intellectual property, and other sensitive information.
description: Possible file or document theft scenarios include: cyberattacks (hackers obtaining sensitive files through phishing, malware, or ransomware); insider leaks (employees, partners, or vendors abusing access privileges to steal confidential files for personal or competitor benefit); physical intrusion (intruders gaining access to paper or electronic sensitive files by breaking into offices or through lost/stolen devices); and social engineering (attackers gaining access to sensitive files through deception, impersonation, or trust manipulation).
complexity: basic
influence: Harms manifest across multiple dimensions: intellectual property loss threatening the company's innovation capacity; competitors gaining business strategies and plans damaging competitive position; files containing customer information causing trust issues and legal liability; and violations of data protection regulations leading to compliance issues, lawsuits, and fines.
keywords: File or Document Theft
keywords: document exfiltration
keywords: file exfiltration
keywords: confidential document leak
keywords: sensitive file theft
keywords: insider document theft
mitigated by: Automated Malicious Document Detection
mitigated by: Access Control System
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Digital Certificate
mitigated by: Electronic File Seal
mitigated by: USB Key Digital Certificate
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Digital Watermark/Text Watermark
mitigated by: Text Watermark
mitigated by: Data Storage Encryption
mitigated by: Database Auditing
mitigated by: Data Erasure
mitigated by: Security Awareness Training
mitigated by: Compliance Governance
mitigated by: Adding Approval Processes
mitigated by: Anomalous Access Behavior Detection
mitigated by: Video Surveillance
citation: Data from Information Repositories (T1213) - MITRE ATT&CK
updated: 2026-06-11
version: 1
related cases: C0653
related cases: C0654
related cases: C0655
related cases: C0656
related cases: C0657
related cases: C0764

After-Sales Rights Abuse
type: Risk
break id: R0068
stix type: x-break-risk
definition: Malicious exploitation and excessive use of rights granted by the platform.
description: For example, national regulations require online shopping platforms to offer 7-day no-questions-asked returns. Buyers exploit this mechanism to use products or services for free and then initiate a return within 7 days.
complexity: basic
influence: Causes financial losses to the platform or sellers.
keywords: After-Sales Rights Abuse
keywords: after-sales abuse
keywords: consumer rights abuse
keywords: return policy exploitation
keywords: warranty abuse
keywords: 7-day return abuse
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
citation: Generali China Life Beijing 315 Risk Alert: Resist Black-Grey Market, Protect Information Security
updated: 2026-06-11
version: 1
related cases: Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
related cases: Exploiting '7-Day No-Reason Return' Policy: Swapping Phones with Dummy Units Leads to Detention
related cases: Guangzhou Liwan Court Tried a 'Buy Genuine, Return Fake' Fraud Case Involving More Than 890,000 Yuan
related cases: C0670
related cases: C0671
related cases: C0672

Malicious Complaints
type: Risk
break id: R0068-001
stix type: x-break-risk
definition: Filing malicious complaints against a trading platform or against merchants on a trading platform.
description: With the goal of gaining improper benefits or forcing the target to be penalized, attackers file malicious complaints against a trading platform through regulatory bodies, or against merchants through the trading platform.
complexity: basic
influence: Causes financial or reputational losses to the platform or sellers.
keywords: Malicious Complaints
keywords: bad-faith complaints
keywords: vexatious complaints
keywords: complaint abuse
keywords: reporting abuse
keywords: malicious reporting
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
citation: Black-Grey Market Preying on Consumer Rights Advocates
updated: 2026-06-11
version: 1
related cases: C0658
related cases: C0659
related cases: C0660
related cases: C0661

Malicious Claims
type: Risk
break id: R0068-002
stix type: x-break-risk
definition: Bulk-purchasing expired, unlisted, or counterfeit goods and filing tenfold compensation claims.
description: Using bulk searches, data scraping, and similar methods to find expired, counterfeit, substandard, or non-compliant products (e.g., containing advertising law prohibited terms). After placing orders, the buyer complains about the seller's violations and demands large sums of money in exchange for withdrawing the complaint.
complexity: intermediate
influence: Causes financial losses to the platform or sellers.
keywords: Malicious Claims
keywords: compensation claim abuse
keywords: bad-faith claims
keywords: tenfold compensation claims
keywords: counterfeit claim arbitrage
keywords: professional claimants
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Real-Name Identity Verification
mitigated by: Customer Service Follow-Up Confirmation
mitigated by: User Profiling
mitigated by: Account Penalty
citation: Meituan Reports Jan-Aug Black-Grey Market Crackdown Results: Over 50 Million Yuan Involved
updated: 2026-06-11
version: 1
related cases: Man Sentenced to 8 Months for 712 Malicious Food Delivery Refund Scams
related cases: C0662
related cases: C0663
related cases: C0664
related cases: C0665
related cases: C0666
related cases: C0667
related cases: C0668
related cases: C0669

Upload Abuse
type: Risk
break id: R0069
stix type: x-break-risk
definition: Using a business system's normal file upload functionality to upload unexpected files.
description: Business systems with user-generated content features such as image or file uploads can be exploited by attackers who upload files through the upload interface that are not intended for the platform's normal use, but rather for illegal storage, distribution of illegal content, and other purposes.
complexity: basic
influence: Consumes platform storage and network resources, and may create compliance risks.
keywords: Upload Abuse
keywords: file upload abuse
keywords: malicious upload
keywords: unexpected file upload
keywords: storage abuse
keywords: illegal content upload
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Authentication (Login)
mitigated by: Restrict Off-Site Access
citation: Jiang Ning Appointed as Xiaoma Consumer Finance GM, Stepping Up Human-AI Collaborative Digital Strategy
updated: 2026-06-11
version: 1
related cases: C0679
related cases: C0680
related cases: C0681
related cases: C0682
related cases: C0683

Image Hosting Abuse
type: Risk
break id: R0069-001
stix type: x-break-risk
definition: Users upload images or files through the platform's normal image upload feature that are not intended for the site's normal functions, and abuse the resources for external access.
description: Two common scenarios: first, users upload large volumes of images to use the platform's image upload feature as personal cloud storage; second, users upload video files disguised as images. Users slice video files into segments, append each segment to an image file to disguise them as images, upload the sliced files via the image upload interface, and use an m3u file to aggregate the image URLs for video playback. This is common in features that allow immediate image upload and return a URL, such as ID photo upload before identity verification or avatar upload after account creation. If the page is not finally submitted, it typically bypasses backend review, creating a blind spot that can be exploited to distribute pirated or pornographic videos.
complexity: basic
influence: Disrupts normal system operations, consumes large amounts of network bandwidth and storage space, and creates compliance risks.
keywords: Image Hosting Abuse
keywords: free image hosting abuse
keywords: external image hosting
keywords: hotlink image hosting
keywords: personal cloud storage abuse
keywords: CDN abuse
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Authentication (Login)
mitigated by: Restrict Off-Site Access
citation: Remote Image Hosting Service Gradually Shutting Down
updated: 2026-06-11
version: 1
related cases: C0673
related cases: C0674
related cases: C0675

Cloud Storage Abuse
type: Risk
break id: R0069-002
stix type: x-break-risk
definition: Similar to image hosting abuse (R0069-001), but the difference is that cloud storage is a feature of the business's cloud service rather than an ancillary resource for user-generated content.
description: Using the cloud storage feature provided by the business to upload unexpected or illegal content. Cloud storage may be part of a cloud computing service or a cloud drive, and is typically subject to weaker content moderation than user-generated content, making it potentially exploitable by bad actors to distribute pirated or pornographic videos.
complexity: basic
influence: Disrupts normal system operations, consumes large amounts of network bandwidth and storage space, and creates compliance risks.
keywords: Cloud Storage Abuse
keywords: cloud drive abuse
keywords: object storage abuse
keywords: illegal file hosting
keywords: storage bucket abuse
keywords: pirated content hosting
mitigated by: Human Verification Technology
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Authentication (Login)
mitigated by: Restrict Off-Site Access
citation: Alibaba OSS Storage Bucket Breached, Malicious Shell Scripts Distributed via Steganography
updated: 2026-06-11
version: 1
related cases: C0676
related cases: C0677
related cases: C0678

Automated Reselling
type: Risk
break id: R0070
stix type: x-break-risk
definition: Using automated means to automatically purchase and resell goods through a platform's normal transaction process.
description: Automated reselling typically serves three purposes: first, buying low and selling high to profit from price differences; second, listing products without actual stock and fulfilling orders through other stocked stores; third, using automation to bulk-create store clusters for mass product listing.
complexity: intermediate
influence: Buy-low-sell-high behavior, once discovered by users, creates the impression of inflated prices on the platform, causing reputational damage and user churn; dropshipping stores often negate competitive advantages or lead to unfair competition; store clusters occupy large amounts of search and recommendation resources, leading to unfair competition.
keywords: Automated Reselling
keywords: scalper bots
keywords: reseller bots
keywords: automated purchasing
keywords: bot resale
keywords: auto-buy reselling
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Single-Device Login
mitigated by: Access Source Tracking
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
citation: OAT-005 Scalping - OWASP
updated: 2026-06-10
version: 1
related cases: C0700
related cases: C0701
related cases: C0702
related cases: C0703
related cases: C0704
related cases: C0705

Buy Low, Sell High
type: Risk
break id: R0070-001
stix type: x-break-risk
definition: Selling products from other platforms or stores at a higher price on the current platform or store to profit from the price difference.
description: A typical buy-low-sell-high approach involves significantly marking up a product's price and then using search bidding ranking mechanisms to place the product at the top of results for greater exposure.
complexity: intermediate
influence: This behavior creates the impression of inflated prices on the platform for users, leading to user churn.
keywords: Buy Low, Sell High
keywords: retail arbitrage
keywords: price arbitrage
keywords: cross-platform arbitrage
keywords: markup reselling
keywords: product flipping
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Single-Device Login
mitigated by: Access Source Tracking
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
citation: OAT-005 Scalping - OWASP
updated: 2026-06-10
version: 1
related cases: C0684
related cases: C0685
related cases: C0686
related cases: C0687
related cases: C0688
related cases: C0689

Dropshipping Store
type: Risk
break id: R0070-002
stix type: x-break-risk
definition: Listing products from other platforms or stores on the current platform or store, and placing orders through the original stocked store when a user places an order.
description: Buy-low-sell-high (R0070-001) is generally also a form of dropshipping, but buy-low-sell-high is more focused on gaining exposure, while dropshipping is more focused on gaining order volume. For example, if a seller only has a store on Platform A and not on Platform B, Platform A gains a competitive advantage. But if the seller lists products on Platform B and fulfills orders through Platform A when users order on B, this competitive advantage is negated — especially if Platform B subsidizes the originally unstocked products, creating the illusion that Platform B is always cheaper than Platform A.
complexity: intermediate
influence: Cross-platform dropshipping reduces the competitive advantage of the original platform and may lead to unfair competition, causing financial or reputational losses.
keywords: Dropshipping Store
keywords: dropshipping
keywords: no-inventory store
keywords: order forwarding store
keywords: middleman store
keywords: one-click fulfillment
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Single-Device Login
mitigated by: Access Source Tracking
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
citation: Drop shipping - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0690
related cases: C0691
related cases: C0692
related cases: C0693
related cases: C0694
related cases: C0695
related cases: C0696
related cases: C0697
related cases: C0699

Store Cluster
type: Risk
break id: R0070-003
stix type: x-break-risk
definition: May be a form of dropshipping store (R0070-002) or may have actual stock. Typically refers to bulk-creating stores to increase exposure.
description: By bulk-creating large numbers of stores to increase exposure and expand the display area of products or services, attracting more potential customers. This practice is typically aimed at increasing product or service visibility on the platform, improving exposure in search results, and gaining more traffic and sales opportunities.
complexity: intermediate
influence: Occupies display opportunities of other stores on the platform, and the mass listing of similar products makes it harder for users to discover differentiated products.
keywords: Store Cluster
keywords: store farming
keywords: multi-store operation
keywords: store matrix
keywords: store network
keywords: bulk-created stores
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: Data Profiling
mitigated by: Single-Device Login
mitigated by: Access Source Tracking
mitigated by: Access Control
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
citation: OAT-005 Scalping - OWASP
updated: 2026-06-10
version: 1
related cases: C0698

Generative AI Risk
type: Risk
break id: R0071
stix type: x-break-risk
definition: Risks and hazards introduced by AIGC (Artificial Intelligence Generated Content) generative AI.
description: AI-generated content risks fall into several categories: sensitive information being embedded in generated content causing data leakage; generated content containing illegal, non-compliant, or unethical material; and the risk of platform content quality degradation from bulk, cheap, and low-quality AI-generated content.
complexity: basic
influence: AI-generated content risks may create compliance risks for the platform and increase the volume of customer complaints.
keywords: Generative AI Risk
keywords: AIGC risk
keywords: genAI risk
keywords: LLM risk
keywords: AI content risk
keywords: model governance risk
mitigated by: Data Desensitization (Masking)
mitigated by: Sensitive Data Removal
mitigated by: Malicious Content Detection
mitigated by: Privacy Computing
mitigated by: AI Content Detection
mitigated by: LLM Security Protection
mitigated by: Shadow AI Detection and Governance
citation: Interim Measures for the Management of Generative Artificial Intelligence Services - Gov.cn
citation: Measures for the Labeling of AI-Generated Synthetic Content - Gov.cn
updated: 2026-06-13
version: 1
related cases: C0715
related cases: C0731
related cases: C0732

AIGC Privacy Leakage
type: Risk
break id: R0071-001
stix type: x-break-risk
definition: AIGC leaking sensitive information learned during large model training into generated content.
description: Sensitive information leakage may occur in several ways: (1) Training data leakage: if text data containing sensitive information was used to train the large language model, the model may generate similar sensitive information based on that data. (2) Model memorization: large language models may sometimes exhibit memorization, including previously input information in generated text. If a user provides sensitive information during a conversation, the model may include it in subsequent generations. (3) Context sensitivity: the model may base generated text on prior context, which may include sensitive information provided by the user, and may implicitly include related information in subsequent generations even if the user no longer explicitly mentions it.
complexity: intermediate
influence: AIGC sensitive information leakage may create compliance risks for the platform.
keywords: AIGC Privacy Leakage
keywords: training data leakage
keywords: model data leakage
keywords: memorization leak
keywords: PII leakage from model
keywords: sensitive output leakage
mitigated by: Data Desensitization (Masking)
mitigated by: Sensitive Data Removal
mitigated by: Privacy Computing
citation: Illegal Proxy Rights Defense Surges 42%: How Technology Can Break Through Financial Black-Grey Market Governance
updated: 2026-06-13
version: 1
related cases: C0706
related cases: C0707
related cases: C0708
related cases: C0709

AIGC Compliance Risk
type: Risk
break id: R0071-002
stix type: x-break-risk
definition: AI-generated content may contain illegal, non-compliant, or unethical material.
description: Large language model content compliance risks mainly include: misleading information, discriminatory content, privacy violations, malicious misuse, intellectual property issues, regulatory compliance issues, and lack of transparency. These risks may lead to the spread of false information, discriminatory speech, privacy violations, malicious misuse, and regulatory non-compliance.
complexity: basic
influence: AIGC compliance risks may create compliance risks for the platform and increase the volume of customer complaints.
keywords: AIGC Compliance Risk
keywords: AI compliance risk
keywords: unsafe model output
keywords: policy-violating AI content
keywords: illegal generated content
keywords: responsible AI risk
mitigated by: Malicious Content Detection
mitigated by: Sensitive Data Removal
mitigated by: Compliance Governance
mitigated by: Legal Action
mitigated by: AI Content Provenance
citation: Interim Measures for the Management of Generative Artificial Intelligence Services - Gov.cn
citation: Legal Compliance Risks and Prevention in the AIGC Wave
updated: 2026-06-13
version: 1
related cases: C0710
related cases: C0711
related cases: C0712
related cases: C0713
related cases: C0714
related cases: C0715
related cases: C0716

AI-Generated Low-Quality Content
type: Risk
break id: R0071-003
stix type: x-break-risk
definition: Bulk, cheap, and low-quality large language model generated content may introduce various risks of platform content quality degradation.
description: First, due to the lack of effective content filtering mechanisms, large volumes of spam, fake news, and low-quality reviews may emerge, degrading overall platform content quality. Second, generated content may involve privacy violations, malicious attacks, and inappropriate speech, exacerbating the spread of misinformation and social tension on social platforms. Additionally, large-scale use of language models to generate content may encourage bot-like behavior, making it difficult for real users to distinguish fake accounts and artificially generated content, damaging the platform's credibility and user experience.
complexity: intermediate
influence: Leads to degraded platform content quality and undermines the motivation of original and high-quality content creators.
keywords: AI-Generated Low-Quality Content
keywords: AI spam
keywords: content farm AI
keywords: low-effort AI content
keywords: synthetic content pollution
keywords: LLM spam
mitigated by: Contractual Clause Restrictions
mitigated by: Automated AI-Generated Content Detection
mitigated by: User Profiling
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
citation: Measures for the Labeling of AI-Generated Synthetic Content - Gov.cn
updated: 2026-06-13
version: 1
related cases: C0717
related cases: C0718
related cases: C0719
related cases: C0720

AI Hallucination Risk
type: Risk
break id: R0071-004
stix type: x-break-risk
definition: Large language models generating seemingly plausible but actually incorrect or fabricated information — known as 'hallucinations' — which may mislead user decisions.
description: AI hallucination refers to large language models generating content that is factually incorrect, logically inconsistent, or entirely fabricated, yet expressed with apparent confidence and plausibility. Key risk scenarios include: (1) Fabricated facts: the model invents non-existent events, people, data, or citations. (2) Incorrect professional advice: generating erroneous advice in medical, legal, financial, and other professional domains, potentially causing serious consequences. (3) False citations: generating seemingly real but non-existent academic papers, legal provisions, or news reports. (4) Logical reasoning errors: producing seemingly valid but actually incorrect reasoning chains in complex inference tasks.
complexity: intermediate
influence: Users are misled into making wrong decisions; incorrect advice in professional domains may cause serious consequences; platform credibility declines.
keywords: AI Hallucination Risk
keywords: LLM hallucination
keywords: fabricated AI output
keywords: AI confabulation
keywords: false AI answers
keywords: model hallucinations
mitigated by: LLM Security Protection
mitigated by: AI Content Detection
mitigated by: Malicious Content Detection
mitigated by: Complaint and Reporting Channel
citation: Survey on Hallucination Problems in Large Language Models
updated: 2026-06-13
version: 1
related cases: C0721
related cases: C0722
related cases: C0723
related cases: C0724

AI Model Poisoning Risk
type: Risk
break id: R0071-005
stix type: x-break-risk
definition: The risk that attackers contaminate training data or model parameters to cause the AI model to exhibit preset erroneous behaviors or backdoors.
description: AI model poisoning refers to attackers injecting malicious data or modifying model parameters during the training or fine-tuning phase, causing the model to produce attacker-intended erroneous outputs under specific trigger conditions. Main attack methods include: (1) Data poisoning: injecting carefully crafted malicious samples into training data to cause the model to learn incorrect patterns. (2) Backdoor attacks: planting a backdoor in the model so that when input contains a specific trigger, the model outputs attacker-controlled results. (3) Model tampering: modifying model weights during distribution to implant malicious behavior. (4) Federated learning poisoning: in federated learning scenarios, malicious participants submit poisoned model updates.
complexity: advanced
influence: AI system decisions are manipulated, security detection is bypassed, and model trustworthiness is lost.
keywords: AI Model Poisoning Risk
keywords: training data poisoning
keywords: model backdoor
keywords: poisoned model
keywords: malicious fine-tuning
keywords: data poisoning attack
mitigated by: LLM Security Protection
mitigated by: Supply Chain Security Audit
mitigated by: Internal Review Mechanism
mitigated by: Anti-Tampering Mechanism
citation: Survey on AI Model Security and Poisoning Attacks
updated: 2026-06-13
version: 1
related cases: C0725
related cases: C0726
related cases: C0727
related cases: C0728
related cases: C0729
related cases: C0730

AI-Generated Fake Reviews
type: Risk
break id: R0071-006
stix type: x-break-risk
definition: The risk of using AI technology (particularly large language models) to bulk-generate fake product reviews, service ratings, or content reviews, disrupting the platform's review system.
description: AI-generated fake reviews refers to attackers using large language models to bulk-generate seemingly authentic fake review content. Compared to traditional manual review fraud, AI-generated reviews have the following characteristics: (1) High content diversity: each review differs in wording, angle, and style, making it difficult to detect through simple text similarity checks. (2) Extremely low generation cost: LLMs can generate large volumes of high-quality reviews in a very short time at far lower cost than manual writing. (3) High targeting: can automatically generate targeted positive or negative reviews based on product features and competitor information. (4) Multilingual support: can easily generate reviews in multiple languages, supporting cross-border e-commerce review fraud. This risk seriously undermines the credibility of the platform's review system, misleads consumer decisions, and disrupts fair competition.
complexity: intermediate
influence: Platform review system credibility declines, consumers are misled, fair competition is disrupted, and platform compliance risks increase.
keywords: AI-Generated Fake Reviews
keywords: fake reviews
keywords: review spam
keywords: review fraud
keywords: opinion spam
keywords: rating manipulation
keywords: AI review spam
mitigated by: AI Content Detection
mitigated by: Malicious Content Detection
mitigated by: Automated AI-Generated Content Detection
mitigated by: Account Penalty
mitigated by: Data Profiling
mitigated by: User Profiling
mitigated by: Contractual Clause Restrictions
mitigated by: Complaint and Reporting Channel
citation: Research on Detection of AI-Generated Fake Reviews
updated: 2026-06-11
version: 1
related cases: Over 20 Million Fake Reviews Busted — 'Cash for Good Ratings' Scheme Ruled Illegal
related cases: C1127
related cases: C1128
related cases: C1129

AI Voice Cloning Fraud
type: Risk
break id: R0071-007
stix type: x-break-risk
definition: The risk of using AI voice cloning technology to forge others' voices for telephone fraud, bypassing voiceprint authentication, or creating fake audio evidence.
description: AI voice cloning fraud refers to attackers using deep learning speech synthesis technology to generate synthetic voices highly similar to a target person based on a small number of voice samples (even just a few seconds of recording). Key risk scenarios include: (1) Telephone fraud: impersonating the voice of friends, family, supervisors, or customer service staff to commit phone fraud and extort transfers or sensitive information. (2) Voiceprint authentication bypass: using cloned voices to bypass voiceprint authentication systems at banks and payment platforms. (3) Fake audio evidence: creating fake call recordings or voice messages for extortion or legal disputes. (4) Enhanced social engineering: combining AI voice cloning with deepfake video for more deceptive social engineering attacks. As zero-shot voice cloning technology matures, attackers can even extract sufficient samples from publicly available voice content on social media.
complexity: advanced
influence: Leads to significantly higher telephone fraud success rates, voiceprint authentication system failures, user financial losses, and trust crises.
keywords: AI Voice Cloning Fraud
keywords: voice cloning
keywords: voice spoofing
keywords: synthetic voice
keywords: voice deepfake
keywords: vishing
keywords: telephone scam
mitigated by: Deepfake Detection
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: SIM Card Security Verification
mitigated by: Multi-Factor Authentication
mitigated by: Customer Service Follow-Up Confirmation
citation: AI Voice Cloning Fraud Cases - FBI
citation: Survey on Voice Deepfake Detection Techniques
updated: 2026-06-11
version: 1
related cases: C1130
related cases: C1131
related cases: C1132
related cases: C1133

Digital Avatar Live Stream Fraud
type: Risk
break id: R0071-008
stix type: x-break-risk
definition: The risk of using AI digital avatar technology for fake live stream commerce, impersonating real streamers, or conducting other live stream fraud.
description: Digital avatar live stream fraud refers to fraudulent activities in live streaming using AI-generated virtual digital avatars. Key risk scenarios include: (1) Fake live stream commerce: using AI digital avatars to impersonate real streamers for 24-hour uninterrupted live stream selling of counterfeit goods or false advertising. (2) Celebrity impersonation: using deepfake technology to generate digital avatar likenesses of celebrities or influencers for live streams, impersonating them for product recommendations or endorsements. (3) Fake interaction: AI digital avatars combined with automated bullet comments and fake viewer data to create false live stream popularity and interaction atmosphere. (4) Undisclosed AI identity: using AI digital avatars for live streaming without clearly disclosing their AI identity to viewers, violating relevant regulations. (5) Emotional fraud: using AI digital avatars in social live streams to establish false emotional connections with users, inducing tips or consumption.
complexity: intermediate
influence: Consumers are misled and defrauded, platform content ecosystem is disrupted, brand reputation is damaged, and compliance risks arise.
keywords: Digital Avatar Live Stream Fraud
keywords: deepfake livestream
keywords: live commerce scam
keywords: virtual influencer fraud
keywords: avatar scam
keywords: livestream impersonation
keywords: AI avatar fraud
keywords: fake live shopping
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Malicious Content Detection
mitigated by: Manual Content Review
mitigated by: Account Penalty
mitigated by: Complaint and Reporting Channel
mitigated by: Contractual Clause Restrictions
citation: Guiding Opinions on Strengthening the Standardized Management of Online Live Streaming
citation: AI Digital Avatar Live Stream Compliance Guidelines
updated: 2026-06-11
version: 1
related cases: C1198
related cases: C1199
related cases: C1200
related cases: C1201
related cases: C1202
related cases: C1203
related cases: C1204

AI Deepfake Risk
type: Risk
break id: R0071-009
stix type: x-break-risk
definition: The risk of using AI deepfake technology to generate fake facial images, videos, or audio for malicious purposes such as identity impersonation, fraud, and public opinion manipulation.
description: AI deepfake risk refers to attackers using AI technologies such as GANs and diffusion models to generate highly realistic fake facial images, videos, or audio content for various fraudulent and attack activities. Key risk scenarios include: (1) Identity impersonation: using deepfake technology to forge others' facial features to bypass facial recognition authentication systems for account takeover and financial fraud. (2) Video call fraud: using AI face-swapping in real-time video calls to impersonate others for social engineering attacks. (3) Fabricated evidence: generating fake video or audio evidence for extortion, reputational damage, or legal disputes. (4) Public opinion manipulation: creating fake videos of public figures to spread misinformation. As deepfake technology rapidly advances and open-source tools proliferate, the attack barrier continues to lower, making this a major emerging threat in business security.
complexity: advanced
influence: Can lead to identity authentication systems being compromised, financial fraud losses, serious brand reputational damage, social trust crises, and legal compliance risks.
keywords: AI Deepfake Risk
keywords: deepfake
keywords: synthetic media
keywords: AI-generated media
keywords: face swap
keywords: voice cloning
keywords: synthetic audio/video
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Real-Name Identity Verification
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: Multi-Factor Authentication
mitigated by: Complaint and Reporting Channel
mitigated by: Real-Time Deepfake Detection
mitigated by: AI Content Provenance
citation: Deepfake Technology Governance White Paper - China Academy of Information and Communications Technology
citation: Deepfakes and the New Disinformation War
updated: 2026-06-11
version: 1
related cases: C1107
related cases: C1108
related cases: C1109
related cases: C1110
related cases: C1111
related cases: C1112
related cases: C1113

AI Face-Swap Fraud
type: Risk
break id: R0071-010
stix type: x-break-risk
definition: Using AI face-swapping technology to replace faces in real-time video or images to impersonate others and commit fraud.
description: AI face-swap fraud is the most common form of deepfake attack. Attackers use tools like DeepFaceLab to train face-swap models based on publicly available photos or videos of the target, then replace their own face with the target's in real-time video calls or recorded videos. Typical attack scenarios include: impersonating corporate executives in video conference fraud (CEO Fraud), impersonating friends or family in video calls to extort money, and forging faces to pass remote identity verification (such as bank account opening or loan approval). Since 2024, multiple large-scale fraud cases using AI face-swapping have been exposed, with single-incident losses reaching tens of millions of yuan.
complexity: advanced
influence: Directly leads to financial fraud losses, identity authentication system failures, and user trust crises.
keywords: AI Face-Swap Fraud
keywords: face swap
keywords: deepfake face swap
keywords: face replacement
keywords: identity spoofing
keywords: face morphing
mitigated by: Deepfake Detection
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: Complaint and Reporting Channel
mitigated by: Multi-Factor Authentication
citation: AI Face-Swap Fraud Case Analysis
updated: 2026-06-11
version: 1
related cases: C1098
related cases: C1099
related cases: C1100
related cases: C1101
related cases: C1102
related cases: C1103
related cases: C1104

AI Synthetic Video Fraud
type: Risk
break id: R0071-011
stix type: x-break-risk
definition: Using AI technology to synthesize fake video content for false advertising, public opinion manipulation, or fraud.
description: AI synthetic video fraud refers to using deepfake technology to generate complete fake video content, including fake news reports, product recommendations, and celebrity endorsements. Unlike AI face-swapping, synthetic videos may involve more complex techniques such as full-body synthesis and scene synthesis. Attackers can use synthetic videos for false advertising, forging celebrity endorsements to promote fraudulent products, and creating fake news to manipulate stock prices.
complexity: advanced
influence: Leads to the spread of misinformation, consumer deception, brand reputational damage, and market order disruption.
keywords: AI Synthetic Video Fraud
keywords: synthetic video
keywords: deepfake video
keywords: fake video
keywords: AI video forgery
keywords: video impersonation
keywords: synthetic media
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Malicious Content Detection
mitigated by: Manual Content Review
mitigated by: Account Penalty
mitigated by: Complaint and Reporting Channel
citation: Deepfake - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1105
related cases: C1106

Employee Corruption
type: Risk
break id: R0072
stix type: x-break-risk
definition: Employee corruption refers to employees using improper means to seek personal gain, abuse their authority, accept bribes, or engage in corrupt activities in the workplace.
description: This may include falsifying expense reports, soliciting kickbacks from suppliers, misusing company resources, bribery, or participating in other corrupt activities.
complexity: basic
influence: Employee corruption harms include damaging the company's reputation, undermining internal trust, reducing work efficiency, causing resource waste, increasing compliance risks, and ultimately potentially triggering legal liability and financial losses.
keywords: Employee Corruption
keywords: internal corruption
keywords: workplace bribery
keywords: kickback scheme
keywords: abuse of authority
keywords: employee bribery
mitigated by: Contractual Clause Restrictions
mitigated by: Identity Security Audit
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Employee Penalty
mitigated by: Legal Action
citation: Corporate fraud - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0740
related cases: C0741
related cases: C0742
related cases: C0743
related cases: C0744

Insider-Outsider Collusion
type: Risk
break id: R0072-001
stix type: x-break-risk
definition: Internal employees collude with external individuals or organizations to commit fraud, embezzlement, bribery, or other improper acts that violate the company's interests and regulations.
description: Behaviors or scenarios include employees colluding with suppliers to falsify expenses, corrupt transactions, and insider-outsider collusion for fraudulent activities.
complexity: basic
influence: May cause financial losses and reputational damage to the company, while increasing compliance risks and posing a serious threat to the company's sound operations.
keywords: Insider-Outsider Collusion
keywords: insider collusion
keywords: external collusion
keywords: inside job
keywords: employee-supplier collusion
keywords: insider fraud ring
mitigated by: Contractual Clause Restrictions
mitigated by: Identity Security Audit
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Employee Penalty
mitigated by: Legal Action
citation: Insider threat - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0733
related cases: C0734
related cases: C0735
related cases: C0736
related cases: C0737
related cases: C0738
related cases: C0739

Device Loss
type: Risk
break id: R0073
stix type: x-break-risk
definition: An employee's work device (such as a laptop, tablet, or phone) is lost or stolen in the workplace or elsewhere.
description: Device loss scenarios are varied, including on public transportation, at airports, hotels, coffee shops, at home, gyms, and other environments. This risk may occur due to employee negligence, haste, or theft, exposing the organization to risks of data leakage, security vulnerabilities, and business disruption.
complexity: basic
influence: May lead to potential information leakage, security vulnerabilities, and business risks.
keywords: Device Loss
keywords: lost laptop
keywords: stolen work phone
keywords: lost corporate device
keywords: device theft
keywords: endpoint loss
mitigated by: Identity Authentication (Login)
mitigated by: Digital Certificate
mitigated by: USB Key Digital Certificate
mitigated by: Data Loss Prevention
mitigated by: Data Storage Encryption
mitigated by: Data Erasure
mitigated by: Security Awareness Training
mitigated by: Forced Password Reset
mitigated by: Video Surveillance
mitigated by: Access Control System
citation: Data breach - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0745
related cases: C0746
related cases: C0747

Privacy Compliance Risk
type: Risk
break id: R0074
stix type: x-break-risk
definition: Privacy compliance risk refers to the risk that an organization fails to comply with relevant privacy regulations or policies when processing personal data, potentially violating individuals' privacy rights and triggering legal liability and negative consequences.
description: Possible privacy compliance risk scenarios include: unauthorized data collection (collecting personal data without explicit user consent); non-transparent data processing (failing to inform users of the purpose, methods, and use of data collection); data breaches (personal data leakage due to security vulnerabilities, internal errors, or external attacks); violation of data retention periods; failure to provide access and modification rights; lack of data security measures such as encryption and access controls; violation of cross-border data transfer regulations; and failure to fulfill data processing agreements.
complexity: basic
influence: May lead to lawsuits, fines, reputational damage, and loss of customer trust.
keywords: Privacy Compliance Risk
keywords: data privacy compliance
keywords: personal data compliance
keywords: privacy law risk
keywords: consent compliance
keywords: data protection compliance
mitigated by: Data Desensitization (Masking)
mitigated by: Complaint and Reporting Channel
mitigated by: Compliance Governance
mitigated by: App Compliance Governance
citation: Personal Information Protection Law of the PRC
citation: Measures for Compliance Auditing of Personal Information Protection
citation: Regulation on the Security and Management of Network Data
updated: 2026-06-11
version: 1
related cases: C0748
related cases: C0749
related cases: C0750
related cases: C0751

Critical Information Infrastructure (CII) Compliance Risk
type: Risk
break id: R0075
stix type: x-break-risk
definition: Compliance risk in the critical information infrastructure domain refers to the risk that an organization fails to meet relevant regulations and address potential threats in the CII sector.
description: Scenarios include failure to ensure the security of networks and information systems, non-compliance with national and regional information security regulations, and failure to respond to cyberattacks and data breaches.
complexity: basic
influence: May lead to legal sanctions, service disruptions, information leakage, and public safety risks.
keywords: Critical Information Infrastructure (CII) Compliance Risk
keywords: CII compliance
keywords: CIIO compliance
keywords: critical infrastructure compliance
keywords: critical information infrastructure protection
keywords: essential systems compliance
mitigated by: Improving Service Availability
mitigated by: Data Loss Prevention
mitigated by: Security Awareness Training
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
mitigated by: Disaster Recovery
citation: Regulation on the Security and Protection of Critical Information Infrastructure
citation: Provisions on the Use and Management of Commercial Cryptography in Critical Information Infrastructure
updated: 2026-06-11
version: 1
related cases: C0752
related cases: C0753
related cases: C0754
related cases: C0755

Classified Protection (MLPS) Compliance Risk
type: Risk
break id: R0076
stix type: x-break-risk
definition: Multi-Level Protection Scheme (MLPS) compliance risk refers to the potential threat of an organization failing to meet relevant regulations and standards under the information security classified protection system.
description: Scenarios include failure to meet the security level requirements for information systems under the classified protection system, failure to fulfill information security management responsibilities, and risks of data leakage and unauthorized access.
complexity: basic
influence: Harms may include legal liability, information leakage, service disruptions, and negative impacts on the organization's reputation and trust.
keywords: Classified Protection (MLPS) Compliance Risk
keywords: MLPS compliance
keywords: Multi-Level Protection Scheme
keywords: MLPS 2.0
keywords: classified cybersecurity protection
keywords: cybersecurity classified protection
mitigated by: Security Awareness Training
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Network Information Security Classified Protection System - ITSEC
updated: 2026-06-13
version: 1
related cases: C0756

Cross-Border Data Transfer Compliance Risk
type: Risk
break id: R0077
stix type: x-break-risk
definition: Cross-border data transfer compliance risk refers to the potential legal, business, and reputational threats arising from an organization's failure to comply with relevant regulations and requirements during the transnational transmission and processing of data.
description: Possible scenarios include: unauthorized data transfers (transmitting personal sensitive information to other countries or regions without explicit consent from data subjects, potentially violating data privacy regulations); lack of cross-border data transfer agreements; non-compliance with specific national or regional regulations; and data leakage risk during transmission due to inadequate encryption and security measures.
complexity: basic
influence: Violating cross-border data transfer regulations may result in legal liability, including fines, lawsuits, and other legal sanctions.
keywords: Cross-Border Data Transfer Compliance Risk
keywords: data transfer compliance
keywords: international data transfer
keywords: data localization compliance
keywords: cross-border personal data transfer
keywords: overseas data transfer risk
mitigated by: Data Desensitization (Masking)
mitigated by: Compliance Governance
mitigated by: Internal Review Mechanism
citation: Measures for the Security Assessment of Cross-border Data Transfers - Gov.cn
citation: Provisions on Facilitating and Regulating Cross-border Data Flows - Gov.cn
citation: Regulation on the Security and Management of Network Data - Gov.cn
updated: 2026-06-11
version: 1
related cases: C0757
related cases: C0758
related cases: C0759
related cases: C0760
related cases: C0761
related cases: C0762

Cross-Border Data Smuggling Risk
type: Risk
break id: R0077-001
stix type: x-break-risk
definition: The risk of illegally transferring sensitive data abroad through various covert channels to circumvent cross-border data security regulations.
description: Cross-border data smuggling risk refers to the risk of illegally transferring regulated sensitive data abroad through covert means. Unlike R0077 Cross-Border Data Transfer Compliance Risk which focuses on compliance-level violations, cross-border data smuggling risk focuses on active, purposeful data theft and transfer behaviors. Key methods include: ① Covert channel transmission: transmitting data to overseas servers through encrypted tunnels, proxy servers, CDN, and other covert channels; ② Data fragmentation: splitting data into small fragments and transmitting them through multiple channels to reduce detection probability; ③ Physical media smuggling: storing data on portable devices carried by personnel across borders; ④ Cloud service abuse: using overseas cloud storage and SaaS services as data relay stations; ⑤ API abuse: performing high-frequency data exports through legitimate API interfaces to circumvent cross-border data transfer approvals; ⑥ Supply chain channels: indirectly transmitting data through third-party vendors' overseas systems. Cross-border data smuggling poses a serious threat to enterprise data sovereignty and national security.
complexity: advanced
influence: Can lead to core data asset exfiltration, national security risks, heavy compliance penalties, and loss of competitive advantage.
keywords: Cross-Border Data Smuggling Risk
keywords: cross-border data smuggling
keywords: data smuggling
keywords: covert data transfer
keywords: data exfiltration
keywords: cross-border data transfer evasion
keywords: data export compliance
mitigated by: Data Classification and Grading
mitigated by: Data Desensitization (Masking)
mitigated by: Zero Trust Architecture
mitigated by: API Security Gateway
citation: China Data Security Law and Cross-Border Data Transfer Regulations
citation: MITRE: Data Exfiltration Techniques
citation: PwC: Global Data Transfer Compliance Report
updated: 2026-06-11
version: 1
related cases: C1337
related cases: C1338
related cases: C1339

Data Breach
type: Risk
break id: R0078
stix type: x-break-risk
definition: Data breach risk refers to the potential threat of an organization's or individual's sensitive, confidential, or personally identifiable information being disclosed, exposed, or accessed without authorization.
description: May occur in various scenarios, including cyberattacks, insider leaks, and physical device loss or theft.
complexity: basic
influence: Harms include privacy violations, financial losses, legal liability, and reputational damage, potentially causing serious impacts on both organizations and individuals.
keywords: Data Breach
keywords: data leak
keywords: sensitive data exposure
keywords: information disclosure
keywords: unauthorized data access
keywords: PII breach
mitigated by: Data Loss Prevention
mitigated by: Compliance Governance
mitigated by: Threat Intelligence
mitigated by: Data Desensitization (Masking)
mitigated by: Traffic Encryption
mitigated by: Legal Action
citation: Data breach - Wikipedia
updated: 2026-06-11
version: 1
related cases: Huang and Others Illegally Obtained CHSI Academic Credentials for Sale
related cases: Equifax Fined $700 Million for Massive Data Breach
related cases: C0766
related cases: C0767
related cases: C0768
related cases: C0769
related cases: C0770

Partner Data Breach
type: Risk
break id: R0078-001
stix type: x-break-risk
definition: Sensitive information leakage caused by external entities or service providers that partner with the organization, due to insufficient security measures, technical vulnerabilities, or improper operations when handling, storing, or transmitting data.
description: Scenarios may include third-party service providers being attacked, unauthorized access, and insecure environments during data transmission.
complexity: basic
influence: Harms include loss of trust from customers and business partners, legal liability, reputational damage, and potential financial losses, posing potential threats to both the organization and its partners.
keywords: Partner Data Breach
keywords: third-party data breach
keywords: vendor data breach
keywords: supplier breach
keywords: service provider breach
keywords: partner leak
mitigated by: Data Obfuscation
mitigated by: Data Desensitization (Masking)
mitigated by: Contractual Clause Restrictions
mitigated by: Credit Level Restriction
mitigated by: Data Loss Prevention
mitigated by: Compliance Governance
citation: Data breach - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0763
related cases: C0765

Customer Success and Support Ticket Data Exposure
type: Risk
break id: R0078-002
stix type: x-break-risk
definition: Customer privacy data, keys, screenshots, and business information in support, CRM, or ticket systems are accessed or exported without authorization.
description: Customer success and support ticket data exposure comes from CRM, support systems, ticketing platforms, and collaboration tools that contain chats, screenshots, secrets, account data, and business context. Data can be accessed or exported beyond authorization. Support teams need broad visibility to solve issues, but excessive permissions and outsourced collaboration increase leakage. Controls need field masking, tiered access, export control, and sensitive ticket auditing.
complexity: intermediate
influence: Support ticket exposure can leak customer privacy, business screenshots, secrets, and incident details, damaging trust and compliance.
keywords: support ticket data exposure
keywords: CRM data leak
keywords: customer success data exposure
keywords: ticket screenshot leak
keywords: support privilege abuse
mitigated by: Enterprise Collaboration Data Loss Prevention
mitigated by: Data-Sharing Approval and Purpose Limitation
mitigated by: Data Loss Prevention
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1793
related cases: C1794
related cases: C1795
related cases: C1796
related cases: C1797

User Privacy Leakage
type: Risk
break id: R0078-003
stix type: x-break-risk
definition: User privacy leakage (PII leaked) refers to the potential threat to personal sensitive information stored, processed, or transmitted on a platform due to security vulnerabilities, data breaches, or misuse, causing user privacy and security issues.
description: Causes of personal privacy leakage risk include platform security vulnerabilities, unauthorized data access, misuse of user data, and improper handling of user information by third-party partners, all of which create potential risks of user privacy exposure.
complexity: basic
influence: Personal privacy leakage risk may cause users to lose trust, trigger legal liability, damage the platform's reputation, reduce user activity, and create regulatory compliance issues, negatively impacting the platform's sustainable development.
keywords: User Privacy Leakage
keywords: PII leakage
keywords: personal data breach
keywords: privacy breach
keywords: sensitive data exposure
keywords: personal information leakage
mitigated by: Data Desensitization (Masking)
mitigated by: Data Loss Prevention
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Privacy breach - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0885
related cases: C0886
related cases: C0887
related cases: C0888
related cases: C0889
related cases: C0890
related cases: C0891
related cases: C0892

Chinese Cryptography Standard (SM) Compliance Risk
type: Risk
break id: R0079
stix type: x-break-risk
definition: The potential threat of an organization failing to comply with the cryptographic algorithm standards issued by China's State Cryptography Administration (SCA) when using encryption algorithms, which may lead to regulatory non-compliance and technical standard inconsistencies.
description: Scenarios may involve the inability to meet domestic regulatory requirements due to the use of non-SM algorithms, potential scrutiny from regulatory authorities, and possible challenges regarding technical standard inconsistencies in critical domains.
complexity: basic
influence: Harms include legal liability, compliance issues, and business restrictions in specific domestic markets, potentially damaging the organization's competitiveness and reputation in the Chinese market.
keywords: Chinese Cryptography Standard (SM) Compliance Risk
keywords: guomi compliance
keywords: SM2 SM3 SM4 compliance
keywords: GM/T algorithms
keywords: commercial cryptography compliance
keywords: State Cryptography Administration standards
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Cryptography Law of the PRC
citation: Regulation on the Administration of Commercial Cryptography
citation: Provisions on the Use and Management of Commercial Cryptography in Critical Information Infrastructure
updated: 2026-06-11
version: 1
related cases: C0771
related cases: C0772
related cases: C0773
related cases: C0774
related cases: C0775

Device Malware Infection
type: Risk
break id: R0080
stix type: x-break-risk
definition: Malware or trojans infiltrate an organization's internal network through employee devices or accounts, potentially stealing sensitive information, monitoring operations, or damaging systems.
description: Scenarios may include employees clicking malicious links, downloading trojan-infected attachments, or being tricked through social engineering, causing malware to enter the internal network.
complexity: intermediate
influence: Harms include sensitive data leakage, network service disruption, damage to information assets, and potential financial losses.
keywords: Device Malware Infection
keywords: endpoint malware
keywords: trojan infection
keywords: workstation compromise
keywords: RAT infection
keywords: backdoor malware
mitigated by: Security Awareness Training
mitigated by: Anomalous Access Behavior Detection
mitigated by: Mobile Threat Defense (MTD)
citation: Malware - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0776
related cases: C0777
related cases: C0778
related cases: C0779
related cases: C0780
related cases: C0781

Supply Chain Risk
type: Risk
break id: R0081
stix type: x-break-risk
definition: Supply chain risk refers to the possibility that products such as software, hardware, and cloud services are exposed to security threats during development, delivery, deployment, and maintenance due to potential threats in supply chain components or links.
description: Supply chain risk spans the development, delivery, deployment, and maintenance of software, hardware, cloud services, and outsourced operations. Attackers may abuse upstream components, build environments, vendor accounts, or delivery processes to introduce malicious code, backdoor settings, or vulnerable components. This risk rarely stays within a single system. It can propagate through dependency chains and downstream customers, so organizations need supplier governance, component provenance, build integrity, release signing, runtime monitoring, and emergency replacement plans.
complexity: intermediate
influence: Harms include potential business disruption, sensitive information exposure, and system vulnerability exposure, significantly impacting the organization's trust and reliability.
keywords: supply chain risk
keywords: supply chain attack
keywords: third-party risk
keywords: software supply chain
keywords: vendor compromise
keywords: upstream poisoning
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
mitigated by: Supply Chain Security Audit
mitigated by: Network Segmentation Technology
citation: Supply chain attack - Wikipedia
updated: 2026-06-22
version: 1
related cases: C0809
related cases: C0810
related cases: C0811
related cases: C0812
related cases: C0813

Software Supply Chain Risk
type: Risk
break id: R0081-001
stix type: x-break-risk
definition: Software supply chain risk refers to the possibility that software systems are exposed to security threats during development, delivery, deployment, and maintenance due to potential threats in supply chain components or links.
description: Scenarios include third-party components being attacked, suppliers suffering data breaches, and software development tools being tampered with, potentially leading to malicious code injection, backdoors, or data leakage.
complexity: intermediate
influence: Harms include potential business disruption, sensitive information exposure, and system vulnerability exposure, significantly impacting the organization's trust and reliability.
keywords: Software Supply Chain Risk
keywords: software supply chain attack
keywords: dependency confusion
keywords: malicious package
keywords: CI/CD compromise
keywords: package hijacking
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Supply chain attack - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0782
related cases: C0783
related cases: C0784
related cases: C0785
related cases: C0786

Hardware Supply Chain Risk
type: Risk
break id: R0081-002
stix type: x-break-risk
definition: Hardware supply chain risk refers to the possibility that hardware systems are exposed to security threats during development, delivery, deployment, and maintenance due to potential threats in supply chain components or links.
description: Scenarios include third-party components being attacked, suppliers suffering data breaches, and hardware development tools being tampered with, potentially leading to malicious code injection, backdoors, or data leakage.
complexity: intermediate
influence: Harms include potential business disruption, sensitive information exposure, and system vulnerability exposure, significantly impacting the organization's trust and reliability.
keywords: Hardware Supply Chain Risk
keywords: hardware trojan
keywords: firmware tampering
keywords: component backdoor
keywords: counterfeit hardware
keywords: hardware tampering
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Supply chain attack - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0787
related cases: C0788
related cases: C0789
related cases: C0790
related cases: C0791
related cases: C0792
related cases: C0793

Cloud Service Supply Chain Risk
type: Risk
break id: R0081-003
stix type: x-break-risk
definition: Cloud service supply chain risk refers to the possibility that cloud services are exposed to security threats during development, delivery, deployment, and maintenance due to potential threats in supply chain components or links.
description: Scenarios include third-party components being attacked, suppliers suffering data breaches, and cloud service development tools being tampered with, potentially leading to malicious code injection, backdoors, or data leakage.
complexity: intermediate
influence: Harms include potential business disruption, sensitive information exposure, and system vulnerability exposure, significantly impacting the organization's trust and reliability.
keywords: Cloud Service Supply Chain Risk
keywords: cloud provider compromise
keywords: SaaS supply chain
keywords: managed service compromise
keywords: third-party cloud risk
keywords: cloud dependency risk
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: Supply chain attack - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0794
related cases: C0795
related cases: C0796
related cases: C0797
related cases: C0798
related cases: C0799

Outsourced Personnel Risk
type: Risk
break id: R0081-004
stix type: x-break-risk
definition: Outsourced personnel risk refers to the possibility that software systems are exposed to security threats due to potential threats from the behavior of outsourced personnel involved in software development, delivery, deployment, and maintenance.
description: Scenarios include outsourced personnel's accounts being compromised, maliciously tampered with, or misused, potentially leading to malicious code injection, backdoors, or data leakage.
complexity: intermediate
influence: Harms include potential business disruption, sensitive information exposure, and system vulnerability exposure, significantly impacting the organization's trust and reliability.
keywords: Outsourced Personnel Risk
keywords: insider threat
keywords: contractor risk
keywords: vendor insider
keywords: third-party personnel
keywords: privileged contractor
mitigated by: Contractual Clause Restrictions
mitigated by: Compliance Governance
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
mitigated by: Video Surveillance
citation: Insider threat - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0800
related cases: C0801
related cases: C0802

Open Source Component Poisoning Risk
type: Risk
break id: R0081-005
stix type: x-break-risk
definition: Attackers publish packages containing malicious code on open source package management platforms (such as npm, PyPI, Maven, etc.) or hijack existing popular open source projects to conduct supply chain attacks against downstream users.
description: Open source component poisoning is a rapidly growing supply chain attack method. Main techniques include: (1) Typosquatting: publishing malicious packages with names similar to popular packages to exploit developer typos. (2) Dependency confusion: exploiting package managers' preference for public repositories to publish malicious public packages with the same name as internal enterprise packages. (3) Maintainer account hijacking: obtaining popular open source project maintainer account access through social engineering or credential leakage to plant malicious code in normal updates. (4) Malicious PR merging: submitting pull requests containing hidden malicious code to popular open source projects. (5) Abandoned package takeover: taking over popular packages abandoned by their original authors and planting malicious code in new versions.
complexity: advanced
influence: Large numbers of downstream projects are implanted with malicious code, sensitive data is leaked, systems are compromised, and the supply chain trust ecosystem is damaged.
keywords: Open Source Component Poisoning Risk
keywords: typosquatting
keywords: dependency confusion
keywords: malicious package
keywords: package takeover
keywords: open source backdoor
keywords: npm malware
keywords: PyPI malware
mitigated by: Supply Chain Security Audit
mitigated by: Vulnerability Identification
mitigated by: Compliance Governance
mitigated by: Internal Review Mechanism
mitigated by: Anti-Tampering Mechanism
citation: SLSA: Supply-chain Levels for Software Artifacts
updated: 2026-06-10
version: 1
related cases: C0803
related cases: C0804
related cases: C0805
related cases: C0806
related cases: C0807
related cases: C0808

Employee Sabotage
type: Risk
break id: R0082
stix type: x-break-risk
definition: The potential threat of internal employees deliberately taking malicious actions to damage the company's information systems, resources, or business activities.
description: Scenarios may include employees deliberately deleting important data, tampering with system configurations, launching denial-of-service attacks, or intentionally spreading malware.
complexity: basic
influence: Harms include data loss, system disruption, service unavailability, and negative impacts on the company's reputation.
keywords: Employee Sabotage
keywords: malicious insider
keywords: disgruntled employee
keywords: insider sabotage
keywords: system sabotage
keywords: data destruction
mitigated by: Server-Side Anti-Tampering
mitigated by: Additional Identity Authorization
mitigated by: Identity Security Audit
mitigated by: Employee Penalty
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Adding Approval Processes
mitigated by: Disaster Recovery
mitigated by: Anomalous Access Behavior Detection
mitigated by: Video Surveillance
mitigated by: Access Control System
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
updated: 2026-06-11
version: 1
related cases: C0814
related cases: C0815
related cases: C0816
related cases: C0817
related cases: C0818
related cases: C0819

Insufficient Employee Security Awareness
type: Risk
break id: R0083
stix type: x-break-risk
definition: Refers to the potential threat that security incidents may occur due to unsafe behaviors by employees in their daily work due to insufficient security awareness.
description: Scenarios may include employees falling victim to phishing attacks, using weak passwords, sharing account information, clicking on unknown links indiscriminately, failing to update patches in a timely manner, or having their accounts compromised through social engineering.
complexity: intermediate
influence: Harms include theft of sensitive information, unauthorized access to company systems, data tampering, and malicious operations performed under stolen identities, posing potential threats to the company's confidentiality, integrity, and availability.
keywords: Insufficient Employee Security Awareness
keywords: security awareness training
keywords: phishing susceptibility
keywords: social engineering
keywords: weak password hygiene
keywords: human factor
mitigated by: Multi-Factor Authentication
mitigated by: Additional Identity Authorization
mitigated by: USB Key Digital Certificate
mitigated by: Single-Device Login
mitigated by: Security Awareness Training
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Identity Security Audit
mitigated by: Biometric Identification
mitigated by: Credential Reuse Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
mitigated by: Access Control
mitigated by: Password Complexity Requirements
mitigated by: Fake Call Detection
citation: Social engineering (security) - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0831
related cases: C0832
related cases: C0833
related cases: C0834
related cases: C0835
related cases: C0836
related cases: C0837
related cases: C0838
related cases: C0839

Employee Account Compromise
type: Risk
break id: R0083-001
stix type: x-break-risk
definition: The potential threat that accounts of internal employees may be obtained and misused by unauthorized individuals or malicious parties.
description: Scenarios may include employees falling victim to phishing attacks, using weak passwords, sharing account information, or being manipulated through social engineering, resulting in account compromise.
complexity: intermediate
influence: Harms include theft of sensitive information, unauthorized access to company systems, data tampering, and malicious operations performed under stolen identities, posing potential threats to the company's confidentiality, integrity, and availability.
keywords: Employee Account Compromise
keywords: account takeover
keywords: credential stuffing
keywords: password reuse
keywords: phishing
keywords: social engineering
keywords: ATO
mitigated by: Multi-Factor Authentication
mitigated by: Additional Identity Authorization
mitigated by: USB Key Digital Certificate
mitigated by: Single-Device Login
mitigated by: Security Awareness Training
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Identity Security Audit
mitigated by: Biometric Identification
mitigated by: Credential Reuse Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
mitigated by: Access Control
mitigated by: Password Complexity Requirements
citation: Credential stuffing - Wikipedia
updated: 2026-06-11
version: 1
related cases: FBI Warns of Account Takeover Fraud via Impersonation of Financial Institution Support Staff
related cases: C0820
related cases: C0821
related cases: C0822
related cases: C0823

Social Engineering Risk
type: Risk
break id: R0083-002
stix type: x-break-risk
definition: The potential threat that attackers use social engineering techniques to fraudulently exploit employees' trust and social connections to obtain sensitive information, steal credentials, or carry out other malicious activities, typically through false identities, impersonated communications, and social engineering tactics. In recent years, AI technologies (such as deepfake voice and video) have been used to enhance the credibility and success rate of social deception.
description: Common employee social engineering scenarios include: identity impersonation (attackers posing as senior management, colleagues, customers, or other trusted entities via email, social media, or instant messaging to request sensitive information or specific tasks); impersonated communications (sending fake emails, messages, or documents to induce employees to click malicious links, download malicious attachments, or provide sensitive information); AI Deepfake Deception (attackers use AI voice cloning or video synthesis technology to impersonate company leaders or colleagues for phone or video scams, significantly increasing deception success rates); social media fraud (creating fake profiles mimicking colleagues or superiors to establish contact and extract sensitive information); and fake emergencies (posing as urgent situations to induce employees to provide sensitive information or perform unsafe operations without proper verification).
complexity: basic
influence: Harms include but are not limited to: information leakage of sensitive data, credentials, or company secrets; network intrusion through unauthorized access; financial losses from fraudulent financial operations; and reputational damage from customer trust issues or broken business partnerships.
keywords: Social Engineering Risk
keywords: pretexting
keywords: impersonation attack
keywords: vishing
keywords: smishing
keywords: business email compromise
keywords: deepfake scam
mitigated by: Real-Name Identity Verification
mitigated by: Security Awareness Training
mitigated by: Anomalous Access Behavior Detection
citation: Social engineering (security) - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0824
related cases: C0825
related cases: C0826
related cases: C0827
related cases: C0828
related cases: C0829
related cases: C0830

Phishing Attack
type: Risk
break id: R0084
stix type: x-break-risk
definition: Phishing attack risk refers to attackers using false and deceptive means to induce individuals or organization members to provide sensitive information such as usernames, passwords, and financial information.
description: Scenarios include impersonating legitimate emails, social media messages, or websites to trick victims into clicking malicious links, downloading malicious attachments, or entering sensitive information.
complexity: intermediate
influence: Harms include personal privacy leakage, account compromise, and financial losses; for organizations, may lead to confidential information leakage, system intrusion, and reputational damage.
keywords: Phishing Attack
keywords: email phishing
keywords: spear phishing
keywords: credential harvesting
keywords: clone phishing
keywords: vishing
keywords: smishing
mitigated by: Threat Intelligence
mitigated by: Domain & Link Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Security Awareness Training
mitigated by: Anomalous Access Behavior Detection
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
citation: Phishing - Wikipedia
citation: T1566 Phishing - MITRE ATT&CK
updated: 2026-06-11
version: 1
related cases: C0848
related cases: C0849
related cases: C0850
related cases: C0851

AI-Enhanced Phishing Attack
type: Risk
break id: R0084-001
stix type: x-break-risk
definition: Using AI technologies (large language models, deepfakes, etc.) to enhance the personalization, credibility, and scalability of phishing attacks.
description: AI-enhanced phishing attacks involve attackers using AI technology to significantly improve the effectiveness of traditional phishing attacks. Key manifestations include: (1) Personalized phishing emails: using LLMs to automatically generate highly personalized phishing emails based on the target's social media information and work background, greatly increasing open and click rates. (2) Multilingual phishing: AI can automatically generate high-quality phishing content in multiple languages, supporting cross-border phishing attacks. (3) Voice phishing (Vishing): using AI voice cloning technology to impersonate trusted individuals in phone phishing. (4) Video phishing: using deepfake technology to impersonate others in video calls. (5) Adaptive phishing: AI-driven phishing systems that automatically adjust attack strategies based on target responses.
complexity: advanced
influence: Phishing attack success rates increase significantly, traditional security awareness training becomes less effective, and organizations face greater social engineering attack risks.
keywords: AI-Enhanced Phishing Attack
keywords: AI phishing
keywords: LLM phishing
keywords: deepfake phishing
keywords: multilingual phishing
keywords: adaptive phishing
keywords: vishing
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Security Awareness Training
mitigated by: Threat Intelligence
mitigated by: LLM Security Protection
citation: AI-Enhanced Phishing Threats - NCSC
updated: 2026-06-11
version: 1
related cases: C0840
related cases: C0841
related cases: C0842
related cases: C0843
related cases: C0844
related cases: C0845
related cases: C0846
related cases: C0847

EIP and Protocol Phishing Attack
type: Risk
break id: R0084-002
stix type: x-break-risk
definition: Attackers exploit vulnerabilities in Ethereum Improvement Proposals (EIP) or other blockchain protocol features to craft phishing transactions that trick users into signing malicious authorizations.
description: EIP and protocol phishing abuses user confusion around new protocol features, signature formats, or wallet prompts. Attackers craft apparently legitimate approvals, permits, delegations, or contract interactions that grant token transfer or execution rights after the user signs. The core risk is semantic opacity: structured signing data can hide real consequences from ordinary users. Wallets, DApps, and risk engines need to translate protocol actions into understandable warnings.
complexity: advanced
influence: Opaque protocol signing can trick users into granting transfer or execution rights, causing direct asset loss while appearing as a normal wallet action.
keywords: EIP and Protocol Phishing Attack
keywords: protocol phishing
keywords: EIP phishing
keywords: signature phishing
keywords: permit phishing
keywords: EIP-712 phishing
keywords: malicious approval
mitigated by: Human Verification Technology
mitigated by: Multi-Factor Authentication
mitigated by: EIP Security Verification Mechanism
citation: H1 2025 Blockchain Security and Anti-Money Laundering Report - SlowMist
citation: Ethereum Improvement Proposals
updated: 2026-06-22
version: 1
related cases: C1521
related cases: C1522
related cases: C1523
related cases: C1524
related cases: C1525

QR Code Phishing (Quishing)
type: Risk
break id: R0084-003
stix type: x-break-risk
definition: The risk of using malicious QR codes to direct users to phishing websites, download malware, or perform other malicious actions, also known as Quishing.
description: QR code phishing (Quishing) is a new type of phishing attack that uses QR codes as attack vectors. Key attack scenarios include: (1) Payment code replacement: covering a merchant's payment QR code with a malicious one to redirect user payments to the attacker's account. (2) Phishing email embedding: embedding malicious QR codes in phishing emails to bypass traditional URL detection and email security gateways. (3) Public placement: posting QR codes containing malicious links in public places disguised as WiFi connections or promotional offers. (4) Fake official QR codes: forging official QR codes from government agencies, banks, or courier companies to trick users into entering personal information after scanning. (5) Dynamic QR code attacks: using short link services to generate dynamic QR codes that initially point to normal pages but are later modified to malicious pages to evade detection. The unique danger of QR code phishing is that users cannot intuitively judge the content a QR code points to before scanning, and mobile device security protection is typically weaker than on PCs.
complexity: intermediate
influence: User personal information leakage, financial losses, malware infection, and account compromise.
keywords: QR Code Phishing (Quishing)
keywords: Quishing
keywords: QR code phishing
keywords: QR code scam
keywords: QR phishing
keywords: malicious QR code
keywords: QR code attack
mitigated by: Security Awareness Training
mitigated by: Malicious Content Detection
mitigated by: Threat Intelligence
mitigated by: Complaint and Reporting Channel
mitigated by: Client Application Hardening
mitigated by: Android Application Hardening
citation: Quishing Attack Trend Analysis
citation: QR Code Security Risk Prevention Guide
updated: 2026-06-11
version: 1
related cases: C1205
related cases: C1206
related cases: C1207
related cases: C1208

Domain / Brand Impersonation
type: Risk
break id: R0084-004
stix type: x-break-risk
definition: Registering domains similar to target brands, building impersonation websites, or creating fake social media accounts to conduct phishing attacks, traffic hijacking, or brand reputation damage.
description: Domain/brand impersonation refers to attackers using domains, page designs, or brand identities similar to well-known brands for fraudulent activities. Main forms include: (1) Typosquatting: registering domains with spellings close to the target brand (e.g., substituting letters, adding or removing characters) to phish users who mistype. (2) Homograph attacks: using visually similar Unicode characters to register domains that are difficult to distinguish with the naked eye. (3) Fake website construction: copying the target brand's website design to build high-fidelity phishing sites to steal user credentials and payment information. (4) Fake app publishing: publishing malicious apps impersonating the brand on unofficial app stores. (5) Social media impersonation: creating fake brand social media accounts for false marketing or fraud. (6) Search engine poisoning: using SEO techniques to rank impersonation websites highly in search results. (7) Subdomain takeover: exploiting expired but still DNS-recorded subdomains of the target brand for impersonation.
complexity: basic
influence: Users are phished leading to credential and financial losses, brand reputation is damaged, user trust declines, and intellectual property disputes arise.
keywords: Domain / Brand Impersonation
keywords: domain impersonation
keywords: brand impersonation
keywords: typosquatting
keywords: lookalike domain
keywords: homoglyph attack
keywords: brand spoofing
mitigated by: Endpoint Detection and Response
mitigated by: Bug Bounty Program
mitigated by: Legal Action
mitigated by: Terminal Abnormal Environment Detection
citation: Submitting a Complaint to ICANN Contractual Compliance
citation: Brand Protection and Domain Impersonation Prevention
updated: 2026-02-27
version: 1
related cases: C0848
related cases: C1273
related cases: C1274
related cases: C1275
related cases: C1276
related cases: C1277
related cases: C1278

Ransomware Attack
type: Risk
break id: R0085
stix type: x-break-risk
definition: The potential threat where attackers encrypt victims' data or threaten to expose their sensitive information, then demand ransom payment to unlock or withhold the data.
description: Scenarios include using malware to infect systems, encrypting files, and then extorting victims to pay for decryption keys or to prevent information leakage.
complexity: advanced
influence: Harms include data loss, system paralysis, and business disruption, potentially causing enormous financial losses, reputational damage, and legal liability for organizations.
keywords: Ransomware Attack
keywords: ransomware
keywords: crypto locker
keywords: file encryption extortion
keywords: data extortion
keywords: double extortion
mitigated by: Server-Side Anti-Tampering
mitigated by: Additional Identity Authorization
mitigated by: Threat Intelligence
mitigated by: Identity Security Audit
mitigated by: Vulnerability Identification
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: PR Crisis Response
mitigated by: Vulnerability Remediation
mitigated by: Disaster Recovery
citation: Ransomware - Wikipedia
citation: T1486 Data Encrypted for Impact - MITRE ATT&CK
updated: 2026-06-11
version: 1
related cases: C0864
related cases: C0865
related cases: C0866
related cases: C0867
related cases: C0868
related cases: C0869
related cases: C0870

Ransomware as a Service (RaaS)
type: Risk
break id: R0085-001
stix type: x-break-risk
definition: Ransomware as a Service is a criminal business model where ransomware developers provide ransomware tools and infrastructure as a service to other criminals, sharing a percentage of the ransom.
description: The RaaS model significantly lowers the technical barrier for ransomware attacks, enabling criminals without technical skills to launch ransomware attacks. RaaS platforms typically provide: ransomware generators, encryption/decryption tools, ransom negotiation platforms, victim management panels, and technical support services. Well-known RaaS groups include LockBit, BlackCat/ALPHV, and Cl0p. The typical RaaS business model has developers taking 20%-30% of the ransom as a platform fee, with the remainder going to the 'affiliates' who actually launch the attacks.
complexity: advanced
influence: The number and frequency of ransomware attacks increase significantly, small and medium enterprises become primary targets, and ransom amounts continue to rise.
keywords: Ransomware as a Service (RaaS)
keywords: RaaS
keywords: ransomware affiliate program
keywords: malware-as-a-service
keywords: extortion platform
keywords: affiliate model
mitigated by: Server-Side Anti-Tampering
mitigated by: Additional Identity Authorization
mitigated by: Threat Intelligence
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
mitigated by: Disaster Recovery
citation: Ransomware as a Service Trend Analysis
updated: 2026-06-11
version: 1
related cases: C0852
related cases: C0853
related cases: C0854
related cases: C0855
related cases: C0856

Double / Triple Extortion
type: Risk
break id: R0085-002
stix type: x-break-risk
definition: In addition to encrypting data, attackers add data leakage threats (double extortion) and pressure on the victim's customers/partners (triple extortion) as multiple extortion tactics.
description: Double/triple extortion is an escalated form of ransomware attack. (1) Double extortion: attackers steal a copy of the victim's data before encrypting it, threatening to publicly leak the data on the dark web if the victim refuses to pay. (2) Triple extortion: in addition to double extortion, attackers also contact the victim's customers, partners, or regulators to notify them of the data breach, applying additional pressure to force payment. (3) Quadruple extortion: some attackers also simultaneously launch DDoS attacks to further paralyze the victim's business systems. This multi-extortion strategy means that even comprehensive data backups cannot fully mitigate ransomware risk.
complexity: advanced
influence: Data leakage risk persists even with backups, customer and partner trust is damaged, and compliance penalty risks arise.
keywords: Double / Triple Extortion
keywords: double extortion
keywords: triple extortion
keywords: quadruple extortion
keywords: leak site
keywords: data theft extortion
mitigated by: Server-Side Anti-Tampering
mitigated by: Data Loss Prevention
mitigated by: Data Desensitization (Masking)
mitigated by: Threat Intelligence
mitigated by: PR Crisis Response
mitigated by: Legal Action
citation: Ransomware - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0857
related cases: C0858
related cases: C0859
related cases: C0860
related cases: C0861
related cases: C0862
related cases: C0863

Server Cryptomining
type: Risk
break id: R0086
stix type: x-break-risk
definition: Server cryptomining risk refers to the potential threat of attackers using compromised server resources without authorization to mine cryptocurrency.
description: Scenarios include attackers infecting servers with malware and using the server's computing power for cryptocurrency mining activities.
complexity: intermediate
influence: Harms include degraded server performance and increased energy consumption, potentially leading to reduced service quality, additional electricity costs, and financial and resource losses for the organization.
keywords: Server Cryptomining
keywords: cryptojacking
keywords: unauthorized crypto mining
keywords: illicit mining
keywords: server mining
keywords: mining malware
mitigated by: IOC (Indicator of Compromise) Intelligence
mitigated by: Vulnerability Identification
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Vulnerability Remediation
citation: Cryptojacking - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0871
related cases: C0872
related cases: C0873
related cases: C0874
related cases: C0875
related cases: C0876

Compute Resource Theft Risk
type: Risk
break id: R0086-001
stix type: x-break-risk
definition: The risk of attackers illegally acquiring and occupying others' computing resources (GPU, CPU, cloud compute, etc.) for cryptocurrency mining or AI model training.
description: Compute resource theft risk refers to the risk of attackers illegally acquiring and occupying others' computing resources through server intrusion, cloud service account abuse, or AI training task hijacking. Unlike R0086 Server Mining which addresses the risk of mining behavior itself, compute resource theft risk focuses on the resource theft aspect of computing resources being illegally occupied. Key attack methods include: ① Cloud compute theft: intruding into cloud service accounts and creating large numbers of GPU instances for mining or AI training; ② Server intrusion: intruding into enterprise servers and using their computing resources for mining or model training; ③ AI training hijacking: injecting malicious tasks during distributed AI training processes to occupy training cluster compute power; ④ Container escape: escaping from containers to host machines and using host compute power; ⑤ Supply chain compute abuse: implanting backdoors in open-source AI tools or models to redirect victim compute power to attacker tasks. With the explosive growth of GPU compute demand for AI large model training, compute power has become a new high-value theft target.
complexity: intermediate
influence: Can lead to massive occupation of computing resources, skyrocketing cloud service costs, degraded business performance, and theft of AI training data and models.
keywords: Compute Resource Theft Risk
keywords: resource hijacking
keywords: cryptojacking
keywords: cloud resource abuse
keywords: GPU mining abuse
keywords: compute hijacking
keywords: cloud compute theft
mitigated by: Endpoint Detection and Response
mitigated by: Privileged Access Management
mitigated by: Zero Trust Architecture
citation: MITRE ATT&CK: Resource Hijacking (T1496)
citation: CrowdStrike: Cloud Compute Resource Abuse Report
citation: Black Market Big Data: 2025 Annual Summary of Internet Black-Grey Market Trends
updated: 2026-06-11
version: 1
related cases: C0798
related cases: C0875
related cases: C1350
related cases: C1351
related cases: C1352
related cases: C1353

Business Logic Tampering Risk
type: Risk
break id: R0087
stix type: x-break-risk
definition: The potential threat of attackers modifying the runtime logic of business systems to manipulate or disrupt system functions, steal sensitive information, or carry out other malicious activities.
description: Scenarios include attackers illegally modifying business logic, manipulating transaction processes, or tampering with data inputs, potentially causing incorrect system processing, resource abuse, or unauthorized data access.
complexity: advanced
influence: Harms include business data inconsistency and compromised transaction integrity, potentially causing financial losses, loss of trust, and compliance issues for the organization.
keywords: Business Logic Tampering Risk
keywords: business logic abuse
keywords: parameter tampering
keywords: workflow bypass
keywords: transaction tampering
keywords: race condition
keywords: logic flaw exploitation
mitigated by: Server-Side Anti-Tampering
mitigated by: Additional Identity Authorization
mitigated by: Adding Approval Processes
mitigated by: IOC (Indicator of Compromise) Intelligence
mitigated by: Identity Security Audit
mitigated by: Vulnerability Identification
mitigated by: Time Limiting
mitigated by: Resource Access Restriction
mitigated by: Legal Action
mitigated by: Vulnerability Remediation
mitigated by: Disaster Recovery
citation: T1190 Exploit Public-Facing Application - MITRE ATT&CK
updated: 2026-06-11
version: 1
related cases: C0877
related cases: C0878
related cases: C0879
related cases: C0880
related cases: C0881

Bulk Account Enumeration
type: Risk
break id: R0090
stix type: x-break-risk
definition: Bulk account enumeration risk refers to the potential threat of attackers using automated tools to scan, verify, or obtain user account information at scale, potentially leading to user privacy leakage and account security issues.
description: Bulk account enumeration typically involves attackers using automated tools for large-scale account scanning, with common techniques including brute force, dictionary attacks, and social engineering. Attackers may attempt to crack passwords, bypass CAPTCHAs, and abuse API interfaces to obtain large amounts of user account information. This behavior may lead to user privacy leakage, account abuse, and platform reputational damage.
complexity: basic
influence: Bulk account enumeration risk may lead to large-scale user account information leakage, triggering personal privacy issues, account abuse, identity theft, and other security risks, while negatively impacting platform reputation and user trust.
keywords: Bulk Account Enumeration
keywords: account enumeration
keywords: user enumeration
keywords: username enumeration
keywords: email enumeration
keywords: CAPTCHA bypass
keywords: credential stuffing
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Resource Access Restriction
mitigated by: Response Status Obfuscation
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
citation: Credential stuffing - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0893
related cases: C0894
related cases: C0895
related cases: C0896
related cases: C0897
related cases: C0898
related cases: C0899
related cases: C0900

Game Account Laundering
type: Risk
break id: R0091
stix type: x-break-risk
definition: Stealing game account credentials through trojans or other hacking methods, then transferring in-game currency and items to the attacker via transactions for profit.
description: Account laundering methods are varied and include but are not limited to: stealing account credentials through illegal means to log in and extract virtual items and currency; exploiting vulnerabilities in game systems or related systems to intrude into accounts; and fraud or malicious programs to deceive users into giving up credentials or to attack accounts and extract virtual assets.
complexity: basic
influence: Damages the platform's gaming ecosystem and causes losses to players' virtual assets.
keywords: Game Account Laundering
keywords: game account theft
keywords: real-money trading
keywords: RMT
keywords: virtual item resale
keywords: virtual currency theft
keywords: stolen game account
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
citation: Cheating in video games - Wikipedia
updated: 2026-06-11
version: 1
related cases: Trojan Account Theft and Impersonation Scam: Three Suspects Criminally Detained by Nanshan Police in Shenzhen
related cases: C0901
related cases: C0902
related cases: C0903
related cases: C0904

Real-World Identity Theft
type: Risk
break id: R0092
stix type: x-break-risk
definition: Real-world identity theft risk refers to the potential threat of malicious actors obtaining others' real identity information through illegal means and using it for fraud, crime, or other unlawful activities, involving the theft and misuse of personal sensitive information that may cause serious financial losses and privacy leakage for victims.
description: Key characteristics include: identity information theft (obtaining personal identity information such as name, ID number, address, phone number, and bank account details); fake account creation (using stolen identity information to open fake bank accounts, credit card accounts, or other financial accounts); credit card fraud; social engineering attacks to obtain additional personal information; and criminal activities such as trafficking, money laundering, and smuggling using stolen identity information.
complexity: basic
influence: Real-world identity theft may cause serious multi-faceted impacts: individuals may face significant financial losses including stolen bank accounts, credit card abuse, and illegally applied loans; credit rating decline and legal liability may further burden victims; psychological impacts including loss of privacy, anxiety, and fear are significant; social trust is affected as identity theft cases increase; and financial institutions may face financial losses from fraudulent transactions and anti-fraud measures.
keywords: Real-World Identity Theft
keywords: identity theft
keywords: identity fraud
keywords: stolen identity
keywords: personal information theft
keywords: account opening fraud
keywords: impersonation fraud
mitigated by: API Signature Verification
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Public Security Organs Crack Down on Personal Information Crimes — 10 Typical Cases
citation: Personal Information Protection Law of the People's Republic of China
updated: 2026-06-13
version: 1
related cases: C0906
related cases: C0907
related cases: C0908
related cases: C0909
related cases: C0910

Payment Channel Abuse
type: Risk
break id: R0093
stix type: x-break-risk
definition: Payment channel abuse risk refers to the potential threat of malicious actors abusing payment systems or channels to obtain financial benefits through illegal means or carry out fraudulent activities, involving various aspects of the payment process including payment cards, electronic payments, online payments, and offline payments.
description: Main aspects include: fraud risk (some bad actors may use fake accounts, forged payment documents, and other means to conduct fraudulent activities); money laundering risk (some bad actors may use payment channels to launder money, converting illegal proceeds into legitimate funds); and cross-border fund risk (cross-border fund flows may involve foreign exchange controls, tax policies, anti-money laundering requirements, and other considerations).
complexity: basic
influence: Causes financial losses and security risks for merchants and consumers.
keywords: Payment Channel Abuse
keywords: payment fraud
keywords: third-party payment
keywords: payment laundering
keywords: money mule
keywords: merchant fraud
keywords: payment processor abuse
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Data Profiling
mitigated by: Legal Action
citation: Rampant Third-Party Payment Chaos: Held Accountable for Providing Unauthorized Payment Channels
updated: 2024-01-22
version: 1
related cases: C0911
related cases: C0912
related cases: C0913
related cases: C0914
related cases: C0915
related cases: C0916

Credit Card Fraud
type: Risk
break id: R0094
stix type: x-break-risk
definition: Credit card fraud refers to the intentional use of forged or invalid credit cards, impersonating another person's credit card to obtain property, or maliciously overdrawing one's own credit card.
description: Common fraud forms include: lost card misuse (cards lost in transit from the issuing bank, lost due to cardholder negligence, or stolen by criminals); fraudulent applications (using others' personal information to apply for credit cards, or deliberately providing false information such as forged ID cards or fake employer/home addresses); and counterfeit credit cards (over 60% of international credit card fraud cases involve counterfeit cards, typically organized gang operations covering data theft, card manufacturing, card trafficking, and card misuse, often using the latest technology to steal real card data). With the popularity of online payments, Card-Not-Present (CNP) fraud has become the most prevalent form of credit card fraud, where attackers use stolen card numbers and CVVs to make purchases on e-commerce platforms. Additionally, Account Takeover (ATO) attacks are increasing, where attackers obtain cardholders' online banking credentials through phishing or credential stuffing, then modify account information to commit fraud.
complexity: basic
influence: Causes serious harm to individuals and society, including infringement of consumer rights, disruption of market order, and damage to financial stability.
keywords: Credit Card Fraud
keywords: carding
keywords: card-not-present fraud
keywords: CNP fraud
keywords: stolen card
keywords: chargeback fraud
keywords: carding attack
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: User Profiling
mitigated by: Legal Action
citation: FBI Internet Crime Report 2024 - IC3 Annual Report
updated: 2026-06-13
version: 1
related cases: C0917
related cases: C0918
related cases: C0919
related cases: C0920
related cases: C0921
related cases: C0922
related cases: C0923

Platform Fraud Risk
type: Risk
break id: R0095
stix type: x-break-risk
definition: Using platform features such as content publishing, comments, and instant messaging, or exploiting platform vulnerabilities, to conduct telecommunications fraud.
description: Possible scenarios include: false information publishing (attackers using user-generated content features to post fake product listings, lottery notifications, or job postings to lure users into fraud); impersonating official accounts or verified users to deceive users into providing personal information, assets, or sensitive data; abusing advertising platforms to publish fake ads directing users to fraudulent sites; social engineering via private messages, comments, or invitations to induce users to click links, provide personal information, or make transfers; and exploiting platform vulnerabilities to bypass security measures and conduct fraud.
complexity: basic
influence: Leads to user information leakage, financial losses, and damage to the platform's reputation and credibility.
keywords: Platform Fraud Risk
keywords: online scam
keywords: platform scam
keywords: fake listings
keywords: impersonation scam
keywords: ad fraud
keywords: marketplace fraud
mitigated by: Real-Name Identity Verification
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Account Penalty
mitigated by: Legal Action
citation: Anti-Telecom and Online Fraud Law of the PRC
citation: 2025 Edition Anti-Telecom and Online Fraud Prevention Handbook
updated: 2026-06-11
version: 1
related cases: C0924
related cases: C0925
related cases: C0926
related cases: C0927
related cases: C0928
related cases: C0929

Platform Online Loan Fraud
type: Risk
break id: R0096
stix type: x-break-risk
definition: Online loan fraud generally refers to internet black/grey market actors using illegal means such as forged identity documents, fabricated credit materials, and purchased illegal data to exploit loopholes in internet loan approval systems during the qualification review stage, illegally obtaining loan qualifications from internet lending platforms, transferring the funds to personal accounts, and refusing to repay the loans.
description: Main fraud methods include: registering large numbers of phone numbers and using them for bulk consumption to artificially boost credit ratings; using technical means to forge identity information, device information, and location information to obtain loans and evade post-loan collection; and exploiting the slow update cycle of public credit information to simultaneously apply for loans from multiple platforms, maliciously exhausting credit. Recent variants also include using real retroactive social insurance or housing fund contributions to create a false appearance of repayment ability and obtain consumer loan limits. Recent variants also include the professional debt bearer model, where black market groups specifically find creditworthy "blank slate" users (such as recent college graduates), fabricate income and bank statements to help them fraudulently obtain loans from multiple platforms, with the loan proceeds taken by the black market and the debt left on the debt bearers.
complexity: basic
influence: Causes financial losses to the platform.
keywords: Platform Online Loan Fraud
keywords: loan fraud
keywords: online loan scam
keywords: lending fraud
keywords: fake loan application
keywords: credit fraud
keywords: loan application fraud
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Identity theft - Wikipedia
updated: 2026-06-13
version: 1
related cases: C0940
related cases: C0941
related cases: C0942
related cases: C0943
related cases: C0944

Anti-Collection Risk
type: Risk
break id: R0096-001
stix type: x-break-risk
definition: Anti-collection generally refers to organizations or individuals using abnormal means to help debtors maliciously evade debts, extending repayment periods, reducing or waiving interest, or otherwise reducing debtors' repayment obligations.
description: For example, anti-collection intermediaries have debtors forward their phone cards or set up call forwarding, so that the anti-collection gang's so-called legal staff negotiate on behalf of the debtor to achieve interest reduction and deferred/installment repayment, ultimately charging the debtor a percentage fee based on the anti-collection outcome.
complexity: basic
influence: Causes financial losses to the platform.
keywords: Anti-Collection Risk
keywords: debt collection evasion
keywords: loan repayment evasion
keywords: collection avoidance
keywords: debt avoidance
keywords: anti-collection
mitigated by: Access Control
mitigated by: Contractual Clause Restrictions
mitigated by: Risk Control Strategy
mitigated by: User Profiling
mitigated by: Legal Action
citation: Heavy Crackdown on Financial Black-Grey Market: Multiple Institutions Help Solve Anti-Collection Cases
updated: 2026-06-13
version: 1
related cases: C0930
related cases: C0931
related cases: C0932
related cases: C0933
related cases: C0934
related cases: C0935
related cases: C0936
related cases: C0937
related cases: C0938
related cases: C0939

Platform-Facilitated Gambling
type: Risk
break id: R0097
stix type: x-break-risk
definition: Criminals using a platform's normal user interaction features to conduct gambling activities.
description: WeChat group red packet gambling is a common form where criminals create multiple group chats and conduct gambling through the red packet grabbing feature. Live stream gambling exploits interactive features of live streaming platforms to attract viewers into streams where hosts play games or take bets. Social media gambling is more covert, with criminals posting false information or posing as ordinary users to attract others into gambling activities.
complexity: basic
influence: Platform compliance risks and user financial losses.
keywords: Platform-Facilitated Gambling
keywords: online gambling
keywords: illegal betting
keywords: live stream gambling
keywords: red packet gambling
keywords: social media gambling
keywords: gambling promotion
mitigated by: Real-Name Identity Verification
mitigated by: Contractual Clause Restrictions
mitigated by: Compliance Governance
mitigated by: Malicious Content Detection
mitigated by: Manual Content Review
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
mitigated by: Legal Action
citation: MPS Crackdown on Cross-Border Gambling
updated: 2026-06-13
version: 1
related cases: C0945
related cases: C0946
related cases: C0947
related cases: C0948
related cases: C0949
related cases: C0950
related cases: C0951

Fake Identity Authentication
type: Risk
break id: R0098
stix type: x-break-risk
definition: A fake identity refers to a person or entity using fictitious or forged identity information to conceal their true identity or purpose.
description: This may include using false names, addresses, dates of birth, social security numbers, and other personal information. Fake identities are typically used to deceive, evade legal liability, commit fraud, carry out cyberattacks, or engage in other improper activities.
complexity: basic
influence: Affects the platform's compliance, security, credibility, user experience, and business operations.
keywords: Fake Identity Authentication
keywords: fake KYC
keywords: KYC bypass
keywords: identity spoofing
keywords: forged identity
keywords: fake ID
keywords: identity verification fraud
mitigated by: Multi-Factor Authentication
mitigated by: Real-Name Identity Verification
mitigated by: Identity Authentication (Login)
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Know your customer - Wikipedia
updated: 2026-06-10
version: 1
related cases: C0952
related cases: C0953
related cases: C0954
related cases: C0955
related cases: C0956
related cases: C0957
related cases: C0958
related cases: C0959

Blocklisted IP Bypass
type: Risk
break id: R0099
stix type: x-break-risk
definition: Attackers using various means to evade or bypass a system's mechanisms for identifying and blocking blocklisted IP addresses. Blocklisted IPs typically contain known malicious IP addresses that the system uses to identify and block potential threats.
description: Methods used for blocklisted IP bypass include: IP address rotation (frequently changing IP addresses to avoid being blocklisted); proxy servers and VPNs (hiding the real IP address and appearing to come from different locations); TOR network (routing traffic through multiple nodes to hide the real IP); botnets (using multiple infected computers with different IP addresses to increase detection difficulty); low-frequency attacks (reducing attack frequency to evade detection); and IP spoofing (disguising the real IP address to appear as legitimate traffic).
complexity: basic
influence: Blocking becomes ineffective if the blocklist cannot be updated in time; legitimate users may be falsely blocked if they use proxies or VPNs; deploying complex blocklist mechanisms may increase system load and be exploited for denial-of-service attacks.
keywords: Blocklisted IP Bypass
keywords: blacklist evasion
keywords: IP rotation
keywords: proxy rotation
keywords: VPN evasion
keywords: Tor bypass
keywords: botnet IPs
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: IP Intelligence
mitigated by: IP Profiling
mitigated by: Network Proxy Detection
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
citation: Proxy server - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0960
related cases: C0961
related cases: C0962
related cases: C0963
related cases: C0964
related cases: C0965

AFK / Idle Behavior
type: Risk
break id: R0100
stix type: x-break-risk
definition: Refers to a player leaving their character idle or using auto-combat features while a game is in progress, without actively controlling the character.
description: AFK behavior may occur because the player has left their device, or to exploit game mechanics to accumulate experience or resources passively.
complexity: basic
influence: AFK behavior affects both the game and other players. In team-based games, AFK players may cause team imbalances, making things harder for other players. AFK behavior may also affect the game's economy, as AFK players may accumulate large amounts of resources or experience, disrupting game balance.
keywords: AFK / Idle Behavior
keywords: AFK
keywords: AFK farming
keywords: idle farming
keywords: leeching
keywords: botting
keywords: auto-combat
mitigated by: Human Verification Technology
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Complaint and Reporting Channel
mitigated by: Anomalous Access Behavior Detection
citation: Cheating in video games - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0966
related cases: C0967
related cases: C0968
related cases: C0969

Intentional Feeding
type: Risk
break id: R0101
stix type: x-break-risk
definition: A player intentionally or through deliberate misplay causes their game character to be killed by an opponent, giving the opponent a kill (known as a 'feed').
description: Intentional feeding directly affects game outcomes. In MOBA games, each kill grants the killer experience and gold, so feeding makes opponents stronger and undermines team combat effectiveness. It also negatively impacts other players' experience by causing game imbalance and making the game significantly harder for teammates.
complexity: basic
influence: Affects game fairness and other players' experience.
keywords: Intentional Feeding
keywords: inting
keywords: feeding
keywords: griefing
keywords: throwing
keywords: soft inting
keywords: intentional griefing
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
citation: Cheating in video games - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0970
related cases: C0971
related cases: C0972
related cases: C0973
related cases: C0974
related cases: C0975
related cases: C0976
related cases: C0977
related cases: C0978

Boosting (Carry Service)
type: Risk
break id: R0102
stix type: x-break-risk
definition: A player (the 'boss') joins a team with a cheater and teams up with the cheating player to gain rapid in-game benefits.
description: In different games, this practice has different names such as 'riding the hack train' or 'taking a flight'. Boosting via cheaters now has a mature commercial model with clear division of labor among cheat distributors, black market intermediaries, and cheat users.
complexity: basic
influence: Affects game fairness and other players' experience.
keywords: Boosting (Carry Service)
keywords: carry service
keywords: elo boosting
keywords: rank boosting
keywords: account boosting
keywords: win boosting
keywords: boosting service
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
citation: Video game boosting - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0979
related cases: C0980
related cases: C0981
related cases: C0982

Spectator Wallhack
type: Risk
break id: R0103
stix type: x-break-risk
definition: A player uses a wallhack cheat on a secondary account to spectate their main account, typically found in FPS games.
description: The basic principle involves using two accounts: a main account and a secondary account used for spectating. After the main and secondary accounts become friends, the main account enters the game while the secondary account opens a wallhack to spectate the main account. Through the secondary account's wallhack, the main account can easily track enemy positions and gain an unfair advantage. If the secondary account is banned, the player creates a new one and continues.
complexity: basic
influence: This behavior undermines game fairness and seriously impacts other players' experience.
keywords: Spectator Wallhack
keywords: wallhack
keywords: ghosting
keywords: spectator cheat
keywords: stream sniping
keywords: map hack
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Penalty
citation: Cheating in video games - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0983
related cases: C0984
related cases: C0985
related cases: C0986
related cases: C0987
related cases: C0988

Escort Cheating
type: Risk
break id: R0104
stix type: x-break-risk
definition: A cheating method in games where multiple accounts are used to match into the same game as the 'boss' main account to escort them, helping the boss achieve better results and win rates.
description: Primarily found in shooting/competitive games. The escort players are split into two teams: one team is the paying 'boss' player (whose main goal is to rank up), and the other team uses a high-ranked main account (the 'driver') paired with a cheating secondary account (the 'enforcer'). Both teams queue at the same time to increase the chance of matching into the same game. Once the driver successfully gets the enforcer into a high-ranked match, the driver leaves the game. The enforcer then eliminates other players, and the boss waits until the final circle to defeat the enforcer and claim victory.
complexity: basic
influence: Affects game fairness and other players' experience.
keywords: Escort Cheating
keywords: matchmaking abuse
keywords: queue syncing
keywords: win trading
keywords: teaming
keywords: collusion
keywords: boosting squad
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Penalty
citation: Cheating in video games - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0989

Account Renting / Lending
type: Risk
break id: R0105
stix type: x-break-risk
definition: Account renting or lending refers to the act of renting or lending an account to another person.
description: This may involve social media accounts, game accounts, e-commerce accounts, payment accounts, and more. Account renting and lending may serve various purposes, some potentially legitimate, but with inherent risks and illegal uses. Uses include: gaming (renting others' game accounts to obtain virtual items, in-game currency, or level up for competitive advantage); social media (renting accounts to increase followers or exposure); e-commerce platforms (renting accounts for fake purchases or fabricated reviews to boost store credibility); and ad fraud (renting accounts for malicious ad clicking to defraud advertisers).
complexity: basic
influence: Account renting/lending carries a range of potential risks including account abuse causing harm to the account owner, fraud and illegal use leading to legal liability, violation of platform rules potentially causing bans, and privacy risks exposing personal information to misuse.
keywords: Account Renting / Lending
keywords: account sharing
keywords: account rental
keywords: account lease
keywords: credential sharing
keywords: shared account
keywords: leased account
mitigated by: Additional Identity Authorization
mitigated by: Single-Device Login
mitigated by: Device Fingerprinting
mitigated by: Risk Control Strategy
mitigated by: Credential Reuse Detection
mitigated by: Facial Recognition
mitigated by: Account Penalty
mitigated by: Contractual Clause Restrictions
citation: Account sharing - Wikipedia
updated: 2026-06-11
version: 1
related cases: Selling Accounts Lands Man in Prison: Huaiyuan Prosecutor Details Social Media Account Resale Case Under PRC’s “Aiding Cybercrime” Law
related cases: C0990
related cases: C0991
related cases: C0992
related cases: C0993

Game Account Boosting Service
type: Risk
break id: R0106
stix type: x-break-risk
definition: Game boosting refers to players hiring professional gamers or teams to play on their behalf, leveling up their game account, obtaining virtual items, or completing specific game tasks. The purpose is to help players progress in the game while saving time and effort.
description: Game boosting is typically provided by skilled players or companies who play on behalf of ordinary players to raise account levels, obtain specific items, skills, or honors. The boosting industry has matured, with a complete black market supply chain formed among account owners, upstream merchants, boosters, and boosting platforms.
complexity: basic
influence: Boosting may disrupt the game environment by making players appear more skilled than they are, affecting game fairness and cooperation. It may also disrupt the game economy, causing inflation and rising item prices. Additionally, boosting involves account security risks including theft or misuse, potentially leading to account bans.
keywords: Game Account Boosting Service
keywords: boosting service
keywords: rank boosting
keywords: account boosting
keywords: carry service
keywords: elo boosting
keywords: game boosting
mitigated by: Real-Name Identity Verification
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Silent CAPTCHA
mitigated by: Account Penalty
citation: Video game boosting - Wikipedia
updated: 2026-06-11
version: 1
related cases: C0994
related cases: C0995
related cases: C0996
related cases: C0997
related cases: C0998
related cases: C0999
related cases: C1000

Match Fixing
type: Risk
break id: R0107
stix type: x-break-risk
definition: Generally refers to malicious behavior in games where players collude to feed kills and absorb kills within the same match to manipulate the outcome, typically occurring in MOBA games and sometimes in FPS games.
description: Match fixers are primarily found in high-ranked competitive matches, engaging in organized and deliberate manipulation of match outcomes for specific purposes. The feeding and absorbing players have a financial relationship, which is the key distinction from ordinary passive gameplay. In recent years, as game security detection technology has improved, match fixing in MOBA games has become less blatant and increasingly covert. Beyond traditional kill-feeding behavior, there are now fixers who specifically target top streamers or professional players, manipulate match outcomes, and profit from sports betting.
complexity: basic
influence: Affects game fairness and other players' experience.
keywords: Match Fixing
keywords: win trading
keywords: match rigging
keywords: result manipulation
keywords: throwing matches
keywords: collusion
keywords: game fixing
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Legal Action
mitigated by: Malicious Content Detection
citation: Elo hell - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1001
related cases: C1002
related cases: C1003
related cases: C1004
related cases: C1005
related cases: C1006

Gold Farming
type: Risk
break id: R0108
stix type: x-break-risk
definition: Gold farming refers to the act of obtaining virtual currency or virtual items in a game and then selling them for real-world money.
description: Also known as 'grinding'. Players continuously kill monsters or complete profitable quests to obtain virtual items and gold, then sell them through auction houses or other channels to convert them into real money. Gold farming typically involves players engaging in various in-game activities such as killing monsters, gathering, and completing quests to accumulate in-game wealth, equipment, and other resources that can be traded in-game or converted to real-world currency through specific channels.
complexity: basic
influence: Affects platform revenue. Large-scale circulation of virtual currency or items may disrupt the in-game economic balance, causing inflation and negatively impacting normal players' experience.
keywords: Gold Farming
keywords: real-money trading
keywords: RMT
keywords: grinding
keywords: farming bots
keywords: virtual currency farming
keywords: item farming
mitigated by: Risk Control Strategy
mitigated by: User Profiling
mitigated by: Reducing Returns
citation: Gold farming - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1007
related cases: C1008
related cases: C1009
related cases: C1010
related cases: C1011
related cases: C1012
related cases: C1013

Privilege Escalation / Unauthorized Access
type: Risk
break id: R0109
stix type: x-break-risk
definition: Unauthorized access or privilege escalation risk refers to users or processes obtaining or attempting to obtain access to resources, data, functions, or systems in an unauthorized manner. Unauthorized access generally falls into two types: horizontal privilege escalation (accessing other users' resources at the same permission level) and vertical privilege escalation (lower-privilege users gaining higher-privilege capabilities).
description: This risk may arise from weak passwords, vulnerability exploitation, lack of access controls, misconfiguration, or unauthorized system or application access. Privilege escalation attacks typically occur at the application logic level, such as accessing other users' data by tampering with request parameters (horizontal privilege escalation), or performing high-privilege operations with low-privilege accounts (vertical privilege escalation). Unauthorized access refers to accessing protected resources without authentication. These risks may allow malicious users, attackers, or unauthorized personnel to bypass normal security controls and access sensitive information or perform certain operations.
complexity: basic
influence: Unauthorized access may lead to serious security issues including but not limited to data leakage, privacy violations, denial of service, and system crashes.
keywords: Privilege Escalation / Unauthorized Access
keywords: privilege escalation
keywords: unauthorized access
keywords: broken access control
keywords: IDOR
keywords: horizontal privilege escalation
keywords: vertical privilege escalation
mitigated by: Additional Identity Authorization
mitigated by: Identity Authentication (Login)
mitigated by: Resource ID Encryption
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
mitigated by: Resource Access Restriction
citation: Privilege escalation - Wikipedia
citation: T1078 Valid Accounts - MITRE ATT&CK
updated: 2026-06-11
version: 1
related cases: C0655
related cases: C1014
related cases: C1015
related cases: C1016
related cases: C1017
related cases: C1018
related cases: C1019

Platform Pornography Risk
type: Risk
break id: R0110
stix type: x-break-risk
definition: Platform pornography risk refers to the presence of pornographic content and related security risks on online platforms or social media.
description: This risk may include unmoderated adult content, obscene images, pornographic advertisements, and inappropriate or illegal content that may cause physical and mental health issues for users. Causes include: the openness and convenience of online platforms providing channels for pornographic content distribution; inadequate moderation allowing pornographic content to proliferate; and profit-driven bad actors publishing and distributing pornographic content.
complexity: basic
influence: Platform pornography risk causes multiple harms to online platforms, including content moderation challenges, minor protection issues, potential social engineering and phishing threats, legal compliance difficulties, damage to user experience and brand reputation, and increased abuse and harassment. This risk may cause user discomfort, damage brand credibility, increase platform management difficulty, and negatively impact users' physical and mental health, minors' healthy development, and the overall online community atmosphere.
keywords: Platform Pornography Risk
keywords: adult content
keywords: pornographic content
keywords: obscene content
keywords: NSFW
keywords: explicit content
keywords: content moderation
mitigated by: Identity Authentication (Login)
mitigated by: Real-Name Identity Verification
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Complaint and Reporting Channel
mitigated by: Account Penalty
mitigated by: Account Ban
mitigated by: Legal Action
citation: Provisions on the Governance of the Online Information Content Ecosystem
updated: 2026-06-13
version: 1
related cases: C1020
related cases: C1021
related cases: C1022
related cases: C1023
related cases: C1024
related cases: C1025

Employee Policy Violations
type: Risk
break id: R0111
stix type: x-break-risk
definition: Employee policy violation risk refers to the potential threat to an organization's security, compliance, and operations when employees intentionally or inadvertently violate organizational rules, policies, or regulations.
description: Employee policy violation scenarios are varied, including unauthorized data access, data leakage, unauthorized software or device use, social engineering and fraud, compliance violations, network abuse, disclosure of trade secrets, and improper use of employee privileges.
complexity: basic
influence: May cause serious negative impacts on the organization, including legal liability, financial losses, reputational damage, and security vulnerabilities.
keywords: Employee Policy Violations
keywords: insider threat
keywords: policy breach
keywords: employee misconduct
keywords: compliance violation
keywords: insider abuse
keywords: unauthorized access
mitigated by: Real-Name Identity Verification
mitigated by: USB Key Digital Certificate
mitigated by: Contractual Clause Restrictions
mitigated by: Data Loss Prevention
mitigated by: Security Awareness Training
mitigated by: Compliance Governance
mitigated by: Adding Approval Processes
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Access Source Tracking
mitigated by: Biometric Identification
mitigated by: Anomalous Access Behavior Detection
mitigated by: Employee Penalty
mitigated by: Legal Action
mitigated by: Disaster Recovery
mitigated by: Access Control System
citation: MITRE Insider Threat Research
citation: Insider Threat - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1035
related cases: C1036
related cases: C1037
related cases: C1038
related cases: C1039
related cases: C1040
related cases: C1041

Employee Account Sharing
type: Risk
break id: R0111-001
stix type: x-break-risk
definition: An employee shares their account credentials (such as username and password) with others without authorization.
description: Generally includes: password sharing (employees sharing login credentials with colleagues or others for convenience or collaboration); shared accounts (multiple people using the same account to save costs, bypass task restrictions, or circumvent permission limits); and external sharing (employees leaking company account information to external parties such as contractors, partners, or competitors, intentionally or unintentionally).
complexity: basic
influence: Shared accounts increase the risk of unauthorized access; tracking which individual performed a specific action becomes difficult, making accountability hard after security incidents; shared accounts may lead to sensitive information leakage; and in some industries or regulations, account sharing may violate compliance requirements, leading to legal liability and fines.
keywords: Employee Account Sharing
keywords: password sharing
keywords: shared credentials
keywords: shared login
keywords: shared account
keywords: credential sharing
mitigated by: Additional Identity Authorization
mitigated by: Multi-Factor Authentication
mitigated by: USB Key Digital Certificate
mitigated by: Single-Device Login
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Identity Security Audit
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Employee Penalty
mitigated by: Anomalous Access Behavior Detection
mitigated by: Access Control
citation: Account Sharing - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1026
related cases: C1027
related cases: C1028
related cases: C1029
related cases: C1030
related cases: C1031

Employee Business-Level Backdoor
type: Risk
break id: R0111-002
stix type: x-break-risk
definition: An employee plants an unauthorized backdoor in software or systems to ensure they can later bypass normal release processes or review mechanisms to directly access or manipulate the system.
description: Specific scenarios may include: unauthorized remote access (developers embedding remote access backdoors to access and control systems after deployment without normal authentication); illegal data access (developers setting business-level backdoors to gain unauthorized access to sensitive data such as PII or financial data); malicious function activation (backdoors containing code to activate malicious functions under specific conditions, such as data destruction or system crashes); and undetectable presence (developers designing backdoors to be difficult to detect, maintaining covert long-term access).
complexity: intermediate
influence: Impacts include: data leakage of sensitive information; business disruption from malicious manipulation causing system crashes; reputational damage once the backdoor is revealed; and legal liability from unauthorized data access or tampering.
keywords: Employee Business-Level Backdoor
keywords: insider backdoor
keywords: remote access backdoor
keywords: hidden backdoor
keywords: unauthorized remote access
keywords: covert access
keywords: logic bomb
mitigated by: Contractual Clause Restrictions
mitigated by: Security Awareness Training
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Access Source Tracking
mitigated by: Identity Security Audit
mitigated by: Employee Penalty
citation: Insider Threat - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1032
related cases: C1033
related cases: C1034

Office Environment Risk
type: Risk
break id: R0112
stix type: x-break-risk
definition: Office environment business security risk involves various potential threats and hazards related to business operations that may cause harm to an organization's information, systems, employees, and customer data.
description: Possible office environment business security risk scenarios include: data leakage (sensitive information, customer data, or trade secrets exposed through unauthorized access, insider leaks, or cyberattacks); cyberattacks (malware, viruses, ransomware, phishing causing business system disruption, data corruption, or theft); supply chain risk (insecure supply chains introducing malware or substandard products); social engineering (attackers obtaining sensitive employee information through impersonation or fraudulent communications); and physical security risks (unauthorized access, device loss, or insecure facility layouts).
complexity: basic
influence: Impacts include: financial losses from data breaches, cyberattacks, and other security incidents; reputational damage reducing customer and partner trust; legal liability from data breaches; and business disruption affecting service delivery and customer satisfaction.
keywords: Office Environment Risk
keywords: office security
keywords: workplace security
keywords: physical security
keywords: social engineering
keywords: data leakage
keywords: insider threat
mitigated by: Access Control System
mitigated by: Access Control
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Video Surveillance
citation: Physical Security - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1080
related cases: C1081
related cases: C1082

Bring Your Own Device (BYOD) Risk
type: Risk
break id: R0112-001
stix type: x-break-risk
definition: BYOD (Bring Your Own Device) refers to employees using their personal devices (such as phones, tablets, laptops) for work-related tasks.
description: BYOD presents multiple potential risk scenarios: personal devices typically lack enterprise-grade security measures and may become sources of security vulnerabilities; compliance issues may be exacerbated by difficulty monitoring personal devices; personal devices connected to the corporate network may be attacked by viruses and malware; managing and monitoring various types of personal devices is difficult; and employees who leave the company may still have access to company data.
complexity: basic
influence: BYOD introduces potential harms including security vulnerabilities, data leakage, compliance issues, network security threats, device management challenges, loss of control, and post-departure access issues.
keywords: Bring Your Own Device (BYOD) Risk
keywords: BYOD
keywords: bring your own device
keywords: mobile device management
keywords: MDM
keywords: unmanaged devices
keywords: personal device risk
mitigated by: Real-Name Identity Verification
mitigated by: USB Key Digital Certificate
mitigated by: Single-Device Login
mitigated by: Data Loss Prevention
mitigated by: Contractual Clause Restrictions
mitigated by: Security Awareness Training
mitigated by: Compliance Governance
mitigated by: Device Fingerprinting
mitigated by: Access Source Tracking
mitigated by: Device Profiling
mitigated by: Anomalous Access Source Detection
mitigated by: Employee Penalty
mitigated by: Access Control
citation: NIST SP 1800-22: Mobile Device Security: Bring Your Own Device (BYOD)
citation: Bring Your Own Device - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1042
related cases: C1043
related cases: C1044
related cases: C1045
related cases: C1046
related cases: C1047
related cases: C1048
related cases: C1049

Unauthorized Physical Access
type: Risk
break id: R0112-002
stix type: x-break-risk
definition: Unauthorized physical access refers to individuals or entities entering office premises, equipment areas, data centers, or other sensitive locations without explicit company or organizational approval.
description: This physical access may lead to information security threats involving: unauthorized personnel entering office areas through social engineering, impersonation, or other deceptive means; inadequate visitor management lacking proper registration and identity verification; unauthorized device connections by employees or visitors introducing malware; physical file and device access by unauthorized individuals; unauthorized data center access leading to illegal operations on servers and storage; and unauthorized server room access causing equipment tampering or data leakage.
complexity: basic
influence: Unauthorized physical access may cause serious information security harms including theft, tampering, or destruction of confidential information; data leakage causing serious business damage; reputational loss, legal liability, and financial losses; and introduction of malware or malicious devices into the corporate network.
keywords: Unauthorized Physical Access
keywords: tailgating
keywords: badge bypass
keywords: facility intrusion
keywords: trespassing
keywords: access control bypass
keywords: unauthorized entry
mitigated by: Additional Identity Authorization
mitigated by: Access Control System
mitigated by: Employee Penalty
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Access Control
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Anomalous Access Behavior Detection
mitigated by: Video Surveillance
citation: Physical Security - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1050
related cases: C1051
related cases: C1052
related cases: C1053
related cases: C1054
related cases: C1055

Unauthorized Device Connection
type: Risk
break id: R0112-003
stix type: x-break-risk
definition: Unauthorized device connection risk refers to unapproved or unauthorized devices (including computers, mobile devices, network equipment, etc.) connecting to the corporate network or systems, potentially causing security threats and data leakage.
description: Possible scenarios include: employees connecting personal devices without authorization or necessary security measures; external personnel or vendors bringing unauthorized hardware devices; unauthorized network devices (such as routers or switches) being connected and altering network topology; and attackers attempting to connect malicious devices (such as malicious USB devices or network sniffers) to execute attacks, steal information, or move laterally.
complexity: basic
influence: Harms include: security threats from viruses, malware, or other threats introduced by unauthorized devices; and data leakage risk from unauthorized devices accessing, storing, or transmitting sensitive information.
keywords: Unauthorized Device Connection
keywords: rogue USB
keywords: unauthorized device
keywords: unapproved hardware
keywords: removable media risk
keywords: rogue peripheral
mitigated by: Access Control System
mitigated by: Employee Penalty
mitigated by: Access Control
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Adding Approval Processes
mitigated by: Video Surveillance
citation: Physical Security - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1056
related cases: C1057
related cases: C1058
related cases: C1059
related cases: C1060
related cases: C1061
related cases: C1062
related cases: C1063

Physical Damage and Destruction
type: Risk
break id: R0112-004
stix type: x-break-risk
definition: Physical damage and destruction risk refers to potential threats to an organization at the physical level that may cause damage or destruction to company facilities, property, or infrastructure, from factors including natural disasters, deliberate sabotage, theft, and terrorist attacks.
description: Possible scenarios include: natural disasters (earthquakes, fires, floods, hurricanes causing severe facility damage); deliberate sabotage (malicious destruction, arson, destructive robbery); theft and intrusion (thieves or unauthorized personnel attempting to enter facilities to steal property or cause damage); terrorist attacks; and industrial accidents (fires, explosions, or leaks damaging facilities and threatening employees and the surrounding environment).
complexity: basic
influence: May lead to: financial losses from expensive repair costs and business interruption; business disruption affecting production and service delivery; reputational damage especially among the public and customers; and employee safety risks causing casualties or health issues.
keywords: Physical Damage and Destruction
keywords: sabotage
keywords: vandalism
keywords: arson
keywords: facility damage
keywords: physical destruction
keywords: disaster damage
mitigated by: Access Control System
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Disaster Recovery
mitigated by: Video Surveillance
citation: Sabotage - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1064
related cases: C1065
related cases: C1066
related cases: C1067
related cases: C1068

Surveillance and Eavesdropping
type: Risk
break id: R0112-005
stix type: x-break-risk
definition: Refers to the potential for confidential information leakage, privacy violations, and other security issues in a corporate environment due to the presence of surveillance equipment or eavesdropping tools, from internal or external threats including employees, competitors, suppliers, or other malicious individuals or organizations.
description: Possible scenarios include: illegal eavesdropping devices installed in offices, meeting rooms, or other sensitive areas; surveillance camera abuse for monitoring employees or internal activities; electronic eavesdropping through remote access to corporate communication devices; insider employees recording confidential information using recording or photography devices; and supply chain risk where third-party suppliers are hacked and eavesdropping devices are introduced.
complexity: basic
influence: Harms include: information leakage of business secrets, strategies, and other important information; privacy violations of employees or management; and reputational damage once surveillance or eavesdropping is exposed.
keywords: Surveillance and Eavesdropping
keywords: eavesdropping
keywords: wiretapping
keywords: covert surveillance
keywords: covert recording
keywords: bugging
keywords: audio interception
mitigated by: Access Control System
mitigated by: Access Control
mitigated by: Legal Action
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Video Surveillance
citation: Eavesdropping - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1069
related cases: C1070
related cases: C1071
related cases: C1072
related cases: C1073
related cases: C1074
related cases: C1075

Wireless Network Risk
type: Risk
break id: R0112-006
stix type: x-break-risk
definition: Wireless network risk refers to potential threats and security issues when using wireless networks (Wi-Fi), which are more susceptible to various types of attacks due to their broadcast nature and wireless transmission characteristics.
description: Common wireless network risks include: unauthorized access (unauthorized individuals attempting to access protected wireless networks); password cracking (attackers trying to crack wireless network passwords through weak passwords, default passwords, or insecure encryption); phishing attacks (attackers setting up fake wireless networks mimicking legitimate ones to steal user information); man-in-the-middle attacks (attackers inserting themselves between users and access points to monitor or tamper with traffic); wireless interference; wireless cloning (attackers cloning legitimate access points); and wireless intrusion.
complexity: basic
influence: May lead to sensitive information leakage, data tampering through man-in-the-middle attacks, unauthorized network access, and business system disruption.
keywords: Wireless Network Risk
keywords: Wi-Fi security
keywords: WiFi security
keywords: rogue access point
keywords: evil twin attack
keywords: WPA cracking
keywords: wireless intrusion
mitigated by: Additional Identity Authorization
mitigated by: Access Control System
mitigated by: Identity Authentication (Login)
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
citation: Wireless Security - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1076
related cases: C1077
related cases: C1078
related cases: C1079

Malicious Player Poaching
type: Risk
break id: R0113
stix type: x-break-risk
definition: Using in-game communication channels to lure players to other gaming platforms through various persuasive tactics.
description: The perpetrator first familiarizes themselves with the target game's mechanics and gameplay; after playing for a period to unlock guild creation features and build some in-game strength; they recruit target game players into the guild and use guild announcements to require members to add their WeChat, then pull them into a 'guild WeChat group'; in the WeChat group, they promote other games (typically strategy, fantasy, or legend-style games) and mobilize members to join new servers.
complexity: basic
influence: Leads to player churn from the platform.
keywords: Malicious Player Poaching
keywords: player poaching
keywords: guild poaching
keywords: player recruitment scam
keywords: cross-game recruiting
keywords: user poaching
mitigated by: Malicious Content Detection
mitigated by: Risk Control Strategy
mitigated by: Account Ban
mitigated by: Real-Name Identity Verification
mitigated by: Legal Action
mitigated by: Complaint and Reporting Channel
citation: Black-Grey Market: Called 'Wild Paths' by Modern People, 'Side Hustles' by Older Generations
updated: 2026-06-11
version: 1
related cases: C1083
related cases: C1084
related cases: C1085
related cases: C1086
related cases: C1087
related cases: C1088
related cases: C1089
related cases: C1090

Game Storage Accounts
type: Risk
break id: R0114
stix type: x-break-risk
definition: Game storage accounts are accounts used in games to store in-game items, equipment, and other assets. These accounts are typically used only for storing items and not for actual gameplay. They may be the player's own secondary accounts or other people's accounts.
description: Methods used by black/grey market actors to build and use game storage accounts include: illegally obtaining game account credentials through trojans, phishing sites, and other means; using cheats or plugins to bypass game restrictions and accumulate more game resources; exploiting game vulnerabilities to attack or steal accounts; using deception or other illegal means to obtain game resources through fake transactions or fraud; and colluding with other players to cheat or engage in violations.
complexity: basic
influence: Disrupts game economic balance by causing price imbalances that affect other players' experience; damages game reputation and credibility; and degrades user experience through spam or item flooding.
keywords: Game Storage Accounts
keywords: mule account
keywords: stash account
keywords: burner account
keywords: gold mule
keywords: virtual asset storage
keywords: item storage account
mitigated by: Multi-Factor Authentication
mitigated by: Risk Control Strategy
mitigated by: Real-Name Identity Verification
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Terminal Abnormal Environment Detection
mitigated by: User Profiling
mitigated by: Account Ban
mitigated by: Reducing Returns
citation: Gold Farming - Wikipedia
citation: Real-Money Trading - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1091

Malicious Ad Placement
type: Risk
break id: R0115
stix type: x-break-risk
definition: Malicious ad placement refers to the act of placing malicious content or false advertising on advertising platforms through fraudulent, deceptive, or harmful means.
description: Fraudulent ads: placing false or deceptive advertisements including fake product promotions and false promises to deceive users. Malware distribution: embedding malicious code or links in ads to spread malware, viruses, or conduct cyberattacks. Ad deception: using false advertising content or images to mislead users into clicking or taking other actions.
complexity: basic
influence: User deception causing financial losses from fake or low-quality products; brand reputation damage from association with malicious ads; cybersecurity threats including malware infection and information leakage; financial losses for brands and advertising platforms; and legal liability from violations of advertising and privacy regulations.
keywords: Malicious Ad Placement
keywords: malvertising
keywords: malicious ads
keywords: ad injection
keywords: fake ads
keywords: drive-by download
keywords: ad fraud
mitigated by: Malicious Content Detection
mitigated by: Manual Content Review
mitigated by: Automated Malicious Image Detection
mitigated by: Automated Malicious Audio Detection
mitigated by: Automated Malicious Video Detection
mitigated by: Automated Malicious Link Detection
mitigated by: Automated Malicious Text Detection
mitigated by: Automated AI-Generated Content Detection
mitigated by: Account Penalty
mitigated by: Store Penalty
mitigated by: Account Ban
mitigated by: Contractual Clause Restrictions
mitigated by: Legal Action
mitigated by: Security Deposit Mechanism
mitigated by: Complaint and Reporting Channel
mitigated by: Adding Approval Processes
citation: Malvertising - Wikipedia
updated: 2026-06-11
version: 1
related cases: C1092
related cases: C1093
related cases: C1094
related cases: C1095
related cases: C1096
related cases: C1097

LLM Prompt Injection Risk
type: Risk
break id: R0117
stix type: x-break-risk
definition: The risk of manipulating the behavior of large language model (LLM)-integrated business systems through carefully crafted prompts to cause the model to perform unintended operations.
description: LLM prompt injection risk is a new type of security risk that has emerged with the widespread adoption of large language models in business systems. Attackers embed malicious instructions in inputs to override or bypass the system's preset prompt constraints, causing the model to leak sensitive information, perform unauthorized operations, or generate harmful content. Prompt injection attacks have been listed by OWASP as the top security risk for LLM applications. Main attack methods fall into two categories: direct prompt injection and indirect prompt injection.
complexity: advanced
influence: Can lead to sensitive data leakage, business logic bypass, system manipulation to perform unauthorized operations, and generation of harmful or non-compliant content.
keywords: LLM Prompt Injection Risk
keywords: prompt injection
keywords: jailbreak
keywords: prompt hijacking
keywords: LLM jailbreak
keywords: adversarial prompt
mitigated by: LLM Security Protection
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Risk Control Strategy
mitigated by: Data Parsing Interference
citation: OWASP Top 10 for LLM Applications
citation: Survey on Prompt Injection Attacks and Defenses
updated: 2026-06-10
version: 1
related cases: C1115
related cases: C1122
related cases: C1123

Direct Prompt Injection
type: Risk
break id: R0117-001
stix type: x-break-risk
definition: An attacker directly embeds malicious instructions in user input to override system prompts or manipulate model behavior.
description: Direct prompt injection refers to attackers embedding malicious instructions directly in input text when interacting with an LLM to manipulate model behavior. Common techniques include: role-playing attacks (asking the model to play an unrestricted character), instruction override (using phrases like 'ignore previous instructions'), encoding bypass (using Base64, Unicode, or other encodings to hide malicious instructions), and multilingual mixing (using instructions in different languages to confuse the model).
complexity: intermediate
influence: Model behavior is manipulated, potentially leaking system prompts, generating non-compliant content, or performing unauthorized operations.
keywords: Direct Prompt Injection
keywords: malicious prompt
keywords: instruction override
keywords: prompt hijacking
mitigated by: LLM Security Protection
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Rate Limiting
mitigated by: Risk Control Strategy
citation: OWASP Top 10 for LLM Applications
updated: 2026-06-10
version: 1
related cases: C1114
related cases: C1115
related cases: C1116
related cases: C1117

Indirect Prompt Injection
type: Risk
break id: R0117-002
stix type: x-break-risk
definition: An attacker hides malicious instructions in external data sources that the model may retrieve or process, indirectly manipulating model behavior.
description: Indirect prompt injection is a more covert attack method where attackers do not interact directly with the model but instead embed malicious instructions in external data sources the model may access, such as web content, documents, emails, or database records. When the LLM application processes this external data, the hidden malicious instructions are executed by the model. For example, in RAG (Retrieval-Augmented Generation) systems, attackers can plant malicious instructions in knowledge base documents; in AI email assistant scenarios, attackers can embed manipulation instructions in email bodies. Indirect prompt injection is more dangerous because it can be triggered without the user's knowledge.
complexity: advanced
influence: Can manipulate model behavior without the user's knowledge, leading to serious consequences such as data leakage and unauthorized operations.
keywords: Indirect Prompt Injection
keywords: retrieval injection
keywords: document injection
keywords: hidden instructions
mitigated by: LLM Security Protection
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Risk Control Strategy
mitigated by: Data Parsing Interference
citation: Indirect Prompt Injection Threats
updated: 2026-06-10
version: 1
related cases: C1118
related cases: C1119
related cases: C1120
related cases: C1121

AI-Automated Attack Escalation
type: Risk
break id: R0118
stix type: x-break-risk
definition: The risk of using AI technology (particularly large language models) to automate, enhance, and scale traditional cyberattacks and business attacks.
description: AI-automated attack escalation refers to attackers using AI technology to significantly improve the efficiency, scale, and success rate of traditional attacks. Key manifestations include: (1) AI-assisted social engineering: using LLMs to automatically generate highly personalized phishing emails and social engineering scripts, greatly improving phishing success rates. (2) AI-assisted vulnerability exploitation: using AI to automatically discover and exploit security vulnerabilities, accelerating attack chain construction. (3) Intelligent CAPTCHA cracking: using multimodal AI models to automatically recognize and solve various CAPTCHAs. (4) Adaptive attacks: AI-driven attack tools that automatically adjust attack methods based on defensive strategies, enabling automated attack-defense confrontation. (5) Bulk content generation: using AI to bulk-generate fake reviews, fake account profiles, and other content to support large-scale business fraud. AI technology has significantly lowered the technical barrier for attacks, reduced attack costs, and greatly improved attack effectiveness.
complexity: advanced
influence: Traditional security defense systems face severe challenges, attack scale and efficiency increase significantly, and defense costs rise substantially.
keywords: AI-Automated Attack Escalation
keywords: AI attack automation
keywords: AI-powered attacks
keywords: automated exploitation
keywords: bot-assisted attacks
keywords: phishing automation
keywords: CAPTCHA bypass
mitigated by: LLM Security Protection
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Human Verification Technology
mitigated by: Rate Limiting
mitigated by: API Security Gateway
mitigated by: Improving Service Availability
mitigated by: Risk Control Strategy
mitigated by: AI Content Detection
citation: OWASP Top 10 for Large Language Model Applications
citation: NCSC: The near-term impact of AI on the cyber threat
updated: 2026-06-13
version: 1
related cases: C1124
related cases: C1125
related cases: C1126

NFT Fraud Risk
type: Risk
break id: R0122
stix type: x-break-risk
definition: The risk of exploiting the opacity and regulatory gaps in the NFT (Non-Fungible Token) market to conduct fake transactions, price manipulation, intellectual property infringement, and other fraudulent activities.
description: NFT fraud risk encompasses multiple fraud forms: (1) Wash trading: the same person or affiliated parties repeatedly trading the same NFT to artificially inflate prices and volume, creating a false sense of prosperity. (2) Rug pull: project teams disappearing with funds after NFT sales, leaving buyers with worthless investments. (3) Intellectual property infringement: minting others' artwork, brand logos, and other content as NFTs for sale without authorization. (4) Fake projects: creating fake NFT projects to attract investors through false promotion and community hype. (5) Phishing attacks: stealing users' crypto assets through fake NFT trading platforms or wallet connection requests. (6) Metadata tampering: modifying the associated digital asset content after NFT minting.
complexity: intermediate
influence: Investor financial losses, intellectual property violations, declining market trust, and platform compliance risks.
keywords: NFT Fraud Risk
keywords: wash trading
keywords: rug pull
keywords: NFT scam
keywords: fake NFT project
keywords: NFT phishing
keywords: metadata tampering
mitigated by: Threat Intelligence
mitigated by: Risk Control Strategy
mitigated by: Malicious Content Detection
mitigated by: Real-Name Identity Verification
mitigated by: Legal Action
mitigated by: Contractual Clause Restrictions
citation: NFT Market Fraud Analysis - Chainalysis
updated: 2026-02-27
version: 1
related cases: C1140
related cases: C1141
related cases: C1142
related cases: C1143
related cases: C1144
related cases: C1145
related cases: C1146

Algorithm Compliance Risk
type: Risk
break id: R0123
stix type: x-break-risk
definition: The risk that algorithmic systems used by enterprises (recommendation algorithms, pricing algorithms, risk control algorithms, etc.) fail to meet regulatory requirements for algorithm transparency, fairness, and explainability.
description: Algorithm compliance risk refers to the risk that enterprises may violate relevant laws and regulations when using algorithms for business decisions. With the introduction of regulations such as the Provisions on the Management of Algorithmic Recommendations for Internet Information Services and the Interim Measures for the Management of Generative AI Services, algorithm compliance requirements are increasingly strict. Key risks include: (1) Algorithmic discrimination: recommendation and pricing algorithms treating different user groups unfairly. (2) Filter bubbles: over-personalized recommendation algorithms narrowing users' information access and affecting information diversity. (3) Algorithm opacity: users unable to understand the algorithmic logic affecting their rights, lacking informed consent and choice. (4) Algorithm manipulation: using algorithms to manipulate search rankings and information feed ordering, affecting fair market competition. (5) Unregistered algorithms: algorithm recommendation services with public opinion attributes or social mobilization capabilities not registered as required.
complexity: intermediate
influence: Faces regulatory penalties, fines, business rectification requirements, as well as declining user trust and reputational losses.
keywords: Algorithm Compliance Risk
keywords: algorithmic fairness
keywords: algorithm transparency
keywords: explainability
keywords: algorithmic discrimination
keywords: filter bubble
keywords: algorithmic audit
mitigated by: Algorithm Audit Mechanism
mitigated by: Compliance Governance
mitigated by: Internal Review Mechanism
mitigated by: Contractual Clause Restrictions
citation: Provisions on the Management of Algorithmic Recommendations for Internet Information Services
citation: Interim Measures for the Management of Generative AI Services
updated: 2026-06-11
version: 1
related cases: C1147
related cases: C1148
related cases: C1149
related cases: C1150
related cases: C1151
related cases: C1152
related cases: C1153

Minor Protection Compliance Risk
type: Risk
break id: R0124
stix type: x-break-risk
definition: The compliance risk that platforms fail to meet increasingly strict legal and regulatory requirements for minor protection, including content rating, usage time limits, consumption limits, and privacy protection.
description: Minor protection compliance risk refers to the compliance challenges internet platforms face in protecting underage users. With the implementation of regulations such as the Regulations on the Protection of Minors in Cyberspace, platforms must meet compliance requirements in the following areas: (1) Real-name authentication and age verification: accurately identifying underage users and preventing minors from bypassing age restrictions. (2) Usage time management: implementing youth mode to limit minors' usage duration and time periods. (3) Content rating and filtering: implementing tiered content management and blocking content unsuitable for minors. (4) Consumption limits: restricting minors' recharge and spending amounts to prevent irrational consumption. (5) Privacy protection: implementing stricter protection measures for minors' personal information. (6) Anti-addiction mechanisms: establishing effective anti-addiction systems to prevent excessive use by minors. (7) Parental supervision: providing parental supervision tools and features.
complexity: intermediate
influence: Faces regulatory penalties, business rectification requirements, public opinion pressure, and legal liability for harm to minors' rights.
keywords: Minor Protection Compliance Risk
keywords: youth mode
keywords: age verification
keywords: parental controls
keywords: child protection
keywords: anti-addiction
keywords: minor privacy
mitigated by: Credit Level Restriction
mitigated by: Biometric Identification
mitigated by: Compliance Governance
mitigated by: Contractual Clause Restrictions
mitigated by: Malicious Content Detection
mitigated by: Time Limiting
citation: Regulations on the Protection of Minors in Cyberspace
citation: SPP Releases 10 Typical Juvenile Cases Covering Crime and Mandatory Reporting
updated: 2026-06-11
version: 1
related cases: C1154
related cases: C1155
related cases: C1156
related cases: C1157
related cases: C1158
related cases: C1159

Cross-Border E-Commerce Compliance Risk
type: Risk
break id: R0125
stix type: x-break-risk
definition: Compliance risks faced by cross-border e-commerce businesses in terms of laws and regulations, tax policies, and data protection requirements across different countries and regions.
description: Cross-border e-commerce compliance risk refers to the compliance challenges enterprises face when conducting cross-border e-commerce, needing to simultaneously comply with laws and regulations of multiple countries and regions. Key risks include: (1) Cross-border data transfer: different countries have different restrictions on cross-border personal data transfers, such as the EU GDPR and China's Data Export Security Assessment Measures. (2) Tax compliance: different countries have different tax policies for cross-border e-commerce, including VAT, customs duties, and digital services taxes. (3) Product compliance: different markets have different product safety standards, certification requirements, and labeling specifications. (4) Consumer rights protection: different countries' consumer protection laws have different requirements for returns, after-sales service, and advertising. (5) Intellectual property: cross-border sales may involve IP infringement risks across different jurisdictions. (6) Payment compliance: cross-border payments involve foreign exchange management and anti-money laundering compliance requirements. (7) Platform liability: different countries have different definitions of e-commerce platform liability and regulatory requirements.
complexity: intermediate
influence: Faces multi-country regulatory penalties, market access restrictions, fines, business disruption, and reputational losses.
keywords: Cross-Border E-Commerce Compliance Risk
keywords: cross-border ecommerce
keywords: international e-commerce
keywords: GDPR
keywords: VAT
keywords: customs duties
keywords: DSA
keywords: cross-border data transfer
mitigated by: Compliance Governance
mitigated by: Contractual Clause Restrictions
mitigated by: Data Desensitization (Masking)
mitigated by: Sensitive Data Removal
mitigated by: Threat Intelligence
mitigated by: Internal Review Mechanism
citation: Cross-Border E-Commerce Compliance White Paper
citation: EU Digital Services Act
updated: 2026-06-11
version: 1
related cases: C1160
related cases: C1161
related cases: C1162
related cases: C1163
related cases: C1164

API Abuse Risk
type: Risk
break id: R0126
stix type: x-break-risk
definition: The risk of attackers discovering, enumerating, and abusing API interfaces of business systems to conduct data theft, business logic bypass, resource exhaustion, and other attacks.
description: API abuse risk is a security risk that has become increasingly prominent with the development of microservice architectures and the API economy. Attackers discover and exploit security flaws in API interfaces through various means to carry out malicious operations. Key risk scenarios include API enumeration attacks, API rate limit bypass, and API business logic abuse.
complexity: intermediate
influence: Sensitive data leakage, business logic bypass, service availability impact, and financial losses.
keywords: API Abuse Risk
keywords: API security
keywords: endpoint abuse
keywords: API scraping
keywords: rate limit bypass
keywords: business logic abuse
keywords: API enumeration
mitigated by: API Security Gateway
mitigated by: Rate Limiting
mitigated by: API Signature Verification
mitigated by: Improving Service Availability
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
citation: OWASP API Security Top 10 2023
citation: Yongan Online API Security Research Report (Q1 2022)
updated: 2026-06-11
version: 1
related cases: C1176
related cases: C1177
related cases: C1178
related cases: C1179
related cases: C1180

API Enumeration Attack
type: Risk
break id: R0126-001
stix type: x-break-risk
definition: Using automated tools to discover and enumerate API endpoints of a target system to obtain unauthorized API interface information.
description: API enumeration attacks involve attackers using path brute-forcing, Swagger/OpenAPI documentation leakage, JavaScript code analysis, and traffic analysis to discover exposed API endpoints. Attackers may discover unprotected admin interfaces, test interfaces, and deprecated but still-active legacy interfaces, then use them to obtain sensitive data or perform unauthorized operations.
complexity: intermediate
influence: Exposes internal interface information, providing entry points for subsequent attacks.
keywords: API Enumeration Attack
keywords: endpoint discovery
keywords: API discovery
keywords: Swagger leak
keywords: OpenAPI leak
keywords: API scanning
keywords: endpoint enumeration
mitigated by: API Security Gateway
mitigated by: Rate Limiting
mitigated by: Data Parsing Interference
mitigated by: Additional Identity Authorization
citation: OWASP API Security Top 10 2023
updated: 2026-06-11
version: 1
related cases: C1165
related cases: C1166
related cases: C1167
related cases: C1168

API Rate Limit Bypass
type: Risk
break id: R0126-002
stix type: x-break-risk
definition: Using technical means to bypass the rate limiting mechanisms of API interfaces to achieve over-frequency calls.
description: API rate limit bypass refers to attackers using IP rotation, distributed requests, parameter variation, header spoofing, and exploiting different API versions to bypass rate limits set on API interfaces. After bypassing rate limits, attackers can conduct brute force attacks, bulk data scraping, and resource exhaustion attacks.
complexity: advanced
influence: Rate limiting protection becomes ineffective, exposing the system to brute force, data scraping, and resource exhaustion risks.
keywords: API Rate Limit Bypass
keywords: rate limit bypass
keywords: throttling bypass
keywords: API scraping
keywords: IP rotation
keywords: resource exhaustion
keywords: anti-bot bypass
mitigated by: API Security Gateway
mitigated by: Rate Limiting
mitigated by: Improving Service Availability
mitigated by: Proxy Detection
citation: OWASP API4:2023 Unrestricted Resource Consumption
updated: 2026-06-11
version: 1
related cases: C1169
related cases: C1170
related cases: C1171

API Business Logic Abuse
type: Risk
break id: R0126-003
stix type: x-break-risk
definition: Exploiting business logic flaws in API interfaces to achieve unintended business operations through legitimate API calls.
description: API business logic abuse refers to attackers analyzing API business logic and exploiting logical flaws in interface design. Examples include: bypassing price validation by modifying API request parameters, skipping payment processes by exploiting API call sequence vulnerabilities, locking inventory through bulk API calls, and achieving race conditions by exploiting API concurrency handling flaws. These attacks use legitimate API calls, making them difficult to detect with traditional security measures.
complexity: advanced
influence: Business logic is bypassed, potentially causing financial losses, data inconsistency, and disruption of business processes.
keywords: API Business Logic Abuse
keywords: business flow abuse
keywords: parameter tampering
keywords: workflow bypass
keywords: race condition
keywords: payment bypass
keywords: sensitive business flows
mitigated by: API Security Gateway
mitigated by: Risk Control Strategy
mitigated by: API Signature Verification
mitigated by: Anti-Tampering Mechanism
citation: OWASP API6:2023 Unrestricted Access to Sensitive Business Flows
updated: 2026-06-11
version: 1
related cases: C1172
related cases: C1173
related cases: C1174
related cases: C1175

Supply Chain Poisoning Risk
type: Risk
break id: R0127
stix type: x-break-risk
definition: The risk of attackers planting malicious code or backdoors at various stages of the software supply chain, affecting the security of downstream users and systems.
description: Supply chain poisoning risk refers to attackers implementing large-scale attacks by contaminating the software supply chain. Main attack methods include: (1) Open source component poisoning: publishing packages containing malicious code on npm, PyPI, Maven, and other package management platforms, or using typosquatting to trick developers into installing malicious packages. (2) Dependency confusion attacks: exploiting package manager dependency resolution mechanisms to cause target systems to install attacker-controlled malicious packages. (3) Build environment contamination: compromising CI/CD pipelines to inject malicious code during the build process. (4) Upstream project hijacking: planting backdoors after gaining maintenance access to popular open source projects. (5) Commercial software backdoors: planting malicious code in commercial software update packages (e.g., the SolarWinds incident). Supply chain attacks have become increasingly frequent in recent years with wide-ranging impact, making them one of the most threatening attack methods.
complexity: advanced
influence: Extremely wide impact range, potentially causing large numbers of downstream systems to be implanted with backdoors, sensitive data leakage, and business disruption.
keywords: Supply Chain Poisoning Risk
keywords: supply chain attack
keywords: dependency confusion
keywords: typosquatting
keywords: malicious package
keywords: CI/CD compromise
keywords: package hijacking
keywords: backdoor injection
mitigated by: Supply Chain Security Audit
mitigated by: Vulnerability Identification
mitigated by: Compliance Governance
mitigated by: Internal Review Mechanism
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
citation: Software Supply Chain Security White Paper - China Academy of Information and Communications Technology
citation: SLSA: Supply-chain Levels for Software Artifacts
updated: 2026-02-27
version: 1
related cases: C1181
related cases: C1182
related cases: C1183
related cases: C1184
related cases: C1185
related cases: C1186

Cloud-Native Security Risk
type: Risk
break id: R0128
stix type: x-break-risk
definition: Security risks in cloud-native architecture (containers, Kubernetes, microservices, Serverless, etc.) environments caused by misconfigurations, permission management flaws, and other issues.
description: Cloud-native security risk refers to the unique security challenges enterprises face when adopting cloud-native technology stacks. Key risks include: (1) Container escape: attackers exploiting container runtime vulnerabilities to break container isolation and gain host machine privileges. (2) Kubernetes misconfiguration: overly permissive RBAC, unauthenticated API Server exposure, unencrypted etcd, missing Pod security policies. (3) Image security: using container images containing known vulnerabilities or malicious code. (4) Service mesh security: insufficient authentication and encryption for inter-microservice communication. (5) Serverless security: overly permissive function permissions, event injection, dependency library vulnerabilities. (6) Cloud configuration vulnerabilities: publicly accessible storage buckets, overly permissive security group rules, excessive IAM permissions. (7) Key management: hardcoded keys, unrotated credentials, improper key storage.
complexity: advanced
influence: Can lead to large-scale data breaches, service disruption, lateral movement attacks, and cloud resource abuse.
keywords: Cloud-Native Security Risk
keywords: cloud native security
keywords: Kubernetes security
keywords: container security
keywords: serverless security
keywords: service mesh security
keywords: RBAC misconfiguration
keywords: container escape
mitigated by: Cloud Security Posture Management
mitigated by: Zero Trust Architecture
mitigated by: Network Segmentation Technology
mitigated by: Vulnerability Identification
mitigated by: Access Control
mitigated by: Additional Identity Authorization
mitigated by: Internal Review Mechanism
citation: OWASP Kubernetes Top 10
citation: Cloud Native Security White Paper - CNCF
updated: 2026-06-11
version: 1
related cases: C1187
related cases: C1188
related cases: C1189
related cases: C1190
related cases: C1191
related cases: C1192

SMS Bombing as a Service
type: Risk
break id: R0129
stix type: x-break-risk
definition: The risk of using commercialized SMS bombing service platforms to send large volumes of spam messages to target phone numbers, causing harassment or consuming SMS resources.
description: SMS Bombing as a Service refers to black market groups packaging SMS bombing capabilities as online services, allowing anyone to launch SMS bombing attacks against a specified phone number for a small fee. Attackers collect large numbers of SMS verification code interfaces from websites and apps, then use these interfaces to bulk-send verification code messages to target numbers. Key harms include: (1) User harassment: target users receive large volumes of spam messages in a short time, severely disrupting normal use. (2) SMS resource consumption: abused platforms must bear large SMS sending costs. (3) Verification code interface abuse: platform SMS verification code interfaces are maliciously called, affecting normal business. (4) Cover for attacks: large volumes of spam messages mask genuine security alert messages (such as login notifications and transaction confirmations).
complexity: basic
influence: Users are harassed, platform SMS resources are consumed, verification code interfaces are abused, and security alerts are buried.
keywords: SMS Bombing as a Service
keywords: SMS bombing
keywords: text bombing
keywords: OTP bombing
keywords: verification code bombing
keywords: SMS flooding
keywords: SMS spam
mitigated by: Rate Limiting
mitigated by: Human Verification Technology
mitigated by: Threat Intelligence
mitigated by: Phone Number Intelligence
mitigated by: Legal Action
mitigated by: API Security Gateway
citation: SMS Bombing Attack Analysis and Defense
updated: 2026-06-11
version: 1
related cases: Hangzhou Police Crack First Illegal SMS Bombing Software Case, Two Suspects Detained
related cases: C1193
related cases: C1194
related cases: C1195
related cases: C1196
related cases: C1197

SIM Swap Attack
type: Risk
break id: R0132
stix type: x-break-risk
definition: Attackers use social engineering to deceive telecom operators into transferring a target user's phone number to a SIM card controlled by the attacker, thereby hijacking phone number-based identity authentication.
description: SIM Swap Attack is an attack method targeting phone number-based identity authentication systems. The attack process typically involves: (1) Information gathering: attackers obtain the target user's personal information (name, ID number, phone number, etc.) through social engineering or data breaches. (2) Contacting the operator: attackers impersonate the target user and contact telecom operator customer service, claiming the phone was lost or the SIM card was damaged, to request a SIM card replacement or number transfer. (3) Number hijacking: after the operator transfers the target number to the attacker's SIM card, the attacker can receive all SMS messages and calls for that number. (4) Account takeover: using the hijacked phone number to receive SMS verification codes and reset the target user's passwords on various platforms. (5) Asset theft: logging into the target user's bank, payment, and cryptocurrency accounts to transfer assets. SIM Swap attacks are extremely harmful because a large number of online services rely on SMS verification codes as an authentication method. It should be noted that this attack occurs far less frequently in mainland China than overseas, mainly due to strict real-name registration requirements and controlled SIM card replacement processes by Chinese telecom operators. However, it remains a significant threat overseas (especially in the US and Europe), posing notable risks to cross-border businesses and overseas users.
complexity: advanced
influence: Phone number is hijacked, all SMS verification-based accounts face takeover risk, and financial assets are stolen.
keywords: SIM Swap Attack
keywords: SIM swap
keywords: SIM swap fraud
keywords: SIM swapping
keywords: phone number port-out fraud
keywords: number porting scam
keywords: account takeover
keywords: ATO
mitigated by: SIM Card Security Verification
mitigated by: Real-Name Identity Verification
mitigated by: Multi-Factor Authentication
mitigated by: SMS Verification
mitigated by: Biometric Identification
mitigated by: Credential Reuse Detection
mitigated by: Force Session Logout
citation: SIM Swap Fraud - FBI IC3
citation: SIM Swap Attack Prevention - CISA
updated: 2026-06-11
version: 1
related cases: C1209
related cases: C1210
related cases: C1211
related cases: C1212
related cases: C1213
related cases: C1214
related cases: C1215

Privacy Computing Abuse Risk
type: Risk
break id: R0133
stix type: x-break-risk
definition: The risk that privacy computing technologies (federated learning, secure multi-party computation, etc.) are misused or improperly implemented, causing privacy protection goals to fail or even creating new security risks.
description: Privacy computing abuse risk refers to risks arising from improper technical implementation, malicious exploitation, or regulatory gaps in the application of privacy computing technologies. Key risks include: (1) Federated learning poisoning: participants injecting malicious model updates during federated learning to affect global model accuracy or plant backdoors. (2) Gradient leakage attacks: inferring participants' original training data by analyzing shared gradient information in federated learning. (3) Privacy computing whitewashing: using privacy computing technology to 'launder' illegally obtained data, making it appear to have undergone compliant privacy protection processing. (4) Excessive collection: collecting excessive user data under the guise of privacy computing without actually implementing effective privacy protection. (5) Compliance facade: deploying privacy computing systems that are misconfigured or incompletely implemented, creating a false appearance of compliance. (6) Technology misuse: using secure multi-party computation and similar technologies to assist illegal activities such as joint money laundering or tax evasion.
complexity: intermediate
influence: Privacy protection goals fail, user data is not effectively protected in practice, compliance risks arise, and technology trust declines.
keywords: Privacy Computing Abuse Risk
keywords: privacy computing abuse
keywords: federated learning abuse
keywords: secure multi-party computation
keywords: SMPC
keywords: privacy-preserving computation
keywords: MPC abuse
mitigated by: Privacy Enhancing Technologies
mitigated by: Compliance Governance
mitigated by: Internal Review Mechanism
mitigated by: Contractual Clause Restrictions
mitigated by: Algorithm Audit Mechanism
citation: Privacy Computing Technology and Application White Paper - China Academy of Information and Communications Technology
citation: Survey on Security and Privacy in Federated Learning
updated: 2026-06-11
version: 1
related cases: C0727
related cases: C1216
related cases: C1217
related cases: C1218
related cases: C1219

Big Data Price Discrimination Risk
type: Risk
break id: R0134
stix type: x-break-risk
definition: The risk of platforms using big data analysis to implement differential pricing for existing users or specific user groups, showing different prices for the same product or service to different users.
description: Big data price discrimination risk refers to internet platforms using user profiles, consumption habits, device information, geographic location, and other big data to implement differential pricing strategies for different users, typically charging higher prices to existing users, high-spending users, or users of specific devices. Main manifestations include: (1) Price discrimination: showing different prices for the same product or service to different users, with existing users paying more than new users. (2) Dynamic pricing manipulation: dynamically adjusting prices based on browsing history and search frequency, with prices rising the more frequently a user views them. (3) Inverted membership pricing: paid members seeing higher prices than non-members. (4) Device-based differential pricing: differential pricing based on the user's device brand and model. (5) Regional differential pricing: unreasonable differential pricing based on the consumption level of the user's region. This behavior violates provisions on fair transactions and prohibition of price discrimination in laws such as the Personal Information Protection Law and the Consumer Rights Protection Law.
complexity: intermediate
influence: Consumer rights are harmed, platforms face regulatory penalties and fines, user trust declines, and brand reputation is damaged.
keywords: Big Data Price Discrimination Risk
keywords: big data price discrimination
keywords: personalized pricing
keywords: algorithmic price discrimination
keywords: surveillance pricing
keywords: dynamic pricing
keywords: discriminatory pricing
mitigated by: Algorithm Audit Mechanism
mitigated by: Compliance Governance
mitigated by: Contractual Clause Restrictions
mitigated by: Complaint and Reporting Channel
mitigated by: Internal Review Mechanism
citation: Anti-Monopoly Guidelines for the Platform Economy
citation: Legal Regulation of Big Data Price Discrimination
updated: 2026-06-11
version: 1
related cases: C1220
related cases: C1221
related cases: C1222
related cases: C1223
related cases: C1224
related cases: C1225
related cases: C1226
related cases: C1227

Platform Monopoly Abuse Risk
type: Risk
break id: R0135
stix type: x-break-risk
definition: The risk of internet platforms with dominant market positions engaging in monopolistic behavior, including forced exclusivity, self-preferencing, and blocking competitors, facing antitrust regulatory penalties.
description: Platform monopoly abuse risk refers to the risk of internet platforms with dominant market positions abusing their advantageous position to engage in competition-restricting behavior. Key manifestations include: (1) Forced exclusivity: requiring merchants to make exclusive choices between platforms, prohibiting them from operating on competing platforms. (2) Self-preferencing: prioritizing the display of proprietary products or services in search rankings and traffic distribution, discriminating against third-party merchants. (3) Blocking competitors: shielding or restricting competitors' links, content, or services from spreading on the platform. (4) Data monopoly: using the massive data accumulated by the platform to build competitive barriers and refusing to open necessary data interfaces to third parties. (5) Bundling: using platform dominance to force users to use affiliated services. (6) Predatory pricing: using below-cost pricing strategies to drive out competitors. With the revision of the Anti-Monopoly Law and increased antitrust enforcement in the platform economy, compliance pressure on platforms continues to grow.
complexity: intermediate
influence: Faces enormous antitrust fines, business rectification requirements, disruption of market competition order, and harm to small and medium merchant rights.
keywords: Platform Monopoly Abuse Risk
keywords: platform monopoly abuse
keywords: platform monopoly
keywords: antitrust abuse
keywords: self-preferencing
keywords: exclusive dealing
keywords: market dominance abuse
mitigated by: Compliance Governance
mitigated by: Contractual Clause Restrictions
mitigated by: Complaint and Reporting Channel
mitigated by: Legal Action
mitigated by: Internal Review Mechanism
citation: Anti-Monopoly Law of the People's Republic of China (2022 Amendment)
citation: Anti-Monopoly Guidelines for the Platform Economy
updated: 2026-06-11
version: 1
related cases: C1228
related cases: C1229
related cases: C1230
related cases: C1231
related cases: C1232
related cases: C1233
related cases: C1234
related cases: C1235
related cases: C1236

Synthetic Identity Fraud
type: Risk
break id: R0136
stix type: x-break-risk
definition: Attackers combine fragments of real personal information with fabricated information to create entirely new fake identities for account registration, credit applications, benefit fraud, and other fraudulent activities.
description: Synthetic identity fraud is an advanced identity fraud technique distinct from direct identity theft (R0098). Attackers do not directly use a real individual's complete identity information, but instead mix fragments of real information from multiple sources (such as a real ID number combined with a fake name and address) with fabricated information to create an identity that appears legitimate in systems but does not actually exist. Key characteristics include: (1) Information splicing: combining real information fragments obtained from data breaches and social engineering databases with fabricated information. (2) Account seasoning: after registering accounts with synthetic identities, gradually building credit records through normal transaction behavior to increase account credibility. (3) Bulk manufacturing: using automated tools to bulk-generate synthetic identities for large-scale fraud. (4) Difficult to trace: since the identity itself is fictitious, victims are difficult to identify clearly, and fraud detection cycles are long. (5) Cross-platform exploitation: the same synthetic identity can be registered and used across multiple platforms to maximize fraud gains.
complexity: advanced
influence: Causes platform credit losses, risk control model failures, increased compliance risks, and losses that are difficult to recover due to unclear victims.
keywords: Synthetic Identity Fraud
keywords: synthetic identity theft
keywords: synthetic ID fraud
keywords: synthetic identities
keywords: fake identity fraud
keywords: identity blending
keywords: account seasoning
mitigated by: Real-Name Identity Verification
mitigated by: Biometric Identification
mitigated by: Graph Computing / Association Analysis
mitigated by: Multi-Factor Authentication
mitigated by: Identity Authentication (Login)
mitigated by: Legal Action
citation: Synthetic Identity Fraud - Federal Reserve
citation: Research on Synthetic Identity Fraud Detection Techniques
updated: 2026-06-11
version: 1
related cases: C1237
related cases: C1238
related cases: C1239
related cases: C1240
related cases: C1241

Buy Now Pay Later (BNPL) Fraud
type: Risk
break id: R0137
stix type: x-break-risk
definition: Fraudulently consuming BNPL credit limits and refusing to repay, or exploiting audit loopholes in BNPL mechanisms to obtain goods and funds fraudulently.
description: BNPL fraud targets the BNPL credit consumption model, manifesting domestically primarily as abuse of credit payment tools such as Huabei and Baitiao. Main fraud patterns include: (1) Fake identity applications: using synthetic identities or stolen identities to activate BNPL limits for malicious consumption. (2) Cash-out fraud: converting BNPL limits into cash through fake transactions with no intention to repay. (3) Multi-platform loan fraud: simultaneously applying for limits on multiple BNPL platforms, concentrating consumption then defaulting. (4) Refund fraud: initiating refunds after receiving goods while retaining the items. (5) Account takeover: stealing others' accounts and using their BNPL limits for consumption. (6) Merchant collusion: colluding with fake merchants to create fake transactions to extract BNPL funds.
complexity: intermediate
influence: Causes credit losses for platforms and financial institutions, rising bad debt rates, and impacts the sustainable development of BNPL business.
keywords: Buy Now Pay Later (BNPL) Fraud
keywords: BNPL fraud
keywords: buy now pay later fraud
keywords: pay later fraud
keywords: installment fraud
keywords: cash-out fraud
keywords: deferred payment fraud
mitigated by: Graph Computing / Association Analysis
mitigated by: Transaction Risk Monitoring
mitigated by: Real-Name Identity Verification
mitigated by: Identity Authentication (Login)
mitigated by: Legal Action
mitigated by: Multi-Factor Authentication
citation: BNPL Fraud Trends - Juniper Research
citation: Huabei/Baitiao Cash-Out Risk Prevention and Control
updated: 2026-06-11
version: 1
related cases: C1242
related cases: C1243
related cases: C1244
related cases: C1245
related cases: C1246

Gift Card / Prepaid Card Fraud
type: Risk
break id: R0138
stix type: x-break-risk
definition: Using stolen credit cards or other illegal funds to purchase gift cards or prepaid cards for money laundering, or forging or tampering with prepaid card information to defraud platform funds.
description: Gift card/prepaid card fraud involves using prepaid card products for fraud and money laundering. Main patterns include: (1) Stolen card purchases: using stolen credit cards to bulk-purchase electronic gift cards, then laundering money by selling them at a discount or using them directly. (2) Forged prepaid cards: forging or tampering with prepaid card numbers and passwords to defraud platform recharge amounts. (3) Gift card arbitrage: bulk-purchasing gift cards to exploit price differences across different channels. (4) Refund laundering: purchasing gift cards with illegal funds then requesting refunds to different accounts to launder money. (5) Social engineering cash-out: in telecom fraud, requiring victims to purchase gift cards and provide card numbers and passwords to quickly transfer funds. (6) Internal theft: internal employees using system vulnerabilities to generate or activate unauthorized gift cards. Gift cards are commonly used as fund transfer tools in cybercrime due to their strong anonymity, good liquidity, and difficulty of tracking.
complexity: basic
influence: Causes direct financial losses to the platform, creates money laundering channels leading to compliance penalties, and damages gift card business credibility.
keywords: Gift Card / Prepaid Card Fraud
keywords: gift card fraud
keywords: prepaid card fraud
keywords: gift card scam
keywords: stored value card fraud
keywords: gift card laundering
keywords: prepaid card laundering
mitigated by: Transaction Risk Monitoring
mitigated by: Graph Computing / Association Analysis
mitigated by: Legal Action
mitigated by: Identity Authentication (Login)
mitigated by: Multi-Factor Authentication
citation: Gift Cards Become New Money Laundering Tool - Wuxi Liangxi District Procuratorate
citation: Prepaid Card Management Measures - People's Bank of China
updated: 2026-06-11
version: 1
related cases: C1247
related cases: C1248
related cases: C1249
related cases: C1250
related cases: C1251
related cases: C1252

Friendly Fraud / Chargeback Fraud
type: Risk
break id: R0139
stix type: x-break-risk
definition: A consumer maliciously initiates a chargeback with their bank or payment institution after legitimately receiving goods or services, falsely claiming non-receipt or unauthorized transaction, to obtain a refund while retaining the goods.
description: Friendly fraud (Chargeback Fraud) is a consumer-initiated fraud distinct from malicious returns (R0054). Its core characteristic is that the consumer bypasses the merchant and initiates a chargeback directly through the bank or payment institution's dispute resolution mechanism. Main forms include: (1) False non-receipt claims: consumers claiming non-receipt to their bank after receiving goods. (2) Unauthorized transaction claims: consumers claiming a transaction they completed themselves was unauthorized. (3) Service dissatisfaction chargebacks: consumers initiating chargebacks without communicating with the merchant. (4) Family member consumption: cardholders disputing charges made by family members (such as children) as unauthorized. (5) Buyer's remorse: consumers obtaining refunds through chargebacks rather than normal return processes. (6) Professional chargeback fraudsters: organized fraudsters repeatedly exploiting chargeback mechanisms.
complexity: basic
influence: Merchants bear product losses and chargeback fees, excessively high chargeback rates lead to payment channel closure, and operational costs increase.
keywords: Friendly Fraud / Chargeback Fraud
keywords: friendly fraud
keywords: chargeback fraud
keywords: chargeback abuse
keywords: false chargeback
keywords: dispute fraud
keywords: chargeback scam
mitigated by: Transaction Risk Monitoring
mitigated by: Behavioral Biometrics
mitigated by: Graph Computing / Association Analysis
mitigated by: Legal Action
mitigated by: Real-Name Identity Verification
citation: Chargeback Fraud - Visa
citation: Case Study: Stay Vigilant, Build Defenses, Jointly Prevent and Combat Financial Black-Grey Market
updated: 2026-06-11
version: 1
related cases: C1253

Membership / Subscription Abuse
type: Risk
break id: R0140
stix type: x-break-risk
definition: Repeatedly obtaining free benefits by exploiting trial period and subscription mechanism loopholes, or illegally obtaining and distributing paid benefits through sharing or reselling membership accounts.
description: Membership/subscription abuse involves fraud targeting platform membership systems and subscription services. Main patterns include: (1) Trial period abuse: repeatedly registering new accounts to obtain free trial benefits, abandoning accounts when they expire and re-registering. (2) Benefit sharing: sharing personal membership account credentials with multiple people beyond the authorized scope. (3) Membership reselling: bulk-registering or stealing membership accounts and reselling them at low prices on third-party platforms. (4) Refund benefit retention: activating membership, using benefits, then canceling the subscription through refund mechanisms while retaining already-obtained benefits (such as downloaded content). (5) Downgrade arbitrage: concentrating use of high-tier benefits during the grace period before immediately downgrading. (6) Family plan abuse: adding non-family members to family sharing plans to obtain membership benefits at low cost.
complexity: basic
influence: Causes platform membership revenue losses, degrades paid user experience, and dilutes the value of the membership system.
keywords: Membership / Subscription Abuse
keywords: subscription abuse
keywords: membership abuse
keywords: subscription fraud
keywords: free trial abuse
keywords: promo abuse
keywords: account sharing
mitigated by: Behavioral Biometrics
mitigated by: Geofencing
mitigated by: Multi-Factor Authentication
mitigated by: Transaction Risk Monitoring
mitigated by: Legal Action
citation: Subscription Fraud Prevention - Recurly
updated: 2026-06-11
version: 1
related cases: Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
related cases: C1254

Geolocation Fraud
type: Risk
break id: R0141
stix type: x-break-risk
definition: Using fake GPS positioning, VPNs, proxies, and other means to tamper with geographic location information to bypass regional restrictions for regional discounts, evade geographic regulation, or conduct location-related fraud.
description: Geolocation fraud refers to attackers using technical means to forge or tamper with geographic location information for improper gain. Main forms include: (1) Regional discount exploitation: faking location to a specific area to obtain coupons, subsidies, or promotions limited to that area. (2) Food delivery/local services fraud: faking delivery addresses to obtain new user subsidies, or faking merchant locations to expand service areas. (3) Ride-hailing fraud: drivers faking GPS routes to inflate mileage and overcharge fares, or faking locations to obtain high-value orders in specific areas. (4) Check-in cheating: faking location to complete in-store check-in tasks for points or rewards. (5) Regulatory evasion: faking location to evade business restrictions or compliance requirements in specific regions. (6) Bidding rank manipulation: faking location to influence location-based search rankings and ad placements.
complexity: basic
influence: Causes platform marketing resource waste, regional operation strategy failures, and location-based risk control model bypass.
keywords: Geolocation Fraud
keywords: GPS spoofing
keywords: location spoofing
keywords: geo spoofing
keywords: fake GPS
keywords: VPN fraud
keywords: proxy fraud
mitigated by: Geofencing
mitigated by: Behavioral Biometrics
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Transaction Risk Monitoring
mitigated by: Legal Action
citation: GPS Spoofing Detection Techniques
updated: 2026-06-11
version: 1
related cases: C1255
related cases: C1256
related cases: C1257
related cases: C1258
related cases: C1259
related cases: C1260
related cases: C1261
related cases: C1262

Man-in-the-Middle Attack
type: Risk
break id: R0142
stix type: x-break-risk
definition: Attackers intercept and tamper with communication data between clients and servers to steal user credentials, session tokens, or tamper with transaction content, achieving information theft or transaction hijacking.
description: A Man-in-the-Middle (MITM) attack involves an attacker secretly intervening between two communicating parties to intercept, view, or tamper with transmitted data. Main attack scenarios include: (1) WiFi hijacking: intercepting user network communications in public WiFi environments to steal login credentials and sensitive information. (2) SSL/TLS downgrade attacks: using SSL stripping and similar techniques to downgrade encrypted connections to plaintext. (3) ARP spoofing: redirecting traffic to the attacker's device through ARP spoofing on a LAN. (4) DNS hijacking: tampering with DNS resolution results to redirect users to malicious servers. (5) Certificate forgery: using forged SSL certificates to impersonate legitimate servers and intercept encrypted communications. (6) Transaction tampering: modifying key information such as payee accounts and transaction amounts during payment. (7) Session hijacking: stealing user session tokens (Session Token/Cookie) to impersonate users.
complexity: advanced
influence: User credentials and sensitive information are leaked, transactions are tampered with causing financial losses, and users lose trust in platform security.
keywords: Man-in-the-Middle Attack
keywords: MITM
keywords: man in the middle
keywords: on-path attack
keywords: SSL stripping
keywords: packet interception
keywords: session hijacking
mitigated by: Endpoint Detection and Response
mitigated by: Security Development Lifecycle
mitigated by: Credential Reuse Detection
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Multi-Factor Authentication
citation: Man-in-the-Middle Attack - OWASP
citation: MITM Attack Defense Guide - CISA
updated: 2026-06-11
version: 1
related cases: C1263
related cases: C1264
related cases: C1265
related cases: C1266
related cases: C1267

OAuth / SSO Authorization Abuse
type: Risk
break id: R0143
stix type: x-break-risk
definition: Exploiting implementation vulnerabilities or design flaws in OAuth, SSO, and other third-party login authorization mechanisms to gain control of user accounts or unauthorized access to user data.
description: OAuth/SSO authorization abuse targets third-party login and single sign-on mechanisms. Main attack methods include: (1) Authorization code hijacking: hijacking OAuth authorization codes through open redirect vulnerabilities to obtain user access tokens. (2) CSRF binding attacks: using CSRF vulnerabilities to bind the attacker's third-party account to the victim's platform account. (3) Token leakage exploitation: stealing access tokens and refresh tokens through insecure token transmission or storage. (4) Scope escalation: expanding permission scope in authorization requests to obtain more user data access than necessary. (5) Account association confusion: exploiting flaws in account association logic between different platforms to achieve account takeover. (6) Implicit flow abuse: exploiting the characteristic of tokens being directly exposed in URLs in the implicit authorization flow. (7) Third-party app abuse: malicious third-party apps obtaining user data through OAuth authorization and then misusing or selling it.
complexity: advanced
influence: User accounts are taken over, personal data is leaked, cross-platform trust chains are broken, and third-party login ecosystem security is affected.
keywords: OAuth / SSO Authorization Abuse
keywords: OAuth abuse
keywords: SSO abuse
keywords: authorization code hijacking
keywords: consent phishing
keywords: token theft
keywords: third-party login abuse
mitigated by: Security Development Lifecycle
mitigated by: Bug Bounty Program
mitigated by: Multi-Factor Authentication
mitigated by: Credential Reuse Detection
mitigated by: Endpoint Detection and Response
mitigated by: OAuth Permission Minimization
citation: OAuth 2.0 Security Best Current Practice - IETF
citation: Research on OAuth authorization security and defense amid the surge in device-code phishing attacks...
updated: 2026-06-11
version: 1
related cases: Microsoft Exposes Threat Actors Abusing OAuth Applications for Automated Financial Attacks
related cases: C1268
related cases: C1269
related cases: C1270
related cases: C1271
related cases: C1272

Content Farm Risk
type: Risk
break id: R0145
stix type: x-break-risk
definition: Bulk-producing low-quality, highly SEO-optimized content to dominate search rankings, polluting the platform content ecosystem, misleading users, and harming the interests of quality content creators.
description: Content farm risk refers to the behavior of using automation or low-cost labor to bulk-produce low-quality content to gain traffic and revenue. Main forms include: (1) SEO keyword stuffing: bulk-producing low-quality articles optimized for popular keywords to dominate search engine rankings. (2) AI-generated content flooding: using large language models to bulk-generate seemingly professional but genuinely valueless content. (3) Content scraping and rewriting: mass-publishing others' original content after simple rewrites, diluting original content traffic. (4) Clickbait and misinformation: using exaggerated headlines and false information to attract clicks and spread misinformation. (5) Comment flooding: bulk-posting fake reviews and answers in product reviews, Q&A communities, and similar contexts. (6) Multi-platform distribution: simultaneously publishing the same batch of low-quality content across multiple platforms to maximize traffic revenue. (7) Ad revenue arbitrage: generating large page view counts through low-quality content to fraudulently obtain advertising revenue shares.
complexity: basic
influence: Platform content quality declines, the cost for users to obtain useful information increases, quality creators leave the platform, and platform brand value is damaged.
keywords: Content Farm Risk
keywords: content farm
keywords: content mill
keywords: SEO spam
keywords: search spam
keywords: spam content
keywords: clickbait farm
mitigated by: Behavioral Biometrics
mitigated by: Graph Computing / Association Analysis
mitigated by: Legal Action
mitigated by: Human Verification Technology
citation: Content Farm Detection and Prevention
citation: Provisions on the Governance of the Internet Information Content Ecosystem
updated: 2026-06-11
version: 1
related cases: C1279
related cases: C1280
related cases: C1281
related cases: C1282
related cases: C1283

Consumer Loan Fraud (Genuine Retroactive Payment)
type: Risk
break id: R0146
stix type: x-break-risk
definition: Fraudulent behavior of obtaining consumer loans by forging repayment capability through genuine retroactive payment of social security, housing provident fund, etc.
description: Criminal groups help borrowers make genuine retroactive payments for social security, housing provident fund and other records to forge proof of stable income and repayment capability, thereby fraudulently obtaining consumer loans from financial institutions. This method is more difficult to identify than traditional fake materials because the retroactive payment records are genuine. In 2026, this method has become mainstream, bringing new challenges to financial institution risk control.
complexity: intermediate
influence: Increases bad debt and post-loan recovery costs for financial institutions, weakens credit-model effectiveness, and may trigger large-scale loan fraud and regulatory accountability.
keywords: Consumer Loan Fraud (Genuine Retroactive Payment)
keywords: genuine retroactive payment
keywords: retroactive social security payments
keywords: retroactive provident fund payments
keywords: loan qualification fraud
keywords: income proof fraud
keywords: consumer loan scam
mitigated by: Real-Name Identity Verification
mitigated by: Graph Computing / Association Analysis
mitigated by: Transaction Risk Monitoring
mitigated by: Identity Authentication (Login)
mitigated by: Legal Action
mitigated by: Security Awareness Training
citation: New Changes in Consumer Loan Fraud in 2026: Genuine Retroactive Payment Becomes Mainstream Method
updated: 2026-06-11
version: 1
related cases: C1284
related cases: C1285
related cases: C1286

Payment Institution Regulatory Compliance Risk
type: Risk
break id: R0147
stix type: x-break-risk
definition: Compliance risks faced by payment institutions due to regulatory data quality issues and failure to meet penetrating supervision requirements.
description: As regulators implement penetrating supervision and payment business supervision for payment institutions, institutions need to provide high-quality regulatory data and keep payment operations, outsourcing, data processing, and risk-control chains traceable. Data quality issues, inconsistent reporting rules, improper data desensitization, weak supplier security management, and inconsistent regulatory reporting scopes may all lead to compliance risk and regulatory penalties.
complexity: advanced
influence: May lead to regulatory penalties, business remediation, license risk, reduced partner trust, and increased data-governance and compliance-operation costs.
keywords: Payment Institution Regulatory Compliance Risk
keywords: payment institution compliance
keywords: non-bank payment institution
keywords: payment license compliance
keywords: payment provider compliance
keywords: regulatory reporting
keywords: supervisory compliance
mitigated by: Compliance Governance
mitigated by: Database Auditing
mitigated by: Data Classification and Grading
mitigated by: Supply Chain Security Audit
citation: Regulation on the Supervision and Administration of Non-bank Payment Institutions
updated: 2026-06-13
version: 1
related cases: C1287
related cases: C1288
related cases: C1289
related cases: C1290
related cases: C1291
related cases: C1292

AI Agent Tool Misuse / Excessive Autonomy Risk
type: Risk
break id: R0148
stix type: x-break-risk
definition: The risk that AI agents integrated with external tools, plugins, MCP servers, or business APIs execute unintended business operations under malicious instructions, incorrect goals, or excessive permissions.
description: AI agents no longer only generate text; they can call search, browsers, code execution, databases, ticketing, payment, marketing, customer service, office automation, and other tools to perform real actions. Attackers can manipulate agents through direct or indirect prompt injection, malicious web pages or documents, forged tool descriptions, polluted MCP context, and unauthorized tool invocation to delete or leak data, initiate transactions, change configurations, send messages, download malicious content, or orchestrate attack chains. The defining feature is that tool permissions, external data, and model reasoning jointly determine execution results, making traditional input filtering insufficient on its own.
complexity: advanced
influence: Can cause sensitive data leakage, unauthorized business operations, amplified automated attacks, indirect manipulation of internal systems, audit difficulties, and compliance risk.
keywords: AI Agent Tool Misuse / Excessive Autonomy Risk
keywords: agentic AI
keywords: tool-calling abuse
keywords: autonomous agent risk
keywords: unsafe tool use
keywords: MCP abuse
keywords: plugin misuse
mitigated by: LLM Security Protection
mitigated by: Zero Trust Architecture
mitigated by: Privileged Access Management
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Agent Behavior Sandbox
citation: OWASP Top 10 for Agentic Applications
citation: Cybersecurity Forecast 2026 - Google Cloud
updated: 2026-06-11
version: 1
related cases: C1293
related cases: C1294
related cases: C1295
related cases: C1296
related cases: C1297

Non-Human Identity and API Key Abuse Risk
type: Risk
break id: R0149
stix type: x-break-risk
definition: The risk that service accounts, API keys, OAuth applications, CI/CD tokens, bot accounts, AI agent credentials, and other non-human identities are abused because they are exposed, overprivileged, ownerless, or not rotated.
description: Enterprise automation, cloud-native systems, SaaS integrations, and AI agent applications create large numbers of non-human identities. These identities often exist as long-lived API keys, access tokens, certificates, service accounts, or application grants scattered across code repositories, configuration files, CI/CD variables, logs, tickets, endpoint environments, and third-party platforms. Once attackers obtain these credentials, they can bypass human login flows and directly call business APIs, access data, modify configurations, move laterally, or maintain persistent access. This risk often compounds with supply chain attacks, infostealers, insider threats, and cloud permission misconfiguration.
complexity: intermediate
influence: Can cause bulk data exposure, business API abuse, cloud resource takeover, supply chain poisoning, difficult attribution, and long-lived persistent access.
keywords: Non-Human Identity and API Key Abuse Risk
keywords: NHI abuse
keywords: non-human identity
keywords: API key abuse
keywords: machine identity abuse
keywords: service account compromise
keywords: token theft
mitigated by: Identity Security Audit
mitigated by: Data Loss Prevention
mitigated by: Zero Trust Architecture
mitigated by: Privileged Access Management
mitigated by: Data Classification and Grading
mitigated by: AI Agent Tool Governance and MCP Security Controls
citation: Cybersecurity Forecast 2026 - Google Cloud
citation: NIST SP 800-207: Zero Trust Architecture
updated: 2026-06-11
version: 1
related cases: C1298
related cases: C1299
related cases: C1300
related cases: C1301
related cases: C1302
related cases: C1303

Pig Butchering / Investment Fraud Risk
type: Risk
break id: R0150
stix type: x-break-risk
definition: Systematic fraud risk in which criminal groups cultivate long-term trust relationships to lure victims into investing funds in fake investment platforms, particularly cryptocurrency platforms.
description: Pig butchering is a long-term relationship-based investment fraud. Scammers contact potential victims through social media and dating apps, spending weeks to months building trust before guiding victims to invest in fake platforms they control. These investment platforms are actually fraudulent websites; victims' funds are quickly transferred and laundered behind the scenes. The name derives from the criminal process of 'fattening the pig' (building trust) and 'slaughtering' (defrauding funds). Key characteristics include: ① Trust cultivation phase: gaining victim trust through romantic relationships, friendship, or professional advice; ② Investment induction phase: demonstrating fake high-yield returns, encouraging victims to start small then increase investments; ③ Harvest phase: when victims attempt to withdraw, demanding high fees or taxes before cutting off contact. Pig butchering has formed a complete industry chain including script training, fake platform development, and money laundering. Global losses are enormous. According to the FBI IC3 report, US investment fraud losses alone reached $9.3 billion in 2024, with cryptocurrency-related fraud accounting for more than half.
complexity: advanced
influence: Can cause victims massive financial losses (single cases reaching millions of dollars), trigger platform trust crises, intensify regulatory pressure, and scam compounds are often associated with serious social issues including human trafficking and forced labor.
keywords: Pig Butchering / Investment Fraud Risk
keywords: pig butchering
keywords: pig-butchering scam
keywords: romance scam
keywords: crypto investment scam
keywords: investment scam
keywords: catfishing scam
mitigated by: Real-Name Identity Verification
mitigated by: Graph Computing / Association Analysis
mitigated by: Identity Authentication (Login)
mitigated by: Data Profiling
mitigated by: Transaction Risk Monitoring
citation: FBI IC3 2024 Internet Crime Report
citation: UNODC Southeast Asia Scam Operations Report
citation: Chainalysis 2026 Crypto Crime Report
updated: 2026-06-11
version: 1
related cases: C1304
related cases: C1305
related cases: C1306
related cases: C1307
related cases: C1308
related cases: C1309
related cases: C1310
related cases: C1311

Malware-Free Attack Risk
type: Risk
break id: R0152
stix type: x-break-risk
definition: The risk that attackers use no traditional malware but instead leverage stolen credentials, legitimate tools, and built-in operating system features to conduct attacks.
description: Malware-free attacks refer to attackers completely avoiding traditional malware (trojans, viruses, ransomware, etc.) and instead conducting attacks by stealing legitimate credentials, using built-in system tools, and leveraging legitimate cloud services. This attack approach renders traditional malware-detection-based security defenses largely ineffective. Key attack methods include: ① Credential theft and abuse: stealing legitimate account credentials and session tokens through phishing, AiTM attacks, and infostealers, then logging into systems directly with legitimate identities; ② Living-off-the-Land (LotL): using built-in operating system tools (PowerShell, WMI, PsExec, etc.) for attack operations without leaving malicious file traces; ③ Legitimate cloud service abuse: using legitimate cloud storage, collaboration tools, and remote management software for data exfiltration and remote control; ④ Identity impersonation: using stolen administrator credentials to directly manipulate Active Directory, cloud management consoles, and other critical infrastructure; ⑤ Supply chain legitimate permission abuse: using legitimate third-party vendor access for lateral movement. According to Microsoft and CrowdStrike reports, approximately 82% of cyber attacks in 2025 used no malware.
complexity: advanced
influence: Traditional security detection systems are almost entirely ineffective; attackers hide within systems using legitimate identities for extended periods, making detection and blocking extremely difficult, with very high risk of data exfiltration and business disruption.
keywords: Malware-Free Attack Risk
keywords: fileless attack
keywords: living off the land
keywords: LOLBins
keywords: credential theft
keywords: legitimate tools abuse
keywords: hands-on-keyboard
mitigated by: Graph Computing / Association Analysis
mitigated by: Endpoint Detection and Response
mitigated by: Zero Trust Architecture
mitigated by: Privileged Access Management
citation: Microsoft Digital Defense Report 2025
citation: CrowdStrike 2026 Global Threat Report
updated: 2026-06-11
version: 1
related cases: C1318
related cases: C1319
related cases: C1320
related cases: C1321
related cases: C1322

Shadow AI Risk
type: Risk
break id: R0153
stix type: x-break-risk
definition: The risk of data leakage, compliance violations, and intellectual property exfiltration caused by employees using third-party AI tools without authorization to process business data.
description: Shadow AI risk refers to the risks arising from employees inputting sensitive business data into third-party AI services or using unvetted AI tools to process business data without formal organizational approval and security assessment. Unlike R0071 Generative AI Risk which focuses on technical risks inherent to AI systems themselves, Shadow AI Risk focuses on organizational management risks from employees' unauthorized use of AI tools. Key risk scenarios include: ① Sensitive data input: inputting customer data, financial reports, source code, and other sensitive information into public AI services, which may result in data being used for model training or leaked to third parties; ② Compliance violations: using AI tools that have not passed security assessments to process regulated data (such as personal privacy data, medical data), violating data protection regulations; ③ Intellectual property exfiltration: processing trade secrets and patented technologies through AI tools, which may lead to intellectual property leakage; ④ Decision dependency: over-relying on unverified AI-generated analysis and recommendations, which may lead to business decision-making errors; ⑤ Data residue: data input into AI services may be cached or stored by service providers and cannot be completely deleted. With the proliferation of tools like ChatGPT, 78% of enterprises have shadow AI usage.
complexity: intermediate
influence: Can lead to sensitive data leakage, compliance violation penalties, trade secret exfiltration, loss of customer trust, and irreversible intellectual property loss.
keywords: Shadow AI Risk
keywords: shadow AI
keywords: shadow GenAI
keywords: unsanctioned AI tools
keywords: unapproved AI usage
keywords: bring-your-own-AI
keywords: AI data leakage
mitigated by: Data Desensitization (Masking)
mitigated by: Zero Trust Architecture
mitigated by: Data Classification and Grading
mitigated by: Shadow AI Detection and Governance
mitigated by: AI Security Posture Management (AI-SPM)
citation: Cisco 2025 Data Privacy Benchmark Study
citation: NIST AI 100-1: AI Risk Management Framework
citation: What Is Shadow AI? - IBM
updated: 2026-06-11
version: 1
related cases: C1323
related cases: C1324
related cases: C1325
related cases: C1326
related cases: C1327
related cases: C1328
related cases: C1329

ClickFix Deception Risk
type: Risk
break id: R0154
stix type: x-break-risk
definition: A social engineering risk where attackers disguise themselves as system repair prompts or CAPTCHA verification steps to trick users into voluntarily executing malicious code.
description: ClickFix deception risk is a novel social engineering attack risk where attackers exploit users' trust in system error prompts and repair operations, disguising malicious code execution as legitimate system operations. Unlike R0084 phishing attacks which focus on information theft, ClickFix deception risk focuses on tricking users into directly executing malicious code locally. Main risk scenarios include: 1) Terminal takeover: after users execute malicious commands, attackers gain remote control of the terminal; 2) Credential theft: malicious commands steal passwords, cookies, and session tokens stored in browsers in the background; 3) Ransomware deployment: downloading and executing ransomware through malicious commands to encrypt user files; 4) Persistent backdoor: implanting persistent backdoors in the system for long-term stealthy access; 5) Lateral movement: using the compromised terminal as a springboard to attack other systems in the enterprise internal network. The social engineering effectiveness of ClickFix attacks is significant because users often believe they are "fixing" a problem rather than "being attacked".
complexity: intermediate
influence: Can result in complete terminal compromise, bulk credential leakage, ransomware infection, and enterprise internal network penetration.
keywords: ClickFix Deception Risk
keywords: ClickFix
keywords: clickfix attack
keywords: fake CAPTCHA
keywords: verification fatigue
keywords: copy-paste malware
keywords: terminal paste attack
mitigated by: Security Awareness Training
mitigated by: Endpoint Detection and Response
mitigated by: Human Verification Technology
citation: Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
citation: ClickFix Attacks - HHS Sector Alert
citation: Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue
updated: 2026-06-11
version: 1
related cases: C1330
related cases: C1331
related cases: C1332
related cases: C1333
related cases: C1334
related cases: C1335
related cases: C1336

Post-Quantum Cryptography Risk
type: Risk
break id: R0156
stix type: x-break-risk
definition: The risk that the development of quantum computing may crack currently widely used classical encryption algorithms such as RSA and ECC in the future, causing encrypted communications and data protection to fail.
description: Post-quantum cryptography risk refers to the risk that the development of quantum computing technology may render currently widely used classical public-key encryption algorithms such as RSA and ECC insecure in the future, thereby causing encrypted communications, digital signatures, and data protection to fail. Key threat scenarios include: ① "Harvest Now, Decrypt Later": attackers steal encrypted data now and wait for quantum computers to mature before decrypting, posing an immediate threat to long-term confidential data; ② Digital signature forgery: quantum computers may crack RSA and ECC signature algorithms, enabling attackers to forge legitimate digital certificates and signatures; ③ Encrypted communication cracking: communication protocols based on classical encryption such as TLS/SSL may be cracked, exposing communication contents; ④ Blockchain security threats: elliptic curve signatures used in cryptocurrencies and smart contracts may be cracked. Although general-purpose quantum computers have not yet been realized, governments and security agencies worldwide have listed post-quantum cryptography migration as a priority, and NIST released the first batch of post-quantum cryptography standards in 2024.
complexity: advanced
influence: Can lead to long-term confidential data leakage, collapse of digital trust systems, cryptocurrency security failure, and complete loss of communication privacy.
keywords: Post-Quantum Cryptography Risk
keywords: PQC
keywords: post-quantum cryptography
keywords: quantum-safe crypto
keywords: quantum-resistant crypto
keywords: quantum-safe migration
keywords: harvest now decrypt later
mitigated by: Quantum-Safe Cryptography Migration
mitigated by: Traffic Encryption
mitigated by: Vulnerability Identification
mitigated by: Threat Intelligence
citation: NIST Post-Quantum Cryptography Standards
citation: ENISA: Post-Quantum Cryptography Integration Study
citation: Frequently Asked Questions about Post-Quantum Cryptography
updated: 2026-06-11
version: 1
related cases: C1340
related cases: C1341
related cases: C1342
related cases: C1343
related cases: C1344
related cases: C1345
related cases: C1346

AI Browser/Phone Black Box Risk
type: Risk
break id: R0157
stix type: x-break-risk
definition: The risk that AI functions embedded in AI-native browsers and phones lack transparency and explainability, causing users to be unable to understand and control AI decision-making behaviors.
description: AI browser/phone black box risk refers to the risk that AI functions embedded in the new generation of AI-native devices (such as AI PCs, AI phones, AI browsers) lack transparency and explainability in their decision-making processes, making users unable to understand and control AI behaviors. Unlike R0148 AI Agent Tool Abuse which focuses on AI being maliciously exploited, the AI black box risk focuses on the opacity and uncontrollability of AI systems themselves. Key risk scenarios include: ① Unexplainable autonomous decisions: AI assistants automatically execute operations (such as auto-replying to emails, auto-shopping, auto-subscribing to services) but cannot explain the decision basis to users; ② Opaque data collection: AI functions continuously collect user behavior data in the background, and users cannot know the scope and purpose of data collection; ③ Bias and discrimination: AI decisions may contain biases from training data, leading to unfair recommendations, screening, or pricing; ④ Uncorrectable erroneous decisions: AI's incorrect decisions may be mistakenly trusted by users as correct, and there is a lack of effective correction mechanisms; ⑤ Privacy leakage channels: cloud processing of AI functions may become new channels for data leakage. With the market proliferation of AI PCs and AI phones, the impact of this risk is rapidly expanding.
complexity: intermediate
influence: Can lead to loss of user autonomy, continuous privacy leakage, unfair treatment, spread of erroneous decisions, and weakening of social trust systems.
keywords: AI Browser/Phone Black Box Risk
keywords: AI browser black box
keywords: AI phone black box
keywords: opaque AI
keywords: explainability risk
keywords: transparency risk
keywords: AI-native devices
mitigated by: Algorithm Audit Mechanism
mitigated by: Agent Behavior Sandbox
mitigated by: Shadow AI Detection and Governance
citation: EU AI Act: Transparency Requirements for AI Systems
citation: NIST AI 100-4: AI Transparency and Explainability
citation: Mozilla: AI Black Box and Consumer Privacy
updated: 2026-06-11
version: 1
related cases: C1347
related cases: C1348
related cases: C1349

Smart Contract Vulnerabilities
type: Risk
break id: R0159
stix type: x-break-risk
definition: Security flaws in blockchain smart contract code that can be exploited by attackers to steal assets or disrupt contract logic.
description: Once deployed on the blockchain, smart contracts are typically immutable. Code vulnerabilities (such as reentrancy attacks, integer overflows, permission control flaws) can lead to severe financial losses. Attackers can trigger vulnerabilities through carefully crafted transactions to transfer digital assets or manipulate contract state.
complexity: advanced
influence: Causes loss of platform or user digital assets, disrupts smart contract business logic, damages blockchain application reputation.
keywords: reentrancy
keywords: smart contract vulnerability
mitigated by: Smart Contract Security Audit
mitigated by: Smart Contract Static Analysis Tools
mitigated by: Formal Verification of Smart Contracts
mitigated by: Code Audit and Bug Bounty
citation: OWASP Smart Contract Top 10
citation: GitHub - demining/Dao-Exploit
updated: 2026-06-15
version: 1
related cases: C1354
related cases: C1355
related cases: C1356
related cases: C1357
related cases: C1358

Flash Loan Attacks
type: Risk
break id: R0160
stix type: x-break-risk
definition: Exploiting flash loan features in DeFi protocols to borrow large amounts of assets within a single transaction for price manipulation or arbitrage attacks.
description: Flash loans allow users to borrow large amounts of crypto assets without collateral, but must be repaid within the same transaction. Attackers exploit this feature by manipulating oracle prices, exploiting price differences between protocols, or triggering liquidation mechanisms for profit, causing huge losses to DeFi protocols.
complexity: advanced
influence: Leads to DeFi protocol fund pool depletion, user asset losses, and disruption of market pricing mechanisms.
keywords: flash loan attack
keywords: DeFi exploit
keywords: oracle manipulation
keywords: uncollateralized loan
keywords: single-transaction arbitrage
keywords: liquidation attack
mitigated by: Oracle Price Verification Mechanism
mitigated by: Flash Loan Limit Control
mitigated by: Reentrancy Attack Protection
citation: Euler Finance Flash Loan Attack Explained - Chainalysis
updated: 2026-06-15
version: 1
related cases: C1359
related cases: C1360
related cases: C1361
related cases: C1362
related cases: C1363
related cases: C1364

Cross-Chain Bridge Attacks
type: Risk
break id: R0161
stix type: x-break-risk
definition: Attacks targeting blockchain cross-chain bridge protocols by exploiting bridge contract vulnerabilities or validation mechanism flaws to steal locked assets.
description: Cross-chain bridges facilitate asset transfers between different blockchains, typically requiring assets to be locked on the source chain and equivalent tokens minted on the target chain. Attackers can exploit bridge contract vulnerabilities, multi-signature validation flaws, or oracle manipulation to mint tokens without locking assets, or directly steal assets from the locked pool.
complexity: advanced
influence: Causes cross-chain bridge fund pool theft, user cross-chain asset losses, and impacts multi-chain ecosystem interoperability.
keywords: cross-chain bridge attack
keywords: bridge exploit
keywords: asset bridge hack
keywords: cross-chain message validation
keywords: wrapped asset risk
keywords: bridge validator compromise
mitigated by: Decentralized Cross-Chain Verification Network
mitigated by: Cross-Chain Bridge Smart Contract Auditing and Monitoring
mitigated by: Chain-Agnostic Design and Redundant Architecture
citation: Cross-Chain Bridge Security
updated: 2026-06-15
version: 1
related cases: C1365
related cases: C1366
related cases: C1367
related cases: C1368
related cases: C1369
related cases: C1370
related cases: C1371

Private Key Leakage and Management Risks
type: Risk
break id: R0162
stix type: x-break-risk
definition: Blockchain wallet private keys being stolen, leaked, or improperly managed, leading to digital asset theft.
description: Private keys are the sole credential for controlling blockchain assets; once leaked, the action is irreversible. Attackers can obtain private keys through phishing, malware, social engineering, or insecure storage. Additionally, seed phrase leakage, improper multi-signature threshold settings, or insufficient key generation randomness can also create asset risks.
complexity: intermediate
influence: User digital assets are stolen and cannot be recovered; platform custodial assets face security threats.
keywords: private key leak
keywords: seed phrase exposure
keywords: wallet key compromise
keywords: key management risk
keywords: custody failure
keywords: hot wallet compromise
mitigated by: Hardware Security Module (HSM) Private Key Storage
mitigated by: Encrypted Storage and Password Protection of Private Keys
mitigated by: Source Code and Configuration File Secret Scanning
citation: Cryptocurrency Wallet Security Best Practices
updated: 2026-06-15
version: 1
related cases: C1372
related cases: C1373
related cases: C1374
related cases: C1375
related cases: C1376

Smart Device Hijacking
type: Risk
break id: R0163
stix type: x-break-risk
definition: Attackers gaining control of IoT smart devices through vulnerabilities to steal data, monitor users, or launch attacks.
description: IoT devices are often compromised remotely due to firmware vulnerabilities, weak passwords, or lack of security updates. Hijacked devices can be used for eavesdropping, surveillance, data theft, or incorporated into botnets for DDoS attacks, and may serve as a gateway for infiltrating internal networks.
complexity: advanced
influence: User privacy leakage, devices become attack tools, corporate internal networks are infiltrated.
keywords: IoT hijacking
keywords: smart device hijacking
keywords: device takeover
keywords: botnet infection
keywords: remote device control
keywords: IoT malware
mitigated by: IoT Device Firmware Security Update Mechanism
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Strong Authentication and Default Credential Changes for IoT Devices
citation: OWASP IoT Top 10
updated: 2026-06-15
version: 1
related cases: C1377
related cases: C1378
related cases: C1379
related cases: C1380
related cases: C1381

Firmware Tampering and Backdoors
type: Risk
break id: R0164
stix type: x-break-risk
definition: IoT device firmware being injected with malicious code or backdoors, leading to device function manipulation or data theft.
description: Attackers tamper with device firmware through supply chain poisoning, OTA update hijacking, or physical access, planting backdoor programs. Tampered firmware can remain dormant long-term, continuously stealing data, monitoring user behavior, or triggering malicious actions at specific times, and is difficult to detect with conventional security software.
complexity: advanced
influence: Devices are monitored long-term, data continuously leaked, becoming an entry point for Advanced Persistent Threats (APT).
keywords: firmware tampering
keywords: firmware backdoor
keywords: malicious firmware
keywords: secure boot bypass
keywords: OTA tampering
keywords: embedded device compromise
mitigated by: Firmware Secure Boot Mechanism
mitigated by: Firmware Update Signature Verification and Rollback Protection
mitigated by: Firmware Integrity Monitoring and Physical Tamper Resistance
citation: Firmware Security: Key Challenges and 11 Critical Best Practices
updated: 2026-06-15
version: 1
related cases: C1382
related cases: C1383
related cases: C1384
related cases: C1385

IoT Botnets
type: Risk
break id: R0165
stix type: x-break-risk
definition: Large numbers of compromised IoT devices organized into botnets for launching distributed attacks or other malicious activities.
description: Attackers exploit security vulnerabilities in IoT devices (such as default passwords, unpatched vulnerabilities) to control devices in bulk, forming botnets (such as Mirai, Mozi). These botnets can launch large-scale DDoS attacks, perform cryptocurrency mining, send spam, or serve as attack springboards.
complexity: advanced
influence: Device performance degradation or failure, becoming part of attack infrastructure, affecting internet stability.
keywords: Mirai
keywords: IoT DDoS
keywords: IoT botnet
mitigated by: IoT Traffic Anomaly Detection and C&C Communication Blocking
mitigated by: IoT Device Security Configuration Enforcement
mitigated by: IoT Botnet Traffic Filtering and Rate Limiting
citation: [PDF] Analyzing The Mirai IoT Botnet and Its Recent Variants - arXiv
updated: 2026-06-15
version: 1
related cases: C1386
related cases: C1387
related cases: C1388
related cases: C1389
related cases: C1390
related cases: C1391
related cases: C1392
related cases: C1393

IoT Default Credential Risks
type: Risk
break id: R0166
stix type: x-break-risk
definition: IoT devices using factory default usernames and passwords that remain unchanged, leading to bulk compromise.
description: Many IoT devices ship with identical default credentials (such as admin/admin), which users fail to change or cannot change after deployment. Attackers use publicly available default credential lists for bulk scanning and login, easily controlling large numbers of devices. Some devices even have hardcoded credentials or hidden backdoor accounts.
complexity: basic
influence: Devices are controlled in bulk, user data is leaked, devices are incorporated into botnets.
keywords: default credentials
keywords: IoT default password
keywords: weak device password
keywords: factory credential risk
keywords: credential stuffing on devices
keywords: insecure default configuration
mitigated by: Mandatory Initial Password Configuration
mitigated by: Default Credential Scanning and Auto-Remediation
mitigated by: Certificate-Based Device Authentication
citation: Default Password Lists
updated: 2026-06-15
version: 1
related cases: C1394
related cases: C1395
related cases: C1396
related cases: C1397
related cases: C1398
related cases: C1399

DAO Governance Attacks
type: Risk
break id: R0167
stix type: x-break-risk
definition: Attackers manipulating governance tokens or voting mechanisms to control decision-making power in Decentralized Autonomous Organizations (DAOs).
description: DAOs make governance decisions through token voting. Attackers can manipulate voting results to pass malicious proposals (such as transferring funds, modifying contract parameters, granting themselves privileges) by buying or borrowing large amounts of governance tokens, using flash loans to temporarily gain voting power, bribing token holders, or exploiting proposal mechanism vulnerabilities.
complexity: advanced
influence: DAO funds are stolen or misused, governance mechanisms fail, community trust collapses.
keywords: DAO governance attack
keywords: governance attack
keywords: governance token manipulation
keywords: proposal attack
keywords: vote buying
keywords: governance takeover
mitigated by: Time-Weighted Voting and Timelock Mechanism
mitigated by: Governance Scope Limitation and Multi-Signature Protection
mitigated by: DAO Governance Proposal Monitoring and Emergency Response
citation: DAO Governance Attack Vectors
updated: 2026-06-15
version: 1
related cases: C1400
related cases: C1401
related cases: C1402
related cases: C1403
related cases: C1404
related cases: C1405

Rug Pull (Exit Scam)
type: Risk
break id: R0168
stix type: x-break-risk
definition: Web3 project teams suddenly withdrawing funds and disappearing after raising capital or attracting liquidity, causing investor funds to become worthless.
description: Rug Pull is a common fraud method in the cryptocurrency space. Project teams attract users to invest or provide liquidity through false promotions, then abscond with funds by removing liquidity pools, transferring contract ownership, or exploiting backdoor functions. Some projects appear legitimate but have pre-embedded code vulnerabilities that harvest users at the opportune moment.
complexity: intermediate
influence: Complete loss of investor funds, damage to Web3 ecosystem trust, attracts regulatory attention.
keywords: Rug Pull
keywords: exit scam
mitigated by: Smart Contract Code Auditing and Public Verification
mitigated by: Liquidity Locking and Token Vesting Schedule
mitigated by: Real-Time Rug Pull Detection and Insurance Mechanisms
citation: How to spot rug pulls when everything looks good? : r/solana - Reddit
updated: 2026-06-15
version: 1
related cases: C1406
related cases: C1407
related cases: C1408
related cases: C1409
related cases: C1410
related cases: C1411
related cases: C1412

Oracle Manipulation
type: Risk
break id: R0169
stix type: x-break-risk
definition: Attackers manipulating external data provided by blockchain oracles to affect smart contracts and DeFi protocols that depend on that data.
description: Oracles provide off-chain data (such as prices, weather) to smart contracts. Attackers can manipulate data sources, attack oracle nodes, exploit price delays, or create false prices in low-liquidity markets to cause oracles to report incorrect data, leading to erroneous liquidations in DeFi protocols, incorrect price calculations, and profiting from these manipulations.
complexity: advanced
influence: DeFi protocol fund losses, users incorrectly liquidated, market pricing mechanisms fail.
keywords: oracle manipulation
keywords: price oracle attack
keywords: DeFi oracle risk
keywords: oracle price spoofing
keywords: TWAP manipulation
keywords: data feed compromise
mitigated by: Multi-Source Oracle Aggregation and Anomaly Detection
mitigated by: Time-Weighted Average Price (TWAP) Mechanism
mitigated by: Automated Detection and Circuit Breaker for Oracle Manipulation
mitigated by: Blockchain Analysis Tool Application
mitigated by: On-Chain Compliance and Regulatory Collaboration
citation: Oracle Manipulation Attacks
updated: 2026-06-15
version: 1
related cases: C1413
related cases: C1414
related cases: C1415
related cases: C1416
related cases: C1417
related cases: C1418

MEV Attacks (Miner Extractable Value)
type: Risk
break id: R0170
stix type: x-break-risk
definition: Miners or validators extracting additional value by reordering, inserting, or censoring transactions, harming ordinary user interests.
description: MEV (Miner/Maximal Extractable Value) refers to the additional profit miners/validators gain by controlling the order of transactions within blocks. Common tactics include: front-running, sandwich attacks, and arbitrage transaction reordering. When users' transactions are maliciously reordered, they may suffer slippage losses, transaction failures, or be forced to settle at unfavorable prices.
complexity: advanced
influence: Increased user transaction costs, price slippage losses, blockchain fairness compromised.
keywords: front-running
keywords: sandwich attack
mitigated by: Private Mempool and MEV Protection Services
mitigated by: Commit-Reveal Mechanism
mitigated by: Transaction Slippage Protection and Limit Orders
citation: Flashbots MEV Research
updated: 2026-06-15
version: 1
related cases: C1419
related cases: C1420
related cases: C1421

51% Attack (Double-Spend Attack)
type: Risk
break id: R0171
stix type: x-break-risk
definition: Attackers control over 51% of a blockchain network's hash power or stake, manipulating the consensus mechanism to execute double-spend and other attacks.
description: When attackers control over half of a blockchain network's computing power (PoW) or staked tokens (PoS), they can reorganize blockchain history, reverse confirmed transactions, execute double-spend attacks (spending the same asset multiple times), censor specific transactions, etc. For smaller blockchain networks with lower hash power, such attacks are less costly and easier to execute.
complexity: advanced
influence: Transactions become untrustworthy, assets stolen through double-spending, blockchain consensus mechanism collapses, network value becomes worthless.
keywords: majority attack
keywords: double-spend
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
mitigated by: Hashrate Rental Market Monitoring and Incident Response
citation: What is a 51% Attack on Blockchain? Risks, Examples, and Costs ...
updated: 2026-06-15
version: 1
related cases: C1422
related cases: C1423
related cases: C1424
related cases: C1425
related cases: C1426

Sybil Attack
type: Risk
break id: R0172
stix type: x-break-risk
definition: Attackers create numerous fake identity nodes to control or disrupt decentralized network operations.
description: Sybil attack refers to attackers controlling multiple forged node identities in P2P networks to gain disproportionate influence. Can be used to: manipulate voting and consensus, surround and isolate target nodes, launch eclipse attacks, pollute routing tables, disrupt reputation systems, etc. Blockchain, social networks, IoT and other decentralized systems all face this threat.
complexity: advanced
influence: Network consensus manipulated, node communication isolated, decentralization characteristics nullified, system security degraded.
keywords: Sybil attack
keywords: fake identities
keywords: identity flooding
keywords: airdrop farming
keywords: governance Sybil
keywords: reputation manipulation
mitigated by: On-Chain Reputation and Credit Systems
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
citation: Sybil Attack on Blockchain
updated: 2026-06-15
version: 1
related cases: C1427
related cases: C1428
related cases: C1429
related cases: C1430
related cases: C1431
related cases: C1432

Gas Fee Manipulation
type: Risk
break id: R0173
stix type: x-break-risk
definition: Attackers manipulate blockchain transaction gas fees to affect transaction order or cause network congestion.
description: Gas fees determine transaction priority in blocks. Attackers can: set extremely high gas fees for front-running, send large amounts of low-gas transactions to clog the network, exploit gas price volatility for arbitrage, manipulate gas auction mechanisms, etc., causing ordinary user transactions to delay or fail, or forcing users to pay higher fees.
complexity: advanced
influence: User transaction costs skyrocket, network congestion paralysis, transaction order maliciously manipulated.
keywords: gas manipulation
keywords: gas price manipulation
keywords: transaction fee abuse
keywords: MEV fee strategy
keywords: priority gas auction
keywords: fee market manipulation
mitigated by: Private Mempool and MEV Protection Services
mitigated by: Commit-Reveal Mechanism
mitigated by: Transaction Slippage Protection and Limit Orders
mitigated by: MEV Protection Mechanism
citation: Ethereum Gas Fee Manipulation
updated: 2026-06-15
version: 1
related cases: C1433
related cases: C1434
related cases: C1435
related cases: C1436
related cases: C1437
related cases: C1438

Gas Fee Manipulation and Frontrunning
type: Risk
break id: R0173-001
stix type: x-break-risk
definition: Miners or validators exploit transaction ordering rights to front-run user transactions through gas fee bidding or collude with arbitrage bots to extract MEV profits.
description: Gas fee manipulation and frontrunning exploit transaction ordering, fee bidding, and block construction. Attackers insert transactions before or after user actions for arbitrage or disruption, including sandwich attacks, liquidation sniping, NFT mint frontrunning, and malicious fee escalation. The risk increases user slippage, trading cost, and perceived unfairness. DeFi protocols need private order flow, slippage controls, batch auctions, and MEV mitigation patterns.
complexity: advanced
influence: Frontrunning and gas manipulation increase slippage and trading costs, distort DeFi markets, and weaken confidence in transaction fairness.
keywords: Gas Fee Manipulation and Frontrunning
keywords: gas fee manipulation
keywords: frontrunning
keywords: MEV attack
keywords: transaction ordering manipulation
keywords: sandwich attack
mitigated by: MEV Protection Mechanism
mitigated by: Private Mempool and MEV Protection Services
mitigated by: Transaction Slippage Protection and Limit Orders
citation: Flash Boys 2.0: Frontrunning in Decentralized Exchanges
citation: Ethereum is a Dark Forest - MEV Threats
updated: 2026-06-22
version: 1
related cases: C1569
related cases: C1570
related cases: C1571
related cases: C1572
related cases: C1573

On-Chain Privacy Leakage
type: Risk
break id: R0174
stix type: x-break-risk
definition: The public and transparent nature of blockchain transactions leads to user identity, assets, and transaction behavior privacy information being tracked and analyzed.
description: All transaction records on public chains are permanently public and accessible. Attackers can use on-chain data analysis, address clustering, transaction graph analysis and other techniques to correlate users' real identities with wallet addresses, track asset flows and transaction habits. Even with pseudonymous addresses, de-anonymization is possible through transaction patterns, amount characteristics, time correlations, etc.
complexity: advanced
influence: User assets and transaction privacy completely exposed, becoming targets for targeted attacks, triggering security and regulatory risks.
keywords: on-chain privacy leak
keywords: address clustering
keywords: wallet deanonymization
keywords: transaction graph analysis
keywords: blockchain analytics
keywords: asset exposure
mitigated by: Address Obfuscation and Privacy Protocol Usage
mitigated by: Zero-Knowledge Proofs and On-Chain Privacy Contracts
mitigated by: Off-Chain Transactions and State Channels
mitigated by: On-Chain Data Access Control
mitigated by: Privacy-Preserving Computation Technology Applications
mitigated by: Data Minimization and Purpose Limitation
citation: Blockchain Security and Privacy: Threats, Challenges, Applications ...
updated: 2026-06-15
version: 1
related cases: C1439
related cases: C1440
related cases: C1441
related cases: C1442
related cases: C1443

Blockchain Replay Attack
type: Risk
break id: R0175
stix type: x-break-risk
definition: Attackers replay a legitimate transaction from one chain on another chain or the same chain, causing assets to be transferred repeatedly.
description: In blockchain fork or cross-chain scenarios, if transaction signatures do not include chain ID or other replay protection identifiers, attackers can copy a user's signed transaction from one chain and execute it on another. Typical scenarios include two chains after a hard fork, cross-chain transfers, contract upgrades, etc. Users may unknowingly lose assets on multiple chains.
complexity: advanced
influence: User assets are repeatedly transferred on multiple chains, causing additional losses.
keywords: blockchain replay attack
keywords: transaction replay
keywords: cross-chain replay
keywords: fork replay
keywords: signature replay
keywords: replay protection
mitigated by: Chain ID and Nonce Mechanism
mitigated by: Timestamp and Expiration Mechanism
mitigated by: Signature Consumption and State Tracking
citation: Replay Attack Protection
updated: 2026-06-15
version: 1
related cases: C1444
related cases: C1445
related cases: C1446
related cases: C1447
related cases: C1448

Timestamp Dependence Attack
type: Risk
break id: R0176
stix type: x-break-risk
definition: Smart contracts rely on block timestamps for logic decisions; miners can manipulate timestamps to affect contract execution results.
description: Smart contracts often use block timestamps (block.timestamp) to implement time-related logic, such as lottery draws, option expiration, interest calculations, etc. Miners can freely set block timestamps within a certain range (typically 15 seconds). Attackers can exploit this feature to manipulate contract results, such as selecting favorable draw times, triggering early or delaying execution, etc.
complexity: advanced
influence: Contract logic manipulated, lottery results predictable, time-sensitive business fails.
keywords: timestamp manipulation
keywords: block timestamp dependence
keywords: miner timestamp manipulation
keywords: time-dependent contract
keywords: smart contract timing risk
mitigated by: Smart Contract Security Audit
mitigated by: Smart Contract Static Analysis Tools
mitigated by: Formal Verification of Smart Contracts
mitigated by: Commit-Reveal Mechanism
mitigated by: Timestamp and Expiration Mechanism
citation: Vulnerability: Timestamp Dependence
updated: 2026-06-15
version: 1
related cases: C1449
related cases: C1450
related cases: C1451
related cases: C1452
related cases: C1453

Immutable Contract Design Flaws
type: Risk
break id: R0177
stix type: x-break-risk
definition: Smart contracts cannot be modified or upgraded after deployment; design flaws or vulnerabilities will exist permanently, creating long-term risks.
description: The immutability of blockchain smart contracts is a double-edged sword. Contracts deployed without upgrade mechanisms cannot be fixed even when serious vulnerabilities or business logic errors are discovered; they can only be abandoned and redeployed. This leads to: locked assets cannot be retrieved, business logic errors continue to affect operations, inability to adapt to changing requirements. Even using proxy patterns and other upgrade solutions may introduce new centralization risks and upgrade authority abuse issues.
complexity: advanced
influence: Contract vulnerabilities cannot be fixed, funds permanently locked, business cannot iterate and optimize.
keywords: immutable contract flaw
keywords: unupgradeable contract risk
keywords: smart contract design flaw
keywords: no emergency pause
keywords: contract migration risk
keywords: irreversible deployment
mitigated by: Proxy Contract Upgrade Pattern
mitigated by: Modular and Minimal Contract Design
mitigated by: Comprehensive Auditing and Formal Verification
mitigated by: Contract Upgrade and Emergency Pause
mitigated by: Code Audit and Bug Bounty
citation: [2407.01493] Immutable in Principle, Upgradeable by Design - arXiv
updated: 2026-06-15
version: 1
related cases: C1454
related cases: C1455

IoT Side-Channel Attacks
type: Risk
break id: R0178
stix type: x-break-risk
definition: Obtaining sensitive information or keys by analyzing physical characteristics (power consumption, electromagnetic radiation, sound, etc.) of IoT devices during operation.
description: Side-channel attacks exploit physical side-channel information generated by devices during operations to infer internal data. Common methods include: power analysis attacks (SPA/DPA), electromagnetic radiation analysis, timing attacks, acoustic attacks, temperature analysis, etc. Attackers can extract keys and recover sensitive data through physical signals without directly cracking encryption algorithms. IoT devices are especially vulnerable due to resource constraints and physical accessibility.
complexity: advanced
influence: Encryption keys extracted, device firmware completely copied, user privacy data leaked.
keywords: side-channel attack
keywords: IoT side-channel
keywords: power analysis
keywords: electromagnetic leakage
keywords: timing side channel
keywords: hardware side channel
mitigated by: Hardware Side-Channel Protection Design
mitigated by: Software-Level Side-Channel Mitigation
mitigated by: Side-Channel Attack Detection and Monitoring
citation: Side-Channel Attacks on IoT: Risks and Mitigation in Embedded ...
updated: 2026-06-15
version: 1
related cases: C1456
related cases: C1457
related cases: C1458
related cases: C1459
related cases: C1460
related cases: C1461
related cases: C1462

Industrial IoT (IIoT) Security Risks
type: Risk
break id: R0179
stix type: x-break-risk
definition: Special security threats faced by Industrial IoT devices and systems that may lead to production disruption, equipment damage, or personal safety accidents.
description: Industrial IoT connects critical infrastructure such as production equipment, sensors, and control systems. Attackers can infiltrate IIoT devices to: tamper with production parameters causing product quality issues, damage equipment operation leading to safety accidents, steal industrial secrets, launch targeted ransomware. IIoT devices typically have long lifecycles, are difficult to update, use insecure industrial protocols (such as Modbus, SCADA), and have expanded attack surfaces when interconnected with IT networks.
complexity: advanced
influence: Production line paralysis, equipment destruction, personnel casualties, industrial secret leakage, supply chain disruption.
keywords: industrial IoT security
keywords: IIoT risk
keywords: industrial device exposure
keywords: ICS IoT
keywords: OT security
keywords: industrial sensor compromise
mitigated by: Industrial Network Isolation and Segmentation
mitigated by: Industrial Protocol Security Hardening
mitigated by: ICS Security Monitoring and Incident Response
citation: ICS-CERT Advisories
updated: 2026-06-15
version: 1
related cases: C1463
related cases: C1464
related cases: C1465
related cases: C1466
related cases: C1467
related cases: C1468
related cases: C1469

Connected Vehicle (V2X) Security Risks
type: Risk
break id: R0180
stix type: x-break-risk
definition: Security threats faced by vehicle-to-everything communication systems that may lead to traffic accidents, privacy breaches, or remote vehicle control.
description: V2X enables communication between vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-pedestrian (V2P). Attackers can: forge false traffic information causing accidents, hijack vehicle communication systems, remotely control critical vehicle functions (brakes, steering), steal driver location and driving data, interfere with autonomous driving decisions, etc. Vehicle CAN bus, OBD ports, and in-vehicle entertainment systems are all potential attack surfaces.
complexity: advanced
influence: Traffic accidents causing casualties, vehicles remotely controlled, user location privacy leaked, autonomous driving system failure.
keywords: connected vehicle security
keywords: V2X security
keywords: vehicle API risk
keywords: telematics attack
keywords: automotive cybersecurity
keywords: vehicle communication attack
mitigated by: V2X PKI Authentication System
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Certificate-Based Device Authentication
mitigated by: Firmware OTA Update Signature Verification
mitigated by: OTA Channel Encryption and Integrity Protection
citation: Vehicle Cybersecurity Best Practices
updated: 2026-06-15
version: 1
related cases: C1470
related cases: C1471
related cases: C1472

OTA Update Hijacking
type: Risk
break id: R0181
stix type: x-break-risk
definition: Attackers hijack the Over-The-Air (OTA) update process of IoT devices to implant malicious firmware or prevent security updates.
description: OTA update is the primary method for remotely upgrading IoT device firmware. Attackers can hijack update channels through man-in-the-middle attacks, forge update servers, exploit update protocol vulnerabilities, etc., to push malicious firmware or prevent security patch installation. If update packages lack encryption signature verification or have verification mechanism flaws, devices will install malicious firmware and be controlled long-term.
complexity: advanced
influence: Devices implanted with backdoor firmware, security vulnerabilities cannot be fixed, batch devices continuously controlled.
keywords: OTA hijacking
keywords: OTA update attack
keywords: firmware update hijack
keywords: vehicle OTA risk
keywords: update package tampering
keywords: rollback attack
mitigated by: Firmware OTA Update Signature Verification
mitigated by: OTA Channel Encryption and Integrity Protection
mitigated by: Phased OTA Deployment and Canary Release
citation: Secure OTA Update Best Practices
updated: 2026-06-15
version: 1
related cases: C1473
related cases: C1474

Automotive OTA Update Hijacking
type: Risk
break id: R0181-001
stix type: x-break-risk
definition: Attackers tamper with or replay vehicle OTA packages to implant malicious firmware or block fixes.
description: Automotive OTA update hijacking targets firmware, configuration, or application update flows. Attackers may tamper with update packages, replay old versions, hijack download channels, or abuse signing workflows so vehicles install malicious or vulnerable software. Vehicle updates affect safety functions and compliance fixes. Automakers need end-to-end signature verification, anti-rollback, staged release monitoring, and abnormal update blocking.
complexity: advanced
influence: Hijacked OTA updates can install malicious firmware, block security patches, or roll vehicles back to vulnerable versions.
keywords: automotive OTA hijacking
keywords: OTA update hijacking
keywords: vehicle firmware tampering
keywords: OTA package replay
keywords: vehicle software supply chain
mitigated by: Connected-Vehicle OTA Security Governance
mitigated by: Firmware OTA Update Signature Verification
mitigated by: OTA Channel Encryption and Integrity Protection
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-22
version: 1
related cases: C1776
related cases: C1777
related cases: C1778

IoT Data Tampering Attack
type: Risk
break id: R0182
stix type: x-break-risk
definition: Attackers tamper with data transmitted or stored by IoT devices, leading to incorrect decisions or system failure.
description: IoT devices collect, transmit, and store large amounts of sensitive data. Without integrity protection, attackers can tamper with data through man-in-the-middle attacks, device intrusion, etc. Typical scenarios include: tampering sensor readings to affect automated decisions (such as temperature, pressure, humidity), modifying device logs to cover attack traces, forging authentication data, tampering control commands, etc. In industrial, medical, and smart city scenarios, this may cause serious consequences.
complexity: advanced
influence: Dangerous decisions based on incorrect data, system control failure, attack behavior hidden, audit logs untrustworthy.
keywords: IoT data tampering
keywords: sensor data tampering
keywords: telemetry manipulation
keywords: device data integrity
keywords: false sensor data
keywords: edge data spoofing
mitigated by: Anti-Tampering Mechanism
mitigated by: Traffic Encryption
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Certificate-Based Device Authentication
mitigated by: IoT Traffic Monitoring and Anomaly Detection
citation: Privacy and Integrity Protection for IoT Multimodal Data Using ...
updated: 2026-06-15
version: 1
related cases: C1475

Virtual Land/Asset Fraud
type: Risk
break id: R0183
stix type: x-break-risk
definition: Fraudulent activities in metaverse virtual land or digital asset transactions, including false sales, duplicate sales, and price manipulation.
description: Metaverse virtual land and asset trading markets face multiple fraud risks: project teams falsely promoting scarcity before over-issuing, selling the same plot to multiple people, manipulating scarce land prices before dumping, forging virtual asset ownership certificates, false promises of future returns, etc. Due to lack of unified regulation and ownership verification mechanisms, investor rights protection is difficult and financial losses are hard to recover.
complexity: intermediate
influence: Investor financial losses, virtual asset ownership disputes, metaverse market trust collapse.
keywords: metaverse fraud
keywords: virtual land fraud
keywords: virtual asset scam
keywords: NFT land scam
keywords: metaverse investment fraud
keywords: digital asset fraud
mitigated by: On-Chain Asset Ownership Verification and Traceability in the Metaverse
mitigated by: Virtual Land Trading Platform Review Mechanism
mitigated by: Virtual Asset Valuation and Information Disclosure
citation: Is anyone else tired of the bullshit Metaverse virtual real estate stories?
updated: 2026-06-15
version: 1
related cases: C1476
related cases: C1477

Metaverse Identity Theft
type: Risk
break id: R0184
stix type: x-break-risk
definition: Attackers stealing or forging users' virtual identities in the metaverse to conduct fraud, harassment, or asset theft.
description: In the metaverse, users engage in social activities and transactions through digital identities (avatars, accounts, NFT identities, etc.). Attackers can steal account credentials, forge similar avatar identities, use deepfake technology to impersonate others, etc., to conduct fraud, scam friends, steal virtual assets, damage reputation, and harass in the metaverse. The imperfection of decentralized identity systems makes identity verification and accountability difficult.
complexity: advanced
influence: User virtual assets stolen, social network relationships disrupted, reputation damaged, fraud losses incurred.
keywords: metaverse identity theft
keywords: virtual identity theft
keywords: avatar impersonation
keywords: account takeover
keywords: digital identity abuse
keywords: virtual profile hijacking
mitigated by: Decentralized On-Chain Identity Verification
mitigated by: Metaverse Identity Federation
mitigated by: Multi-Factor Authentication
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Cross Virtual-Real Identity Isolation
citation: Metaverse Identity Security
updated: 2026-06-15
version: 1
related cases: C1478
related cases: C1479
related cases: C1480
related cases: C1481

Virtual World Asset Theft
type: Risk
break id: R0185
stix type: x-break-risk
definition: Illegal theft or transfer of users' virtual assets (equipment, items, currency, NFTs, etc.) in the metaverse.
description: Virtual assets in the metaverse have real economic value, making them targets for attackers. Theft methods include: exploiting smart contract vulnerabilities to transfer NFT assets, obtaining wallet private keys through social engineering, hacking game servers to steal items, exploiting trading system vulnerabilities to duplicate assets, phishing websites to induce authorization, etc. The digital nature of virtual assets makes them easy to steal in bulk and quickly transfer, with cross-border tracking being difficult.
complexity: advanced
influence: User virtual property losses, metaverse economic system imbalance, platform reputation damage.
keywords: virtual asset theft
keywords: metaverse asset theft
keywords: NFT theft
keywords: digital item theft
keywords: wallet draining
keywords: in-game asset theft
mitigated by: On-Chain Asset Ownership Verification and Traceability in the Metaverse
mitigated by: Decentralized On-Chain Identity Verification
mitigated by: On-Chain Reputation and Credit Systems
mitigated by: Zero-Knowledge KYC and Privacy Protection
mitigated by: Hardware Security Module (HSM) Private Key Storage
mitigated by: Encrypted Storage and Password Protection of Private Keys
mitigated by: Smart Contract Security Audit
mitigated by: Virtual Asset Cross-Chain Verification
citation: Virtual Assets - FATF
updated: 2026-06-15
version: 1
related cases: C1482
related cases: C1483
related cases: C1484
related cases: C1485

Eclipse Attack
type: Risk
break id: R0186
stix type: x-break-risk
definition: Attackers control all network connections of a target node, isolating it from the honest network and manipulating the blockchain information it receives.
description: Eclipse attack targets individual nodes in P2P networks. Attackers use Sybil nodes to occupy all connection slots of the target node, isolating it from the real network. The isolated node can only receive information from attackers, who can provide false blockchain views, hide transactions, execute double-spend attacks, or cause incorrect consensus votes. Lightweight nodes and SPV clients are especially vulnerable.
complexity: advanced
influence: Node receives false blockchain data, transactions double-spent, consensus voting manipulated, network partitioned.
keywords: eclipse attack
keywords: peer isolation attack
keywords: blockchain network partition
keywords: node isolation
keywords: P2P network attack
keywords: consensus manipulation
mitigated by: On-Chain Reputation and Credit Systems
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
mitigated by: Hashrate Rental Market Monitoring and Incident Response
citation: Eclipse Attacks on Bitcoin's Peer-to-Peer Network
updated: 2026-06-15
version: 1
related cases: C1486
related cases: C1487
related cases: C1488
related cases: C1489
related cases: C1490
related cases: C1491

Long-Range Attack / Nothing-at-Stake
type: Risk
break id: R0187
stix type: x-break-risk
definition: In PoS blockchains, attackers use historical private keys to construct an alternative chain from the genesis block, attempting to overwrite the main chain history.
description: Long-range attack is a threat specific to PoS consensus mechanisms. After obtaining private keys of early stakeholders, attackers can fork from any point in blockchain history and build an alternative chain. Since PoS validation requires no actual computing power (nothing-at-stake), attackers can construct longer chains at low cost. Newly joining nodes may mistake the forged chain as the main chain.
complexity: advanced
influence: Blockchain history rewritten, transactions reversed, new nodes accept false chain, consensus mechanism trust collapses.
keywords: long-range attack
keywords: nothing-at-stake
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
mitigated by: Hashrate Rental Market Monitoring and Incident Response
citation: Long-Range Attacks on Proof-of-Stake
updated: 2026-06-15
version: 1
related cases: C1492
related cases: C1493
related cases: C1494
related cases: C1495
related cases: C1496
related cases: C1497
related cases: C1498

Selfish Mining
type: Risk
break id: R0188
stix type: x-break-risk
definition: Miners deliberately hide mined blocks and reveal them at strategic times to gain excess profits, undermining blockchain fairness.
description: Selfish mining is a strategic miner attack. After mining a new block, the miner does not immediately broadcast it but continues mining on a private chain. When the public chain catches up, they selectively reveal the private chain to make it the main chain, invalidating other miners' work. This strategy allows mining pools with over 33% hash power to gain revenue exceeding their hash power share, while reducing overall network security and wasting computational resources.
complexity: advanced
influence: Honest miner revenue reduced, computational resources wasted, blockchain security degraded, centralization trend intensified.
keywords: selfish mining
keywords: block withholding
keywords: mining pool manipulation
keywords: consensus attack
keywords: block propagation abuse
keywords: miner strategy attack
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
mitigated by: Hashrate Rental Market Monitoring and Incident Response
citation: Majority is not Enough: Bitcoin Mining is Vulnerable
updated: 2026-06-15
version: 1
related cases: C1499
related cases: C1500
related cases: C1501

Sensor Spoofing Attack
type: Risk
break id: R0189
stix type: x-break-risk
definition: Attackers deceive IoT sensors through physical or electronic means to collect false data, causing systems to make incorrect decisions.
description: Sensors are the data source for IoT systems, and their accuracy directly affects system decisions. Attackers can deceive sensors through various methods: physical interference (such as using bright light to deceive light sensors, heat sources to deceive temperature sensors), electromagnetic interference, signal injection, sensor saturation attacks, etc. In autonomous driving, industrial control, smart home, and security monitoring scenarios, false sensor data may lead to serious consequences.
complexity: advanced
influence: System makes dangerous decisions based on incorrect data, security mechanisms bypassed, accident risks increased, monitoring fails.
keywords: sensor spoofing
keywords: GPS spoofing
keywords: sensor data spoofing
keywords: IoT sensor attack
keywords: false telemetry
keywords: perception spoofing
mitigated by: Anti-Tampering Mechanism
mitigated by: IoT Traffic Monitoring and Anomaly Detection
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Certificate-Based Device Authentication
citation: Identify spoofing attacks in Internet of Things (IoT) environments ...
updated: 2026-06-15
version: 1
related cases: C1502
related cases: C1503
related cases: C1504
related cases: C1505

Internet of Medical Things (IoMT) Security Risks
type: Risk
break id: R0190
stix type: x-break-risk
definition: Special security threats faced by medical IoT devices that may directly endanger patient life safety and privacy.
description: IoMT connects critical medical devices such as pacemakers, insulin pumps, infusion pumps, and patient monitors. Attackers can control devices through wireless hijacking, firmware tampering, and protocol vulnerabilities, causing: incorrect medication dosages leading to patient casualties, tampering with vital signs data misleading diagnoses, shutting down life-saving equipment, stealing sensitive patient health privacy, etc. Medical devices are typically difficult to update, have long certification cycles and service lives, with weak security protections.
complexity: advanced
influence: Patient life safety threatened, massive health privacy leaks, medical accidents, hospital operations paralyzed, legal liability.
keywords: medical device security
keywords: IoMT security
keywords: connected medical device
keywords: healthcare IoT risk
keywords: patient safety risk
keywords: medical sensor compromise
mitigated by: Medical Device Security Gateway
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Certificate-Based Device Authentication
mitigated by: Firmware OTA Update Signature Verification
mitigated by: OTA Channel Encryption and Integrity Protection
citation: FDA Medical Device Cybersecurity Guidance
updated: 2026-06-15
version: 1
related cases: C1506
related cases: C1507

AR/VR Device Security Risks
type: Risk
break id: R0191
stix type: x-break-risk
definition: Special security threats faced by Augmented Reality (AR) and Virtual Reality (VR) devices that may lead to privacy breaches, physical harm, or device hijacking.
description: AR/VR devices integrate numerous sensors (cameras, microphones, eye tracking, gesture recognition, etc.) and immersive interactions, facing unique risks: continuous user visual and auditory monitoring after device hijacking, stealing eye-tracking data to infer sensitive information (such as passwords, health conditions), tampering with reality overlay content to mislead user behavior, VR motion sickness attacks affecting physical health, minors' exposure to inappropriate content, etc. Device firmware and application ecosystem lack adequate security protections.
complexity: advanced
influence: Comprehensive user privacy leakage, biometric data stolen, physical space security threats, mental health impacts.
keywords: VR privacy
keywords: AR device security
keywords: XR privacy
keywords: headset sensor data
keywords: eye tracking privacy
keywords: spatial data exposure
mitigated by: XR Device Trusted Boot
mitigated by: Spatial Data Privacy Protection
mitigated by: Mobile Threat Defense (MTD)
mitigated by: Network Isolation and Access Control for IoT Devices
citation: Security and privacy for augmented reality systems
updated: 2026-06-15
version: 1
related cases: C1508
related cases: C1509
related cases: C1510
related cases: C1511
related cases: C1512

Virtual World Harassment and Violence
type: Risk
break id: R0192
stix type: x-break-risk
definition: Virtual harassment, violent behavior, and inappropriate content experienced by users in the metaverse that may cause psychological trauma and real-world harm.
description: The immersive nature of the metaverse makes the psychological impact of virtual harassment and violence approach real-life experiences. Risks include: virtual sexual harassment and personal space invasion, verbal violence and cyberbullying, psychological trauma from virtual violent behavior, minors' exposure to inappropriate content, deepfake technology creating false inappropriate content, virtual stalking and harassment, etc. Due to anonymity and cross-border characteristics, accountability and regulation are difficult, and victim protection mechanisms are imperfect.
complexity: intermediate
influence: User psychological trauma and PTSD, minors' mental and physical health damage, platform reputation and legal liability, user attrition.
keywords: virtual harassment
keywords: metaverse harassment
keywords: VR harassment
keywords: cyberbullying
keywords: virtual violence
keywords: immersive safety
mitigated by: Malicious Content Detection
mitigated by: Automated Malicious Document Detection
mitigated by: 3D Content AI Moderation
mitigated by: Security Awareness Training
mitigated by: Account Penalty
citation: [PDF] Investigating Harassment and Safety in VR - USENIX
updated: 2026-06-15
version: 1
related cases: C1513
related cases: C1514
related cases: C1515
related cases: C1516
related cases: C1517

Blockchain Supply Chain Attack
type: Risk
break id: R0193
stix type: x-break-risk
definition: Attackers compromise blockchain development tools, SDKs, wallet plugins and other supply chain components to inject malicious code, affecting numerous downstream projects and users.
description: Blockchain supply chain attacks target development tools, wallet plugins, SDKs, node components, frontend dependencies, and release processes. Attackers tamper with dependencies, insert backdoors, or take over publisher accounts to deliver malicious logic to downstream Web3 projects. Because Web3 applications directly handle keys, signatures, and on-chain assets, supply chain compromise can trigger asset theft, authorization tampering, or sensitive data exposure during normal user interactions.
complexity: advanced
influence: A compromised Web3 dependency or release path can spread asset theft and backdoors across many downstream projects, damaging ecosystem trust.
keywords: blockchain supply chain attack
keywords: Web3 supply chain
keywords: wallet plugin poisoning
keywords: SDK poisoning
keywords: malicious dependency
keywords: build pipeline compromise
mitigated by: Supply Chain Security Audit
mitigated by: Blockchain Supply Chain Security Audit
mitigated by: Threat Intelligence
mitigated by: Legal Action
mitigated by: Vulnerability Identification
citation: 2025 Web3 Security Annual Report: Supply Chain Attacks Become the Largest Threat
citation: Blockchain Security: Preventing Threats Before They Strike
updated: 2026-06-22
version: 1
related cases: C0805
related cases: C1518
related cases: C1519
related cases: C1520

Telegram Bot Phishing
type: Risk
break id: R0195
stix type: x-break-risk
definition: As Web3 communities primarily use Telegram, attackers create fake official bots or hijack community groups to trick users into connecting wallets or revealing seed phrases.
description: Telegram Bot phishing exploits Web3 communities, airdrop campaigns, and support channels. Attackers impersonate official bots, moderators, or verification tools to lure users into phishing links, wallet connections, or seed phrase disclosure. Fast-moving Telegram groups and easy identity spoofing make the attack effective, especially when combined with fake announcements, private messages, and urgent reward claims.
complexity: intermediate
influence: Telegram impersonation can lead users to expose seed phrases or connect wallets to phishing sites, enabling immediate wallet takeover and community trust damage.
keywords: Telegram bot phishing
keywords: fake Telegram bot
keywords: Web3 community phishing
keywords: seed phrase phishing
keywords: wallet connection phishing
mitigated by: Real-Name Identity Verification
mitigated by: Telegram Official Verification
mitigated by: Threat Intelligence
mitigated by: Legal Action
mitigated by: Endpoint Detection and Response
citation: H1 2025 Blockchain Security Report: Telegram Bot Phishing Risks
citation: Telegram FAQ
updated: 2026-06-22
version: 1
related cases: C1526
related cases: C1527
related cases: C1528
related cases: C1529
related cases: C1530

Quantum Computing Threat
type: Risk
break id: R0196
stix type: x-break-risk
definition: Quantum computers may break the Elliptic Curve Cryptography (ECC) used by blockchains before 2028, threatening private key security and transaction integrity.
description: Quantum computing threat means that sufficiently mature quantum capability could weaken the elliptic curve cryptography assumptions used by blockchains, wallets, and identity systems. Long-lived public keys, signature algorithms, and key management processes become migration pressure points. Large-scale practical quantum computing remains uncertain, but high-value assets and long-lived credentials should plan for post-quantum migration, address rotation, signature upgrades, and ecosystem compatibility testing.
complexity: advanced
influence: Quantum advances could undermine long-lived blockchain keys and signatures, forcing costly ecosystem migration and threatening high-value assets.
keywords: quantum computing threat
keywords: post-quantum cryptography
keywords: ECC breaking
keywords: blockchain quantum risk
keywords: quantum-resistant migration
mitigated by: Quantum-Safe Cryptography Migration
mitigated by: Transaction Risk Monitoring
mitigated by: Vulnerability Identification
mitigated by: Threat Intelligence
citation: Blockchain security challenges under quantum threats
citation: Ethereum Quantum Resistance Roadmap
updated: 2026-06-22
version: 1
related cases: C1531
related cases: C1532
related cases: C1533
related cases: C1534
related cases: C1535
related cases: C1536
related cases: C1537

Multi-Signature Wallet Social Engineering
type: Risk
break id: R0197
stix type: x-break-risk
definition: Attackers use social engineering (fake urgent proposals, impersonating team members) to trick multi-signature wallet signers into quickly approving malicious transactions.
description: Multi-signature wallet social engineering targets DAO, foundation, and institutional treasury approval flows. Attackers forge urgent proposals, impersonate team members, create pressure, or send misleading transaction summaries to make multiple signers approve malicious transactions. Multisig reduces single-key failure but does not prevent coordinated mistaken approvals. Governance needs transaction simulation, timelocks, permission tiers, and independent review.
complexity: intermediate
influence: Socially engineered multisig approvals can drain DAO or institutional treasuries despite formal multi-party controls.
keywords: multi-signature wallet social engineering
keywords: multisig phishing
keywords: DAO treasury attack
keywords: malicious proposal signing
keywords: emergency proposal scam
mitigated by: Multi-Sig Timelock Mechanism
mitigated by: Adding Approval Processes
mitigated by: Privileged Access Management
citation: 2024 Crypto Crime Trends from Chainalysis
citation: Multisig Best Practices to Maximize Transaction Security - Polygon
updated: 2026-06-22
version: 1
related cases: C1538
related cases: C1539
related cases: C1540

Token Minting and Deflation Bug
type: Risk
break id: R0198
stix type: x-break-risk
definition: Token economic model vulnerabilities in smart contracts allow unauthorized minting (inflation) or burning (deflation) of tokens, disrupting economic balance.
description: Token minting and deflation bugs arise from smart contract permission errors, arithmetic flaws, hook logic, or upgrade mistakes. Attackers may mint tokens without authorization, destroy supply abnormally, or corrupt balance accounting. These bugs directly undermine scarcity and market expectations, leading to price collapse, liquidity loss, and governance distortion. Token economics, permissions, and edge states need dedicated review before launch.
complexity: advanced
influence: Unauthorized minting or supply manipulation can collapse token value, drain liquidity, and invalidate governance or incentive assumptions.
keywords: Token Minting and Deflation Bug
keywords: token minting bug
keywords: token deflation bug
keywords: unauthorized minting
keywords: tokenomics vulnerability
keywords: smart contract mint bug
mitigated by: Vulnerability Remediation
mitigated by: Token Economic Model Audit
mitigated by: Smart Contract Static Analysis Tools
mitigated by: Legal Action
citation: Smart Contract Token Economics Security
citation: Building Secure Smart Contracts
updated: 2026-06-22
version: 1
related cases: Osmosis Chain Liquidity Pool Drain Vulnerability Incident
related cases: C1541
related cases: C1542
related cases: C1543

NFT Royalty Bypass
type: Risk
break id: R0199
stix type: x-break-risk
definition: Attackers bypass NFT marketplace royalty mechanisms through off-market trades or custom contracts, depriving creators of secondary sales revenue.
description: NFT royalty bypass occurs when traders use off-market transfers, custom contracts, aggregators, or marketplaces that do not enforce royalty rules. The creator may define a royalty policy, but enforcement depends on contracts and marketplace behavior. This weakens creator revenue and creates inconsistent rules across markets. Projects need to distinguish between on-chain enforceability, marketplace commitments, and community governance.
complexity: intermediate
influence: Royalty bypass reduces creator revenue, fragments marketplace rules, and weakens the economic model for NFT projects.
keywords: NFT royalty bypass
keywords: royalty evasion
keywords: off-market NFT trade
keywords: custom contract sale
keywords: creator royalty
mitigated by: On-Chain Royalty Enforcement
mitigated by: Transaction Risk Monitoring
mitigated by: Smart Contract Static Analysis Tools
mitigated by: Legal Action
citation: How NFT royalties work: Designs, challenges, and new ideas
citation: EIP-2981: NFT Royalty Standard
updated: 2026-06-22
version: 1
related cases: C1544
related cases: C1545
related cases: C1546
related cases: C1547
related cases: C1548
related cases: C1549

Layer 2 Bridging Risk
type: Risk
break id: R0200
stix type: x-break-risk
definition: Asset bridges between Layer2 scaling solutions (Rollup, sidechains) and mainchain have security vulnerabilities that may result in funds being locked or stolen.
description: Layer 2 bridging risk sits in asset locking, message validation, exit proofs, and relayer workflows between the base chain and rollups, sidechains, or app chains. A validation flaw or privileged key abuse can lock funds or release assets incorrectly. Bridges often hold large liquidity and depend on complex on-chain and off-chain coordination. Security review must cover contracts, proof systems, operational keys, delay windows, and emergency exits.
complexity: advanced
influence: Bridge failures can lock or incorrectly release cross-layer assets, creating large liquidity losses and user confidence damage.
keywords: Layer 2 bridge risk
keywords: cross-chain bridge risk
keywords: Rollup bridge
keywords: sidechain bridge
keywords: asset bridge vulnerability
mitigated by: Vulnerability Remediation
mitigated by: Layer2 Bridge Security Audit
mitigated by: Decentralized Cross-Chain Verification Network
mitigated by: Cross-Chain Bridge Smart Contract Auditing and Monitoring
mitigated by: Chain-Agnostic Design and Redundant Architecture
citation: L2BEAT - Layer2 Bridge Risk Analysis
citation: Blockchain Cross-Chain Bridge Security: Challenges, Solutions, and ...
updated: 2026-06-22
version: 1
related cases: C1368
related cases: C1370
related cases: C1550
related cases: C1551
related cases: C1552
related cases: C1553
related cases: C1554
related cases: C1555

Account Abstraction Wallet Risk
type: Risk
break id: R0201
stix type: x-break-risk
definition: Account abstraction standards like ERC-4337 introduce new attack surfaces including UserOperation validation bypass, Paymaster abuse, and malicious aggregators.
description: Account abstraction wallets move signature validation, gas sponsorship, batch execution, and permission logic into smart contracts. This introduces UserOperation, Bundler, Paymaster, and aggregation components, each with new failure modes. The architecture improves usability but expands the attack surface. Designers must reason about permission models, replay protection, simulation differences, and the trust boundary of third-party sponsorship services.
complexity: advanced
influence: Account abstraction flaws can enable unauthorized execution, fee sponsorship abuse, or wallet policy bypass in new smart wallet designs.
keywords: account abstraction wallet risk
keywords: ERC-4337 risk
keywords: UserOperation bypass
keywords: Paymaster abuse
keywords: smart contract wallet risk
mitigated by: Account Abstraction Security Audit
mitigated by: Hardware Security Module (HSM) Private Key Storage
mitigated by: Encrypted Storage and Password Protection of Private Keys
mitigated by: EIP Security Verification Mechanism
mitigated by: DApp Frontend Integrity Verification
citation: EIP-4337: Account Abstraction
citation: Account Abstraction Security Considerations
updated: 2026-06-22
version: 1
related cases: C1556
related cases: C1557
related cases: C1558

On-Chain Data Privacy Exposure
type: Risk
break id: R0202
stix type: x-break-risk
definition: Blockchain transaction transparency allows tracking of user behavior, asset holdings and identity through MEV bot monitoring, address clustering analysis and other means.
description: On-chain privacy exposure comes from public visibility of transactions, addresses, balances, and contract interactions. Attackers can combine address clustering, transaction graphs, MEV monitoring, and off-chain data to infer asset holdings, behavior, and identity links. The leak may not involve a breach; it is a byproduct of transparent ledgers and analytics. High-value users and institutions need address isolation, privacy-preserving protocols, and minimal off-chain disclosure.
complexity: intermediate
influence: On-chain privacy exposure can reveal asset holdings, trading habits, and identity links, enabling targeted phishing, extortion, or surveillance.
keywords: on-chain privacy exposure
keywords: address clustering
keywords: blockchain analytics
keywords: MEV monitoring
keywords: transaction tracing
mitigated by: Zero-Knowledge Proof
mitigated by: On-Chain Privacy Protection
mitigated by: On-Chain Data Access Control
mitigated by: Privacy-Preserving Computation Technology Applications
mitigated by: Data Minimization and Purpose Limitation
citation: An Empirical Analysis of Privacy in the Lightning Network
citation: Chainalysis: The Blockchain Data Platform
updated: 2026-06-22
version: 1
related cases: C1440
related cases: C1559
related cases: C1560
related cases: C1561
related cases: C1562
related cases: C1563

DApp Frontend Hijacking
type: Risk
break id: R0203
stix type: x-break-risk
definition: Attackers hijack IPFS gateways or poison DNS to tamper with DApp frontend code, replacing payment addresses or injecting malicious interactions without user awareness.
description: DApp frontend hijacking targets the user access layer rather than the on-chain contract. Attackers may abuse DNS, IPFS gateways, CDN configuration, or frontend dependencies to alter displayed content and wallet interaction parameters. Users see a familiar interface while signing requests or recipient addresses may be replaced. Projects need release integrity, domain hardening, resource verification, and independent transaction previews.
complexity: intermediate
influence: Frontend hijacking can make users sign malicious transactions on a familiar DApp interface, sending funds or approvals to attackers.
keywords: DApp frontend hijacking
keywords: DApp DNS hijacking
keywords: IPFS gateway hijacking
keywords: frontend supply chain attack
keywords: wallet interaction tampering
mitigated by: DApp Frontend Integrity Verification
mitigated by: Supply Chain Security Audit
mitigated by: Anomalous Access Behavior Detection
citation: What is dApp Security? - CertiK
citation: IPFS Content Addressing and Security
updated: 2026-06-22
version: 1
related cases: C0729
related cases: C1564
related cases: C1565
related cases: C1566
related cases: C1567
related cases: C1568

AIoT Convergence Attack
type: Risk
break id: R0205
stix type: x-break-risk
definition: Attackers compromise IoT device AI decision systems through model poisoning, adversarial examples and other means, causing misjudgment or malicious behavior.
description: AIoT convergence attacks target IoT devices that use AI for perception, inference, or automated control. Attackers may use adversarial inputs, sensor spoofing, model poisoning, or firmware tampering to influence decisions and actions. When AIoT is used in access control, traffic, healthcare, industrial, or home automation, data-layer attacks can produce physical consequences. Protection must combine model robustness, device identity, trusted data, and execution safety.
complexity: advanced
influence: AIoT manipulation can turn model or sensor attacks into unsafe physical actions in homes, factories, healthcare, or transport systems.
keywords: AIoT attack
keywords: AIoT security
keywords: IoT AI attack
keywords: adversarial example
keywords: model poisoning
keywords: smart device misclassification
mitigated by: AIoT Model Security Protection
mitigated by: Endpoint Detection and Response
mitigated by: IoT Traffic Monitoring and Anomaly Detection
mitigated by: Network Isolation and Access Control for IoT Devices
citation: Smart IoT (AIoT) Security Technologies and Application Research, 2025 Edition
citation: SP 800-183, Networks of 'Things' | CSRC
updated: 2026-06-22
version: 1
related cases: C0729
related cases: C1574
related cases: C1575
related cases: C1576
related cases: C1577
related cases: C1578
related cases: C1579
related cases: C1580

IoT Hardware Supply Chain Attack
type: Risk
break id: R0206
stix type: x-break-risk
definition: Attackers implant backdoors in IoT device chips, firmware, communication modules and other hardware supply chain components for long-term persistence and remote control.
description: IoT hardware supply chain attacks occur across chips, modules, sensors, firmware, manufacturing, and logistics. Attackers may implant backdoors, replace components, or alter default settings so deployed devices remain controllable. IoT fleets are large, long-lived, and hard to patch in the field. Supplier verification, firmware signing, hardware sampling, and runtime anomaly monitoring are essential.
complexity: advanced
influence: Hardware supply chain compromise can place persistent backdoors into large IoT fleets that are expensive to detect, patch, or recall.
keywords: IoT hardware supply chain attack
keywords: firmware backdoor
keywords: chip backdoor
keywords: hardware implant
keywords: communication module poisoning
mitigated by: IoT Hardware Security Module
mitigated by: Firmware Secure Boot Mechanism
mitigated by: Firmware Update Signature Verification and Rollback Protection
mitigated by: Firmware Integrity Monitoring and Physical Tamper Resistance
mitigated by: Blockchain Supply Chain Security Audit
citation: 2024 Cybersecurity Deep Insight: Hardware Supply Chain Risk
citation: Hardware Security | CSRC
updated: 2026-06-22
version: 1
related cases: C0793
related cases: C1581
related cases: C1582
related cases: C1583
related cases: C1584

eSIM and iSIM Hijacking
type: Risk
break id: R0207
stix type: x-break-risk
definition: Remote provisioning capabilities of embedded SIM (eSIM) and integrated SIM (iSIM) are exploited by attackers for SIM hijacking and identity theft.
description: eSIM and iSIM hijacking abuses remote provisioning, carrier workflows, device binding, or identity verification weaknesses to move or control a mobile network identity. Attackers can intercept SMS, take over recovery flows, or impersonate devices. As eSIM and iSIM expand into phones, vehicles, and IoT devices, SIM identity affects payments, authentication, and device management. Defense needs both carrier-side verification and business-side risk controls.
complexity: advanced
influence: eSIM or iSIM takeover can compromise mobile identity, intercept recovery channels, and support account takeover or device impersonation.
keywords: eSIM and iSIM Hijacking
keywords: eSIM hijacking
keywords: iSIM hijacking
keywords: remote SIM provisioning abuse
keywords: mobile identity takeover
keywords: device authentication hijacking
mitigated by: Digital Certificate
mitigated by: eSIM Security Management
mitigated by: Multi-Factor Authentication
mitigated by: Threat Intelligence
mitigated by: Legal Action
citation: GSMA eSIM Specifications
citation: Privacy and data protection in mobile applications - ENISA
updated: 2026-06-22
version: 1
related cases: C1585
related cases: C1586
related cases: C1587
related cases: C1588
related cases: C1589
related cases: C1590

Medical IoT Risk
type: Risk
break id: R0208
stix type: x-break-risk
definition: Attacks on medical IoT devices (pacemakers, insulin pumps, monitors, etc.) may directly threaten patient life safety.
description: Medical IoT risk affects connected monitors, infusion pumps, imaging systems, wearables, and implantable devices. Attackers can exploit weak passwords, old firmware, flat networks, or supply chain weaknesses to alter data or device behavior. The impact can go beyond privacy and downtime into clinical decisions and patient safety. Medical environments must manage device availability, clinical workflow, and update capability together.
complexity: advanced
influence: Medical IoT compromise can disrupt clinical workflows, expose health data, and in severe cases affect patient safety.
keywords: Medical IoT Risk
keywords: medical device security
keywords: connected medical device attack
keywords: insulin pump attack
keywords: pacemaker security
mitigated by: Medical Device Security Gateway
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: IoT Traffic Monitoring and Anomaly Detection
citation: Annual report on the riskiest connected devices: medical IoT
citation: FDA Medical Device Cybersecurity
updated: 2026-06-22
version: 1
related cases: C1591
related cases: C1592
related cases: C1593
related cases: C1594
related cases: C1595

Unauthorized Outbound Connection and C2 Control
type: Risk
break id: R0209
stix type: x-break-risk
definition: IoT devices infected with trojans actively connect to C2 servers to receive remote commands, becoming part of botnets.
description: Unauthorized outbound connection and C2 control are typical signs of compromised devices. Infected devices connect to attacker infrastructure and receive commands for scanning, proxying, DDoS, data theft, or lateral movement. IoT devices often sit at the network edge with limited logging and operations support, making them durable footholds. Enterprises need outbound baselines, domain and IP reputation checks, and device isolation.
complexity: intermediate
influence: C2-controlled IoT devices can become botnet nodes, proxies, or internal footholds for data theft and lateral movement.
keywords: Unauthorized Outbound Connection and C2 Control
keywords: unauthorized outbound connection
keywords: C2 control
keywords: IoT botnet
keywords: device malware
keywords: command and control server
mitigated by: Business-Level Honeypot
mitigated by: IoT Traffic Monitoring and Anomaly Detection
mitigated by: Endpoint Detection and Response
mitigated by: Network Segmentation Technology
mitigated by: Threat Intelligence
citation: Industrial Internet Cybersecurity Bulletin, 2025 Issue 1
citation: Securing the Internet of Things (IoT) - CISA
updated: 2026-06-22
version: 1
related cases: C1596
related cases: C1597
related cases: C1598
related cases: C1599
related cases: C1600
related cases: C1601

Industrial Protocol Exploitation
type: Risk
break id: R0210
stix type: x-break-risk
definition: Attackers exploit security vulnerabilities in industrial IoT protocols like Modbus, OPC-UA, Profinet to achieve unauthorized access and device control.
description: Industrial protocol exploitation targets weaknesses in protocols such as Modbus, OPC UA, Profinet, and BACnet, including missing authentication, plaintext traffic, command injection, or implementation bugs. Attackers can read production data, change control parameters, or disrupt equipment. Many industrial protocols were designed for trusted networks. Once exposed through remote operations or IoT platforms, risk increases sharply. Segmentation, protocol gateways, command allowlists, and anomaly detection are central defenses.
complexity: advanced
influence: Industrial protocol exploitation can alter control parameters, interrupt production, and create safety and availability incidents.
keywords: industrial protocol exploitation
keywords: Modbus vulnerability
keywords: OPC UA security
keywords: Profinet security
keywords: ICS protocol attack
mitigated by: Industrial Protocol Deep Packet Inspection
mitigated by: Industrial Network Isolation and Segmentation
mitigated by: Industrial Protocol Security Hardening
mitigated by: ICS Security Monitoring and Incident Response
citation: CISA Industrial Control Systems
citation: ENISA IoT Security Good Practices
updated: 2026-06-22
version: 1
related cases: C1602
related cases: C1603
related cases: C1604
related cases: C1605
related cases: C1606
related cases: C1607
related cases: C1608
related cases: C1609

Smart Home Privacy Eavesdropping
type: Risk
break id: R0211
stix type: x-break-risk
definition: Smart speakers, cameras and other home devices are remotely controlled by attackers to eavesdrop on user voice, video and other private information.
description: Smart home privacy eavesdropping occurs when cameras, doorbells, speakers, TVs, or hubs are accessed or controlled without authorization. Attackers can capture audio, video, routines, and household details. Home devices often ship with weak defaults, cloud account weaknesses, or long patch gaps. Vendors need secure defaults, cloud access control, anomaly alerts, and firmware update support.
complexity: intermediate
influence: Compromised smart home devices can expose private audio, video, routines, and household information to attackers.
keywords: smart home eavesdropping
keywords: smart speaker eavesdropping
keywords: camera compromise
keywords: home IoT privacy
keywords: remote monitoring abuse
mitigated by: Single-Device Login
mitigated by: Smart Home Privacy Switch
mitigated by: Traffic Encryption
mitigated by: Network Segmentation Technology
mitigated by: Legal Action
citation: Data breaches are a reality: smart-home privacy risks
citation: FTC Securing Your Internet-Connected Devices at Home
updated: 2026-06-22
version: 1
related cases: C1073
related cases: C1610
related cases: C1611

Vehicle V2X Attack
type: Risk
break id: R0212
stix type: x-break-risk
definition: Attackers hijack vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications to send false information interfering with driving decisions.
description: Vehicle V2X attacks target communication between vehicles, roadside infrastructure, and cloud systems. Attackers can forge location, speed, road event, or signal messages that mislead automated or assisted driving decisions. The risk turns network manipulation into road safety impact. Systems must validate message origin, spatial and temporal plausibility, certificate status, and abnormal behavior before acting on V2X data.
complexity: advanced
influence: False V2X messages can mislead driving decisions and create road safety incidents rather than only digital service disruption.
keywords: V2X attack
keywords: V2V attack
keywords: V2I attack
keywords: connected vehicle security
keywords: fake traffic message
mitigated by: V2X PKI Authentication System
mitigated by: Industrial Protocol Security Hardening
mitigated by: IoT Traffic Monitoring and Anomaly Detection
citation: NHTSA Vehicle Cybersecurity
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-22
version: 1
related cases: C1612
related cases: C1613
related cases: C1614
related cases: C1615
related cases: C1616
related cases: C1617

Edge Computing Node Attack
type: Risk
break id: R0213
stix type: x-break-risk
definition: Attackers compromise IoT edge computing nodes to steal locally processed sensitive data or tamper with AI inference results.
description: Edge computing node attacks target local compute resources deployed in stores, factories, base stations, vehicles, or campuses. Attackers can use physical access, weak operations accounts, container flaws, or exposed services to steal data or alter inference results. Edge nodes are distributed and often lack data center-grade controls. Design needs trusted boot, remote attestation, least privilege, and auditable behavior during disconnected operation.
complexity: advanced
influence: Compromised edge nodes can leak local sensitive data, alter AI inference, and become distributed footholds outside central data centers.
keywords: edge computing node attack
keywords: edge node compromise
keywords: MEC security
keywords: edge AI tampering
keywords: edge gateway attack
mitigated by: Edge Computing Security Container
mitigated by: Zero Trust Architecture
mitigated by: Endpoint Detection and Response
citation: AIoT security: edge computing node security
citation: NIST Cybersecurity for IoT Program
updated: 2026-06-22
version: 1
related cases: C1618
related cases: C1619

Digital Human Deepfake
type: Risk
break id: R0214
stix type: x-break-risk
definition: Attackers use AI technology to clone others' appearance and voice to create digital avatars for fraud, impersonation or personality rights infringement.
description: Digital human deepfakes use generative AI to clone appearance, voice, facial expression, and speaking style for impersonation. Attackers may pose as support agents, streamers, executives, or relatives to commit fraud or manipulate opinion. Real-time generation lowers the cost of convincing impersonation. Businesses need liveness checks, provenance signals, identity verification, and behavior-based anomaly detection.
complexity: intermediate
influence: Deepfaked digital humans can impersonate trusted people or brands, increasing fraud success and reputational harm.
keywords: digital human deepfake
keywords: virtual human impersonation
keywords: AI face swap scam
keywords: voice cloning scam
keywords: deepfake identity fraud
mitigated by: Real-Time Deepfake Detection
mitigated by: AI Content Provenance
mitigated by: Digital Avatar Watermark Verification
citation: Building a strong security barrier for digital humans
citation: Coalition for Content Provenance and Authenticity (C2PA)
updated: 2026-06-22
version: 1
related cases: Anhui Hefei Police Crack Province's First Facial Recognition Crime Case
related cases: C1620
related cases: C1621
related cases: C1622
related cases: C1623
related cases: C1624
related cases: C1625
related cases: C1626
related cases: C1627
related cases: C1628

Metaverse Social Engineering Attack
type: Risk
break id: R0215
stix type: x-break-risk
definition: Immersive virtual environments reduce user vigilance, allowing attackers to build trust through virtual identities before launching phishing and fraud attacks.
description: Metaverse social engineering uses immersive spaces, virtual identities, and real-time interaction to build trust. Attackers may impersonate friends, support staff, hosts, or partners to obtain credentials, move virtual assets, or drive users to malicious entry points. Immersive presence and social pressure can make phishing more persuasive. Platforms need identity indicators, contextual risk prompts, and step-up confirmation for high-risk actions.
complexity: intermediate
influence: Immersive social engineering can make phishing and fraud more persuasive, leading to credential loss, asset transfer, and user harm.
keywords: metaverse social engineering
keywords: virtual identity scam
keywords: VR social phishing
keywords: immersive phishing
keywords: virtual space impersonation
mitigated by: Metaverse Identity Federation
mitigated by: Deepfake Detection
mitigated by: Real-Time Deepfake Detection
citation: Research on metaverse development status and security risks
citation: Defining and Building the Metaverse - The World Economic Forum
updated: 2026-06-22
version: 1
related cases: C1513
related cases: C1629
related cases: C1630

Virtual Asset Cross-Platform Transfer Risk
type: Risk
break id: R0216
stix type: x-break-risk
definition: Virtual asset interoperability protocols between metaverse platforms have vulnerabilities that may cause asset transfer failures, double-spending or theft.
description: Virtual asset cross-platform transfer risk appears when assets move across metaverse platforms, games, wallets, or marketplaces. Protocol flaws, synchronization failures, or authorization gaps can cause loss, double spend, or theft. Interoperability increases liquidity but connects the trust boundaries of multiple platforms. Designs need clear custody rules, finality, rollback handling, and dispute processes.
complexity: advanced
influence: Cross-platform asset transfer flaws can cause virtual asset theft, loss, or double spend across connected metaverse platforms.
keywords: virtual asset cross-platform transfer
keywords: metaverse asset interoperability
keywords: cross-platform asset bridge
keywords: virtual asset double spend
mitigated by: Virtual Asset Cross-Chain Verification
mitigated by: Cross-Chain Bridge Smart Contract Auditing and Monitoring
mitigated by: Multi-Chain Asset Mapping and Tracking
citation: Interoperability security for metaverse virtual assets
citation: Ethereum NFT Standards
updated: 2026-06-22
version: 1
related cases: C1631
related cases: C1632
related cases: C1633
related cases: C1634

XR Device Firmware Attack
type: Risk
break id: R0217
stix type: x-break-risk
definition: Attackers exploit firmware vulnerabilities in VR/AR headsets, controllers and other XR devices to achieve device control, data theft or malicious code implantation.
description: XR device firmware attacks target headsets, controllers, base stations, and sensor firmware. Attackers may exploit update mechanisms, driver flaws, or debug interfaces to control devices and steal visual, motion, or spatial data. XR devices hold high privileges and collect sensitive body and environment signals. Vendors need firmware signing, permission isolation, vulnerability response, and peripheral trust controls.
complexity: advanced
influence: XR firmware compromise can expose camera, motion, spatial, and sensor data while giving attackers control of high-privilege devices.
keywords: XR firmware attack
keywords: VR headset firmware vulnerability
keywords: AR device attack
keywords: XR controller hijacking
keywords: sensor data theft
mitigated by: XR Device Trusted Boot
mitigated by: Firmware Secure Boot Mechanism
mitigated by: Firmware Update Signature Verification and Rollback Protection
mitigated by: Firmware Integrity Monitoring and Physical Tamper Resistance
citation: Legal risks in metaverse development: technology and data
citation: NIST Mobile Device Security
updated: 2026-06-22
version: 1
related cases: C1635
related cases: C1636
related cases: C1637
related cases: C1638
related cases: C1639
related cases: C1640

Spatial Computing Privacy Exposure
type: Risk
break id: R0218
stix type: x-break-risk
definition: Biometric and environmental data such as eye tracking, gestures, spatial positioning collected by XR devices are accessed without authorization, leaking user privacy.
description: Spatial computing privacy exposure comes from continuous collection of eye tracking, gestures, pose, room structure, and surrounding objects. Even without traditional identifiers, these signals can reveal health, living environment, and behavior patterns. If apps, SDKs, or cloud services over-collect spatial data, they create highly sensitive profiles. Platforms should limit granularity, purpose, retention, and provide local processing where possible.
complexity: intermediate
influence: Spatial data leakage can reveal biometric behavior, room layouts, and daily routines, creating highly sensitive privacy exposure.
keywords: spatial computing privacy
keywords: XR privacy exposure
keywords: eye-tracking data leakage
keywords: gesture data leakage
keywords: spatial map exposure
mitigated by: Spatial Data Privacy Protection
mitigated by: Privacy Enhancing Technologies
mitigated by: Data Classification and Grading
citation: XR device privacy protection technologies
citation: XRSI Privacy and Safety Framework
updated: 2026-06-22
version: 1
related cases: C1641
related cases: C1642
related cases: C1643
related cases: C1644

Metaverse Content Moderation Challenge
type: Risk
break id: R0219
stix type: x-break-risk
definition: 3D virtual content and real-time voice interactions are difficult to moderate automatically, increasing risk of spreading violating content (pornography, violence, fraud, etc.).
description: Metaverse content moderation is difficult because 3D scenes, live voice, gestures, virtual props, and multi-user interactions combine in real time. Harmful content may only appear from a certain viewpoint or during a specific interaction. Traditional moderation models do not fully understand spatial semantics and live context. Platforms need reporting, behavior detection, voice analysis, scene sampling, and tiered governance.
complexity: intermediate
influence: Weak metaverse moderation can allow harmful 3D, voice, or interactive content to spread, increasing user safety and compliance risk.
keywords: metaverse content moderation
keywords: 3D content moderation
keywords: virtual space governance
keywords: real-time voice moderation
keywords: immersive content safety
mitigated by: Malicious Content Detection
mitigated by: 3D Content AI Moderation
mitigated by: Legal Action
mitigated by: AI Content Provenance
citation: Content security baseline for an integrated physical-digital metaverse
citation: Meta VR Safety Guidelines
updated: 2026-06-22
version: 1
related cases: C1513
related cases: C1645
related cases: C1646

Virtual World Economic Manipulation
type: Risk
break id: R0220
stix type: x-break-risk
definition: Attackers manipulate metaverse economic systems by hoarding virtual land, monopolizing virtual currency, causing speculative bubbles.
description: Virtual world economic manipulation uses hoarding, virtual currency manipulation, fake volume, or control of scarce resources to influence market prices. Attackers can cash out, launder value, or lure users into speculative bubbles. When virtual economies connect to real money, advertising revenue, or benefit distribution, manipulation creates financial and consumer protection risk. Platforms need anomaly monitoring across accounts, funds, and market concentration.
complexity: intermediate
influence: Virtual economy manipulation can inflate asset bubbles, enable cash-out or laundering, and harm users who rely on platform markets.
keywords: virtual world economic manipulation
keywords: metaverse economy manipulation
keywords: virtual land speculation
keywords: virtual currency manipulation
keywords: digital asset hoarding
mitigated by: Virtual Economy Regulation Mechanism
mitigated by: Transaction Risk Monitoring
mitigated by: Graph Computing / Association Analysis
citation: Security risks in metaverse economic systems
citation: BIS Report on Virtual Currencies
updated: 2026-06-22
version: 1
related cases: C1647
related cases: C1648
related cases: C1649
related cases: C1650
related cases: C1651

Cross-Virtual-Physical Identity Correlation Attack
type: Risk
break id: R0221
stix type: x-break-risk
definition: Attackers analyze users' behavior patterns and social relationships in the metaverse to reverse-track their real identity for targeted attacks or blackmail.
description: Cross-virtual-physical identity correlation attacks infer real identities or other platform accounts from virtual behavior, social graphs, device features, and transaction records. Attackers can then perform targeted scams, harassment, or extortion. The risk comes from stitching together multiple low-sensitivity signals. Platforms should reduce identifier reuse and restrict exportable behavioral data.
complexity: advanced
influence: Identity correlation can deanonymize users across virtual and real contexts, enabling targeted scams, harassment, or extortion.
keywords: identity correlation attack
keywords: metaverse identity correlation
keywords: virtual identity deanonymization
keywords: behavioral profiling
keywords: real-world identity tracing
mitigated by: Cross Virtual-Real Identity Isolation
mitigated by: Privacy Enhancing Technologies
mitigated by: Decentralized On-Chain Identity Verification
citation: Analysis of identity-correlation attacks in the metaverse
citation: W3C Decentralized Identifiers (DIDs)
updated: 2026-06-22
version: 1
related cases: C1513
related cases: C1652
related cases: C1653
related cases: C1654
related cases: C1655

Shadow API Exposure Risk
type: Risk
break id: R0222
stix type: x-break-risk
definition: Undocumented or deprecated APIs remain reachable, allowing sensitive capabilities to bypass formal governance.
description: Shadow API exposure means undocumented, deprecated, or test endpoints remain reachable from internal or external networks. These endpoints are often outside unified authentication, rate limiting, audit, and change management. Attackers can discover them through frontend resources, path enumeration, or mobile traffic analysis, then bypass formal API gateways and security policies.
complexity: intermediate
influence: Undocumented endpoints can bypass authentication, rate limits, and audit controls, exposing sensitive data and weakening API governance.
keywords: shadow API
keywords: undocumented API
keywords: deprecated endpoint
keywords: API inventory gap
keywords: API governance blind spot
mitigated by: API Asset Discovery and Catalog Governance
mitigated by: Strong API Authorization and Object-Level Access Control
mitigated by: API Rate Limiting and Quota Control
citation: OWASP API Security Top 10 2023
updated: 2026-06-22
version: 1
related cases: C1656
related cases: C1657

API Object-Level Authorization Risk
type: Risk
break id: R0223
stix type: x-break-risk
definition: The API checks only the login state but not object ownership, allowing attackers to enumerate and access other users' resources.
description: API object-level authorization risk occurs when an endpoint verifies login state but not whether the requested object belongs to the user or tenant. Attackers can modify order IDs, user IDs, file IDs, or similar parameters to access other users resources. The issue is common in mobile, open platform, and microservice APIs, and automation can quickly expand the exposure. Server-side object authorization and tenant isolation are required.
complexity: basic
influence: Missing object ownership checks can expose user profiles, orders, files, or financial records at scale and create privacy and compliance impact.
keywords: BOLA
keywords: IDOR
keywords: object-level authorization
keywords: horizontal privilege escalation
keywords: object ownership check
mitigated by: Strong API Authorization and Object-Level Access Control
mitigated by: Session Token Binding and Replay Detection
mitigated by: Risk Control Strategy
mitigated by: Anomalous Access Behavior Detection
citation: OWASP API Security Top 10 2023
updated: 2026-06-22
version: 1
related cases: C1658
related cases: C1659
related cases: C1660
related cases: C1661
related cases: C1662

API Bulk Call Resource Exhaustion
type: Risk
break id: R0224
stix type: x-break-risk
definition: Attackers call costly APIs at scale to consume quotas, inventory, compute capacity, or third-party service spend.
description: API bulk call resource exhaustion occurs when attackers repeatedly call expensive endpoints to consume inventory, SMS quota, compute, coupons, or third-party service budget. The attack abuses legitimate business functions rather than breaking authentication. Without limits by user, device, IP, business object, and cost dimension, abusive traffic blends with normal requests and causes degraded service, cost spikes, and poor user experience.
complexity: intermediate
influence: High-cost API abuse can increase cloud and third-party service costs, exhaust legitimate user quotas, and degrade service availability.
keywords: API resource exhaustion
keywords: bulk API calls
keywords: API abuse
keywords: quota exhaustion
keywords: high-cost endpoint abuse
mitigated by: API Rate Limiting and Quota Control
mitigated by: API Asset Discovery and Catalog Governance
mitigated by: Rate Limiting
mitigated by: Improving Service Availability
citation: OWASP API Security Top 10 2023
updated: 2026-06-22
version: 1
related cases: C1663
related cases: C1664

Webhook Forgery and Event Replay
type: Risk
break id: R0225
stix type: x-break-risk
definition: Attackers forge or replay webhook events to trigger false payments, shipments, authorizations, or status changes.
description: Webhook forgery and event replay occur when receivers fail to validate signatures, timestamps, event IDs, or idempotency state. Attackers can create or repeat events that trigger shipment, recharge, authorization, or state changes. Asynchronous events connect payments, orders, SaaS integrations, and automation flows. A broken trust boundary can turn forged external messages into internal business actions.
complexity: intermediate
influence: Forged or replayed callbacks can trigger false payment confirmation, wrong shipment, authorization changes, and accounting inconsistency.
keywords: webhook forgery
keywords: event replay
keywords: callback signature bypass
keywords: payment callback spoofing
keywords: asynchronous event security
mitigated by: Webhook Signature Verification and Replay Protection
mitigated by: API Input Validation and Contract Testing
mitigated by: Rate Limiting
mitigated by: Risk Control Strategy
mitigated by: Traffic Encryption
citation: OWASP API Security Top 10 2023
updated: 2026-06-22
version: 1
related cases: C1665
related cases: C1666
related cases: C1667
related cases: C1668
related cases: C1669

CI/CD Pipeline Credential Exposure
type: Risk
break id: R0226
stix type: x-break-risk
definition: Pipeline logs, variables, runners, or build scripts expose deployment credentials and cloud keys.
description: CI/CD pipeline credential exposure often comes from build logs, environment variables, runner configuration, script output, caches, or third-party plugins. Leaked cloud keys, repository tokens, and deployment credentials can give attackers direct access to production resources. Pipelines connect code, artifacts, environments, and privileges, making them a major supply chain entry point. Credentials need least privilege, short lifetime, runner isolation, and sensitive output auditing.
complexity: advanced
influence: Pipeline credential exposure can let attackers enter repositories, artifact stores, cloud resources, or production systems without normal approvals.
keywords: CI/CD credential exposure
keywords: pipeline secret leakage
keywords: runner compromise
keywords: build log secret leak
keywords: deployment key exposure
mitigated by: Least-Privilege CI/CD Pipeline Governance
mitigated by: Build Artifact Signing and Provenance
mitigated by: Dependency Pinning and Malicious Package Detection
citation: OWASP Top 10 CI/CD Security Risks
updated: 2026-06-22
version: 1
related cases: C0785
related cases: C1670
related cases: C1671
related cases: C1672
related cases: C1673
related cases: C1674
related cases: C1675
related cases: C1676
related cases: C1677

Build Artifact Poisoning Risk
type: Risk
break id: R0227
stix type: x-break-risk
definition: Attackers tamper with build artifacts, container images, or release packages to introduce backdoors into production.
description: Build artifact poisoning means attackers alter images, installers, frontend assets, SDKs, or release packages so normal delivery installs a backdoor into production or customer environments. The attack can occur on builders, artifact repositories, signing workflows, or distribution channels. Artifacts are trusted by downstream systems, so impact scales with installation and deployment privilege. Controls include artifact signing, reproducible builds, repository permissions, and pre-release integrity checks.
complexity: advanced
influence: Poisoned artifacts can deploy backdoors into production or customer environments, causing bulk compromise and supply chain trust damage.
keywords: build artifact poisoning
keywords: container image poisoning
keywords: release package tampering
keywords: artifact repository compromise
keywords: software supply chain poisoning
mitigated by: Build Artifact Signing and Provenance
mitigated by: Dependency Pinning and Malicious Package Detection
mitigated by: SBOM Generation and Vulnerability Impact Analysis
citation: OWASP Top 10 CI/CD Security Risks
citation: Software Bill of Materials - CISA
updated: 2026-06-22
version: 1
related cases: C0784
related cases: C0811
related cases: C1678
related cases: C1679
related cases: C1680
related cases: C1681
related cases: C1682
related cases: C1683

Dependency Confusion and Malicious Package Poisoning
type: Risk
break id: R0228
stix type: x-break-risk
definition: Attackers publish same-name or look-alike packages that cause build systems to download malicious components.
description: Dependency confusion and malicious package poisoning exploit package manager resolution rules, leaked internal package names, or lookalike names to make build systems install attacker-controlled components. Malicious packages can steal secrets during install or runtime. The risk is common when public and private registries are mixed or dependency review is weak. Organizations need source priority controls, lockfiles, package provenance checks, and install anomaly monitoring.
complexity: advanced
influence: Malicious dependencies can steal tokens, tamper with code, or implant backdoors during build, affecting multiple projects and releases.
keywords: dependency confusion
keywords: malicious package
keywords: package name squatting
keywords: open source package poisoning
keywords: internal package confusion
mitigated by: Dependency Pinning and Malicious Package Detection
mitigated by: SBOM Generation and Vulnerability Impact Analysis
mitigated by: Threat Intelligence
mitigated by: Legal Action
mitigated by: Vulnerability Identification
citation: Software Bill of Materials - CISA
updated: 2026-06-22
version: 1
related cases: C0805
related cases: C1677
related cases: C1683
related cases: C1684
related cases: C1685
related cases: C1686
related cases: C1687
related cases: C1688

SBOM Absence Hiding Vulnerability Impact
type: Risk
break id: R0229
stix type: x-break-risk
definition: The organization cannot quickly determine whether newly disclosed vulnerabilities affect its products or supplier deliveries.
description: SBOM absence prevents organizations from knowing which open source components, versions, and transitive dependencies exist in products, images, and supplier deliverables. When a new vulnerability is disclosed, teams cannot quickly determine exposure. In multi-product and supplier-heavy environments, component invisibility slows response and weakens customer assurance, compliance evidence, and patch prioritization.
complexity: intermediate
influence: Without a component inventory, vulnerability impact analysis and patch response are delayed, leaving high-risk dependencies in production.
keywords: missing SBOM
keywords: software bill of materials
keywords: component vulnerability impact
keywords: supply chain visibility
keywords: dependency inventory
mitigated by: SBOM Generation and Vulnerability Impact Analysis
mitigated by: Supply Chain Security Audit
mitigated by: Threat Intelligence
mitigated by: Vulnerability Identification
citation: Software Bill of Materials - CISA
updated: 2026-06-22
version: 1
related cases: C1689
related cases: C1690
related cases: C1691
related cases: C1692
related cases: C1693

Public Cloud Storage Bucket Exposure
type: Risk
break id: R0230
stix type: x-break-risk
definition: Object storage buckets or snapshots are misconfigured for public access, causing data leakage.
description: Public cloud storage bucket exposure usually comes from object storage, backup snapshots, log buckets, or static asset buckets configured for public access. Once sensitive files are public, search engines, scanners, or attackers can download them directly. This risk requires little technical sophistication but can cause large data breaches. Organizations need continuous public asset inventory, clear separation of static content from sensitive data, and alerting on public policies.
complexity: basic
influence: Public buckets can directly leak customer data, logs, backups, and key files, leading to regulatory and trust impact.
keywords: public cloud storage bucket
keywords: object storage exposure
keywords: S3 bucket leak
keywords: cloud snapshot exposure
keywords: storage permission misconfiguration
mitigated by: Cloud Configuration Baselines and Drift Detection
mitigated by: Data Loss Prevention
mitigated by: Data Classification and Grading
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C0887
related cases: C1694
related cases: C1695
related cases: C1696
related cases: C1697

Cloud IAM Over-Permissioning
type: Risk
break id: R0231
stix type: x-break-risk
definition: Cloud users, roles, or service accounts hold permissions beyond business need, expanding blast radius after compromise.
description: Cloud IAM over-permissioning means users, roles, service accounts, or temporary credentials hold more privileges than the business requires. If any credential is stolen, attackers can use broad permissions for lateral movement, privilege escalation, or sensitive data access. Cloud permissions are granular and complex, and exceptions accumulate over time. Governance should shrink permissions based on actual use and monitor high-risk API calls.
complexity: intermediate
influence: Excessive permissions amplify any credential compromise, enabling resource deletion, data export, or cloud cost abuse.
keywords: cloud IAM over-permissioning
keywords: IAM privilege sprawl
keywords: least privilege gap
keywords: service account overprivilege
keywords: cloud role abuse
mitigated by: Cloud Identity Permission Reduction
mitigated by: Privileged Access Management
mitigated by: Zero Trust Architecture
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1698
related cases: C1699
related cases: C1700
related cases: C1701
related cases: C1702

SaaS Third-Party App Authorization Abuse
type: Risk
break id: R0232
stix type: x-break-risk
definition: Employees grant high-privilege SaaS applications access to mail, drive, or customer data.
description: SaaS third-party app authorization abuse occurs when employees or admins grant external apps access to mail, drives, calendars, CRM, or customer data, and the app exceeds expectations or is compromised. OAuth consent is often perceived as login, but may grant long-lived read or action permissions. Enterprises need app review, high-risk scope restrictions, and periodic cleanup of unused grants.
complexity: intermediate
influence: Abused SaaS authorization can continuously read mail, drive, and customer data while bypassing many endpoint and network controls.
keywords: SaaS app authorization abuse
keywords: OAuth authorization risk
keywords: third-party app access
keywords: mailbox access abuse
keywords: enterprise SaaS integration risk
mitigated by: SaaS Application Permission Audit
mitigated by: OAuth Permission Minimization
mitigated by: Enterprise Collaboration Data Loss Prevention
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: Microsoft Exposes Threat Actors Abusing OAuth Applications for Automated Financial Attacks
related cases: Microsoft Warns: OAuth Redirect Abuse Leads to Phishing and Malware Distribution
related cases: C0794
related cases: C1703
related cases: C1704
related cases: C1705

Collaborative Document Link Exposure
type: Risk
break id: R0233
stix type: x-break-risk
definition: Cloud drives, documents, IM files, or knowledge bases remain exposed for long periods through shared external links.
description: Collaborative document link exposure comes from cloud drives, online documents, messaging files, or knowledge bases configured with public links, long validity, or forwarding permissions. Once a link leaks, outsiders may access content without an account. Collaboration tools make sharing easy but hide permission boundaries. Organizations need sensitive document detection, public sharing restrictions, expiration controls, and access anomaly monitoring.
complexity: basic
influence: Long-lived public document links can expose customer data, project plans, credential screenshots, and internal procedures.
keywords: document link exposure
keywords: cloud drive sharing leak
keywords: public share link
keywords: knowledge base link exposure
keywords: collaboration file leak
mitigated by: Enterprise Collaboration Data Loss Prevention
mitigated by: Data Desensitization (Masking)
mitigated by: Data Loss Prevention
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1706
related cases: C1707
related cases: C1708
related cases: C1709

Chargeback and Refund Abuse
type: Risk
break id: R0235
stix type: x-break-risk
definition: Users or organized groups obtain improper refunds through chargebacks, empty-package claims, or fabricated after-sales evidence.
description: Chargeback and refund abuse uses payment disputes, after-sales policies, logistics conflicts, or fake evidence to obtain improper refunds. Common patterns include empty packages, item swaps, forged delivery issues, and repeated complaints. The risk creates direct losses for platforms, merchants, and payment providers, while undermining fair after-sales rules. Detection must combine logistics evidence, history, device linkage, and dispute handling strategy.
complexity: intermediate
influence: Refund and chargeback abuse causes direct merchandise and payment losses, merchant disputes, channel penalties, and higher support cost.
keywords: chargeback fraud
keywords: refund abuse
keywords: empty package refund
keywords: fake after-sales evidence
keywords: friendly fraud
mitigated by: Refund and Dispute Risk-Control Strategy
mitigated by: Risk Control Strategy
mitigated by: Transaction Risk Monitoring
citation: PCI Data Security Standard
updated: 2026-06-22
version: 1
related cases: C1713
related cases: C1714
related cases: C1715
related cases: C1716
related cases: C1717
related cases: C1718
related cases: C1719

Payment Tokenization Misconfiguration
type: Risk
break id: R0236
stix type: x-break-risk
definition: Payment tokens, card substitutes, or binding relationships are misconfigured, causing unauthorized charges or data exposure.
description: Payment tokenization misconfiguration occurs when card substitutes, payment tokens, binding relationships, or merchant domain isolation are configured incorrectly. Attackers may reuse, enumerate, or use tokens across contexts to make unauthorized charges. Tokenization reduces exposure of raw card numbers, but does not replace authorization boundaries. Payment systems must validate token scope, device binding, merchant binding, transaction context, and lifecycle.
complexity: advanced
influence: Token boundary errors can enable unauthorized charges, incorrect binding relationships, and exposure of sensitive payment data.
keywords: payment tokenization misconfiguration
keywords: payment token risk
keywords: card token misuse
keywords: unauthorized charge
keywords: token binding error
mitigated by: Payment Account and Merchant Onboarding Review
mitigated by: Data Loss Prevention
mitigated by: Strong API Authorization and Object-Level Access Control
citation: PCI Data Security Standard
updated: 2026-06-22
version: 1
related cases: C1720
related cases: C1721
related cases: C1722
related cases: C1723

Ad Click Injection
type: Risk
break id: R0237
stix type: x-break-risk
definition: Attackers inject fake clicks before installation or conversion to steal attribution revenue.
description: Ad click injection forges click events shortly before an install, open, or conversion to steal attribution from organic traffic or other channels. Attackers often use malicious SDKs, background services, or device permissions to fabricate clicks. The risk distorts campaign measurement and makes advertisers pay for hijacked conversions. Anti-fraud analysis should examine click-to-conversion time, device behavior, SDK source, and channel distribution.
complexity: intermediate
influence: Click injection steals real conversion attribution, wastes ad budget, and distorts channel evaluation and bidding strategy.
keywords: click injection
keywords: mobile ad fraud
keywords: attribution hijacking
keywords: install attribution fraud
keywords: ad click fraud
mitigated by: Ad Delivery and Attribution Anti-Fraud
mitigated by: Affiliate Marketing and Channel Quality Scoring
mitigated by: Threat Intelligence
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1724
related cases: C1725
related cases: C1726
related cases: C1727
related cases: C1728
related cases: C1729
related cases: C1730

Fake Conversion and Install Farm
type: Risk
break id: R0238
stix type: x-break-risk
definition: Fraud operators use device farms and scripts to simulate registrations, installs, retention, and conversions.
description: Fake conversion and install farms use device farms, emulators, scripts, or crowdsourced labor to simulate registration, installation, retention, purchases, or other funnel events. The goal is to obtain CPA, CPS, acquisition subsidies, or platform rewards. These actions look valid in funnel metrics but lack real user value. Platforms need device fingerprinting, behavior sequence analysis, retention quality checks, payment linkage, and channel profiling.
complexity: intermediate
influence: Fake conversions consume acquisition budget, pollute growth metrics, and push teams to scale low-quality channels.
keywords: install farm
keywords: fake conversion
keywords: device farm
keywords: CPA fraud
keywords: ad conversion fraud
mitigated by: Ad Delivery and Attribution Anti-Fraud
mitigated by: Affiliate Marketing and Channel Quality Scoring
mitigated by: Device Fingerprinting
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: BotSpot: A Hybrid Learning Framework to Uncover Bot Install Fraud in Mobile Advertising
related cases: Botspot++: A Hierarchical Deep Ensemble Model for Bots Install Fraud Detection in Mobile Advertising
related cases: Europol Dismantles SIM Farm Network Tied to 49 Million Fake Accounts
related cases: C1731
related cases: C1732

Affiliate Marketing Commission Fraud
type: Risk
break id: R0239
stix type: x-break-risk
definition: Channels use cookie stuffing, fake traffic, or landing-page hijacking to obtain commissions improperly.
description: Affiliate marketing commission fraud uses cookie stuffing, fake traffic, landing page hijacking, coupon plugins, or last-click hijacking to attribute orders to a cheating partner. Brands then pay commission for organic orders or other channels results. Controls need real referral path validation, click quality checks, conversion windows, and attribution conflict analysis.
complexity: intermediate
influence: Commission fraud inflates partner spend, corrupts attribution reports, and reduces returns for legitimate partners.
keywords: affiliate commission fraud
keywords: cookie stuffing
keywords: landing page hijacking
keywords: CPS fraud
keywords: affiliate attribution fraud
mitigated by: Affiliate Marketing and Channel Quality Scoring
mitigated by: Ad Delivery and Attribution Anti-Fraud
mitigated by: Access Source Tracking
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1733
related cases: C1734
related cases: C1735
related cases: C1736
related cases: C1737
related cases: C1738

Unauthorized Use of Shared Data
type: Risk
break id: R0240
stix type: x-break-risk
definition: Business teams, suppliers, or partners use shared data beyond the authorized purpose.
description: Unauthorized use of shared data occurs when internal teams, vendors, or partners use shared data beyond approved purpose, scope, or duration. It can appear in joint modeling, marketing activation, outsourced operations, and data API integrations. Even if initial sharing was approved, later purpose drift creates compliance and trust risk. Organizations need data use contracts, purpose audits, masking, isolation, and expiration handling.
complexity: intermediate
influence: Purpose drift in shared data can trigger privacy complaints, contract breach, regulatory action, and loss of partner trust.
keywords: unauthorized data use
keywords: shared data misuse
keywords: partner data abuse
keywords: purpose limitation violation
keywords: data sharing compliance
mitigated by: Data-Sharing Approval and Purpose Limitation
mitigated by: Privacy Impact Assessment and Compliance Evidence
mitigated by: Data Classification and Grading
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: Huang and Others Illegally Obtained CHSI Academic Credentials for Sale
related cases: C1739

Missing Privacy Impact Assessment
type: Risk
break id: R0241
stix type: x-break-risk
definition: New businesses or models go live without assessing personal-information processing risks and compliance obligations.
description: Missing privacy impact assessment means a new business, system, algorithm, or data partnership launches without structured review of personal data purpose, necessity, risk, and mitigation. High-risk processing can enter production without sufficient safeguards. The gap causes teams to overlook obligations in collection, sharing, cross-border transfer, automated decision-making, and model training. Privacy assessment should be embedded in procurement, development, and launch processes.
complexity: basic
influence: Skipping privacy assessment leaves high-risk data processing without necessity and legality review, increasing remediation and penalty risk.
keywords: privacy impact assessment
keywords: PIA
keywords: DPIA
keywords: personal information protection assessment
keywords: privacy compliance review
mitigated by: Privacy Impact Assessment and Compliance Evidence
mitigated by: Compliance Governance
mitigated by: Legal Action
mitigated by: Threat Intelligence
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1740

Training Data Copyright and Licensing Risk
type: Risk
break id: R0242
stix type: x-break-risk
definition: AI training data has unclear provenance, authorization, or copyright status, creating compliance and commercial disputes.
description: Training data copyright and licensing risk comes from unclear corpus provenance, insufficient authorization, unknown copyright status, or license terms that conflict with commercial model use. Model output may also reproduce protected content. The risk affects commercialization, customer delivery, and cross-border deployment. Teams need records of data source, license conditions, cleaning steps, and deletion request handling.
complexity: intermediate
influence: Unclear training data authorization can cause copyright disputes, model takedown, customer claims, and commercialization limits.
keywords: training data copyright
keywords: data licensing risk
keywords: AI training corpus compliance
keywords: copyrighted training data
keywords: unclear data provenance
mitigated by: AI Training Data Governance
mitigated by: Privacy Impact Assessment and Compliance Evidence
mitigated by: Legal Action
mitigated by: Threat Intelligence
citation: NIST AI Risk Management Framework
updated: 2026-06-22
version: 1
related cases: C0715
related cases: C1741
related cases: C1742
related cases: C1743

Training Data Poisoning Risk
type: Risk
break id: R0243
stix type: x-break-risk
definition: Attackers contaminate training sets, feedback data, or labeling results to influence model behavior.
description: Training data poisoning occurs when attackers inject malicious samples into training sets, labels, feedback data, or knowledge bases so the model behaves incorrectly under specific triggers. Sources include public datasets, user feedback, and supplier data. The attack may not show in normal accuracy tests but can trigger bias, safety bypass, or wrong decisions in target scenarios. Defense requires provenance, anomaly detection, and before-after model evaluation.
complexity: advanced
influence: Poisoned training data can make models produce attacker-desired errors or unsafe behavior in critical business scenarios.
keywords: training data poisoning
keywords: data poisoning
keywords: model poisoning
keywords: label poisoning
keywords: feedback data contamination
keywords: AI supply chain attack
mitigated by: AI Training Data Governance
mitigated by: Agent Behavior Sandbox
mitigated by: Algorithm Audit Mechanism
citation: NIST AI Risk Management Framework
updated: 2026-06-22
version: 1
related cases: C1744
related cases: C1745
related cases: C1746
related cases: C1747
related cases: C1748
related cases: C1749
related cases: C1750

RAG Unauthorized Retrieval
type: Risk
break id: R0244
stix type: x-break-risk
definition: Retrieval-augmented systems return document fragments or sensitive knowledge that the user is not authorized to access.
description: RAG unauthorized retrieval happens when retrieval-augmented systems do not apply user permissions, tenant boundaries, or document classification during retrieval. A user query may retrieve inaccessible snippets that the model then summarizes. Vector similarity is not access control. RAG systems need permission checks at indexing, retrieval, reranking, and generation stages, plus audit of sensitive outputs.
complexity: advanced
influence: Unauthorized RAG retrieval can disclose internal documents, customer data, or cross-tenant knowledge through model answers.
keywords: RAG unauthorized retrieval
keywords: RAG permission bypass
keywords: knowledge base leakage
keywords: vector database permissions
keywords: sensitive document retrieval
mitigated by: RAG Knowledge-Base Permission Isolation
mitigated by: Prompt Injection Defense and Context Isolation
mitigated by: Enterprise Collaboration Data Loss Prevention
citation: OWASP Top 10 for Large Language Model Applications
updated: 2026-06-22
version: 1
related cases: Apple Sues Former iOS Engineer Aude Over Leaks of Unreleased Products and Sensitive Information
related cases: C1751
related cases: C1752
related cases: C1753

Sensitive Information Leakage in Model Output
type: Risk
break id: R0245
stix type: x-break-risk
definition: Models disclose training data, system prompts, or internal materials in conversations, summaries, or generated code.
description: Sensitive information leakage in model output occurs when a model reveals training data, system prompts, internal documents, secret fragments, or customer information during chat, summarization, code generation, or tool use. It can be triggered by prompt manipulation, context pollution, or permission mistakes. The risk grows when models connect to enterprise knowledge bases and business systems. Controls need input and output review, context minimization, permission binding, and sensitive data detection.
complexity: intermediate
influence: Model output leakage can expose prompts, internal documents, customer data, or secrets through AI applications.
keywords: model output data leakage
keywords: prompt leakage
keywords: training data leakage
keywords: LLM sensitive information leak
keywords: internal document exposure
mitigated by: Model Output Safety Evaluation
mitigated by: RAG Knowledge-Base Permission Isolation
mitigated by: Data Desensitization (Masking)
citation: OWASP Top 10 for Large Language Model Applications
updated: 2026-06-22
version: 1
related cases: C1754
related cases: C1755
related cases: C1756

MFA Fatigue Attack
type: Risk
break id: R0246
stix type: x-break-risk
definition: Attackers repeatedly trigger MFA prompts to induce users to approve a login by mistake.
description: MFA fatigue attacks repeatedly trigger login prompts until a user approves one under fatigue, confusion, or social pressure. Attackers usually already know the password and only need the second factor. Push approval without transaction meaning is easy to misclick. Number matching, location prompts, rate limits, and high-risk login blocking reduce success.
complexity: basic
influence: MFA fatigue can defeat enabled multi-factor authentication and give attackers an authenticated enterprise session.
keywords: MFA fatigue attack
keywords: MFA bombing
keywords: push bombing
keywords: multi-factor fatigue
keywords: login approval abuse
mitigated by: MFA Fatigue Resistance and High-Risk Verification
mitigated by: Identity Authentication (Login)
mitigated by: Anomalous Access Behavior Detection
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: Uber MFA Fatigue Attack Incident
related cases: C1757
related cases: C1758
related cases: C1759

Session Token Replay
type: Risk
break id: R0247
stix type: x-break-risk
definition: Attackers replay stolen cookies, tokens, or session credentials from another device.
description: Session token replay occurs when attackers steal cookies, access tokens, or refresh tokens and reuse them from another device or environment. Tokens may be obtained through malware, proxy logs, XSS, phishing, or endpoint compromise. Without device binding, location checks, risk signals, or token rotation, attackers can bypass password and MFA checks. Defenses need token protection, abnormal session detection, and rapid revocation.
complexity: intermediate
influence: Replayed session tokens bypass passwords and MFA, enabling account takeover, data export, and persistent access.
keywords: session token replay
keywords: cookie replay
keywords: token replay
keywords: session hijacking
keywords: access token theft
mitigated by: Session Token Binding and Replay Detection
mitigated by: Credential Reuse Detection
mitigated by: Identity Security Audit
citation: OWASP API Security Top 10 2023
updated: 2026-06-22
version: 1
related cases: Session Hijacking 2.0: The Latest Attack Bypassing MFA
related cases: C1540

Mobile App Repackaging Fraud
type: Risk
break id: R0248
stix type: x-break-risk
definition: Attackers repackage apps to implant ads, phishing pages, or risk-control bypass logic.
description: Mobile app repackaging fraud decompiles a legitimate app, inserts ads, phishing pages, malicious SDKs, or risk-control bypass logic, and redistributes it through unofficial channels. Users believe they installed the real app. Repackaged apps can steal accounts, hijack payments, fake device context, or consume ad budgets. Vendors need app hardening, signature checks, channel monitoring, and runtime integrity detection.
complexity: intermediate
influence: Repackaged apps impersonate the brand, steal accounts and payment data, and bypass mobile risk controls.
keywords: mobile app repackaging
keywords: Android repackaging
keywords: malicious SDK injection
keywords: pirated app fraud
keywords: mobile phishing app
mitigated by: Mobile App Integrity and Runtime Protection
mitigated by: Client Application Hardening
mitigated by: Vulnerability Identification
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1760
related cases: C1761
related cases: C1762
related cases: C1763
related cases: C1764
related cases: C1765
related cases: C1766

CDN Cache Poisoning
type: Risk
break id: R0249
stix type: x-break-risk
definition: Attackers poison cached content through cache-key confusion, header pollution, or edge-rule defects.
description: CDN cache poisoning abuses cache key design, request header handling, parameter normalization, or edge rule flaws so an attacker-crafted response is cached as legitimate content. Later users receive the poisoned content. The risk can affect static pages, API responses, and redirects, amplifying one request across many users. Defenses need clear cache keys, isolation of user-specific responses, and abnormal cache hit monitoring.
complexity: advanced
influence: Poisoned CDN cache can distribute malicious pages, incorrect data, or phishing redirects to many users.
keywords: CDN cache poisoning
keywords: cache poisoning
keywords: cache key confusion
keywords: edge cache pollution
keywords: HTTP header poisoning
mitigated by: Edge and CDN Rule Change Audit
mitigated by: Server-Side Anti-Tampering
mitigated by: API Input Validation and Contract Testing
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1767
related cases: C1768
related cases: C1769

Edge Function Configuration Abuse
type: Risk
break id: R0250
stix type: x-break-risk
definition: Misconfigured edge functions or WAF rules cause authentication bypass, data forwarding, or traffic hijacking.
description: Edge function configuration abuse occurs when CDN edge functions, Workers, WAF rules, or traffic orchestration logic are misconfigured. Attackers may bypass authentication, forward sensitive requests, alter responses, or create an open proxy. Edge logic sits between users and origin services, so mistakes affect the full traffic entry point. Changes need review, staged rollout, least privilege, and rollback mechanisms.
complexity: intermediate
influence: Abused edge functions can cause authentication bypass, data forwarding, response tampering, and broad traffic disruption.
keywords: edge function abuse
keywords: Edge Function risk
keywords: WAF rule misconfiguration
keywords: edge authentication bypass
keywords: traffic hijacking
mitigated by: Edge and CDN Rule Change Audit
mitigated by: Cloud Configuration Baselines and Drift Detection
mitigated by: Identity Security Audit
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C1770
related cases: C1771
related cases: C1772
related cases: C1773
related cases: C1774
related cases: C1775

Vehicle Data Interface Abuse
type: Risk
break id: R0252
stix type: x-break-risk
definition: Connected-vehicle APIs, diagnostic interfaces, or third-party in-vehicle apps are abused to read location and driving data.
description: Vehicle data interface abuse occurs when connected vehicle APIs, diagnostic interfaces, in-vehicle apps, or third-party services over-read location, route, driving behavior, or vehicle status. Attackers or partners may use the data beyond authorization. Vehicle data is strongly tied to identity and behavior. Leakage can enable tracking, profiling, insurance discrimination, or preparation for theft. Defenses need granular consent, purpose limitation, and access auditing.
complexity: intermediate
influence: Vehicle interface abuse can expose location, driving behavior, and vehicle state, creating privacy, safety, and compliance risk.
keywords: vehicle data interface abuse
keywords: connected vehicle API abuse
keywords: vehicle diagnostic interface abuse
keywords: driving data exposure
keywords: location data misuse
mitigated by: V2X PKI Authentication System
mitigated by: Strong API Authorization and Object-Level Access Control
mitigated by: Data Classification and Grading
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-22
version: 1
related cases: C1779
related cases: C1780
related cases: C1781
related cases: C1782

Decentralized Identity Credential Forgery
type: Risk
break id: R0253
stix type: x-break-risk
definition: Attackers forge DIDs or verifiable credentials to impersonate users, organizations, or qualifications.
description: Decentralized identity credential forgery targets DID, verifiable credentials, and issuance or verification flows. Attackers may impersonate issuers, tamper with claims, reuse revoked credentials, or trick verifiers into accepting untrusted proofs. When credentials gate access to finance, education, enterprise, or platform rights, forgery breaks the trust chain. Systems must verify signatures, status, revocation lists, issuer authority, and context constraints.
complexity: intermediate
influence: Forged DID or verifiable credentials let attackers impersonate users, institutions, or qualifications to gain unauthorized rights.
keywords: DID credential forgery
keywords: verifiable credential forgery
keywords: VC forgery
keywords: decentralized identity attack
keywords: identity claim impersonation
mitigated by: Decentralized Identity Credential Verification
mitigated by: Metaverse Identity Federation
mitigated by: Decentralized On-Chain Identity Verification
citation: W3C Decentralized Identifiers (DIDs) v1.0
updated: 2026-06-22
version: 1
related cases: C1783
related cases: C1784
related cases: C1785
related cases: C1786
related cases: C1787
related cases: C1788

Vendor Remote Access Abuse
type: Risk
break id: R0254
stix type: x-break-risk
definition: Third-party supplier remote-maintenance accounts, VPNs, or tools are stolen and used to enter enterprise environments.
description: Vendor remote access abuse happens when third-party operations accounts, VPN, bastion hosts, remote desktop, or SaaS admin portals are stolen or used beyond scope. Attackers can enter the enterprise through a trusted supplier relationship. Third-party access often remains highly privileged and long-lived for continuity. Organizations need task-based authorization, mandatory MFA, session recording, expiration, and abnormal access blocking.
complexity: advanced
influence: Abused vendor remote access bypasses enterprise perimeter controls and becomes a channel into core systems.
keywords: vendor remote access abuse
keywords: third-party admin account abuse
keywords: VPN account compromise
keywords: remote tool abuse
keywords: outsourced access risk
mitigated by: Privileged Access Management
mitigated by: Zero Trust Architecture
mitigated by: Identity Security Audit
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-22
version: 1
related cases: C0797
related cases: C1789
related cases: C1790
related cases: C1791
related cases: C1792

Human Verification Technology
type: Avoidance
break id: A0001
stix type: course-of-action
definition: Also known as CAPTCHA or verification code mechanism, it distinguishes human operations from non-human operations by presenting challenges.
description: Challenges are typically presented through behavioral CAPTCHAs, image-text CAPTCHAs, or by collecting and analyzing data such as mouse movement trajectories, click events, screen touch pressure, swipe trajectories, request access rates, and 3D gyroscope readings. Note: facial recognition is generally considered a form of biometric identification (A0023).
category: AC01
keywords: Human Verification Technology
keywords: CAPTCHA
keywords: anti-bot verification
keywords: bot check
keywords: human check
keywords: challenge-response
keywords: verification challenge
citation: OAT-009 CAPTCHA Defeat - OWASP
citation: NIST SP 800-63B: Digital Identity Guidelines - Authentication and Lifecycle Management
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The black-gray industry has given rise to 'CAPTCHA-solving platforms' (AT0008), which use crowdsourced human labor to complete human verification challenges. This is a dimensionality-reduction attack against human verification, and in theory can render all explicit human verification completely ineffective.

Image-Text CAPTCHA
type: Avoidance
break id: A0001-001
stix type: course-of-action
definition: A type of human verification challenge where the challenger must identify the content in an image and enter it into an input field.
description: Image CAPTCHAs, also known as graphic CAPTCHAs, are a common user identity verification method. They typically consist of a set of randomly generated numbers, letters, or symbols displayed in graphical form, usually with interference elements such as lines, noise, or distortion to prevent automated tools (e.g., bots or OCR software) from easily recognizing them. Users must correctly enter the characters shown in the image to pass verification. This method is primarily used to prevent malicious software or non-human users from performing automated operations. The challenge mainly relies on the gap between human ability to recognize irregular image text and computer recognition ability.
category: AC01
keywords: Image-Text CAPTCHA
keywords: image CAPTCHA
keywords: graphic CAPTCHA
keywords: text CAPTCHA
keywords: OCR CAPTCHA
keywords: image verification
keywords: image-text challenge
citation: Captcha open-source libraries on GitHub
updated: 2026-06-13
version: 1
effectiveness: high
limitation: As computer processing power improves and AI image recognition capabilities advance, the probability of this type of CAPTCHA being cracked is increasing. In particular, the development of AI-generated content has rendered traditional image CAPTCHA mechanisms nearly ineffective. A mainstream evolution direction for image CAPTCHAs is to combine them with behavioral CAPTCHAs (A0001-002), using multi-dimensional factors to complete the human verification challenge.

Behavioral CAPTCHA
type: Avoidance
break id: A0001-002
stix type: course-of-action
definition: A human verification mode that combines image-text recognition with human mouse/keyboard and screen interaction.
description: Common behavioral CAPTCHAs are built on the basis of human recognition of image-text information, requiring actions such as clicking, selecting, sliding, and dragging. They judge human vs. machine by comparing the differences between human behavior and machine behavior. Because image recognition is supplemented by behavioral identification, resistance to cracking is higher than traditional image CAPTCHAs (A0001-001).
category: AC01
keywords: Behavioral CAPTCHA
keywords: slider CAPTCHA
keywords: sliding puzzle CAPTCHA
keywords: click CAPTCHA
keywords: interaction CAPTCHA
keywords: behavior-based verification
keywords: human behavior verification
citation: AJ-Captcha (behavioral CAPTCHA, including sliding puzzle and text click-selection)
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The principle of behavioral CAPTCHAs is to perform certain keyboard/mouse actions based on understanding of image-text information. As seen from the limitations of image CAPTCHAs (A0001-001), the challenge of distinguishing humans from machines through image-text is becoming increasingly difficult. Behavioral CAPTCHAs use deep learning on human keyboard/mouse actions to form models that identify the smooth automated keyboard/mouse operations of machines. However, automated machines can also use deep learning on human keyboard/mouse actions to achieve convincing imitation, which will be a major challenge in the future.

Voice CAPTCHA
type: Avoidance
break id: A0001-003
stix type: course-of-action
definition: A human verification technology similar to image CAPTCHAs but using audio for verification. Users must listen to system-generated voice content and then answer or perform related operations to prove they are a real human user. Voice CAPTCHAs are commonly used in phone verification, voice navigation systems, and other scenarios requiring voice interaction.
description: Methods include: digit string verification — the system generates a voice string containing numbers, and the user must listen and enter the correct digit string to complete verification. Voice commands — the user may be asked to follow voice prompts to perform certain instructions, such as saying specific words, numbers, or performing an action. Speech recognition technology — the voice CAPTCHA system may use speech recognition to confirm whether the user's answer is correct.
category: AC01
keywords: Voice CAPTCHA
keywords: audio CAPTCHA
keywords: speech CAPTCHA
keywords: voice verification challenge
keywords: audio verification
keywords: speech challenge
citation: Digital Identity Guidelines: Authentication and Lifecycle Management - NIST SP 800-63B
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of voice CAPTCHAs include sensitivity to voice quality, differences in user comprehension, noisy environments, unfriendliness to users with disabilities, and potentially increased computational resource requirements.

Silent CAPTCHA
type: Avoidance
break id: A0001-004
stix type: course-of-action
definition: A human verification technology that analyzes the user's behavioral characteristics to determine whether the user is a real human. Silent CAPTCHA does not require the user to perform any additional operations or actively input any information to complete verification.
description: Methods include: user behavior analysis — analyzing behavioral characteristics such as mouse movement trajectories, click events, screen touch pressure, swipe trajectories, request access rates, and 3D gyroscope data to determine whether the user is a real human. User environment analysis — analyzing environmental characteristics such as IP address, device information, browser information, operating system information, and geographic location to determine whether the user is a real human. Combined behavior and environment analysis — analyzing both behavioral and environmental characteristics together to determine whether the user is a real human.
category: AC01
keywords: Silent CAPTCHA
keywords: invisible CAPTCHA
keywords: passive CAPTCHA
keywords: background verification
keywords: risk-based verification
keywords: frictionless bot detection
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of silent CAPTCHA include sensitivity to the user's environment and unfriendliness to users with disabilities.

API Signature Verification
type: Avoidance
break id: A0002
stix type: course-of-action
definition: Performing integrity signing and verification on interface requests.
description: Also known as interface signature verification or request signing. Because client-side data integrity cannot be guaranteed, hashing the request data and re-verifying it on the server side can ensure the data has not been tampered with. Note: data integrity is closely tied to the strength of the hashing algorithm — weak algorithms like MD5 are no longer sufficient to guarantee integrity. Additionally, API signatures are increasingly used in automated request detection and countermeasures. Strictly speaking, API signatures themselves do not have human verification capability; the current focus is on the complexity and concealment of custom signing algorithms, such as client application hardening (A013), data hiding (A039), algorithm whitebox protection, dynamic keys, WebAssembly, etc.
category: AC01
keywords: API Signature Verification
keywords: request signing
keywords: API signing
keywords: interface signature verification
keywords: HMAC signature
keywords: payload signing
keywords: request integrity verification
citation: smart-cloud - an open-source Spring Cloud scaffold with API signing capability
updated: 2026-06-11
version: 1
effectiveness: high
limitation: API signatures are fine for ensuring data integrity during transmission, but because they are widely used to prevent automation, they face strong adversarial pressure. Since the signing algorithm must exist in some form on the client side, it is effectively visible to the user. Attackers can break the signing algorithm by parsing the algorithm, calling the signing interface, simulating clicks, etc., enabling automated forgery of requests.

Cloud-Side Anti-Crawling
type: Avoidance
break id: A0003
stix type: course-of-action
definition: Identifying and restricting crawler requests on the server side based on terminal request characteristics and access frequency.
description: Also known as cloud-side crawler identification. Broadly speaking, any capability for human-machine identification or automated request detection falls under the scope of crawler identification. Here we use a narrow definition: the ability to identify high-frequency automated requests on the server side based on terminal request characteristics, user identity, and access frequency. Terminal request characteristics include but are not limited to: device fingerprinting and terminal tracking (A021), request IP and HTTP header information, etc. Terminal request characteristics combined with user identity enable unique identification of the requesting endpoint; combined with server-side algorithms and rate/count limits per unit time, this enables identification and restriction of high-frequency automated requests.
category: AC03
keywords: Cloud-Side Anti-Crawling
keywords: anti-crawling
keywords: crawler detection
keywords: anti-scraping
keywords: bot detection
keywords: web scraping defense
keywords: anti-bot
citation: Introduction to Crawlers and Anti-Crawling Techniques (see Chapter 2 - Anti-Crawling Technologies)
updated: 2026-02-27
version: 1
effectiveness: high
limitation: Crawler identification depends on three prerequisites: 1. unique identification of the requester, 2. identity identification of the requester, 3. request frequency calculation. All three are necessary. Without effective unique identification, detection can be bypassed by changing IP, UA, or device fingerprint. Without identity identification, good crawlers (search engines) cannot be distinguished from bad ones. Without frequency calculation, effective blocking is impossible. All three prerequisites have limitations: terminal and identity identification not tied to accounts can be forged; account-based identity identification can be countered by bulk registration (R0030-001); if identity is identified by request characteristics, those can be forged; request frequency can be bypassed by slow-rate crawling. Additionally, crawler identification has inherent latency, making it unable to identify and prevent scenarios like last-second bidding (R0003-001) and auction sniping (R0003-002) in real time. Therefore, crawler identification alone cannot solve the problem of automated requests; it must be combined with other countermeasures.

Rate Limiting
type: Avoidance
break id: A0004
stix type: course-of-action
definition: Controlling the access frequency when a visitor requests related resources.
description: Rate limiting can be used in scenarios such as traffic peak shaving. Its purpose is to relieve server pressure. For crawler scenarios with extremely high-frequency data requests far exceeding normal human request rates, it has a relatively direct blocking effect, preventing traffic far exceeding server capacity from causing denial of service and cascading failures.
category: AC04
keywords: Rate Limiting
keywords: throttling
keywords: API rate limiting
keywords: request rate control
keywords: traffic shaping
keywords: request throttling
keywords: burst control
citation: API4:2019 Lack of Resources & Rate Limiting - OWASP API Security ...
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Unlike crawler identification (A003), rate limiting does not strictly distinguish between human traffic and automated traffic. This means that a threshold set too low will mistakenly block some legitimate human requests, while a threshold set too high will let through low-frequency crawlers. Therefore, it cannot be considered an effective crawler identification and blocking measure.

API Rate Limiting and Quota Control
type: Avoidance
break id: A0004-001
stix type: course-of-action
definition: Apply dynamic limits, quotas, and circuit breakers by user, device, IP, tenant, endpoint, and business action.
description: Apply dynamic limits, quotas, and circuit breakers by user, device, IP, tenant, endpoint, and business action.
category: AC01
keywords: API Rate Limiting and Quota Control
keywords: API rate limiting
keywords: quota control
keywords: dynamic throttling
keywords: circuit breaker
keywords: abuse prevention
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

IoT Botnet Traffic Filtering and Rate Limiting
type: Avoidance
break id: A0004-002
stix type: course-of-action
definition: Implement DDoS traffic filtering and rate limiting at the network perimeter to mitigate the impact of attacks originating from compromised devices.
description: Even if a device is infected, its attack capability should be restricted. Mitigation measures include: deploying DDoS scrubbing services (e.g., Cloudflare, Akamai) at the upstream ISP or CDN layer to filter large-scale botnet attacks; setting outbound traffic quotas for individual IoT devices, with automatic rate limiting or blocking of abnormally high traffic; applying behavior-based rate limiting instead of fixed thresholds; deploying Botnet Traffic Filter (BTF) to identify and drop traffic matching botnet signatures; and integrating with threat intelligence feeds to update botnet IP blacklists in real time. This serves as the last line of defense in a defense-in-depth strategy.
category: AC04
keywords: IoT Botnet Traffic Filtering and Rate Limiting
citation: Risk Control for Stablecoin Operations
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Cannot prevent devices from being infected, only reduces the impact; large-scale DDoS attacks may still overwhelm rate limiting; requires continuous threat intelligence updates; rate limiting may affect legitimate high-traffic applications; costs increase with traffic volume.

Quantity Limiting
type: Avoidance
break id: A0005
stix type: course-of-action
definition: Controlling the total number of accesses when a visitor requests related resources.
description: Quantity limiting is similar to rate limiting (A004), but its control point is primarily on the total number of resource requests over a longer period of time. Rate limiting controls the number of accesses within a short time window without limiting the total over a longer period. For example, SMS verification code request interfaces typically apply both per-unit-time rate limits and total request limits per hour or day based on identifiers such as IP, phone number, or user ID — both to prevent malicious resource consumption and to prevent verification code abuse and SMS bombing.
category: AC04
keywords: Quantity Limiting
keywords: quota
keywords: usage limit
keywords: daily limit
keywords: count cap
keywords: attempt limit
keywords: request cap
citation: Authorization Cheat Sheet - OWASP
citation: Blocking Brute Force Attacks - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Quantity limiting is a relatively broad loss-reduction measure: it allows losses or risks to occur but with a certain tolerance. When the unique identity of the requester cannot be accurately identified, the effect is poor. For example, malicious SMS consumption (R0029) and CC attacks (R0029-001) can achieve sustained abuse by continuously changing IPs. If total limits are applied without distinguishing requester identity, normal users will be affected — for example, some cloud services limit total daily request traffic and block all requests once the limit is exceeded.

Malicious Content Detection
type: Avoidance
break id: A0006
stix type: course-of-action
definition: Identifying malicious content in user-generated content.
description: User-generated content (UGC) includes but is not limited to: text, images, video (streams), links, etc. Malicious content varies by interest and scenario and includes but is not limited to: illegal content, violations, fraud, malicious promotion, etc. Simple text detection can be achieved by setting keywords; complex text content may also involve natural language processing. For image or video content, in addition to OCR text recognition, image content recognition is also required. For links, beyond blacklists and whitelists, some scenarios also require combining domain and link threat intelligence (A016-002) for more precise identification.
category: AC03
keywords: Malicious Content Detection
keywords: content moderation
keywords: UGC moderation
keywords: harmful content detection
keywords: abuse detection
keywords: trust and safety
keywords: policy enforcement
citation: Provisions on the Governance of the Online Information Content Ecosystem
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Malicious content detection is mostly based on keyword matching or scoring mechanisms from some type of strategy model, which allows attackers to counter detection through keyword bypasses, model bypasses, or borderline scoring techniques.

Manual Content Review
type: Avoidance
break id: A0006-001
stix type: course-of-action
definition: Reviewing user-generated content for compliance through human review.
description: Manual review is most commonly used for reviewing images, videos, and video streams, or to supplement automated machine identification with stronger judgment.
category: AC03
keywords: Manual Content Review
keywords: human review
keywords: manual moderation
keywords: content moderation review
keywords: trust and safety review
citation: Provisions on the Governance of the Online Information Content Ecosystem
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Due to human resource and efficiency constraints, multi-account, large-scale automated requests can be used to achieve a denial-of-service attack against human reviewers. This can result in prolonged downtime for pre-publication review, or significantly extended response times for post-publication removal of malicious content.

Automated Malicious Image Detection
type: Avoidance
break id: A0006-002
stix type: course-of-action
definition: Identifying malicious image content in user-generated content.
description: Malicious image detection generally consists of two parts: first, OCR recognition of text within the image followed by malicious text detection (A006-001); second, recognition of the visual content of the image itself, such as pornography or violence, which typically requires machine image recognition algorithms.
category: AC03
keywords: Automated Malicious Image Detection
keywords: image moderation
keywords: visual moderation
keywords: image abuse detection
keywords: image safety
keywords: OCR filtering
citation: Artificial Intelligence Risk Management Framework - NIST AI 100-1
citation: Tesseract OCR Documentation
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Current OCR text recognition accuracy is relatively high, but it is still subject to the limitations of automated malicious text detection (A006-001). Recognizing image content itself currently has a low accuracy rate and needs to be combined with manual content review (A006-007).

Automated Malicious Audio Detection
type: Avoidance
break id: A0006-003
stix type: course-of-action
definition: Identifying malicious audio content in user-generated content.
description: Malicious audio detection should also consist of two parts: first, speech recognition to convert speech to text, followed by malicious text detection (A006-001); second, recognition of the content conveyed by the audio, such as pornography or violence.
category: AC03
keywords: Automated Malicious Audio Detection
keywords: audio moderation
keywords: voice moderation
keywords: audio abuse detection
keywords: audio safety detection
citation: Speaker Recognition Evaluation - NIST
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Attackers can use adversarial samples to fool automated malicious audio detection systems, preventing them from accurately detecting and identifying malicious audio. Additionally, automated malicious audio detection systems may be affected by environmental noise, language variation, speaker variation, and other factors, reducing their accuracy.

Automated Malicious Video Detection
type: Avoidance
break id: A0006-004
stix type: course-of-action
definition: Identifying malicious video content in user-generated content.
description: The current general approach to malicious video detection is to extract key frames as images and then perform malicious image detection (A006-002), and to extract the audio track for automated malicious audio detection (A006-003). With the development of AI-generated content, multi-modal large models have gained the ability to understand video content, and detection effectiveness is being significantly improved.
category: AC03
keywords: Automated Malicious Video Detection
keywords: video moderation
keywords: stream moderation
keywords: video abuse detection
keywords: video safety detection
citation: TRECVID - NIST
updated: 2026-06-13
version: 1
effectiveness: high
limitation: This is equally subject to the limitations of automated malicious image detection (A006-002) and automated malicious audio detection (A006-003).

Automated Malicious Link Detection
type: Avoidance
break id: A0006-005
stix type: course-of-action
definition: Identifying malicious links in user-generated content.
description: There are currently two mainstream approaches to handling links: whitelist mode and blacklist mode. Blacklist mode typically needs to be combined with domain and link threat intelligence (A016-002).
category: AC03
keywords: Automated Malicious Link Detection
keywords: malicious URL detection
keywords: phishing URL detection
keywords: URL reputation
keywords: link scanning
keywords: safe browsing
citation: CISA Avoiding Social Engineering and Phishing Attacks
citation: An effective detection approach for phishing websites using URL and HTML features
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Whitelist-based domain auditing is ineffective against open redirect vulnerabilities and resource abuse (R0069). Blacklist-based auditing has the problem that domains or links can easily be changed. Therefore, in many cases neither approach works well.

Automated Malicious Document Detection
type: Avoidance
break id: A0006-006
stix type: course-of-action
definition: Identifying malicious documents in user-generated content.
description: Malicious document detection is carried out in two aspects: first, document content recognition — extracting document content and then performing malicious text detection (A006-001) and malicious image detection (A006-002); second, antivirus detection of the document itself, which typically requires integration with antivirus software.
category: AC03
keywords: Automated Malicious Document Detection
keywords: malicious document scanning
keywords: office document security
keywords: macro malware detection
keywords: document safety scanning
keywords: file inspection
citation: Analyze Malicious Office Documents: The Complete Guide
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Attackers can use adversarial samples to fool automated malicious document detection systems, preventing them from accurately detecting and identifying malicious documents. Additionally, automated malicious document detection systems may be affected by changes in file format, language, font, and other factors, reducing their accuracy.

Automated Malicious Text Detection
type: Avoidance
break id: A0006-007
stix type: course-of-action
definition: Identifying malicious text content in user-generated content.
description: Simple text detection is typically built on a blacklist of keywords; complex text detection combines deep learning with sentiment analysis of the text.
category: AC03
keywords: Automated Malicious Text Detection
keywords: text moderation
keywords: NLP moderation
keywords: harmful text detection
keywords: spam text detection
keywords: content filtering
citation: Leveraging NLP Techniques for Effective Content Moderation
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Due to the diversity and ambiguity of language, and the widespread existence of homophones, near-homophones, and visually similar characters in Chinese, it is very easy to bypass automated malicious text detection and produce malicious text that preserves the original meaning. A classic example is 'Martian script' (a form of obfuscated Chinese text), and there are many other methods such as using pinyin initials as substitutes. Therefore, in some necessary or extreme scenarios, manual content review (A006-007) needs to be introduced as a supplement.

Automated AI-Generated Content Detection
type: Avoidance
break id: A0006-008
stix type: course-of-action
definition: Identifying whether user-generated content was produced by AI.
description: Technologies for detecting AI-generated content (AIGC detection) include: grammatical and logical analysis, semantic consistency detection in text; texture structure detection, frequency domain feature analysis, generation artifact detection in images; spectral feature analysis and voiceprint consistency detection in audio; inter-frame consistency detection and deepfake detection in video. Deep learning models such as convolutional neural networks and multi-modal detection models are widely applied. Since 2025, multi-modal AI detection technology has achieved an average accuracy rate of over 90% for videos generated by mainstream models, but as generative models continue to evolve, the adversarial battle between detection and generation continues to escalate.
category: AC03
keywords: Automated AI-Generated Content Detection
keywords: AI content detection
keywords: synthetic content detection
keywords: AI-generated text detection
keywords: AI-generated image detection
keywords: deepfake detection
citation: iResearch & NetEase Yidun Release Industry First Digital Content Risk Control White Paper
updated: 2026-06-13
version: 1
effectiveness: high
limitation: These methods face the challenge that advanced generative models are increasingly approaching realistic expression, and traditional rule-based and pattern detection approaches may be insufficient to distinguish generated from real content. Deepfake technology continues to evolve, and adversarial samples can fool detection systems. Additionally, while AI-generated content labeling requirements (such as China's requirement for explicit labeling of AI-generated videos starting September 2025) provide supplementary judgment, content from non-compliant platforms remains difficult to identify.

Multi-Factor Authentication
type: Avoidance
break id: A0007
stix type: course-of-action
definition: Adding additional identity verification factors beyond the primary identification method (such as username and password).
description: Multi-Factor Authentication (MFA), sometimes also called two-factor authentication, has become the mainstream approach to identity verification. Its existence largely addresses the problem of identity impersonation and abuse caused by credential leaks. Common MFA factors include: SMS verification codes, email verification codes, Time-based One-Time Passwords (TOTP), etc.
category: AC01
keywords: Multi-Factor Authentication
keywords: MFA
keywords: 2FA
keywords: two-factor authentication
keywords: two-step verification
keywords: step-up authentication
citation: Multifactor Authentication Cheat Sheet - OWASP
citation: NIST SP 800-63B: Digital Identity Guidelines - Authentication and Lifecycle Management
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Compared to traditional username/password login, MFA can significantly improve account security. However, attacks against MFA are also constantly emerging, such as Man-in-the-Middle (MitM) attacks, SIM swap attacks, Pass-The-Cookie attacks, MFA fatigue attacks, etc., which to some extent undermine the account security framework built by MFA.

SMS Verification
type: Avoidance
break id: A0007-001
stix type: course-of-action
definition: Sending a verification code to the user's phone via SMS; the user enters the code to complete identity verification.
description: SMS verification codes are currently the most common form of multi-factor authentication. Their advantages include: 1. The user's phone number is unique and can serve as a unique identifier; 2. SMS verification codes are one-time use with a short validity period, effectively preventing identity impersonation and abuse from code leaks during the validity window; 3. SMS verification codes are a mandatory verification method that users cannot bypass.
category: AC01
keywords: SMS Verification
keywords: SMS OTP
keywords: text message verification
keywords: SMS code
keywords: phone verification code
citation: SMS OTP (One-Time Password) Verification: Quick Start Guide
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because SMS verification codes are sent to the user's phone via SMS, the code may be leaked during the sending process by the SMS service provider or during the phone's receipt process, leading to identity impersonation and abuse. Additionally, since SMS verification codes rely on phone numbers, and users may change their phone numbers, the new holder of a phone number may gain access to the previous holder's account. Furthermore, SMS verification codes are also subject to SMS bombing (R0029).

Email Verification
type: Avoidance
break id: A0007-002
stix type: course-of-action
definition: Sending a verification code to the user's email address; the user enters the code to complete identity verification.
description: Email verification codes are similar to SMS verification codes. Their advantages include: 1. The user's email address is unique and can serve as a unique identifier; 2. Email verification codes are one-time use with a short validity period, effectively preventing identity impersonation and abuse from code leaks during the validity window; 3. Email verification codes are a mandatory verification method that users cannot bypass.
category: AC01
keywords: Email Verification
keywords: email OTP
keywords: email code
keywords: email confirmation
keywords: mailbox verification
citation: Multi-Factor Authentication - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because registering an email address is relatively easy, using email verification codes to defend against bulk registration (R0030-001) is less effective. Additionally, many email services do not require multi-factor authentication for login, meaning that even if email verification codes are used, identity impersonation and abuse cannot be prevented if the user's credentials are leaked.

One-Time Password
type: Avoidance
break id: A0007-003
stix type: course-of-action
definition: A time-based one-time password generated by the TOTP algorithm; the user enters the password to complete identity verification.
description: TOTP is a time-based one-time password. Its advantages include: 1. TOTP is one-time use with a short validity period, effectively preventing identity impersonation and abuse from password leaks during the validity window; 2. TOTP is a mandatory verification method that users cannot bypass.
category: AC01
keywords: One-Time Password
keywords: OTP
keywords: one-time code
keywords: passcode
keywords: verification code
keywords: TOTP
keywords: HOTP
citation: Nearly 1,000 Data Breaches in Q1 2023, Affecting 1,204 Companies Across 38 Industries
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because TOTP is generated by the TOTP algorithm which is time-based, the security of TOTP depends on time synchronization. If the server time and the user's terminal time are out of sync, the TOTP-generated password will be incorrect.

Phone Voice Verification
type: Avoidance
break id: A0007-004
stix type: course-of-action
definition: A human verification technology conducted via phone call. After receiving the call, the user must complete a verification challenge, typically by responding to a system-generated voice prompt or performing a related operation. This verification method is commonly used for account identity verification, password resets, and other sensitive operations to improve security.
description: Methods include: digit string verification — after the user answers the call, the system plays a voice string containing numbers, and the user must listen and enter the correct digit string to complete verification. Voice commands — the user may be asked to follow voice prompts to perform certain instructions, such as saying specific words, numbers, or performing an action. Speech recognition technology — the voice verification system may use speech recognition to confirm whether the user's response is correct.
category: AC01
keywords: Phone Voice Verification
keywords: voice verification
keywords: voice OTP
keywords: call verification
keywords: IVR verification
citation: Digital Identity Guidelines: Authentication and Lifecycle Management - NIST SP 800-63B
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of phone voice verification codes include sensitivity to voice quality, differences in user comprehension, confidentiality concerns, unfriendliness to users with disabilities, and potential risks of abuse.

Passkeys / Phishing-Resistant Authentication
type: Avoidance
break id: A0007-005
stix type: course-of-action
definition: A phishing-resistant authentication method based on FIDO2, WebAuthn, and passkey standards that uses public-key cryptography and relying-party binding to reduce reusable credential theft.
description: Passkeys replace reusable passwords or one-time codes with asymmetric keys. During registration, an authenticator creates a key pair, keeps the private key on a device, security key, or platform authenticator, and stores only the public key on the server. During sign-in, the authenticator verifies the legitimate domain and signs the challenge. This reduces phishing, credential stuffing, MFA fatigue, and adversary-in-the-middle code theft risks for account login, administrator access, and high-risk transaction confirmation.
category: AC01
keywords: Passkeys / Phishing-Resistant Authentication
keywords: passkeys
keywords: phishing-resistant auth
keywords: passwordless login
keywords: FIDO2
keywords: WebAuthn
keywords: anti-phishing MFA
citation: More than a Password - CISA
citation: CISA Secure by Demand Guide: Phishing-Resistant Authentication
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Passkeys do not prevent session hijacking after an active session cookie, device token, or endpoint is stolen by malware. Cross-device sync, account recovery, device loss, and compatibility require supporting processes. High-risk services should combine passkeys with device binding, session risk controls, anomaly detection, and step-up authorization.

Improving Service Availability
type: Avoidance
break id: A0008
stix type: course-of-action
definition: Improving the number of concurrent terminal requests that can be handled by filtering traffic and increasing server computing resources.
description: Improving service availability is a systematic engineering effort. On one hand, it requires identifying and blocking malicious traffic; on the other hand, it requires addressing system bottlenecks and improving response efficiency.
category: AC01
keywords: Improving Service Availability
keywords: high availability
keywords: uptime improvement
keywords: service resilience
keywords: fault tolerance
keywords: service continuity
citation: High Availability - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Cost issues: improving service availability requires significant investment in human, material, and financial resources, which may increase enterprise costs. Technical issues: in some cases, technical limitations may affect service availability — for example, some applications may not be able to seamlessly switch between multiple data centers. Human factors: human factors may also affect service availability, such as human error and malicious attacks.

Adding Computing Resources
type: Avoidance
break id: A0008-001
stix type: course-of-action
definition: Improving the number of concurrent terminal requests that can be handled by adding server computing resources.
description: For distributed architectures, adding computing resources is the simplest and most effective way to improve availability.
category: AC01
keywords: Adding Computing Resources
keywords: autoscaling
keywords: horizontal scaling
keywords: capacity scaling
keywords: scale out
keywords: elastic scaling
citation: Auto Scaling - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: This is complementary to business system optimization (A008-004). Adding computing resources can quickly resolve availability issues but will significantly increase operating costs.

DDoS Protection
type: Avoidance
break id: A0008-002
stix type: course-of-action
definition: Identifying and filtering attack traffic through a DDoS protection system.
description: Filtering attack traffic through a DDoS protection system allows fewer, more legitimate user requests to be served by the server. This is an effective approach when the system is under large-scale attack.
category: AC01
keywords: DDoS Protection
keywords: DDoS mitigation
keywords: anti-DDoS
keywords: traffic scrubbing
keywords: volumetric attack defense
keywords: L7 DDoS protection
citation: Denial of Service Attack - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Existing DDoS protection systems have limited effectiveness against CC attacks and need to be combined with cloud-side anti-crawling (A003) and other measures.

Front-End CDN
type: Avoidance
break id: A0008-003
stix type: course-of-action
definition: Configuring a CDN in front of resource access to achieve caching and acceleration of static resources.
description: Dynamic-static separation is a common method for improving server response efficiency. For situations where dynamic-static separation cannot be implemented or where static resource load is high, a front-end CDN can effectively relieve server pressure and improve response efficiency.
category: AC01
keywords: Front-End CDN
keywords: CDN
keywords: content delivery network
keywords: edge caching
keywords: static asset delivery
keywords: web acceleration
citation: What is Amazon CloudFront? - AWS Documentation
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Caching acceleration is effective for static resources but does not help with dynamic resources.

Business System Optimization
type: Avoidance
break id: A0008-004
stix type: course-of-action
definition: Optimizing the business system to improve response efficiency and reduce resource consumption.
description: Reducing the system load of business requests by streamlining processes, setting up caches, optimizing algorithms, increasing concurrency, and adjusting architecture — thereby reducing response time and increasing request throughput.
category: AC01
keywords: Business System Optimization
keywords: system optimization
keywords: performance tuning
keywords: process optimization
keywords: throughput improvement
keywords: latency reduction
citation: Business Continuity - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Has a long implementation cycle; suitable for long-term planning but not a quick fix. Requires significant R&D investment.

Increasing Business Resources
type: Avoidance
break id: A0008-005
stix type: course-of-action
definition: Addressing resource scarcity to some extent by increasing the available business resources.
description: For example, increasing the number of products, quota slots, adding more shifts, flights, etc.
category: AC01
keywords: Increasing Business Resources
keywords: capacity expansion
keywords: resource scaling
keywords: inventory expansion
keywords: quota increase
keywords: staffing increase
citation: Cloud Computing - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: For resources that can yield high returns, it is difficult to directly solve resource scarcity by simply increasing supply.

Time Limiting
type: Avoidance
break id: A0009
stix type: course-of-action
definition: Controlling related resources so they are only valid within a certain time window.
description: A typical scenario for time limiting is SMS verification code sending: by limiting the interval between code sends, it prevents SMS bombing against a specific phone number. Time limits are also commonly applied in scenarios such as password brute-forcing and payment password errors to prevent account compromise and financial loss. Time limiting is sometimes also applied to user content posting scenarios to prevent content bombing or to slow down the pressure from automated requests.
category: AC04
keywords: Time Limiting
keywords: time window limit
keywords: cooldown period
keywords: send interval limit
keywords: expiry window
keywords: temporal rate limiting
citation: Rate Limiting - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Time limiting is generally a 'business-impacting' countermeasure that has some effect on normal user requests or services. Therefore, a compromise value is usually chosen that is acceptable to normal users while maximally blocking attackers.

Terminal Abnormal Environment Detection
type: Avoidance
break id: A0010
stix type: course-of-action
definition: Identifying the application runtime environment and user request environment to detect anomalies.
description: Abnormal environment detection works by collecting, analyzing, and evaluating dozens of data points including but not limited to: terminal silent human verification challenges, application legitimacy, process legitimacy, whether the device is rooted/jailbroken, gyroscope status, and whether plugins are installed. In business scenarios, abnormal environment detection is generally implemented through the business terminal access system. Depending on the business access mode, the terminal access system may be a browser, a mobile APP, a desktop application, etc. Abnormal environment detection capability is heavily dependent on the permissions of the business terminal access system. Due to user authorization restrictions and legal/regulatory constraints, abnormal environment detection has certain limitations and is also constrained by adversarial countermeasures and terminal data integrity.
category: AC02
keywords: Terminal Abnormal Environment Detection
keywords: device fingerprinting
keywords: anomaly detection
keywords: device environment check
keywords: abnormal device detection
keywords: terminal environment detection
citation: Device Fingerprint - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Because abnormal environment detection is carried out on a user-controlled terminal, the ultimate effectiveness depends on the adversarial contest. In theory, since the terminal is controllable, it is always possible to bypass various abnormal environment detection strategies — it is ultimately a matter of time cost and capability.

Emulator Detection
type: Avoidance
break id: A0010-001
stix type: course-of-action
definition: Identifying whether an APP is running on a mobile phone emulator.
description: Emulators are often used for fraudulent order manipulation. Accurately identifying emulators has become an important module in app development, and there are now specialized companies providing SDKs for developers to detect emulators. Currently popular Android emulators fall into roughly two categories: those based on QEMU and those based on Genymotion (VirtualBox-type). Common detection methods include: checking whether the IMEI is all zeros (0000000000 format); checking for emulator-specific values in the Build properties; matching QEMU-specific feature files and properties; obtaining CPU information and filtering out x86 (real devices are generally ARM-based), etc.
category: AC02
keywords: Emulator Detection
keywords: emulator check
keywords: Android emulator detection
keywords: virtual device detection
keywords: QEMU detection
keywords: Genymotion detection
citation: MASTG-KNOW-0031: Emulator Detection - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: There are two countermeasure points for mobile emulator detection: one is to pre-forge the information collected by the APP; the other is to forge the information after the APP has collected and uploaded it.

Cloud Phone Detection
type: Avoidance
break id: A0010-002
stix type: course-of-action
definition: Identifying whether an APP is running on a cloud phone.
description: Cloud phone detection can be performed using the same methods as mobile emulator detection (A010-001). Additionally, device fingerprinting, abnormal environment monitoring, and outbound IP can also be used for cloud phone detection. Since cloud phones typically cannot modify the ROM and most cannot even obtain root access, the countermeasure effectiveness is generally better than mobile emulator detection (A010-001).
category: AC02
keywords: Cloud Phone Detection
keywords: cloud phone check
keywords: virtual phone detection
keywords: cloud handset detection
keywords: phone farm detection
citation: NIST Guidelines for Managing the Security of Mobile Devices
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: As cloud phones and cloud gaming continue to develop and become more widespread, APP vendors will not be able to adopt a blanket 'cloud equals blacklisted' policy, otherwise they will face a large number of user complaints. This leaves room for the black-gray industry to exploit cloud phones in the future.

ROOT/Jailbreak Detection
type: Avoidance
break id: A0010-003
stix type: course-of-action
definition: Identifying whether an APP is running on a device that has been rooted or jailbroken.
description: Detection is based on characteristics of rooted or jailbroken devices, such as: checking whether the published system version is test-keys (test build) or release-keys (release build); checking for the existence of Superuser.apk; detecting whether 'su' exists in common directories; using the 'which' command to check for 'su'; executing 'su' to see if root access can be obtained; checking for busybox; accessing the /data directory to check read/write permissions, etc.
category: AC02
keywords: ROOT/Jailbreak Detection
keywords: root detection
keywords: jailbreak detection
keywords: rooted device detection
keywords: jailbroken device detection
keywords: anti-rooting
citation: Summary of Android Root Detection Methods
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: There are two strategies for anti-detection on rooted devices: one is to target the app and interfere with its root detection behavior; the other is to target the system and hide the system's own root-related characteristics. By reversing every root detection policy and rule in the app, anti-detection strategies can be pre-built. For example, the open-source RootCloak can hook API calls to counter root detection.

Cheat/Plugin Detection
type: Avoidance
break id: A0010-004
stix type: course-of-action
definition: Identifying whether a program has had runtime instructions injected or cheat programs attached.
description: Detection is performed by checking program runtime integrity, keyword or DLL list detection, process lists, window title keywords, etc. to determine whether cheat programs are present.
category: AC02
keywords: Cheat/Plugin Detection
keywords: anti-cheat
keywords: cheat detection
keywords: plugin detection
keywords: mod menu detection
keywords: game hack detection
keywords: DLL injection detection
citation: In-Depth Analysis of DMA Hardware Cheat Principles and Detection Techniques
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Similar to the limitations of mobile ROOT/jailbreak detection (A010-003), by analyzing and reversing the detection process, blocking or providing hooked false values can bypass cheat detection. However, since cheats are typically used in games, and game data packets are much less readable than HTTP-based APP traffic, hiding cheat detection logic and data reporting within normal game operation and communication will increase the difficulty of anti-cheat countermeasures.

Multi-Instance Detection
type: Avoidance
break id: A0010-005
stix type: course-of-action
definition: Identifying whether an APP is running in multiple instances on a terminal.
description: Game multi-instance detection simply limits the number of game processes and is divided into pre-detection, in-process detection, and post-detection. In-process and post-detection are often silent and serve as the basis for banning or penalizing accounts. Pre-detection prevents multi-instance launching and includes methods such as: process enumeration multi-instance detection, mutex object multi-instance detection, semaphore multi-instance detection, window multi-instance detection, shared memory multi-instance detection, etc.
category: AC02
keywords: Multi-Instance Detection
keywords: multi-instance check
keywords: multi-open detection
keywords: instance limiting
keywords: multi-login detection
keywords: parallel instance detection
citation: MASTG-KNOW-0031: Emulator Detection - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: By analyzing and reversing the detection process, blocking or providing hooked false values can bypass multi-instance detection.

Debugger Detection
type: Avoidance
break id: A0010-006
stix type: course-of-action
definition: Identifying whether a program is being debugged.
description: The most basic debugger detection technique is to check the BeingDebugged flag in the Process Environment Block (PEB). Another PEB member called NtGlobalFlag (offset 0x68) is also used by packers to detect whether the program was loaded with a debugger. Kernel32!CheckRemoteDebuggerPresent() is another API that can be used to determine whether a debugger is attached to a process. When stepping over INT3 and INT1 instructions in a debugger, since the debugger typically handles these debug interrupts, the exception handler will not be called by default. Debugger Interrupts exploits this fact — a packer can set a flag in the exception handler, and if the flag is not set after the INT instruction, it means the process is being debugged. See references for more methods.
category: AC02
keywords: Debugger Detection
keywords: anti-debugging
keywords: debugger check
keywords: debug detection
keywords: process debugging detection
keywords: runtime debugger detection
citation: MASTG-KNOW-0085: Anti-Debugging Detection - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: By analyzing and reversing the detection process, blocking or providing hooked false values can bypass debugger detection.

Virtual Machine Detection
type: Avoidance
break id: A0010-007
stix type: course-of-action
definition: Identifying whether an APP is running inside a virtual machine.
description: Virtual machine environment detection refers to software's ability to determine whether it is currently running in a virtual machine and to take corresponding action based on the result. From a malware perspective, it can change its behavior inside a virtual machine to increase analysis difficulty. From a software security perspective, it is used to prevent reverse engineering and abnormal use in certain scenarios.
category: AC02
keywords: Virtual Machine Detection
keywords: VM detection
keywords: virtual machine check
keywords: sandbox detection
keywords: hypervisor detection
keywords: virtualized environment detection
citation: Virtual Machine Runtime Environment Detection
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Virtual machine detection methods mainly work by checking certain environment properties and files, but these methods are not absolutely reliable because black-gray industry actors can modify the virtual machine's environment properties and files to evade detection.

Headless Browser Detection
type: Avoidance
break id: A0010-008
stix type: course-of-action
definition: Identifying whether an APP is running inside a headless browser.
description: Headless browser detection refers to software's ability to determine whether it is currently running in a headless browser and to take corresponding action based on the result. From a malware perspective, it can change its behavior inside a headless browser to increase analysis difficulty. From a software security perspective, it is used to prevent reverse engineering and abnormal use in certain scenarios.
category: AC02
keywords: Headless Browser Detection
keywords: headless Chrome detection
keywords: headless mode detection
keywords: browser automation detection
keywords: bot browser detection
keywords: Puppeteer detection
citation: National Cybersecurity Awareness Week: Domain Name Theft Should Not Be Underestimated
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Headless browser detection methods mainly work by checking certain environment properties and files, but these methods are not absolutely reliable because black-gray industry actors can modify the headless browser's environment properties and files to evade detection.

HOOK Detection
type: Avoidance
break id: A0010-009
stix type: course-of-action
definition: Identifying whether an APP is running in a HOOKed environment.
description: HOOK detection refers to software's ability to determine whether it is currently running in a HOOKed environment and to take corresponding action based on the result. From a malware perspective, it can change its behavior in a HOOKed environment to increase analysis difficulty. From a software security perspective, it is used to prevent reverse engineering and abnormal use in certain scenarios.
category: AC02
keywords: HOOK Detection
keywords: anti-hooking
keywords: API hooking detection
keywords: runtime hooking detection
keywords: function hooking
keywords: inline hooking
citation: Android Hook, Detection, and Countermeasures
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: HOOK detection methods mainly work by checking certain environment properties and files, but these methods are not absolutely reliable because black-gray industry actors can modify the HOOKed environment's properties and files to evade detection.

Force Session Logout
type: Avoidance
break id: A0011
stix type: course-of-action
definition: Logging the user out of their session and invalidating the current login state on the server side.
description: Forcing a session logout is a lightweight user penalty strategy (A020). Some cases are for the user's account security, such as detection and handling of cookie reuse and logins from unusual locations. Other cases aim to force the session holder to go through the identity authentication (A018) login challenge again — for example, many crawlers use session tokens for data scraping. Since the login challenge typically includes credential verification, human verification (A001), and multi-factor authentication (A007) challenges, this can effectively disrupt automated crawlers.
category: AC04
keywords: Force Session Logout
keywords: session logout
keywords: forced logout
keywords: session invalidation
keywords: sign out everywhere
keywords: token revocation
citation: Session Management - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Many applications support multi-point login, meaning that even after a session is forced out, the user can still access via another active session. Additionally, because forcing a session logout effectively disrupts the black-market cookie trading workflow, many black-market account vendors now provide one-click login tools that can re-login instantly even after a forced logout.

Forced Password Reset
type: Avoidance
break id: A0012
stix type: course-of-action
definition: Issuing a mandatory password reset to the user; the user must successfully reset their password before they can log in.
description: Forced password resets are generally applied in scenarios such as successful credential stuffing, password leaks, logins from unusual locations, long periods of inactivity, password expiration, and unchanged default passwords. The main purpose is to use the password reset process and the identity authentication (A018) within it to verify account ownership and reduce the risk of credential exposure.
category: AC04
keywords: Forced Password Reset
keywords: password reset enforcement
keywords: mandatory password change
keywords: forced reset
keywords: account recovery reset
keywords: password rotation
citation: Password Policy - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Forced password resets have a significant negative impact on user experience.

Client Application Hardening
type: Avoidance
break id: A0013
stix type: course-of-action
definition: Applying code-level obfuscation, anti-debugging, and other protections to front-end JS scripts or client APPs.
description: Client-side code obfuscation can, to some extent, prevent black-gray industry actors from directly reverse-engineering client-side code to analyze resource access logic and implement business automation and data scraping. It also increases the difficulty of breaking client-side human verification challenges, abnormal environment detection (A010), API signatures (A002), and other business security measures. However, because the obfuscated code still resides on the user's client, it is theoretically possible to fully reverse the obfuscated code given sufficient time and effort. Therefore, client-side code obfuscation is only a means of reducing the ROI of black-gray industry actors. However, according to the PDR formula Pt > Dt + Rt, if defenders can reduce the obfuscation cycle to within the cracking cycle, long-term protection may be achievable. Anti-debugging can be either a blocking mechanism against debugging or an interference mechanism — for example, one program logic can run in a non-debug environment and a different logic in a debug environment.
category: AC01
keywords: Client Application Hardening
keywords: app hardening
keywords: client-side hardening
keywords: code obfuscation
keywords: anti-reverse engineering
keywords: anti-tampering
keywords: anti-debugging
citation: Code Obfuscation - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Hardened applications can still be decompiled: although hardening increases the difficulty of decompilation, it cannot completely prevent it. Hackers can use various means to crack hardened applications and obtain source code and sensitive information. Hardened applications may have compatibility issues: since hardening modifies the application's code and structure, it may cause compatibility problems — for example, the hardened application may not run on certain devices or may crash. Hardened applications may have performance issues: since hardening increases the application's size and runtime overhead, it may cause performance problems such as slower startup or higher memory usage.

Android Application Hardening
type: Avoidance
break id: A0013-001
stix type: course-of-action
definition: Hardening Android applications through anti-reverse engineering, anti-tampering, anti-debugging, and anti-malware measures.
description: Multiple DEX protection modes combined with VMP virtual machines encrypt and protect critical code and core logic, preventing source code extraction via reverse engineering tools such as IDA, JEB, JADX, APKTool, and Readelf. Each file in the app is assigned a unique fingerprint; combined with signature and file integrity verification, replacing any file will prevent the app from running, guarding against ad virus injection, repackaging, and feature blocking. Multi-layer encryption combined with low-level countermeasures prevents code injection and Java/C-layer dynamic debugging, effectively resisting dynamic debugging, memory dumping, code injection, and HOOK attacks. Effectively detects and counters: ROOT, emulators, UI hijacking, multi-instance tools, Xposed plugins, Frida, and other HOOK tools. (Excerpted from dun.163.com)
category: AC01
keywords: Android Application Hardening
keywords: Android app hardening
keywords: APK hardening
keywords: mobile app hardening
keywords: Android anti-reverse engineering
keywords: Android code obfuscation
citation: OWASP Mobile Application Security
updated: 2026-06-11
version: 1
effectiveness: high
limitation: May have compatibility and runtime performance issues.

iOS Application Hardening
type: Avoidance
break id: A0013-002
stix type: course-of-action
definition: Hardening iOS applications through anti-reverse engineering, anti-tampering, anti-debugging, and anti-malware measures.
description: Encrypts strings to prevent keyword-based location of core business code via tools like IDA. Applies multiple obfuscation methods to application code to increase complexity and reverse analysis difficulty without affecting original logic and performance. Obfuscates application symbols to increase code reverse difficulty. Advanced anti-debugging techniques prevent attackers and malicious analysts from dynamically debugging the program. Protects binary code from being decompiled into pseudo-code by reverse analysis tools. Protects numerical values in the application from being tampered with by memory editors (e.g., attack power, HP in games). Applies integrity protection to prevent tampering, repackaging, and other cheating behaviors. (Excerpted from dun.163.com)
category: AC01
keywords: iOS Application Hardening
keywords: iOS app hardening
keywords: IPA hardening
keywords: mobile app hardening
keywords: iOS anti-reverse engineering
keywords: iOS code obfuscation
citation: OWASP Mobile Application Security
updated: 2026-06-11
version: 1
effectiveness: high
limitation: May have compatibility and runtime performance issues.

H5/Mini-Program Hardening
type: Avoidance
break id: A0013-003
stix type: course-of-action
definition: Hardening H5 applications through anti-reverse engineering, anti-tampering, anti-debugging, and anti-malware measures.
description: Uses encryption technology to counter dynamic debugging and prevent code from being debugged and cracked or data from being extracted. Supports strong binding of H5 applications to specified domains, preventing domain tampering that could redirect users or enable fraud. Encrypts code and script files, including dynamic encryption/decryption of strings, function names, and expressions, and obfuscates variables to increase cracking difficulty. Also supports code file compression to reduce application size. Uses encryption technology to protect data and prevent sensitive data from being obtained through network packet capture. (Excerpted from dun.163.com)
category: AC01
keywords: H5/Mini-Program Hardening
keywords: H5 hardening
keywords: mini-program hardening
keywords: mini app hardening
keywords: webview hardening
keywords: JavaScript obfuscation
keywords: WeChat mini program security
citation: OWASP Bytecode Obfuscation
updated: 2026-06-11
version: 1
effectiveness: high
limitation: May have compatibility and runtime performance issues.

Desktop Application Hardening
type: Avoidance
break id: A0013-004
stix type: course-of-action
definition: Hardening desktop applications through anti-reverse engineering, anti-tampering, anti-debugging, and anti-malware measures.
description: Encrypts and protects the application to prevent decompilation. Applies obfuscation to increase code complexity and reverse analysis difficulty without affecting original logic and performance. Obfuscates application symbols to increase code reverse difficulty. Advanced anti-debugging techniques prevent attackers and malicious analysts from dynamically debugging the program. Protects binary code from being decompiled into pseudo-code by reverse analysis tools. Protects numerical values in the application from being tampered with by memory editors (e.g., attack power, HP in games). Applies integrity protection to prevent tampering, repackaging, and other cheating behaviors.
category: AC01
keywords: Desktop Application Hardening
keywords: desktop app hardening
keywords: Windows app hardening
keywords: reverse engineering protection
keywords: code obfuscation
keywords: desktop anti-tampering
citation: OWASP Bytecode Obfuscation
updated: 2026-06-11
version: 1
effectiveness: high
limitation: May have compatibility and runtime performance issues.

Anti-Tampering Mechanism
type: Avoidance
break id: A0014
stix type: course-of-action
definition: A set of technologies and measures designed to ensure the integrity of data, software, or information. Such mechanisms aim to prevent unauthorized modification, tampering, or damage, ensuring data trustworthiness and accuracy.
description: Common anti-tampering methods and practices include: Digital signatures — using asymmetric encryption algorithms to generate digital signatures for data; verifying the signature confirms data integrity and source authenticity. Hash algorithms — hashing data to generate a fixed-length hash value; even a minor change in the data causes a significant change in the hash, used to verify data integrity. Access control — restricting access permissions to data and systems to prevent unauthorized modification. Secure transport protocols — using secure transport protocols (such as HTTPS) to ensure data integrity during transmission. Logging — recording key operations and events to track and verify the modification history of data.
category: AC01
keywords: Anti-Tampering Mechanism
keywords: tamper protection
keywords: integrity protection
keywords: anti-modification
keywords: data integrity check
keywords: file integrity monitoring
citation: Tamper Protection - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Key management: if key management is improper, mechanisms such as digital signatures may be attacked, affecting data integrity verification. Dependence on a trusted environment: the effectiveness of anti-tampering mechanisms depends on the overall security of the system or environment; if the overall environment is untrusted, the mechanism may be compromised. Performance impact: some anti-tampering measures may have a certain impact on system performance, especially in large-scale data processing scenarios. Human factors: human error, negligence, or insider threats may bypass anti-tampering mechanisms and affect data integrity.

Client-Side Anti-Tampering
type: Avoidance
break id: A0014-001
stix type: course-of-action
definition: Ensuring the integrity of client-side programs and preventing malicious tampering.
description: Signing and integrity-checking the client application and its associated files ensures that the program cannot run normally if content injection, repackaging, or feature blocking occurs at runtime.
category: AC01
keywords: Client-Side Anti-Tampering
keywords: client-side tamper protection
keywords: app tamper protection
keywords: anti-repackaging
keywords: anti-injection
keywords: client integrity check
citation: Code Obfuscation - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Attackers can use decompilation tools to analyze the program and find the implementation of the anti-tampering algorithm. Additionally, attackers can use debugging tools to trace the program's execution and find vulnerabilities in the anti-tampering algorithm.

Server-Side Anti-Tampering
type: Avoidance
break id: A0014-002
stix type: course-of-action
definition: A set of security measures designed to protect server systems from unauthorized access, modification, or damage, ensuring the integrity of software, configurations, and data on the server.
description: Common server-side anti-tampering measures include: Integrity checks — using hash algorithms to regularly check the integrity of critical files and system images on the server to detect tampering. Real-time monitoring — deploying real-time monitoring systems to watch server activity and file system changes, detecting anomalies promptly. Secure configuration — applying security configurations to the server OS and related services, disabling unnecessary services and ports, and following the principle of least privilege. Firewalls and Intrusion Detection Systems (IDS) — deploying firewalls and IDS to monitor and block malicious traffic and reduce unauthorized access. Regular vulnerability scanning and patch management — regularly scanning the server for vulnerabilities and applying patches promptly to prevent attackers from exploiting known vulnerabilities. Access control — using strong password policies, multi-factor authentication, and other measures to restrict server access, ensuring only authorized users can access it. Encrypted communication — using encrypted communication protocols (such as SSH, HTTPS) to protect communication between the server and clients.
category: AC01
keywords: Server-Side Anti-Tampering
keywords: server-side tamper protection
keywords: server integrity checks
keywords: file integrity monitoring
keywords: configuration integrity
keywords: change detection
citation: File Integrity Monitoring - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Zero-day vulnerabilities: anti-tampering mechanisms may not defend against undisclosed zero-day vulnerabilities since no corresponding fix exists yet. False positives and false negatives: security tools may produce false positives or false negatives, leading to misinterpretation of normal operations or overlooking real threats. Human factors: administrator misconfiguration, negligence, or insider threats may bypass anti-tampering measures. Performance impact: strong anti-tampering measures may sometimes have a certain impact on server performance.

Risk Control Strategy
type: Avoidance
break id: A0015
stix type: course-of-action
definition: Implementing existing or additional risk control strategies to mark and manage special users or behaviors.
description: Risk control is the most widely applied measure in business security and is an essential tool for defending against major business operational risks. The security capability level of risk control is heavily dependent on its strategies — this is both an advantage and a disadvantage. The advantage is flexibility in business protection; the disadvantage is coverage of business protection scenarios. Additionally, because risk control can have many risk handling stages and post-processing logic, it can avoid direct confrontation with attackers at high-adversarial stages, achieving long-term effectiveness. However, precisely because of this, compared to some other security measures, risk control can be lagging in certain situations — for example, some identification and handling occurs after the business process has completed, which may cause some financial loss and may also lead to a poor user experience.
category: AC03
keywords: Risk Control Strategy
keywords: risk control
keywords: fraud prevention
keywords: risk management strategy
keywords: policy controls
keywords: rule engine
keywords: risk rules
citation: 50+ Experts Discuss LLM Technology Evolution: 2024 Global Machine Learning Technology Conference
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Risk control strategies may be affected by data quality, data sources, and data processing, leading to inaccurate risk assessments. Additionally, risk control strategies may be limited by technical means — for example, some fraud methods may not be detectable by traditional risk control technology.

Threat Intelligence
type: Avoidance
break id: A0016
stix type: course-of-action
definition: Marking black-market identities using threat intelligence such as blacklisted IP databases and blacklisted phone number databases.
description: Also commonly abbreviated as TI or CTI. The definition of threat intelligence can be very broad: any data label that can identify good or bad is threat intelligence. Threat intelligence places high demands on intelligence operations capability and intelligence quality, requiring data to remain fresh on a continuous and real-time basis. Precision and recall are generally used as metrics for threat intelligence quality. Good threat intelligence can be used directly as a protective measure, while poor-quality threat intelligence needs to be combined with risk control strategies (A015) to avoid incomplete coverage or large-scale false positives.
category: AC03
keywords: Threat Intelligence
keywords: CTI
keywords: cyber threat intelligence
keywords: threat feeds
keywords: intel sharing
keywords: indicator feeds
keywords: threat intel
citation: [PDF] Guide to Cyber Threat Information Sharing
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of threat intelligence mainly include: incomplete information sources, timeliness challenges, excessive false information, difficulty distinguishing targeted attacks, difficulty quantifying real impact, challenges in cross-organizational sharing and collaboration, and compliance issues related to privacy and regulations.

IP Intelligence
type: Avoidance
break id: A0016-001
stix type: course-of-action
definition: Labeling IP addresses with risk scores, types, and other attributes.
description: IP intelligence refers to various information about IP addresses. In a narrow sense, IP intelligence may only include the risk score of an IP. In a broad sense, IP intelligence also includes: geographic location, ISP (Internet Service Provider) information, ASN (Autonomous System Number), malicious activity history, user information, proxy detection, network traffic analysis, etc.
category: AC03
keywords: IP Intelligence
keywords: IP reputation
keywords: IP risk scoring
keywords: proxy detection
keywords: geolocation intelligence
keywords: IP reputation data
citation: Threat Intelligence - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of IP threat intelligence are that it can only provide limited information and cannot provide a complete threat picture. Additionally, since network attackers constantly change their attack methods and techniques, the effectiveness of IP intelligence can also be affected. Therefore, when using IP intelligence, it needs to be combined with other security technologies and measures to improve the effectiveness of network security protection.

Domain & Link Threat Intelligence
type: Avoidance
break id: A0016-002
stix type: course-of-action
definition: Labeling malicious domains or links.
description: Compared to IP intelligence (A016-001), domain and link intelligence has higher accuracy and effectiveness, but its use cases are more limited: IP intelligence can be applied to virtually any network request scenario, while domain and link intelligence is typically only applicable to malicious link detection (A006-005) scenarios.
category: AC03
keywords: Domain & Link Threat Intelligence
keywords: domain intelligence
keywords: URL intelligence
keywords: malicious domain detection
keywords: link reputation
keywords: phishing domain reputation
citation: Information Sharing - CISA
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Domain-level threat intelligence has the problem of being too broad, making domain-based blocking prone to false positives. Link-level intelligence has the problem of being too narrow, meaning that simply modifying a link descriptor can bypass detection.

Phone Number Intelligence
type: Avoidance
break id: A0016-003
stix type: course-of-action
definition: Labeling black-market phone numbers, recycled numbers, etc.
description: Black-market phone numbers are mostly generated from risk control systems and risk device identification countermeasures. Recycled numbers (numbers reassigned to new users) typically come from carriers; by connecting to carrier interfaces, businesses can promptly obtain the active status and secondary identity binding status of phone numbers.
category: AC03
keywords: Phone Number Intelligence
keywords: phone reputation
keywords: phone number risk
keywords: recycled number detection
keywords: virtual number detection
keywords: blacklisted number
citation: Thousands of Phones Hacked by Spyware - Xinhua
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Black-market actors can obtain phone numbers by renting real people's phone numbers. Additionally, interception SIM cards (real phones with malware installed to intercept SMS messages) have a high market share in the black-market industry and have become the most mainstream type of malicious phone number. Although these phone numbers are used for black-gray market activities, they cannot be directly blocked as blacklisted numbers.

IOC (Indicator of Compromise) Intelligence
type: Avoidance
break id: A0016-004
stix type: course-of-action
definition: IOC (Indicator of Compromise) intelligence refers to specific markers and characteristics used to detect and confirm whether a computer system or network has been threatened or compromised. These markers can include specific file hashes, IP addresses, domain names, malicious file behavior patterns, etc.
description: Content may include: file hash values — unique identifiers of malicious files, used to identify known malware. IP addresses — known malicious IP addresses associated with malicious activity. Domain names — potentially malicious domain names associated with threats. Malicious file behavior patterns — specific malware may have unique behavior patterns that can serve as threat indicators.
category: AC03
keywords: IOC (Indicator of Compromise) Intelligence
keywords: IOC intelligence
keywords: IOCs
keywords: indicators of compromise
keywords: threat indicators
keywords: malware indicators
citation: OASIS Cyber Threat Intelligence Technical Committee
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of IOC intelligence include dependence on known attack patterns, vulnerability to attackers changing IOCs, susceptibility to false positives and false negatives, and its static-feature-based nature making it difficult to adapt to dynamic and evolving threat environments.

Risk Address Intelligence
type: Avoidance
break id: A0016-005
stix type: course-of-action
definition: Labeling false or malicious shipping and contact addresses entered by users.
description: Such intelligence systems typically combine data analysis, machine learning, and AI technologies to extract patterns, behaviors, and characteristics from large data sources to identify potentially risky addresses. Key aspects include: fake identity and fraud detection — analyzing user-provided address information against other data points (such as name, contact information) to identify fake identities or fraudulent behavior. Historical behavior analysis — analyzing past user behavior patterns to identify abnormal or unusual address entry behavior, such as frequently changing addresses or using similar fake addresses. Geographic information verification — using GIS and geolocation data to verify whether user-provided addresses match actual geographic locations. Social network analysis — linking user address information with their social network activity and relationships to help detect potential fraud or illegal activity. Blacklist matching — matching against known blacklists of addresses associated with fraud and malicious activity.
category: AC03
keywords: Risk Address Intelligence
keywords: address risk scoring
keywords: shipping address fraud
keywords: address reputation
keywords: fraud address screening
keywords: delivery address intelligence
citation: Guide to Cyber Threat Information Sharing - NIST SP 800-150
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Limitations include the possibility of false information evading detection, high false positive rates, strong dependence on data quality, privacy concerns, constraints from geographic diversity, insufficient adaptability to new fraud forms, potential negative impact on user experience, and relatively high implementation and maintenance costs.

Additional Identity Authorization
type: Avoidance
break id: A0017
stix type: course-of-action
definition: Adding permission verification to the application workflow to re-confirm the user's request intent and true identity.
description: Additional identity authorization can be applied in business scenarios such as: payment, password changes, identity binding, third-party OAuth authorization, coupon redemption, points redemption, account cancellation, etc. Available forms include: entering a password, facial recognition, fingerprint recognition, phone verification code, etc.
category: AC01
keywords: Additional Identity Authorization
keywords: step-up authorization
keywords: secondary authorization
keywords: reauthentication
keywords: transaction approval
keywords: consent confirmation
citation: Multi-Factor Authentication - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Adding identity authorization via password entry is only suitable for scenarios where the goal is to have the user re-confirm their request intent, or to defend against stolen login credentials (e.g., cookies). Since it cannot guarantee that the person who knows the login password is the actual account owner, it is not very effective for confirming the user's true identity. In many cases, users are required to set a separate password in addition to the login password, such as a payment password.

Access Control System
type: Avoidance
break id: A0017-001
stix type: course-of-action
definition: A system that controls the access permissions of personnel by verifying their identity, thereby achieving the goal of security management.
description: Access control systems come in many types and forms. Common types include: password-based access control — identity verification through entering a specific numeric password, usually combined with a mechanical lock. Card-based access control — identity recognition using magnetic cards, IC cards, RFID cards, etc., common in office buildings and residential communities. Biometric access control — using biometric technologies such as fingerprint recognition, facial recognition, and iris recognition, offering high security. Mobile app access control — remote door opening via a smartphone app, suitable for smart homes and self-service libraries. Combined access control — combining multiple identity recognition methods, such as fingerprint + password or card + biometrics, to improve security. Cloud-based access control — remote management and monitoring via cloud computing, common in large enterprises or public venues. Special access control — such as inductive loop access control and infrared sensing access control, suitable for specific environments and special needs. Each type has its own advantages and disadvantages and is suitable for different application scenarios. Choosing the right type requires considering security requirements, ease of use, and cost.
category: AC01
keywords: Access Control System
keywords: access control
keywords: authorization system
keywords: permission management
keywords: ACL
keywords: policy enforcement
citation: Access Control Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Non-biometric access control systems are susceptible to credential theft. Additionally, access control systems that do not implement precise flow control can be bypassed by tailgating.

Identity Authentication (Login)
type: Avoidance
break id: A0018
stix type: course-of-action
definition: Requiring users to confirm their identity through login or similar means when requesting related resources from a terminal.
description: In most cases, identity authentication takes the form of login. Without verifying login status, it is very difficult to continuously monitor terminal access behavior, because both request characteristics and request sources are trivially easy to forge. This makes evading server-side continuous monitoring of terminal access a common method for avoiding penalties for resource abuse. For this reason, many businesses now use identity authentication as an effective means of achieving continuous monitoring of terminal access behavior. Without authentication, terminals can only access a limited type or quantity of resources; to access more resources, identity authentication is required.
category: AC01
keywords: Identity Authentication (Login)
keywords: login
keywords: sign in
keywords: authentication
keywords: user authentication
keywords: account login
citation: Authentication - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The protective effectiveness of identity authentication is heavily dependent on the cost of obtaining a business identity — both the registration cost and the login authentication cost — and is also closely related to the severity of account penalties (A020). Some websites allow arbitrary bulk registration of user identities, in which case the value of identity authentication is very limited.

Zero-Knowledge Proof
type: Avoidance
break id: A0018-001
stix type: course-of-action
definition: A special interactive protocol that allows a prover to prove to a verifier that a statement is true without providing any information about the statement to the verifier.
description: The basic idea of zero-knowledge proof is that the prover, through a series of interactions, proves to the verifier that they know the evidence for a statement, but in this process the prover does not reveal any information about the evidence. A typical application scenario is identity authentication: the prover can prove to the verifier that they know a certain password without revealing any information about the password. For example, in an e-commerce scenario, when a user's identity is in doubt, the user can confirm their identity by selecting products they have previously purchased. Or in a social scenario, the user can confirm their identity by selecting their own friends.
category: AC01
keywords: Zero-Knowledge Proof
keywords: ZKP
keywords: zero knowledge proof
keywords: zero-knowledge protocol
keywords: proof of knowledge
keywords: privacy-preserving proof
citation: Verifiable Credentials Data Model - W3C
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Users may lose access to certain knowledge, making it impossible to pass verification.

Identity Security Audit
type: Avoidance
break id: A0019
stix type: course-of-action
definition: Conducting continuous security audits of user accounts to detect account risks in a timely manner.
description: Similar to the risk monitoring mechanism of risk control strategies (A015), identity behavior monitoring and risk assessment is also an audit-based protective measure. However, the two differ in their protection subjects and objects: risk control protects the business from users, while identity behavior auditing protects users from attackers. Identity security auditing is a commonly used means of assessing identity security. After an anomaly is detected, it needs to be combined with other identity measures such as re-authentication (A018), multi-factor authentication (A007), and forced password reset (A012).
category: AC03
keywords: Identity Security Audit
keywords: account audit
keywords: identity audit
keywords: user account audit
keywords: security review
keywords: account risk review
citation: Security Audit - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Generally, identity security auditing relies on detecting abnormal account behavior, which requires a certain amount of time and data as a reference baseline. Additionally, in some cases, identity security auditing has a certain degree of latency — subsequent handling or loss mitigation is required after a risk is identified.

Invitation Code Mechanism
type: Avoidance
break id: A0019-002
stix type: course-of-action
definition: A mechanism that restricts user registration through invitation codes.
description: When registering, users must enter an invitation code to complete registration. Invitation codes can be generated by administrators or by other users. The invitation code mechanism can effectively prevent malicious registration, but requires administrators or other users to generate invitation codes, so the cost is relatively high.
category: AC01
keywords: Invitation Code Mechanism
keywords: invite code system
keywords: referral code
keywords: invitation-only signup
keywords: beta invite
keywords: registration gate
citation: A Brief History of Google
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The invitation code mechanism increases the cost of user registration and is therefore not suitable for scenarios with a large volume of user registrations.

Friend-Assisted Authentication
type: Avoidance
break id: A0019-003
stix type: course-of-action
definition: A mechanism that uses the user's friends to assist in authenticating the user's identity.
description: When registering or authenticating, users must select their friends, and the system sends verification information to those friends. The user must pass verification by those friends to complete registration.
category: AC01
keywords: Friend-Assisted Authentication
keywords: social verification
keywords: friend verification
keywords: contact verification
keywords: peer-assisted authentication
keywords: friend-assisted login
citation: WeChat Friend-Assisted Verification
updated: 2026-06-11
version: 1
effectiveness: high
limitation: If the user has no friends, or if friends are unwilling to help with verification, the user will be unable to complete registration.

Account Penalty
type: Avoidance
break id: A0020
stix type: course-of-action
definition: Penalizing accounts when they violate related rules, and prohibiting related behaviors or actions.
description: Identity penalty strategies are an effective means of limiting the continuous damage caused by illegal or non-compliant users to the business. Identity penalties can operate at two levels: one is restrictions on the account itself, such as temporary suspension, public warning, or revocation of authorization; the other is restrictions on the resources accessible to the account, such as disabling specific business functions, limiting resource usage frequency, deleting resources, or restricting access to illegal resources.
category: AC04
keywords: Account Penalty
keywords: account sanctions
keywords: account suspension
keywords: account restriction
keywords: disciplinary action
keywords: enforcement action
citation: OWASP Blocking Brute Force Attacks
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Account penalties are a loss-mitigation strategy with a certain degree of latency.

Store Penalty
type: Avoidance
break id: A0020-001
stix type: course-of-action
definition: Penalizing a store when it violates related rules, and prohibiting related behaviors or actions.
description: Store penalty strategies include: lowering credit ratings, lowering tier levels, taking down products, reducing search ranking weight, suspending the store, banning the store, fines, etc.
category: AC04
keywords: Store Penalty
keywords: merchant penalty
keywords: store suspension
keywords: shop sanctions
keywords: seller penalty
keywords: merchant sanctions
citation: Interpretation of the Personal Fine System
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Store penalties are a loss-mitigation strategy with a certain degree of latency.

Employee Penalty
type: Avoidance
break id: A0020-002
stix type: course-of-action
definition: Employee penalty strategies are a set of sanctions established by an organization in response to employees violating company rules or policies.
description: Penalty content may include verbal warnings, written warnings, suspension, demotion, salary deductions, termination, etc. Effective employee penalty strategies should balance punishment and improvement, making employees aware of the consequences of misconduct while providing opportunities for correction and improvement.
category: AC04
keywords: Employee Penalty
keywords: employee sanctions
keywords: disciplinary action
keywords: workplace discipline
keywords: staff penalty
keywords: HR sanctions
citation: Ministry of Public Security Releases Top 10 Financial Black-Grey Market Crime Cases
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Limitations include the potential to cause employee dissatisfaction and affect the work environment. Compliance must be ensured to guard against legal action. Therefore, fair, clear, and consistently enforced strategies must be developed in alignment with relevant regulations and company policies.

Account Ban
type: Avoidance
break id: A0020-003
stix type: course-of-action
definition: Banning an account when it violates related rules, preventing the account from logging in.
description: Account ban strategies include: account ban, account freeze, account deactivation, account deletion, etc.
category: AC04
keywords: Account Ban
keywords: account lockout
keywords: account freeze
keywords: account suspension
keywords: deactivation
keywords: ban
citation: Account Lockout - NIST SP 800-53
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Account banning is a loss-mitigation strategy with a certain degree of latency.

Device Fingerprinting
type: Avoidance
break id: A0021
stix type: course-of-action
definition: Device characteristics or unique device identifiers that can be used to uniquely identify a device.
description: Device fingerprinting is a method used to identify and label computing devices (such as smartphones, tablets, computers, etc.). It uses the hardware and software characteristics of the device itself to create a unique identifier for recognizing and verifying the device in future accesses. Device fingerprints include some inherent, difficult-to-tamper, and unique device identifiers — for example, the IMEI number assigned to each phone during manufacturing, or the MAC address assigned to a computer's network card. These unique device identifiers can be considered device fingerprints. Additionally, a combination of device characteristics such as name, model, shape, color, and features can also be used as a device fingerprint.
category: AC02
keywords: Device Fingerprinting
keywords: device fingerprint
keywords: browser fingerprinting
keywords: browser fingerprint
keywords: terminal fingerprinting
keywords: device profiling
citation: Fingerprinting - MDN Web Docs
citation: OWASP Web Security Testing Guide - Fingerprint Web Server
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: For unique identifiers in devices such as IMEI, IMSI, MAC address, Android ID, and IDFA, due to user privacy restrictions and system upgrades, these generally require user authorization to access. This makes universality a problem, especially since black-gray market devices will basically never grant such permissions. For device identifiers computed from multiple device characteristics, they are too easily tampered with, making recall impossible.

Device Tagging
type: Avoidance
break id: A0021-001
stix type: course-of-action
definition: Tagging terminals using device characteristics, persistent cookies, and other methods.
description: Also called terminal tagging or device labeling. Device tagging can typically be implemented through covert tracking markers and special device characteristic collection. Device tagging generally serves two purposes: one is to assign a unique identifier to the device so that the device's identity is known when the tag is present; the other is to assign a special label to the device (such as 'clean device' or 'blacklisted device') so that even after the device changes its fingerprint, the device's security status can still be continuously identified and tracked.
category: AC02
keywords: Device Tagging
keywords: device labeling
keywords: terminal tagging
keywords: persistent device ID
keywords: device tracking
keywords: covert tracking
citation: Device Fingerprint - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Due to the inability to guarantee terminal data integrity, combined with legal and regulatory requirements for user privacy, terminal tagging has significant constraints and is only effective under certain conditions.

Traffic Encryption
type: Avoidance
break id: A0022
stix type: course-of-action
definition: Encrypting network request traffic or response traffic.
description: Traffic encryption typically provides a protection mechanism for process security. By encrypting data during transmission, attackers cannot directly obtain the original data or directly modify it.
category: AC01
keywords: Traffic Encryption
keywords: network encryption
keywords: in-transit encryption
keywords: transport encryption
keywords: TLS
keywords: HTTPS
citation: Transport Layer Security - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Traffic encryption increases the complexity and cost of data transmission. When using traffic encryption, the trade-off between security and performance impact needs to be considered.

Transport Protocol Encryption
type: Avoidance
break id: A0022-001
stix type: course-of-action
definition: Encrypting the entire transport layer or application layer communication data using custom algorithms or modified standard encryption algorithms.
description: Transport layer encryption refers to encrypting data at the transport layer to ensure data is not stolen or tampered with during transmission — for example, modified SSL or TLS. Application layer encryption refers to encrypting data at the application layer — for example, modified HTTPS. Since the data transport protocol itself is encrypted, the specific business scenarios above it can be ignored, achieving full business scenario coverage below the application layer.
category: AC01
keywords: Transport Protocol Encryption
keywords: transport encryption
keywords: TLS
keywords: SSL
keywords: protocol encryption
keywords: application-layer encryption
citation: Transport Layer Security - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Not applicable to scenarios where users access web pages via a browser.

Request Data Encryption
type: Avoidance
break id: A0022-002
stix type: course-of-action
definition: Encrypting request data sent to the server.
description: Request data encryption refers to encrypting the request body on top of an existing protocol (such as HTTPS) before sending it to the server, to ensure data is not stolen or tampered with during transmission. Request data encryption can be applied in any business scenario, but requires decryption logic to be added on the server side.
category: AC01
keywords: Request Data Encryption
keywords: request payload encryption
keywords: encrypted request body
keywords: client-side encryption
keywords: body encryption
keywords: end-to-end request encryption
citation: OWASP REST Security Cheat Sheet
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Generally implemented by hooking the remote request function to encrypt data, but this may cause certain compatibility issues. If some business logic does not use a unified remote request function, that portion of data cannot be encrypted.

Response Data Encryption
type: Avoidance
break id: A0022-003
stix type: course-of-action
definition: Encrypting response data from the server.
description: Response data encryption refers to encrypting the response body on the server side to ensure data is not stolen or tampered with during transmission. Response data encryption can be applied in any business scenario, but requires decryption logic to be added on the client side.
category: AC01
keywords: Response Data Encryption
keywords: response payload encryption
keywords: encrypted response body
keywords: server-side encryption
keywords: body encryption
keywords: end-to-end response encryption
citation: OWASP REST Security Cheat Sheet
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Generally implemented by hooking the remote request function to encrypt data, but this may cause certain compatibility issues. If some business logic does not use a unified remote request function, that portion of data cannot be encrypted.

Custom Transport Protocol
type: Avoidance
break id: A0022-004
stix type: course-of-action
definition: Using a custom transport protocol instead of standard protocols.
description: A custom transport protocol refers to defining a custom protocol at the transport or application layer, or modifying a common protocol to make it non-standard, to ensure data cannot be parsed or tampered with during transmission. Custom transport protocols can be applied in any business scenario, but require custom protocol parsing logic to be added on both the client and server sides.
category: AC01
keywords: Custom Transport Protocol
keywords: custom protocol
keywords: proprietary protocol
keywords: non-standard protocol
keywords: protocol obfuscation
keywords: custom transport
citation: OWASP Cryptographic Storage Cheat Sheet
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Custom transport protocols require custom protocol parsing logic on both the client and server sides, and the protocol versions on both sides must be consistent; otherwise communication will fail.

Biometric Identification
type: Avoidance
break id: A0023
stix type: course-of-action
definition: Identifying and verifying user identity by recognizing and comparing human biometric characteristics.
description: Face, fingerprint, voiceprint, iris, gait, palm print, vein pattern, DNA, and other human biometric characteristics all have a certain degree of uniqueness. Currently, the most commonly used for remote comparison on mobile devices are face, facial features, and voiceprint. Since facial recognition and voiceprint recognition face very intense adversarial competition, they are currently mainly used as a third verification factor beyond basic identity authentication (A018) and two-factor authentication (A007), and are more focused on preventing identity impersonation than account theft.
category: AC03
keywords: biometrics
keywords: biometric authentication
keywords: biometric verification
citation: Biometric Technology - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: High false recognition rate: biometric identification technology in practical applications can have a high false recognition rate due to environmental, device, and physiological change factors. Susceptibility to attack: biometric identification technology has certain security risks — biometric characteristics such as face, voiceprint, fingerprint, and iris can be copied or forged, leading to system attacks. Privacy leakage: biometric identification technology requires collecting users' biometric information; if this information is leaked, it will pose a threat to user privacy.

Facial Recognition
type: Avoidance
break id: A0023-001
stix type: course-of-action
definition: Identifying and verifying user identity by recognizing and comparing facial features.
description: Facial recognition is a biometric identification technology that identifies and verifies user identity by recognizing and comparing facial features. The main steps include face detection, facial feature extraction, and facial feature comparison. Applications on mobile devices include face unlock, face payment, and face check-in.
category: AC03
keywords: face recognition
keywords: face authentication
keywords: face unlock
citation: Facial Recognition System - Wikipedia
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Facial recognition technology has certain security risks — facial images can be copied or forged, leading to system attacks.

Real-Name Identity Verification
type: Avoidance
break id: A0024
stix type: course-of-action
definition: Binding a virtual identity to a real-world identity.
description: A person's or entity's real-world identity includes legally recognized documents such as national ID cards, household registration books, driver's licenses, military officer IDs, soldier IDs, passports, and business licenses. The real-name identity verification process is the process of binding a person's or entity's online virtual identity to their real-world identity. This process may use biometric identification (A023) and other methods to confirm the validity of the real-world identity.
category: AC01
keywords: real name verification
keywords: identity proofing
keywords: KYC
citation: Digital Identity Guidelines: Enrollment and Identity Proofing - NIST SP 800-63A
citation: Ministry of Public Security Announces Top 10 Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because personal ID document information leaks occur frequently, it is not sufficient to verify identity ownership by simply entering an ID number or photographing an ID document. It is necessary to combine facial recognition, SMS verification linked to the registered phone number, bank card holder verification, and other methods to confirm the document owner.

Digital Certificate
type: Avoidance
break id: A0025
stix type: course-of-action
definition: Digitally signing and encrypting data or files through a digital certificate mechanism.
description: Unlike API signature verification (A002), digital certificates place more emphasis on the integrity of the entire transmission chain from sender to receiver, and can also serve as a mechanism for verifying the sender's authenticity. API signatures focus more on ensuring the integrity of data passed from the client and across sites. Simply put, digital certificates primarily protect the data transmission process, while API signatures primarily protect the user terminal.
category: AC01
keywords: X.509 certificate
keywords: PKI certificate
keywords: public key certificate
citation: Transport Layer Security Cheat Sheet - OWASP
citation: RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Since digital certificates are issued by trusted third-party authorities, the security of digital certificates is heavily dependent on the trustworthiness of the issuing authority. If the issuing authority is compromised, attackers can forge digital certificates. Additionally, the security of digital certificates is also affected by the signing algorithm — if the signing algorithm is compromised, attackers can forge digital signatures.

Email Digital Certificate
type: Avoidance
break id: A0025-001
stix type: course-of-action
definition: Providing trustworthiness guarantees for email senders and integrity and confidentiality guarantees for email content.
description: Digitally signing and encrypting emails and attachments provides a high level of confidentiality and security for electronic communications. Encryption means only the intended recipient can read the email, while digital signatures allow them to confirm the sender and verify that the email was not tampered with in transit. (Excerpted from Tencent Cloud)
category: AC01
keywords: S/MIME
keywords: email signing certificate
keywords: email encryption certificate
citation: Recommendation for Key Management - NIST SP 800-57 Part 1 Rev. 5
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Using email digital certificates can be relatively complex — users need to understand the concept of digital certificates, purchase certificates, configure email clients, etc. This may create a barrier for general users. Digital certificates need to be renewed on time, and updates must be performed before expiration. Certificate management can become complex, especially for large-scale deployments. For end-to-end encryption and signing to work, both the sender and recipient must support and configure digital certificates, which may impose limitations when communicating with users who do not use digital certificates. Email digital certificates can only provide security during transmission and cannot address endpoint security issues such as password leaks or malware infections.

HTTPS Digital Certificate
type: Avoidance
break id: A0025-002
stix type: course-of-action
definition: Providing trustworthiness, integrity, and confidentiality guarantees for HTTP requests.
description: By purchasing and installing an HTTPS certificate service, the trustworthiness, integrity, and confidentiality of user requests to the server are guaranteed.
category: AC01
keywords: SSL certificate
keywords: TLS certificate
keywords: server certificate
citation: Transport Layer Security Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The security of HTTPS digital certificates is heavily dependent on the trustworthiness of the issuing authority. If the issuing authority is compromised, attackers can forge digital certificates. Additionally, the security of HTTPS digital certificates is also affected by the signing algorithm — if the signing algorithm is compromised, attackers can forge digital signatures.

Electronic File Seal
type: Avoidance
break id: A0025-003
stix type: course-of-action
definition: Providing trustworthiness and integrity signing guarantees for files.
description: Provides full-chain trusted behavior authentication for online contracting, contract management (historical contracts, contract templates), electronic data preservation and notarization, and real-time evidence collection of electronic documents (electronic contracts, electronic orders, electronic agreements, etc.). By ensuring the completeness, trustworthiness, and non-tamperability of electronic data throughout its entire lifecycle, it effectively resolves the difficulties of electronic data preservation, management, and judicial authentication. (Excerpted from jdcloud.com)
category: AC01
keywords: electronic seal
keywords: e-seal
keywords: digital seal
citation: Recommendation for Key Management - NIST SP 800-57 Part 1 Rev. 5
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Using electronic file seals may be relatively complex for general users, requiring understanding of digital signatures and seals and how to correctly apply and verify them. The trustworthiness and validity of electronic file seals depend on the reliability of the underlying Public Key Infrastructure (PKI). If the PKI is attacked or has issues, the trustworthiness of the electronic seal will be threatened.

USB Key Digital Certificate
type: Avoidance
break id: A0025-004
stix type: course-of-action
definition: A USB interface hardware device with a built-in microcontroller or smart card chip, with a certain amount of storage space, capable of storing the user's private key and digital certificate.
description: Authentication information required for client login (such as username, password, QQ, email, phone, ID number, etc.) can all be written into the USB key. Algorithms and code can also be written in, allowing the key to replace the traditional 'username + password' login method, achieving the goal of only being able to log in to a website or application system when the key is plugged in. Developers can also set the USB key to work alongside the traditional 'username + password' login mode as needed. The USB key can be used for access control, setting different clients to have different permissions — for example, some clients can only use part of the website or system's features, or different clients use different modules. It can also be configured to require the USB key to remain plugged in during use, or to automatically log out after a set time following removal.
category: AC01
keywords: USB token
keywords: hardware token
keywords: smart card certificate
citation: FIDO2: Moving the World Beyond Passwords
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The device is easy to lose or be stolen, potentially leading to unauthorized access to sensitive information. Depends on the login system's support — if the system does not support USB Key login, the USB Key cannot be used.

Credential Reuse Detection
type: Avoidance
break id: A0026
stix type: course-of-action
definition: Analyzing credential usage patterns to identify whether credentials are being maliciously reused.
description: Credential reuse detection is a commonly used method for identifying malicious accounts. It can be applied in any business scenario by analyzing data collected from terminals or request characteristics on the server side to determine whether the same access credential is being used in multiple places. Common detection methods include: User-Agent analysis, IP analysis, device fingerprint analysis, etc.
category: AC03
keywords: credential stuffing
keywords: password reuse detection
keywords: shared credential detection
citation: Credential Stuffing Prevention Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because normal users also experience IP drift, IP analysis is generally based on geographic region. If an attacker uses a local proxy IP and also modifies the UA and device fingerprint, detection may be bypassed. The author (Monyer) has filed a patent titled 'An Identity Impersonation Detection Technology Based on Access Bifurcation Analysis' to address this problem.

Customer Service Follow-Up Confirmation
type: Avoidance
break id: A0027
stix type: course-of-action
definition: Using customer service phone follow-ups and similar methods to confirm user authenticity or the legitimacy of their actions.
description: In certain specialized business scenarios (such as financial scenarios), when the system identifies abnormal user behavior during the handling process, customer service phone follow-ups can be combined to notify users or verify user legitimacy.
category: AC03
keywords: callback verification
keywords: outbound verification call
keywords: phone verification
citation: Digital Identity Guidelines: Authentication and Lifecycle Management - NIST SP 800-63B
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because customer service follow-up confirmation has a relatively high cost, it is generally only used for confirming major business risks rather than all business risks. Additionally, the effectiveness of customer service follow-up confirmation is heavily dependent on the professionalism and attitude of the customer service staff.

Resource Access Restriction
type: Avoidance
break id: A0028
stix type: course-of-action
definition: Restricting the resources accessible to a requester.
description: Unlike account penalty strategies (A020), resource access restrictions do not necessarily require obtaining the user's login identity. By using session information delivered to the terminal by the browser, access IP information, or unique device IDs obtained through terminal tracking (A021), the accessor can be identified. On this basis, specific business functions can be disabled, resource usage frequency can be limited, resources can be deleted, or access to illegal resources can be restricted.
category: AC04
keywords: resource-level access control
keywords: content access restriction
keywords: access throttling
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: In non-login scenarios, resource access restrictions can only rely on terminal factors such as IP, UA, and device ID, all of which can be forged. This limits the effectiveness of this measure against sophisticated attackers.

Restrict Off-Site Access
type: Avoidance
break id: A0028-001
stix type: course-of-action
definition: Restricting access from external sites by checking the Referer header and similar methods.
description: Generally applied to image, video, and file resource requests. Restricting off-site access can reduce unnecessary server load and is also an effective way to prevent resource abuse.
category: AC04
keywords: hotlink protection
keywords: referer check
keywords: anti-hotlinking
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: It should be noted that the Referer field can be forged, so this technique is not completely reliable. Additionally, some browsers provide a Referrer Policy option that controls whether the browser includes the Referer field in requests, making it difficult to determine the access source.

Data Profiling
type: Avoidance
break id: A0029
stix type: course-of-action
definition: Collecting and analyzing various data to form labeled profiles of that data.
description: Data profiling refers to labeled data models abstracted from data attributes, data behaviors, and other information.
category: AC03
keywords: dataset profiling
keywords: data quality analysis
keywords: attribute profiling
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
citation: GB/T 35273-2020 Information Security Technology - Personal Information Security Specification
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Data quality issues: data profiling requires large amounts of data; if data quality is poor, it will affect profile accuracy. Data privacy issues: data profiling requires collecting large amounts of data; if not handled properly, it will involve data privacy concerns. Timeliness issues: data profiling is based on historical data analysis and prediction; if the data is outdated or inaccurate, it will affect the timeliness of the profile.

User Profiling
type: Avoidance
break id: A0029-001
stix type: course-of-action
definition: Labeling users and describing them through various tags.
description: User profiling refers to labeled user models abstracted from user attributes, preferences, lifestyle habits, and behavior. In plain terms, it means assigning tags to users — tags are highly refined characteristic identifiers derived from analyzing user information. Through labeling, users can be described using highly summarized, easy-to-understand characteristics, making it easier for people to understand users and for computers to process them.
category: AC03
keywords: customer profiling
keywords: audience segmentation
keywords: persona building
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Data quality issues: user profiling requires large amounts of data; if data quality is poor, it will affect profile accuracy. Data privacy issues: user profiling requires collecting large amounts of user data; if not handled properly, it will involve user privacy concerns. Timeliness issues: user profiling is based on historical data analysis and prediction; if the data is outdated or inaccurate, it will affect the timeliness of the profile.

IP Profiling
type: Avoidance
break id: A0029-002
stix type: course-of-action
definition: Analyzing the behavior and characteristics of an IP address and associating it with various labels and attributes to form a comprehensive understanding of that IP address.
description: IP profiling can include multiple aspects such as the IP address's geographic location, carrier, network quality, and user profile, and can be used to determine whether the IP address poses a risk or is a malicious IP. In the network security field, IP profiling is an important technical means that can help enterprises better understand threats and anomalous behavior in the network, improving network security protection capabilities. Through IP profiling, enterprises can quickly locate and handle malicious attacks, fraud, and other network security incidents, protecting business and data security.
category: AC03
keywords: IP reputation
keywords: IP intelligence
keywords: IP enrichment
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: With the proliferation of IPv6, the number of IP addresses will increase dramatically, posing greater challenges for IP profiling technology.

Device Profiling
type: Avoidance
break id: A0029-003
stix type: course-of-action
definition: Labeling devices and describing them through various tags.
description: Device profiling refers to labeled device models abstracted from device attributes and device behaviors.
category: AC03
keywords: device fingerprinting
keywords: device intelligence
keywords: device reputation
citation: Fingerprinting - MDN Web Docs
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Device profiling is an extension of device fingerprinting (A0021). If device fingerprinting is inaccurate, device profiling will also be affected. Additionally, the accuracy of device profiling is also affected by the device profiling algorithm.

Business-Level Honeypot
type: Avoidance
break id: A0030
stix type: course-of-action
definition: A fake business resource system built specifically for attackers rather than normal users.
description: This resource system should ensure that it will not be accessed by normal users during normal business access or request processes, but can be discovered and accessed by attackers through resource ID enumeration, reverse engineering, packet capture, cracking, and other methods. Any access to the fake business resource system is therefore from an attacker. This serves two purposes: first, it immediately alerts the business that a resource has been targeted and attacked; second, it enables continuous tracking of the attacker's identity, characteristics, and behavior to facilitate countermeasure upgrades or related handling.
category: AC02
keywords: honeypot
keywords: decoy account
keywords: canary resource
citation: Guide to Intrusion Detection and Prevention Systems (IDPS)
citation: MITRE D3FEND: Connected Honeynet Technique
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Completely ineffective against attack behavior that perfectly simulates normal user access.

Return Fake Data (Data Poisoning)
type: Avoidance
break id: A0031
stix type: course-of-action
definition: Returning inaccurate or fake data to identified attackers.
description: Also called 'data poisoning.' Returning fake data is typically aimed at scraping of price, review count, sales volume, inventory, and other data. Since price data is widely used by price comparison websites or competitors for unfair competition, returning fake data will render such attempts ineffective. Review counts and sales volumes combined with prices can be used to infer a company's GMV and assess its business performance, which may be used for malicious stock market manipulation or short selling. Returning fake data will make such calculations inaccurate.
category: AC04
keywords: anti-scraping fake data
keywords: scraper poisoning
keywords: price scraping defense
citation: Artificial Intelligence Risk Management Framework - NIST AI 100-1
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Returning fake data must only be used when the accuracy of identifying malicious requests is 100%. If fake data is accessed by a normal user, the minor consequence is causing confusion for the user; the more serious consequence is that it could be used as evidence that the platform fabricates data and does not comply with lawful business operations. The lesser impact is negative public opinion; the greater impact may lead to compliance issues.

Data Parsing Interference
type: Avoidance
break id: A0032
stix type: course-of-action
definition: Increasing the difficulty for programs to parse or understand the content of obtained data.
description: Common data parsing interference methods include: text obfuscation, response data encryption (A022-003), dynamic page rendering, JS obfuscation, and returning fake data (A031). Text obfuscation further includes CSS offset, image-disguised text, and custom fonts. These methods do not directly identify or block attackers' data request processes, but instead increase the difficulty for programs to understand data resources, thereby raising the adversarial level.
category: AC01
keywords: parser evasion
keywords: anti-scraping obfuscation
keywords: response obfuscation
citation: Introduction to Crawlers and Anti-Crawling Techniques (see Chapter 2 - Anti-Crawling Technologies)
updated: 2026-02-27
version: 1
effectiveness: high
limitation: Any resource displayed on a terminal, no matter how complex the countermeasures, can potentially be reversed and cracked. Additionally, there is a very simple and brute-force method that can bypass most data parsing interference: simulate user requests, access the page containing the resource, take a screenshot, and use OCR to identify the resource content — this can easily bypass the methods mentioned above.

Single-Device Login
type: Avoidance
break id: A0033
stix type: course-of-action
definition: Allowing an account to be logged in only once on the same type of device.
description: Same-type devices refer to: browsers, mobile APPs, tablets, mini-programs, etc. An account is only allowed to be logged into one browser, mobile APP, tablet, or mini-program instance at a time. When a second same-type device attempts to log in, the previously logged-in corresponding device instance is logged out. This prevents a single account from being logged into multiple same-type devices simultaneously.
category: AC01
keywords: one-device login
keywords: device-bound login
keywords: single-session login
citation: Digital Identity Guidelines: Authentication and Lifecycle Management - NIST SP 800-63B
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The detection mechanism for single-device login typically records the number of logins on the same type of device on the server side and resets the previous instance or logs it out when the count exceeds 1. However, this mechanism has a problem: in the case of credential reuse (R0035), i.e., cookie-based login (AT0030), since both the previous device and the new device use the same login instance, the restriction can be bypassed to achieve multi-point login. In this case, a credential reuse detection mechanism needs to be added.

Data Obfuscation
type: Avoidance
break id: A0034
stix type: course-of-action
definition: A privacy protection technique that transforms, perturbs, or replaces sensitive data to reduce the risk of data leakage while maintaining a certain level of data usability. The goal is to reduce the risk of identifying sensitive information during data processing and sharing.
description: Methods include: substitution and replacement — replacing certain values in the original data with vague or fictitious values, such as replacing real names with randomly generated names. Perturbation — introducing noise or perturbation into the data to make it difficult to accurately restore the original values, such as adding random numbers to numerical data. Generalization — reducing specific details to a more general form to protect privacy, such as generalizing a specific address to the city level. Desensitization — removing or replacing sensitive information in the data to protect privacy. Data masking — using masking techniques to hide part of the data, showing only a portion of the information to limit access to sensitive information.
category: AC01
keywords: data masking
keywords: data perturbation
keywords: data redaction
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Although data obfuscation plays an important role in privacy protection, its use also has some limitations. First, obfuscation may cause information loss, affecting the precision and detail of the original data and thus impacting data analysis and mining effectiveness. Second, some complex obfuscation techniques may introduce significant performance overhead, increasing computational and storage costs. Additionally, excessive data obfuscation may cause data usability issues, reducing the practical value of data for users or analysts. Finally, although intended to protect privacy, some obfuscation techniques may still be subject to attacks that restore data or infer sensitive information, further increasing the factors that need to be carefully weighed when using data obfuscation.

Numerical Obfuscation
type: Avoidance
break id: A0034-001
stix type: course-of-action
definition: Applying a certain degree of obfuscation and approximation to precise numerical values to create a significant difference from the exact values.
description: The purpose of numerical obfuscation is to prevent attackers from obtaining precise numerical values through data analysis and data mining. For example, many third-party organizations scrape precise product sales volumes and prices to estimate a company's annual revenue and profit, gaining a first-mover advantage in securities trading or corporate mergers and acquisitions. Numerical obfuscation methods include: rounding, truncation, modulo, arithmetic operations, random numbers, etc. Application scenarios include: prices, inventory, sales volumes, ratings, review counts, etc.
category: AC01
keywords: numeric masking
keywords: value rounding
keywords: value bucketing
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The goal of numerical obfuscation is to allow data viewers to see the general trend of data without seeing precise values, while preventing third-party organizations from grasping the company's exact operational status. This goal is inherently contradictory, because even without precise data, the final operational status can be estimated from the general trend. Therefore, this defense approach is only suitable for scenarios where the goal is to prevent third-party organizations from obtaining precise operational data.

Numerical Indexing
type: Avoidance
break id: A0034-002
stix type: course-of-action
definition: Converting precise numerical values into an indexed form to create a significant difference from the exact values.
description: Numerical indexing refers to expressing linear values in a non-linear way through a certain algorithm. The goal is to allow data viewers to see the general trend without seeing precise values, while preventing third-party organizations from grasping the company's exact operational status. Methods include: exponential transformation, logarithmic transformation, squaring, square root, cubing, cube root, etc.
category: AC01
keywords: ordinal encoding
keywords: numeric binning
keywords: value mapping
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Given a certain number of real values, it may be possible to reverse-engineer the indexing algorithm by comparing the generated corresponding indices. Therefore, when indexing, either completely hide the real values to prevent reverse-engineering, or use a stepped algorithm to make the index a stepped curve where each segment uses a different algorithm, making reverse-engineering more difficult.

Response Status Obfuscation
type: Avoidance
break id: A0034-003
stix type: course-of-action
definition: Obfuscating precise response statuses so that specific states cannot be distinguished.
description: For example, many login systems display 'username or password incorrect' when a user fails to log in, allowing attackers to determine whether a user exists on the platform. After obfuscating the response status, whether the user does not exist or the password is wrong, the message 'username or password incorrect' is displayed, preventing attackers from inferring whether the user does not exist or the password is wrong.
category: AC01
keywords: status code masking
keywords: error code obfuscation
keywords: response masking
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Response status obfuscation is a relatively basic countermeasure that is well worth trying, but it is not a silver bullet.

Data Desensitization (Masking)
type: Avoidance
break id: A0035
stix type: course-of-action
definition: Removing or replacing sensitive information in data with special symbols.
description: Data desensitization is a technical measure used to protect the security and privacy of sensitive data. The basic principle is to use desensitization algorithms to obscure or transform sensitive data, reducing its sensitivity level before releasing it externally or making it available for access. Methods include static data desensitization — a one-time processing of the original data's sensitive fields to reduce data sensitivity and personal privacy risk — and dynamic data desensitization, which processes data in real time during use to protect private information.
category: AC01
keywords: data masking
keywords: data redaction
keywords: de-identification
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
citation: SP 800-188, De-Identifying Government Datasets: Techniques and ...
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Data desensitization may have the following limitations: first, due to insufficient protection of sensitive data, malicious attackers can combine background information to infer sensitive data, creating privacy leakage risks; second, existing desensitization techniques typically alter the original data structure, affecting data accuracy to some extent.

Sensitive Data Removal
type: Avoidance
break id: A0035-001
stix type: course-of-action
definition: Removing sensitive information from data.
description: Unlike data desensitization (A035), sensitive data removal refers to removing sensitive information from data rather than replacing it with special symbols. The basic principle is to use removal algorithms to obscure or transform sensitive data, reducing its sensitivity level before releasing it externally or making it available for access. Methods include static data removal and dynamic data removal.
category: AC01
keywords: data redaction
keywords: PII removal
keywords: sensitive field stripping
citation: Guide to Protecting the Confidentiality of Personally Identifiable Information - NIST SP 800-122
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Sensitive data removal depends on the execution of data classification and grading, as well as the ability to identify sensitive data. If data classification is inaccurate or the ability to identify sensitive data is insufficient, the effectiveness of sensitive data removal will be poor. Additionally, static sensitive data removal may affect data completeness, availability, and accuracy.

User Information Tokenization
type: Avoidance
break id: A0035-002
stix type: course-of-action
definition: Converting users' sensitive information into tokens.
description: User information tokenization is a privacy protection and security enhancement practice. A token is a string that represents specific information or permissions without directly containing sensitive data. This approach helps reduce risk when processing user data, especially in network communication and storage.
category: AC01
keywords: PII tokenization
keywords: identity tokenization
keywords: tokenized user data
citation: Information Supplement: Tokenization Product Security Guidelines - PCI SSC
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Tokenization is not applicable to all scenarios. In some applications, direct access to the user's original data is required rather than processing through tokens.

Virtual Phone Number
type: Avoidance
break id: A0035-003
stix type: course-of-action
definition: Replacing the user's real phone number with a virtual phone number during order fulfillment.
description: Virtual phone numbers allow the other party in a transaction to communicate with the user through the virtual number without knowing the user's real phone number. Application scenarios include: transactions, delivery, customer service, complaints, and after-sales. Starting in 2025, China's MIIT launched the 700-number range privacy protection service pilot, replacing platform-built virtual numbers with a dedicated number range that features high identifiability, unified regulation, and three-element binding (user, service provider, session cycle), further standardizing privacy protection number services.
category: AC01
keywords: disposable phone number
keywords: proxy number
keywords: masked phone number
citation: Personal Information Protection Law of the People's Republic of China
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Due to the limited number of available virtual numbers, tokens must be used to map multiple user phone numbers to a single virtual number, increasing the cost of calls. Virtual numbers are not friendly for SMS sending and receiving — for example, parcel lockers do not support virtual numbers, preventing consumers from receiving pickup codes. Additionally, some enterprises use mobile phone numbers as intermediary numbers for bulk commercial marketing calls or even fraud under the guise of user privacy protection. The introduction of the 700 dedicated number range helps address this issue, but industry regulation is still being improved.

Resource ID Encryption
type: Avoidance
break id: A0036
stix type: course-of-action
definition: Encrypting resource IDs so that attackers cannot directly enumerate all resource IDs.
description: Processing resource IDs with encoding techniques so that attackers cannot access resources by incrementing or randomly enumerating resource IDs. Common encoding methods include: random character generation, encryption, and hashing.
category: AC01
keywords: opaque identifiers
keywords: encrypted identifiers
keywords: hashids
citation: SP 800-57 Part 1 Rev. 5, Recommendation for Key Management
updated: 2026-06-13
version: 1
effectiveness: high
limitation: When choosing an encoding algorithm, ensure it cannot be guessed — for example, using timestamps as IDs, using guessable hash algorithms, or using brute-force-enumerable algorithms. Once the algorithm is guessable, this countermeasure loses its meaning. Additionally, encryption and hash algorithms must be protected against insider leaks and theft, because once leaked, the protection is permanently invalidated. Therefore, either ensure the confidentiality of the algorithm, or use random character generation as a better approach.

Access Source Tracking
type: Avoidance
break id: A0037
stix type: course-of-action
definition: Tracking the access source of resources to determine the reliability and reasonableness of the source.
description: Common source tracking checks the Referer header in resource requests. However, there are now more sophisticated approaches: one is to generate encrypted access tokens with time-based, random, and unique properties in the pre-access page for in-site resource access to track resource access; the other is to embed the sharer's identity information as an access token in the shared link when resources are shared off-site. This way, both in-site and off-site resource access can be tracked, enabling identification and blocking of abnormal sources.
category: AC02
keywords: referer tracking
keywords: source attribution
keywords: access source tracing
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Two foreseeable breakable scenarios are: 1. For in-site access, attackers can obtain in-site resource access tokens by bulk-constructing resource pre-access pages. 2. For off-site access, in high-traffic scenarios such as advertising and promotion, it is difficult to determine whether token acquisition is non-compliant based on volume alone. For scenario 1, the pre-access page can be included in the tracking coverage, or the randomness of resources in the pre-access page can be increased to prevent targeted resource access. For scenario 2, the off-site resource access ID can be encoded to decouple it from targeted in-site resource access.

Proxy Detection
type: Avoidance
break id: A0038
stix type: course-of-action
definition: Detecting the use of proxies when users request network resources.
description: Proxy detection primarily analyzes the data characteristics of user requests to identify and assess the use of network proxies and terminal proxies, further confirming whether the request is from a real user.
category: AC03
keywords: anonymous proxy detection
keywords: proxy fingerprinting
keywords: VPN detection
citation: Proxy Server - Wikipedia
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The biggest problem with proxy detection is that normal users may also use proxies, making false positives easy.

Web Access Proxy Detection
type: Avoidance
break id: A0038-001
stix type: course-of-action
definition: Detecting the access proxy used when users request resources (a typical access proxy is a web browser).
description: Black-gray industry actors may use non-standard web access proxies to request resources, such as headless browsers, curl, wget, or HTTP libraries from various programming languages. Detection methods include: User-Agent analysis, JavaScript environment detection, JA3 fingerprinting, HTTP/2 fingerprinting, etc.
category: AC03
keywords: HTTP proxy detection
keywords: forward proxy detection
keywords: proxy header check
citation: Proxy, Technique T1090 - MITRE ATT&CK
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Because web access proxy detection ultimately relies on analyzing terminal request information, placing this measure in a high-adversarial context makes it easy to bypass by forging and modifying data.

Network Proxy Detection
type: Avoidance
break id: A0038-002
stix type: course-of-action
definition: Detecting whether users are using a network proxy when requesting resources.
description: Common network proxy methods include VPN, SOCKS5, and HTTP proxies. Current common network proxy detection methods include: IP intelligence, request IP clustering, IP attribute analysis, TCP/IP fingerprinting, DNS server location discrepancy, using WebRTC to expose the real IP, and leveraging the network latency characteristics of proxies to determine whether a network proxy is being used.
category: AC03
keywords: SOCKS proxy detection
keywords: VPN detection
keywords: network proxy check
citation: Proxy, Technique T1090 - MITRE ATT&CK
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Network proxy detection has the following limitations: first, normal users may also use network proxies, making false positives easy; second, using mobile carrier egress IPs as proxies makes blocking difficult even when detected; third, using ADSL dial-up networks as proxies allows immediate switching to a new proxy by re-dialing after being blocked.

Data Hiding
type: Avoidance
break id: A0039
stix type: course-of-action
definition: Hiding data needed by terminal security capabilities to increase the difficulty for attackers to discover and obtain it.
description: Unlike response data encryption (A022-003), the goal of data hiding is to make attackers unaware of the existence of the data itself, or to know it exists but be unable to find where it is. Some typical data hiding techniques include: algorithm whitebox protection — the goal is to maintain the security of an encryption algorithm even when the encryption key is embedded in the application; steganography — hiding information within other media using a certain algorithm, such as hiding text within an image; virtualization technology — compiling information into specific bytecode to be executed in a custom bytecode interpreter, etc.
category: AC01
keywords: hidden data
keywords: data cloaking
keywords: stealth data
citation: Steganography, Technique T1027.003 - MITRE ATT&CK
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The core adversarial point of data hiding is the reverse-engineering threshold and time cost caused by information asymmetry. Once the hiding method is discovered, cracking is only a matter of time. Therefore, data hiding typically employs dynamic algorithms or a 'hide-and-seek' mechanism: dynamic algorithms strengthen protection by issuing new algorithms and invalidating old ones before the old algorithm is reverse-engineered; 'hide-and-seek' strengthens protection by moving hidden data from its original location to a new location before it is found.

Certificate Pinning (SSL Pinning)
type: Avoidance
break id: A0040
stix type: course-of-action
definition: Pinning the server's SSL certificate in the client.
description: Also known as SSL Pinning. Certificate pinning is a protective measure that pins the server's SSL certificate in the client, preventing attackers from intercepting and modifying network traffic via a man-in-the-middle attack.
category: AC01
keywords: TLS pinning
keywords: public key pinning
keywords: certificate trust pinning
citation: MASTG-TEST-0244: Missing Certificate Pinning in Network Traffic - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Certificate pinning is an effective defense mechanism against man-in-the-middle attacks, aimed at raising the bar for MITM attacks. However, attackers can bypass SSL Pinning by using frameworks like Frida or Xposed to hook certificate verification functions, or by replacing the embedded certificate in the application and repackaging it. Additionally, bypassing is easier on jailbroken or rooted devices, and there are now multiple automated tools that can achieve one-click SSL Pinning bypass.

Access Control
type: Avoidance
break id: A0041
stix type: course-of-action
definition: A security management strategy designed to ensure that only authorized and authenticated individuals or entities can enter, connect to, or use systems, networks, applications, or resources. The purpose is to restrict access to sensitive information and critical systems to reduce potential threats and risks.
description: Access control covers multiple aspects including: authentication — confirming the identity of a user or device to ensure the claimed identity is legitimate and accurate. Authorization — granting authenticated individuals or entities specific permissions to perform certain operations or access certain resources. Access level control — determining the resources, areas, or functions that users or devices can access and setting corresponding permissions. Compliance checks — ensuring users or devices meet the compliance standards and policies specified by the organization or system. Device health checks — verifying that devices connecting to the network meet predefined security standards, including whether they have the latest security patches and antivirus software.
category: AC01
keywords: authorization
keywords: access management
keywords: permission control
citation: Access Control Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Access control focuses on static management of authentication and access permissions and is difficult to adapt to dynamically changing environments and threats. It is also relatively difficult to detect and respond to potential malicious behavior by internal threats or already-authenticated users. Additionally, maintaining complex access policies and rules may increase management and operational complexity, leading to misjudgments or excessive restrictions. Finally, traditional access control may not be flexible enough for modern work environments such as mobile devices and remote work. Organizations implementing access control need to consider these limitations comprehensively and combine other security strategies and technologies to improve overall security.

Feature Randomization
type: Avoidance
break id: A0042
stix type: course-of-action
definition: Randomizing business features so that attackers cannot complete automated operations through a fixed workflow.
description: Attackers typically complete automated operations by locating feature points and reproducing business workflows. By randomizing the locating attributes of feature points, or inserting some random events into the business workflow, the attacker's fixed automated workflow can be invalidated.
category: AC01
keywords: workflow randomization
keywords: anti-bot workflow
keywords: interaction randomization
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Feature randomization is highly intrusive to the business and requires strong security-business collaboration to implement. Additionally, changes to features may lead to a degraded user experience.

DOM Randomization
type: Avoidance
break id: A0042-001
stix type: course-of-action
definition: Randomizing the DOM structure so that attackers cannot locate and manipulate page elements through the DOM structure.
description: By randomizing the DOM structure and attributes — such as the DOM tree, element IDs, and class names — attackers cannot locate and manipulate page elements via XPath, ID, class, etc.
category: AC01
keywords: DOM obfuscation
keywords: randomized DOM
keywords: element shuffling
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: DOM randomization is ineffective against attack methods that use OCR to identify and manipulate page elements.

Random Event Workflow
type: Avoidance
break id: A0042-002
stix type: course-of-action
definition: Inserting random events into the normal business workflow so that attackers cannot complete automated operations through a fixed workflow.
description: Random event workflows are generally targeted at business scenarios with fixed sequential steps. For example, inserting random CAPTCHAs, random questions, random ad pop-ups, or random red packet pop-ups between normal steps to interrupt and interfere with the normal business workflow, invalidating the attacker's pre-recorded automation.
category: AC01
keywords: random event injection
keywords: challenge step
keywords: human verification step
citation: Authorization Cheat Sheet - OWASP
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Attackers can bypass this type of defense by continuously enumerating random events and alerting on automation workflow exceptions.

Contractual Clause Restrictions
type: Avoidance
break id: A0043
stix type: course-of-action
definition: Adding clauses to contracts that can limit the compliance of risk generation and reduce the probability of risk occurrence.
description: For example, setting breach of contract liability, breach penalties, and breach compensation.
category: AC01
keywords: contract clauses
keywords: liquidated damages clause
keywords: penalty clause
citation: Civil Code of the People's Republic of China
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The prerequisite for modifying contract clauses is that both parties to the contract are legal entities, and the modification must comply with laws and regulations. The goal is to restrict the attacker's legal behavior, not to prevent the attacker's malicious behavior.

Legal Action
type: Avoidance
break id: A0044
stix type: course-of-action
definition: Taking legal measures to combat attackers.
description: Legal action is both an effective means of stopping ongoing harm and a deterrent through publicizing the results of enforcement. Currently, criminal statutes related to cybercrime include: Article 285 'Unauthorized Access to Computer Information Systems,' Article 286 'Destruction of Computer Information Systems,' Article 287 'Assisting in Information Network Crimes,' Article 253 'Infringement of Citizens' Personal Information,' Article 219 'Infringement of Trade Secrets,' etc. Additionally, Article 255 'Illegal Business Operations' and Article 217 'Copyright Infringement,' while not cybercrime-specific statutes, are frequently used in cybercrime convictions.
category: AC04
keywords: litigation
keywords: legal recourse
keywords: cease and desist
citation: Criminal Law of the People's Republic of China
citation: Translation: Cybersecurity Law of the People's Republic of China ...
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: The prerequisites for legal action are: 1. There must be illegal or criminal facts that can be referenced against legal statutes; 2. The attacker must be locatable and apprehensible; 3. Criminal evidence and the amount of criminal proceeds must be fixable. For example, web scraping is a common violation that enterprises deeply resent, but there is no specific criminal basis for scraping in the statutes. Scraping only meets the conditions for legal action when it involves: breaking into a system (285), causing a system to malfunction (286), obtaining a certain amount of users' personal information (253), providing paid scraping services to others (255), etc., and when the criminal amount can be very accurately determined, non-criminal amounts distinguished, and the suspect can be located and apprehended within the jurisdiction.

Privacy Computing
type: Avoidance
break id: A0045
stix type: course-of-action
definition: A collection of technologies that enable data analysis and computation while ensuring the data itself is not exposed externally, achieving the goal of data being 'usable but invisible.'
description: Privacy computing employs multiple methods to protect user data privacy, including homomorphic encryption, secure multi-party computation, differential privacy, zero-knowledge proofs, searchable encryption, fully homomorphic encryption, and blockchain with smart contracts. Homomorphic encryption allows computation on encrypted data; secure multi-party computation ensures privacy in collaborative computations; differential privacy prevents inference of individual data by introducing noise; zero-knowledge proofs allow verifying the truth of a statement without revealing other information. Searchable encryption enables searching over encrypted data; fully homomorphic encryption provides more flexible homomorphic computation; and blockchain with smart contracts enable decentralized privacy protection. These methods can be combined based on different application requirements to meet diverse privacy protection needs.
category: AC01
keywords: privacy-preserving computation
keywords: secure computation
keywords: PETs
citation: Privacy-Enhancing Cryptography (PEC) - NIST CSRC
citation: Privacy-Preserving Computation: Concepts, Frameworks, and Future Development Trends
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of privacy computing include performance overhead, reduced accuracy, communication overhead, complexity, security dependencies, compliance issues, and selective disclosure. It must be applied carefully with consideration for balancing privacy protection against other aspects.

Privacy-Preserving Computation Technology Applications
type: Avoidance
break id: A0045-001
stix type: course-of-action
definition: Using privacy-preserving computation techniques such as MPC and TEE to protect data processing procedures
description: Privacy-Preserving Computation: Multi-Party Secure Computation; Trusted Execution Environment; Federated Learning; Homomorphic Encryption; Differential Privacy; Secure Multi-Party Computation.
category: AC01
keywords: Privacy-Preserving Computation Technology Applications
citation: Smart Contract Risk Feedback Loop
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Low technology maturity; Significant performance impact; Complex implementation

Credit Level Restriction
type: Avoidance
break id: A0046
stix type: course-of-action
definition: Rating users by credit score and applying different restrictions based on their credit level.
description: Credit grading applies different restrictions to users based on their credit level. For example, users with a high credit rating may enjoy more privileges, while users with a low credit rating enjoy fewer. The goal is to deter malicious behavior and incentivize users to improve their credit standing. Methods include behavior-based, attribute-based, relationship-based, and evaluation-based credit grading.
category: AC04
keywords: credit scoring
keywords: reputation scoring
keywords: trust score restrictions
citation: SAMR Opinions on Enterprise Credit Risk Classification Management
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Credit analysis relies on the platform's collection and analysis of user behavior, attributes, relationships, and evaluations, so it cannot identify new high-quality users and may to some extent reduce the motivation of new high-quality users.

Security Deposit Mechanism
type: Avoidance
break id: A0047
stix type: course-of-action
definition: Also known as a deposit or earnest money, this requires users to pay a certain amount as collateral when using platform services, which may be forfeited upon breach of contract.
description: A deposit (also called a security deposit or risk margin in practice) is an amount agreed upon by both parties, paid by the debtor or a third party to the creditor as a guarantee of performance. When the obligation is fulfilled, the deposit is returned or offset; when the obligation is not fulfilled, the creditor has priority claim to the funds. The party paying the deposit is called the depositor, generally the debtor or a third party. The party receiving the deposit is called the depositee, who is the creditor.
category: AC01
keywords: deposit guarantee
keywords: earnest money
keywords: performance bond
citation: Civil Code of the People's Republic of China
updated: 2026-06-13
version: 1
effectiveness: high
limitation: If the deposit amount is too large it will dampen user motivation; if too small it will reduce the deterrent effect. A careful trade-off is required.

Complaint and Reporting Channel
type: Avoidance
break id: A0048
stix type: course-of-action
definition: A channel or mechanism provided to users for submitting complaints, reports, or feedback about issues.
description: Such channels are typically designed to help users resolve problems encountered while using services or purchasing goods, and also help maintain social order and regulate industry behavior.
category: AC03
keywords: whistleblower hotline
keywords: complaint hotline
keywords: reporting hotline
citation: Measures for Handling Market Regulation Complaints and Reports
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Detection of violations depends on user reports, and user reports may be inaccurate.

Digital Watermark/Text Watermark
type: Avoidance
break id: A0049
stix type: course-of-action
definition: Embedding specific information into digital signals — including text, audio, files, images, or video — for copyright protection, integrity verification, copy prevention, or traceability tracking
description: Also known as a digital watermark. When a watermarked signal is copied, the embedded information is copied along with it. Digital watermarks can be divided into visible and invisible types. Visible watermarks contain information that can be seen while viewing an image or video. Invisible watermarks are added to audio, images, or video as digital data but cannot normally be seen. In general, visible watermarks are primarily used for deterrence and copyright declaration; invisible watermarks are primarily used for traceability and copyright determination.
category: AC03
keywords: digital watermarking
keywords: invisible watermark
keywords: watermarking
citation: [PDF] enhancing personal identity verification with digital watermarks ...
citation: C2PA Specification: Content Credentials for Media Provenance and Integrity
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Watermarks may disappear or become unrecoverable when the digital signal is edited, such as through image cropping, video editing, or audio editing.

Text Watermark
type: Avoidance
break id: A0049-001
stix type: course-of-action
definition: Adding invisible or imperceptible information to text content to verify document authenticity, protect intellectual property, or manage digital rights.
description: Text watermarks can be visible — for example, replacing certain digits, letters, or symbols with homoglyphs — or invisible, such as inserting invisible characters like Unicode control characters into the text.
category: AC03
keywords: invisible text watermark
keywords: text watermarking
keywords: character-level watermark
citation: JD.Army Open Source Text Watermark Solution
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of text watermarking include visibility issues, ease of removal, inapplicability to all text types, stealth requirements, inability to prevent copying, inapplicability to encrypted text, difficulty scaling to large deployments, and legal and privacy concerns.

Digital Avatar Watermark Verification
type: Avoidance
break id: A0049-002
stix type: course-of-action
definition: Add invisible watermarks to legitimate digital avatars, verifying authenticity through C2PA standard.
description: Add invisible watermarks to legitimate digital avatars, verifying authenticity through C2PA standard.
category: AC01
keywords: Digital Avatar Watermark Verification
citation: C2PA Content Authenticity
updated: 2026-06-16
version: 1
effectiveness: high

Data Loss Prevention
type: Avoidance
break id: A0050
stix type: course-of-action
definition: Also known as DLP (Data Loss Prevention), a collection of technologies that protect data from leakage through classification, labeling, monitoring, and blocking.
description: Through content inspection, policy rules, real-time monitoring, and encryption, DLP systems can deeply scan data, identify specific patterns or keywords, monitor real-time data flows to quickly respond to potential leakage risks, and use encryption to protect data security. DLP systems can also implement protections on endpoint devices, monitor network traffic and communication channels, generate detailed reports and audit logs, and enhance employee awareness of sensitive information protection through user education and training.
category: AC01
keywords: DLP
keywords: data exfiltration prevention
keywords: content inspection
citation: [PDF] Guide to Protecting the Confidentiality of Personally
citation: NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations (SC-7, SC-8, SC-28)
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of DLP systems include false positives, content recognition challenges, endpoint device limitations, uncontrolled endpoint devices, insider threats, real-time latency, complexity, and implementation costs. Organizations must consider and manage these comprehensively during deployment.

Data Storage Encryption
type: Avoidance
break id: A0050-001
stix type: course-of-action
definition: Encrypting data to ensure its security on storage media.
description: Data storage encryption can be divided into two types: encrypting data before storing it, or encrypting the storage medium itself. The former allows finer-grained control over data but requires storing the key on the storage medium, so key security must be ensured. The latter does not require storing the key on the storage medium but provides coarser-grained control over data.
category: AC01
keywords: encryption at rest
keywords: storage encryption
keywords: disk encryption
citation: Recommendation for Key Management - NIST SP 800-57 Part 1 Rev. 5
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Key management: the security of encryption depends on proper key management. If keys are poorly managed, they may be leaked or lost, making data unrecoverable or accessible to unauthorized parties. Performance impact: the encryption and decryption process may introduce some performance overhead. For large-scale data storage and frequent data access, encryption may cause certain delays.

Database Auditing
type: Avoidance
break id: A0050-002
stix type: course-of-action
definition: Recording and auditing database operations to ensure database security.
description: Database auditing is the process of monitoring and recording database system activities to ensure security, compliance, and traceability. It covers key areas including access control auditing, change auditing, sensitive data auditing, anomalous activity detection, audit log management, and compliance auditing. Through auditing, organizations can identify potential security issues, protect sensitive data, meet regulatory compliance requirements, and gain deep insight into database usage to take timely measures to improve security policies. Database administrators and security professionals typically use specialized audit tools to simplify and automate this process.
category: AC01
keywords: database audit logs
keywords: SQL audit trail
keywords: DB activity monitoring
citation: Guide to Computer Security Log Management - NIST SP 800-92
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Main limitations include performance overhead, log management challenges, privacy and compliance issues, false positives and false negatives, complexity and configuration management challenges, confidentiality concerns, and technical limitations.

Data Erasure
type: Avoidance
break id: A0050-003
stix type: course-of-action
definition: Erasing data to ensure it cannot be recovered.
description: Data erasure refers to completely deleting or overwriting data on a storage device to ensure it cannot be recovered or accessed. This is a common data management and information security measure, typically performed before a device is decommissioned, reassigned, recycled, sold, or discarded. Simply deleting files or formatting a storage device does not always ensure complete data erasure, as these operations typically only mark the file system as free while the actual data remains. Therefore, a safer approach is to use specialized data erasure tools or software to overwrite the data on the storage device, making it unrecoverable.
category: AC01
keywords: secure deletion
keywords: data wiping
keywords: disk wiping
citation: Guidelines for Media Sanitization - NIST SP 800-88 Rev. 1
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Data erasure is not a one-time operation; multiple passes are needed to ensure data cannot be recovered. The process is relatively slow and time-consuming. The effectiveness of data erasure is affected by the storage medium — for example, solid-state drives (SSDs) are harder to erase completely.

Security Awareness Training
type: Avoidance
break id: A0051
stix type: course-of-action
definition: An internal organizational training activity aimed at increasing employees' awareness and understanding of information security, cybersecurity, and internal policies to reduce potential security risks and prevent security threats.
description: This training typically covers password management, phishing prevention, social engineering attack recognition, data protection, physical security, and more. It aims to cultivate security awareness and good information security practices among employees to strengthen overall security.
category: AC01
keywords: phishing training
keywords: security training
keywords: user awareness training
citation: Building an Information Technology Security Awareness and Training Program - NIST SP 800-50
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitation of security awareness training is that it may be difficult to sustain employees' lasting attention to security issues. Content needs to be regularly updated to keep pace with evolving threats, and the long-term effectiveness of training is difficult to measure.

Internal Review Mechanism
type: Avoidance
break id: A0052
stix type: course-of-action
definition: A set of review procedures and measures established by a company to monitor and evaluate employee behavior and ensure compliance with company policies and regulations.
description: Scenarios may include but are not limited to: behavioral compliance review — examining whether employee behavior meets the company's ethical and regulatory requirements, including the absence of fraud, corruption, bribery, and other misconduct; data access review — monitoring employee access to sensitive data and company resources to ensure access is limited to work responsibilities; network activity review — monitoring employee activity on the company network to prevent cybersecurity risks and improper use of company resources; internal investigations — when violations or reports occur, conducting internal investigations to verify the relevant circumstances.
category: AC03
keywords: internal audit
keywords: compliance review
keywords: employee investigation
citation: The NIST Cybersecurity Framework 2.0
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitation of internal review mechanisms is the need to balance oversight with employee privacy. Excessive review may infringe on personal privacy rights, cause employee dissatisfaction, and reduce job satisfaction. Review procedures must strictly comply with regulations to prevent compliance risks. Additionally, review mechanisms may be subject to internal bias or errors, leading to inaccurate results.

PR Crisis Response
type: Avoidance
break id: A0053
stix type: course-of-action
definition: The process by which an organization takes proactive communication and response measures when facing negative public opinion, reputational threats, or crisis events, in order to mitigate negative impact, protect reputation, and restore public trust.
description: Methods include timely and transparent disclosure of information, effective crisis management, developing crisis communication plans, maintaining open dialogue with stakeholders, and taking positive improvement and remediation measures.
category: AC04
keywords: crisis communication
keywords: reputation management
keywords: media response
citation: Infoseek Crisis PR: From Passive Defense to Proactive Risk Control
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: Challenges include the difficulty of predicting public opinion risks, the difficulty of controlling public sentiment, and the speed at which misinformation spreads.

Compliance Governance
type: Avoidance
break id: A0054
stix type: course-of-action
definition: The adoption of a series of systems, policies, processes, and controls by an organization to ensure its business activities are conducted within the bounds of laws, regulations, industry standards, and internal rules, and comply with relevant compliance requirements.
description: Compliance governance measures include but are not limited to: establishing a compliance framework — developing clear compliance policies, procedures, and standards to ensure employees understand and follow relevant regulations and company rules; training and education — providing compliance training to employees to increase their awareness of regulations and organizational compliance requirements; risk assessment and monitoring — conducting regular compliance risk assessments and monitoring business activities to identify and address potential compliance risks in a timely manner; internal compliance audits — conducting internal audits to ensure business activities comply with compliance policies and regulatory requirements; compliance reporting and communication — providing compliance reports to stakeholders to ensure transparency and timely communication; establishing a compliance team — setting up a dedicated compliance team or hiring compliance professionals to oversee and drive compliance matters.
category: AC01
keywords: regulatory compliance
keywords: compliance management
keywords: GRC
citation: Personal Information Protection Law of the People's Republic of China
citation: ISO/IEC 27001:2022 Information Security Management Systems - Requirements
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Compliance governance faces several limitations. First, the complexity and constant evolution of regulations makes compliance governance complex and in need of continuous updates. Cultural differences are also a major challenge, as understanding and expectations of compliance vary across regions and countries. Human factors may affect the effectiveness of compliance governance, requiring training and cultural development to reinforce employee compliance awareness. Technological advances and new business models may bring new compliance challenges, and establishing and maintaining a compliance governance system may require significant investment in human, technical, and financial resources.

App Compliance Governance
type: Avoidance
break id: A0054-001
stix type: course-of-action
definition: The process of ensuring that the development, operation, and use of an app comply with relevant laws, regulations, regulatory requirements, and industry standards, while safeguarding user rights. It involves multiple aspects such as personal information protection, data security, privacy policies, and content compliance.
description: To achieve app compliance governance, a series of regulations and standards must be followed, such as the Cybersecurity Law, Consumer Rights Protection Law, Data Security Law, and Personal Information Protection Law. Attention must also be paid to industry-specific standards and regulatory requirements in areas such as finance, healthcare, and education. The goal is to ensure that app development and operations comply with all applicable laws and industry standards, protect users' personal information and privacy, prevent data leakage and misuse, and ensure app content aligns with social ethics and public interest. To achieve this, app operators need to establish a comprehensive compliance management system, develop detailed compliance policies and processes, strengthen internal training and management, cooperate with regulatory inspections and guidance, and promptly rectify non-compliant issues.
category: AC01
keywords: app store compliance
keywords: mobile app compliance
keywords: app policy review
citation: Personal Information Protection Law of the People's Republic of China
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The regulatory environment for mobile applications can change at any time, and regulatory requirements vary across different countries and regions, making compliance governance complex and challenging.

Vulnerability Identification
type: Avoidance
break id: A0055
stix type: course-of-action
definition: The process of detecting and identifying potential security vulnerabilities in computer systems, networks, or applications.
description: Vulnerability identification typically includes the following steps: scanning and automated tools — using automated tools and scanners to comprehensively scan systems, networks, or applications to discover known vulnerabilities, including common security flaws and misconfigurations; manual review — security professionals conduct manual reviews, deeply analyzing systems, code, or configurations to discover vulnerabilities that automated tools may miss or novel vulnerability types; vulnerability databases — leveraging vulnerability databases to learn about the latest known vulnerability information, including descriptions, remediation recommendations, and released security patches; system vulnerabilities — identifying vulnerabilities in operating systems, network devices, or other infrastructure, including systems without applied security patches; application vulnerabilities — discovering potential vulnerabilities through review of application source code or binary code, such as input validation issues and buffer overflows; configuration errors — checking whether system and application configurations have security vulnerabilities, such as default passwords and improper permission settings.
category: AC03
keywords: vulnerability scanning
keywords: vuln discovery
keywords: CVE detection
citation: National Vulnerability Database - NIST
citation: OWASP Vulnerability Management Guide
citation: NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Vulnerability identification faces several limitations. First, incomplete vulnerability databases mean some vulnerabilities may not be covered. Second, automated tools and scanners may produce false positives — incorrectly flagging non-existent vulnerabilities — and may also miss real vulnerabilities, producing false negatives. Additionally, for complex applications and custom-developed systems, relying solely on automated tools may not uncover all vulnerabilities, and manual review is costly. Therefore, vulnerability identification requires a combination of approaches including automated tools, manual review, updated vulnerability databases, and regular system audits to improve comprehensiveness and accuracy.

Vulnerability Remediation
type: Avoidance
break id: A0056
stix type: course-of-action
definition: After identifying security vulnerabilities in a computer system, network, or application, taking a series of measures to patch or eliminate those vulnerabilities in order to reduce the risk of potential attackers exploiting them for unauthorized access, data leakage, destruction, or other malicious activities.
description: Key vulnerability remediation methods include: security patch application — security patches released by manufacturers or developers typically contain fixes for known vulnerabilities, and organizations should apply these patches promptly to ensure vulnerabilities are addressed; system configuration updates — updating system and application configurations to fix configuration errors that may cause vulnerabilities, such as disabling default passwords and restricting unnecessary services; code review and fixes — reviewing source code or binary code for application vulnerabilities, identifying potential security issues and fixing them; network security device configuration — updating and fixing configurations on network and security devices to address potential vulnerabilities; data encryption and access control — using data encryption and strengthened access controls to improve overall system security.
category: AC04
keywords: patch management
keywords: vulnerability patching
keywords: remediation workflow
citation: Known Exploited Vulnerabilities Catalog - CISA
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Limitations of vulnerability remediation include: delays and complexity — some fixes may take time to develop, test, and apply, giving attackers a window of opportunity; incomplete fixes — remediation measures may sometimes introduce new issues or miss other vulnerabilities while addressing one; vendor dependency — if a vulnerability involves hardware or software vendors, the speed and effectiveness of the fix may depend on vendor cooperation and support; complexity and cost — for complex systems and large-scale networks, vulnerability remediation can become complex and costly, especially when business continuity is involved.

Adding Approval Processes
type: Avoidance
break id: A0057
stix type: course-of-action
definition: Introducing additional approval steps in an organization or project to ensure the legality, compliance, and traceability of decisions.
description: Key practices include: approver assignment — designating approvers for each step based on their responsibilities and authority; approval conditions and rules — defining the conditions and rules that trigger approval, such as expenditures exceeding a certain amount or critical decisions; electronic approval systems — using electronic approval tools to automate and streamline the approval process, improving efficiency and reducing human error; approval logs and records — recording decisions at each approval step to support auditing and traceability.
category: AC01
keywords: approval workflow
keywords: sign-off process
keywords: authorization workflow
citation: The NIST Cybersecurity Framework 2.0
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Limitations include: efficiency issues — too many approval steps may slow down decision-making and reduce work efficiency; human error — manual approval processes are prone to mistakes or oversights; process complexity — overly complex approval processes may be difficult to understand and manage, increasing maintenance burden; applicability constraints — not all scenarios require additional approval steps, and some simple decisions may become unnecessarily cumbersome.

Disaster Recovery
type: Avoidance
break id: A0058
stix type: course-of-action
definition: A set of plans and procedures developed by an organization to respond to various sudden disaster events, aimed at ensuring business continuity and rapidly restoring normal operations. This covers natural disasters, human accidents, technical failures, and other emergencies.
description: Common practices include: backup and recovery strategies — regularly backing up critical data and system configurations to enable rapid restoration to the pre-disaster state; redundant systems and equipment — deploying redundant hardware, network devices, and systems to guard against primary equipment or system failures; disaster recovery sites — establishing alternate work locations to ensure employees can continue working when the primary office is unavailable; emergency communication plans — ensuring reliable communication channels so that internal and external parties can effectively coordinate disaster response; regular drills — conducting regular drills of the disaster recovery plan to ensure the team is familiar with procedures and to identify and resolve potential issues.
category: AC04
keywords: DR plan
keywords: business continuity
keywords: backup and recovery
citation: Contingency Planning Guide for Federal Information Systems
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Limitations include: cost — establishing a comprehensive disaster recovery mechanism may require significant investment, which may be difficult for smaller organizations; unpredictable disasters — some disasters cannot be predicted or prevented, so the mechanism may not cover all scenarios; supply chain dependency — if a link in the supply chain is affected, it may impact the execution of the disaster recovery mechanism; human factors — human errors, mistakes, or negligence may cause the disaster recovery plan to fail.

Anomalous Access Behavior Detection
type: Avoidance
break id: A0059
stix type: course-of-action
definition: Real-time monitoring and analysis of user access behavior in systems, networks, or applications to identify activities that differ significantly from normal behavior patterns, thereby detecting potential anomalies, fraud, or security threats.
description: Key aspects of anomalous behavior detection include: modeling normal behavior — the system first learns and models the normal behavior patterns of users or entities by analyzing historical data, user behavior patterns, device characteristics, etc.; monitoring real-time behavior — after establishing a normal behavior model, the system continuously monitors real-time behavior, including user logins, access patterns, interaction behavior, and data access; detecting anomalous behavior — the system uses pre-established models and rules to detect behavior that significantly deviates from normal patterns, potentially involving statistical analysis, machine learning, rule engines, and other techniques; real-time response — upon detecting anomalous behavior, the system should immediately take appropriate measures such as issuing alerts, interrupting access, or forcing re-authentication; iterative optimization — anomalous behavior detection systems need continuous iteration and optimization to adapt to evolving threats and environments, including updating models, adjusting rules, and adopting new algorithms. In information security, anomalous behavior detection can identify intrusions, malware, and unauthorized access. In finance, it can detect credit card fraud and money laundering. In healthcare, it can monitor patient physiological data to identify potential health issues.
category: AC03
keywords: UEBA
keywords: login anomaly detection
keywords: behavior analytics
citation: OWASP Automated Threats to Web Applications
citation: NIST SP 800-53 Rev. 5: Security and Privacy Controls (AU-6, AU-7, SI-4 Anomaly Detection)
updated: 2026-06-13
version: 1
effectiveness: high
limitation: Anomalous behavior detection has several practical limitations, including false positive and false negative rates — the system may incorrectly flag normal behavior as anomalous or miss genuinely anomalous behavior. Adversarial attacks may make the system easier to evade, while concept drift, privacy concerns, resource consumption, and imbalanced data distribution are also challenges. When designing and applying anomalous behavior detection systems, these limitations must be considered comprehensively and appropriate measures taken to improve robustness and performance.

Anomalous Access Source Detection
type: Avoidance
break id: A0060
stix type: course-of-action
definition: Analyzing and evaluating the source of user or system access to determine whether anomalies or potential threats exist. This includes examining the IP address, device type, geographic location, network behavior, and other information of entities accessing the system to identify possible anomalous or malicious activity.
description: Anomalous access source detection can include the following aspects: IP address analysis — analyzing the IP addresses of system access to check for access from anomalous geographic locations, anonymous proxies, or malicious networks; device fingerprinting — analyzing device characteristics such as operating system, browser version, and device type to determine whether there is anomalous device access; behavioral pattern analysis — analyzing user behavior patterns including access time, access frequency, and page browsing sequence to detect unusual patterns; user identity verification — confirming the user's true identity through authentication to prevent impersonation or spoofed access. Additional approaches include: identifying whether the sharer of a page access link is anomalous, and setting and validating page access tokens.
category: AC03
keywords: anomalous IP detection
keywords: source verification
keywords: device fingerprinting
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1
effectiveness: high
limitation: There is a certain false positive rate, requiring combination with other methods for comprehensive judgment, or using cumulative counting to improve detection accuracy.

Reducing Returns
type: Avoidance
break id: A0061
stix type: course-of-action
definition: Reducing the returns an attacker receives under sustained attack.
description: Some typical ways to reduce returns include: reducing bonus amounts under sustained referral farming; in games, reducing item drop rates or monster kill scores under sustained gold farming; and similar approaches.
category: AC04
keywords: return rate reduction
keywords: reward farming prevention
keywords: promotion abuse prevention
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Reducing returns is a preferred method for lowering attractiveness, but as long as there is still value, it is difficult to fully control. It can have a significant negative impact on the experience of highly motivated high-value users, thereby affecting their engagement.

Video Surveillance
type: Avoidance
break id: A0062
stix type: course-of-action
definition: A technology that uses cameras, monitors, computer software and hardware, and other technical means to perform real-time monitoring and remote control of specific areas.
description: Traditional surveillance systems include front-end cameras, transmission cables, and video surveillance platforms. Cameras can be divided into network digital cameras and analog cameras, serving as front-end video image signal collectors. Video surveillance is widely used in many settings due to its intuitive, accurate, timely, and information-rich nature. Modern surveillance systems can use smartphones, with automatic image recognition, storage, and automatic alerting. Video data is transmitted back to a control host via 3G/4G/WiFi, where it can be viewed in real time, recorded, played back, retrieved, and stored, enabling mobile internet-based video surveillance.
category: AC02
keywords: CCTV
keywords: video monitoring
keywords: remote surveillance
citation: [PDF] Video Analytics in Public Safety
updated: 2026-06-13
version: 1
effectiveness: medium
limitation: Video surveillance relies heavily on personnel to interpret footage and has a certain degree of latency.

Password Complexity Requirements
type: Avoidance
break id: A0063
stix type: course-of-action
definition: Rules and requirements imposed by a system or service when setting passwords to ensure passwords are strong enough to be difficult to guess or crack.
description: These requirements typically include: length — requiring a minimum password length, as longer passwords are generally more secure and harder to crack; character types — requiring passwords to contain different types of characters such as uppercase letters, lowercase letters, numbers, and special symbols to increase complexity; avoiding common passwords — prohibiting easily guessed common passwords such as 'password' or '123456'; no dictionary words — prohibiting the use of dictionary words to prevent dictionary attacks; periodic changes — requiring users to change passwords regularly to reduce the risk of password misuse; no repeated characters — avoiding the same character appearing repeatedly in a password; no match with username — prohibiting passwords that are the same as or contain the username; password history — recording previously used passwords to ensure new passwords differ from prior ones; account lockout — locking accounts after multiple incorrect password attempts to prevent brute-force attacks.
category: AC01
keywords: password policy
keywords: strong password rules
keywords: password strength requirements
citation: Password Policy Recommendations for Microsoft 365
citation: Focus on Cryptography and Security: Building the Security Shield for a Cyber Power
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Overly strict requirements may lead users to adopt hard-to-remember passwords, which they then record in insecure locations or replace with weak passwords. Forcing periodic password changes may prompt users to adopt easily guessable patterns, such as appending numbers or special characters. Complexity requirements primarily defend against brute-force and dictionary attacks and have limited effectiveness against advanced attack methods such as social engineering. Finally, overly complex password rules may degrade user experience, making users more likely to adopt insecure alternatives and undermining overall security.

AI Content Detection
type: Avoidance
break id: A0064
stix type: course-of-action
definition: The ability to identify and determine whether content — including text, images, audio, video, and other media formats — has been generated by artificial intelligence.
description: The main technical approaches for AI content detection include: (1) statistical feature analysis — analyzing statistical features such as perplexity and burstiness to determine whether content is AI-generated; AI-generated text typically exhibits lower perplexity and more uniform word frequency distribution; (2) digital watermark detection — detecting implicit watermark markers embedded in AI-generated content, such as invisible watermarks planted by vendors like OpenAI; (3) deep learning classifiers — training specialized neural network models to distinguish human-created from AI-generated content by learning differences in semantics, style, and structure; (4) metadata analysis — examining EXIF information, generation tool signatures, and other metadata in image and video files to determine their origin; (5) adversarial detection — using adversarial sample techniques to detect AI-generated content that has been obfuscated; (6) multimodal fusion detection — combining text, image, audio, and other modalities for comprehensive judgment to improve detection accuracy.
category: AC03
keywords: AI-generated content detection
keywords: synthetic content detection
keywords: machine-generated content detection
citation: GPTZero - AI Content Detection Tool
citation: A Survey on AI-Generated Content Detection
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The main limitations of AI content detection include: (1) arms race effect — as generative models continuously evolve, detection techniques need constant updates and face inherent lag; (2) misclassification risk — detection models may falsely flag human-created content as AI-generated, or fail to detect AI-generated content, especially content that has been manually polished; (3) cross-language differences — most detection tools are trained on English and may perform poorly on Chinese and other languages; (4) mixed content challenge — when humans and AI collaborate on creation, it is difficult to accurately determine the degree of AI involvement; (5) computational cost — large-scale real-time detection requires significant computational resources.

LLM Security Protection
type: Avoidance
break id: A0065
stix type: course-of-action
definition: A set of security measures deployed for large language model (LLM) services, including input filtering, output guardrails, prompt injection prevention, and model access control, to prevent models from being maliciously exploited or producing harmful outputs.
description: The main LLM security protection measures include: (1) prompt filtering — performing security checks on user-submitted prompts to identify and block inputs containing injection attacks, jailbreak attempts, sensitive information probing, and other malicious intent; (2) output guardrails — performing real-time review of model-generated content to filter outputs containing harmful information, sensitive data, or prohibited content; (3) system prompt hardening — using carefully designed system prompts to constrain model behavior boundaries and prevent role-playing attacks and instruction overrides; (4) model access control — implementing fine-grained API access control including identity authentication, rate limiting, and usage quota management; (5) security sandbox — running the model in an isolated sandbox environment to restrict its access to external systems and data; (6) red team testing — regularly conducting adversarial testing of the model to discover and fix security vulnerabilities; (7) content grading — managing model outputs at different levels based on user identity and context.
category: AC01
keywords: LLM guardrails
keywords: prompt injection defense
keywords: model access controls
citation: OWASP Top 10 for LLM Applications
citation: LLM Security Practice Guide
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of LLM security protection include: (1) the diversity of prompt injection makes complete defense extremely difficult, as attackers can bypass filters through encoding, multilingual mixing, indirect injection, and other techniques; (2) overly strict security policies may reduce model usability and affect normal user experience; (3) security measures themselves may introduce additional latency and computational overhead; (4) the black-box nature of models makes it difficult to fully predict and control their behavior; (5) new attack methods continue to emerge, requiring continuous updates to protection strategies.

Deepfake Detection
type: Avoidance
break id: A0066
stix type: course-of-action
definition: The ability to use technical means to identify and determine whether audio, video, image, and other media content has been tampered with or generated by AI deepfake technology.
description: The main technical approaches for deepfake detection include: (1) facial artifact detection — analyzing abnormalities in micro-expressions, blink frequency, facial symmetry, skin texture, and other biometric features in video faces, as AI-generated faces often exhibit unnatural details in these areas; (2) audio spectrum analysis — identifying AI-synthesized speech by analyzing spectral features, fundamental frequency variations, formant patterns, and other acoustic characteristics, as synthesized speech typically shows anomalies in high-frequency bands and transition segments; (3) temporal consistency detection — checking temporal consistency between video frames, as deepfake videos may exhibit discontinuities in frame transitions, lighting changes, and background consistency; (4) digital forensics analysis — using image forensics techniques to analyze compression artifacts, noise patterns, color space anomalies, and other digital features; (5) enhanced liveness detection — combining liveness detection in identity verification scenarios by requiring users to complete random actions, facial expression changes, and other interactive verification; (6) multimodal cross-validation — simultaneously analyzing cross-modal features such as lip sync and emotional consistency between audio and video.
category: AC03
keywords: synthetic media detection
keywords: deepfake analysis
keywords: face forgery detection
citation: Deepfake Detection Challenge Dataset - Meta AI
citation: A Survey on Deepfake Detection
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of deepfake detection include: (1) rapid advances in generation technology make forged content increasingly realistic, continuously increasing detection difficulty; (2) real-time detection requires significant computational resources and is difficult to deploy in resource-constrained environments such as mobile devices; (3) post-processing operations such as compression and transcoding may destroy the features relied upon for detection; (4) adversarial attacks targeting specific detection methods can effectively reduce detection accuracy; (5) insufficient cross-domain generalization means detectors trained on specific generative models may perform poorly on new models.

Real-Time Deepfake Detection
type: Avoidance
break id: A0066-001
stix type: course-of-action
definition: Security techniques for instantly detecting and alerting on AI-generated deepfake content during real-time communications such as video conferences, voice calls, and live streams.
description: Real-time deepfake detection targets real-time communication scenarios, distinguishing it from A0066 Deepfake Detection which focuses on offline/static content analysis. As AI deepfake technology is applied in real-time during video calls and phone conversations, attackers can replace faces in real-time during video conferences or clone target voices during phone calls, making traditional post-hoc detection methods inadequate. Real-time deepfake detection includes: ① Video stream liveness detection: determining whether a video stream is deepfake by analyzing facial micro-expressions, eye movement, and lighting consistency; ② Voice stream authenticity verification: determining whether speech is AI-synthesized through voiceprint analysis, breathing patterns, and emotional coherence; ③ Communication metadata validation: verifying that endpoint identities and transmission paths have not been tampered with; ④ Multimodal cross-validation: performing consistency analysis across audio, video, and text signals; ⑤ Behavioral baseline comparison: real-time comparison with known genuine person behavioral patterns. This technology is critical for defending against real-time attack scenarios such as AI face-swap fraud and AI voice cloning scams.
category: AC03
keywords: Real-Time Deepfake Detection
keywords: live deepfake detection
keywords: audio deepfake detection
keywords: video stream deepfake detection
keywords: AI voice clone detection
keywords: liveness analysis
keywords: real-time face forgery detection
keywords: voice spoof detection
citation: Cybersecurity Forecast 2026 - Google Cloud
citation: Microsoft Digital Defense Report 2025
citation: Deepfake Detection - NIST
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Real-time detection requires analysis within extremely short timeframes, demanding significant computational resources; detection accuracy may decline as deepfake technology advances; high-quality deepfakes may temporarily evade detection; privacy regulations may limit real-time analysis of communication content; false positives may disrupt normal business communications.

Fake Call Detection
type: Avoidance
break id: A0066-002
stix type: course-of-action
definition: Security techniques for detecting and identifying fraudulent phone calls that use AI voice cloning combined with caller ID spoofing.
description: Fake call detection targets combined attacks using AI voice cloning and caller ID spoofing. As AI voice cloning technology matures, attackers can clone target voices in real-time and, combined with caller ID spoofing, impersonate acquaintances, supervisors, or financial institution staff to perpetrate telecom fraud. Fake call detection includes: ① Caller ID verification: verifying the authenticity of incoming call numbers through STIR/SHAKEN protocols to detect number spoofing; ② AI voice cloning detection: analyzing voiceprint features during calls to identify AI-synthesized speech; ③ Call behavior anomaly detection: identifying abnormal call patterns such as unfamiliar numbers making urgent transfer requests; ④ Identity cross-verification: verifying the caller's true identity through other channels (SMS, in-person); ⑤ Call metadata analysis: analyzing call path information to identify VoIP spoofing and gateway anomalies. In 2025, Google Android launched an industry-first fake call detection feature that verifies call authenticity through end-to-end encrypted RCS protocol.
category: AC03
keywords: Fake Call Detection
keywords: scam call detection
keywords: caller ID spoofing detection
keywords: vishing detection
keywords: STIR/SHAKEN
keywords: AI voice clone detection
keywords: spoofed call screening
keywords: voice phishing detection
citation: Google Android Scam Detection - Official Blog
citation: FCC STIR/SHAKEN Framework
citation: INTERPOL Report on AI Voice Cloning Fraud
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Not all phone systems support STIR/SHAKEN protocols; high-quality AI voice clones may temporarily evade voiceprint detection; attackers may use legitimate communication channels as intermediaries to reduce suspicion; false positives may block legitimate emergency calls; some countries' communication infrastructure does not support caller verification.

API Security Gateway
type: Avoidance
break id: A0067
stix type: course-of-action
definition: A security protection layer deployed in front of API services that protects backend APIs from abuse and attacks through identity authentication, authorization management, traffic control, request validation, and threat detection.
description: The main protection capabilities of an API security gateway include: (1) identity authentication and authorization — supporting multiple authentication methods such as OAuth 2.0, JWT, and API Key, and implementing fine-grained access control policies; (2) request validation — strictly validating API request parameters, formats, and schemas, and rejecting non-conforming requests; (3) rate limiting and quota management — implementing fine-grained rate limiting based on dimensions such as user, IP, and API endpoint to prevent brute-force API calls; (4) threat detection — identifying common API attack patterns such as SQL injection, XSS, and parameter tampering; (5) traffic analysis — using machine learning to analyze API call patterns and identify anomalous behavior and potential abuse; (6) data masking — automatically masking sensitive data in API responses; (7) API version management — managing the API lifecycle and promptly retiring deprecated API endpoints; (8) audit logging — recording detailed logs of all API calls to support security auditing and post-incident tracing.
category: AC01
keywords: API gateway security
keywords: API protection
keywords: API access control
citation: OWASP API Security Top 10
citation: API Security Best Practices
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of API security gateways include: (1) they may introduce additional network latency, affecting API response performance; (2) complex security policy configurations may cause legitimate requests to be incorrectly blocked; (3) detection capability for business-logic-level API abuse (such as malicious use of legitimate parameter combinations) is limited; (4) security rules need continuous maintenance and updates to address new attack types; (5) in microservice architectures, blind spots remain in east-west traffic API security protection.

Zero Trust Architecture
type: Avoidance
break id: A0068
stix type: course-of-action
definition: A security model whose core principle is 'never trust, always verify.' Rather than implicitly trusting any user, device, or service based on network location, every access request is subject to continuous identity verification and authorization.
description: The main implementation elements of Zero Trust Architecture include: (1) continuous identity verification — continuously verifying the identity of users and devices rather than only at login, dynamically adjusting verification strength based on risk level; (2) least privilege principle — strictly limiting the access permissions of users and services, granting only the minimum set of permissions needed to complete the current task; (3) micro-segmentation — dividing the network into fine-grained security zones to restrict lateral movement, so that even if an attacker breaches one zone they cannot easily spread; (4) device trust assessment — continuously evaluating the security posture of connected devices, including operating system version, patch status, and security software status; (5) encrypted communications — all communications use encrypted transmission, whether on internal or external networks; (6) security analytics and automation — using SIEM, SOAR, and other tools for real-time security analysis and automated response; (7) software-defined perimeter (SDP) — using SDP technology to hide network resources, making them visible only to authenticated and authorized users.
category: AC01
keywords: zero trust
keywords: ZTA
keywords: never trust always verify
citation: NIST SP 800-207 Zero Trust Architecture
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of Zero Trust Architecture include: (1) high implementation complexity requiring large-scale transformation of existing IT infrastructure with significant cost; (2) potential impact on user experience as frequent identity verification and permission checks may reduce work efficiency; (3) poor compatibility with legacy systems that may not support the authentication and authorization mechanisms required by Zero Trust; (4) requires robust identity management infrastructure; (5) full implementation of Zero Trust is a long-term process that is difficult to cover all business scenarios in the short term.

Privacy Enhancing Technologies
type: Avoidance
break id: A0069
stix type: course-of-action
definition: Privacy Enhancing Technologies (PET) are a set of technical solutions designed to protect personal data privacy, enabling data to be used and analyzed while minimizing the exposure of personal information.
description: The main types of privacy enhancing technologies include: (1) federated learning — achieving collaborative model training through distributed learning without centralizing raw data, keeping data local at all times; (2) differential privacy — protecting individual privacy while maintaining the validity of statistical analysis by adding carefully designed noise to data or query results; (3) homomorphic encryption — allowing computation operations to be performed directly on encrypted data and obtaining correct results without decryption; (4) secure multi-party computation — enabling multiple parties to collaboratively complete joint computation tasks without revealing their respective private data; (5) trusted execution environment (TEE) — using hardware-level security isolation to process sensitive data in protected memory regions; (6) anonymization and pseudonymization — reducing the association between data and personal identity through de-identification techniques; (7) zero-knowledge proofs — proving the truth of a statement without revealing specific information.
category: AC01
keywords: PETs
keywords: privacy-preserving technologies
keywords: privacy-enhancing tech
citation: PETs Testbed - NIST
citation: Privacy-Enhancing Technologies - ENISA
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of privacy enhancing technologies include: (1) performance overhead — techniques such as homomorphic encryption have significant computational overhead that may affect system performance and real-time capability; (2) implementation complexity — deploying and maintaining PET systems requires specialized cryptography and security knowledge; (3) balance between data usability and privacy protection — excessive privacy protection may reduce the analytical value of data; (4) insufficient standardization — standards and interoperability for various PET technologies are still evolving; (5) novel attacks — new threats such as model poisoning attacks against federated learning and membership inference attacks against differential privacy continue to emerge.

Supply Chain Security Audit
type: Avoidance
break id: A0070
stix type: course-of-action
definition: A systematic security inspection and assessment of each link in the software, hardware, and service supply chain to identify potential security risks and vulnerabilities and ensure the integrity and trustworthiness of the supply chain.
description: The main approaches for supply chain security auditing include: (1) software composition analysis (SCA) — scanning and identifying all open-source components and their versions used in software projects, detecting known vulnerabilities and license compliance issues; (2) software bill of materials (SBOM) — establishing and maintaining a complete software bill of materials that records the origin, version, and dependency relationships of all software components; (3) code signing verification — verifying the digital signatures of software packages and updates to ensure code has not been tampered with; (4) dependency auditing — analyzing the software dependency tree to identify transitively dependent components with security risks; (5) vendor security assessment — evaluating the security capabilities of third-party vendors, including secure development processes, vulnerability response mechanisms, and data protection measures; (6) continuous monitoring — continuously monitoring security of supply chain components in use and promptly identifying newly disclosed vulnerabilities; (7) build environment security — ensuring the security of CI/CD pipelines and build environments to prevent poisoning attacks during the build process.
category: AC03
keywords: software supply chain security
keywords: SBOM analysis
keywords: SCA scanning
citation: Cybersecurity Supply Chain Risk Management - NIST CSRC
citation: Software Supply Chain Security Development Insight Report (2024) - SecRSS
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of supply chain security auditing include: (1) the open-source ecosystem is vast, and fully auditing all dependent components requires enormous effort; (2) zero-day vulnerabilities and undisclosed backdoors are difficult to discover through routine audits; (3) supply chain attack methods continue to evolve, requiring continuous updates to audit standards and tools; (4) for closed-source commercial software, audit depth is limited by vendor cooperation; (5) standardization and automation of SBOM still need improvement.

Cloud Security Posture Management
type: Avoidance
break id: A0071
stix type: course-of-action
definition: Cloud Security Posture Management (CSPM) is a category of automated tools and practices used to continuously monitor and assess the security configuration of cloud infrastructure, identifying misconfigurations, compliance deviations, and security risks.
description: The main capabilities of cloud security posture management include: (1) configuration compliance checking — automatically scanning cloud resource configurations and checking compliance against security baselines such as CIS Benchmarks and national security standards to identify insecure configuration items; (2) asset visibility — providing a unified view of all resources in the cloud environment, including compute instances, storage buckets, databases, network configurations, and IAM policies; (3) risk assessment and prioritization — prioritizing discovered security issues based on risk severity and business impact to help security teams focus on critical risks; (4) automated remediation — providing automated remediation for common misconfigurations, such as closing public storage buckets and fixing overly permissive security group rules; (5) multi-cloud support — supporting unified security management across major cloud platforms including AWS, Azure, GCP, and Alibaba Cloud; (6) container and Kubernetes security — extending to container image scanning, Kubernetes cluster configuration auditing, and other cloud-native security scenarios; (7) compliance reporting — automatically generating security reports that meet various compliance standards.
category: AC03
keywords: CSPM
keywords: cloud configuration scanning
keywords: misconfiguration management
citation: Cloud Security Investment Map: How Wiz Became the Fastest to Reach M ARR
citation: Cloud Security Posture Management - Google Security Command Center
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of cloud security posture management include: (1) it primarily focuses on configuration-level security issues with limited coverage of application-layer and business-logic-layer security risks; (2) differences in APIs and configuration models across cloud platforms in multi-cloud environments increase the complexity of unified management; (3) automated remediation may affect normal business operations in certain scenarios and should be used with caution; (4) real-time monitoring of dynamic and ephemeral cloud resources such as serverless functions presents challenges; (5) alert fatigue — large volumes of security alerts may cause security teams to overlook truly important risks.

Algorithm Audit Mechanism
type: Avoidance
break id: A0072
stix type: course-of-action
definition: A systematic inspection and evaluation of algorithmic systems to ensure their fairness, transparency, explainability, and compliance, preventing algorithmic discrimination, bias, and misuse.
description: The main components of an algorithm audit mechanism include: (1) fairness assessment — detecting decision-making disparities across different groups (such as gender, age, and region) to identify potential discrimination and bias issues; (2) transparency review — evaluating the transparency of algorithmic decision-making processes to ensure users can understand the algorithmic logic affecting their rights; (3) explainability analysis — using explainable AI techniques such as SHAP and LIME to analyze the key factors and reasoning paths behind algorithmic decisions; (4) data auditing — reviewing the quality, representativeness, and bias of training data to ensure data sources are legal and compliant; (5) impact assessment — evaluating the potential impact of algorithms on user rights, market competition, and social equity; (6) compliance checking — checking the compliance of algorithmic systems against regulatory requirements such as the Provisions on the Administration of Algorithmic Recommendations for Internet Information Services; (7) periodic review — establishing a regular algorithm audit system to track changes in algorithm performance and fairness metrics; (8) third-party auditing — engaging independent third-party organizations to conduct algorithm audits to improve objectivity and credibility.
category: AC03
keywords: algorithm audit
keywords: AI audit
keywords: algorithmic accountability
citation: Provisions on the Administration of Algorithmic Recommendations for Internet Information Services
citation: Special Feature: Blockchain Technology and Application Research
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of algorithm audit mechanisms include: (1) complex deep learning models have inherent black-box characteristics, making it technically difficult to fully understand their decision logic; (2) the definition of fairness may vary across different scenarios and cultural contexts, making it difficult to establish uniform standards; (3) algorithm auditing requires specialized technical capabilities and domain knowledge, and qualified auditors and organizations are relatively scarce; (4) audit results may be influenced by the choice of audit methods and evaluation metrics; (5) dynamically updated algorithm models require continuous auditing, and one-time audits cannot guarantee long-term compliance.

SIM Card Security Verification
type: Avoidance
break id: A0073
stix type: course-of-action
definition: Using technical means to verify the authenticity and binding relationship of SIM cards, preventing SIM swap attacks and phone number hijacking, and protecting the security of phone-number-based identity authentication.
description: The main approaches for SIM card security verification include: (1) SIM binding verification — binding user accounts to the ICCID or IMSI of a specific SIM card and triggering additional security verification when the SIM card changes; (2) carrier-assisted verification — cooperating with telecom carriers to query number status in real time through carrier interfaces, detecting SIM card replacement, number porting, and other change events; (3) device-SIM association detection — monitoring changes in the association between mobile devices and SIM cards, and performing risk assessment when the same number appears on a new device; (4) multi-channel verification — for critical operations, relying not only on SMS verification codes but also combining app push notifications, email verification, biometrics, and other verification channels; (5) number status monitoring — continuously monitoring the network status of user phone numbers to promptly detect anomalies such as suspension, cancellation, and secondary number assignment; (6) SIM card locking — allowing users to proactively lock their SIM cards to prevent unauthorized SIM card replacement.
category: AC01
keywords: SIM Card Security Verification
keywords: SIM swap fraud prevention
keywords: SIM binding verification
keywords: ICCID binding
keywords: IMSI verification
keywords: carrier SIM swap check
keywords: number port-out detection
keywords: phone number takeover protection
citation: SIM Swap Fraud - GSMA
citation: Best Practices for Protecting Against SIM Swap Attacks
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of SIM card security verification include: (1) reliance on carrier technical support and data sharing, with differences in interface capabilities and response speeds across carriers; (2) limited cross-border carrier coordination capability for international roaming and overseas carriers; (3) obtaining SIM card information may involve user privacy and requires compliant handling; (4) the proliferation of eSIM technology presents new challenges for physical SIM binding verification; (5) social engineering attacks may bypass carrier SIM card replacement processes.

Behavioral Biometrics
type: Avoidance
break id: A0074
stix type: course-of-action
definition: Identifying users and assessing risk by analyzing behavioral habit characteristics such as typing rhythm, swipe trajectory, grip posture, and mouse movement patterns. This is distinct from A0023, which is based on physiological biometrics.
description: Behavioral biometrics is a technology for identity verification and risk assessment based on user behavioral habits. The main recognition dimensions include: (1) keystroke dynamics — analyzing the rhythm of user typing, key hold duration, inter-key intervals, and other characteristics to form a unique typing behavior fingerprint; (2) touchscreen behavior analysis — on mobile devices, analyzing swipe speed, touch pressure, swipe angle, finger contact area, and other characteristics; (3) mouse behavior analysis — on PC, analyzing mouse movement speed, acceleration, click frequency, movement trajectory curvature, and other characteristics; (4) grip posture recognition — analyzing the posture and angle at which users hold their phones using gyroscopes and accelerometers; (5) gait recognition — analyzing the user's walking rhythm and gait characteristics through built-in phone sensors; (6) usage habit modeling — analyzing browsing paths, feature usage frequency, operation time distribution, and other behavioral patterns within an app. The advantage of behavioral biometrics is that it can perform continuous, passive identity verification without requiring active user cooperation, serving as a supplement to traditional identity authentication.
category: AC03
keywords: Behavioral Biometrics
keywords: behavioral biometric authentication
keywords: continuous authentication
keywords: keystroke dynamics
keywords: mouse dynamics
keywords: touch dynamics
keywords: behavioral profiling
keywords: user behavior analytics
citation: Biometrics - NIST
citation: ISO/IEC 30107-1:2016 Biometric Presentation Attack Detection - Framework
updated: 2026-06-13
version: 1
effectiveness: high
limitation: The limitations of behavioral biometrics include: (1) user behavior can change due to physical condition, mood, and environment, leading to higher false positive rates; (2) initial modeling requires a period of data accumulation, with a prominent cold-start problem; (3) behavioral characteristics may differ across devices, reducing cross-device recognition accuracy; (4) automated tools can simulate human behavioral patterns to bypass detection; (5) collecting user behavioral data may involve privacy compliance issues.

Graph Computing / Association Analysis
type: Avoidance
break id: A0075
stix type: course-of-action
definition: Using graph databases and graph computing technologies to analyze the relationships between entities such as accounts, devices, IPs, and phone numbers, identifying organized fraud behavior and anomalous association patterns.
description: Graph computing and association analysis is a risk control analysis method based on graph theory that identifies fraud groups and anomalous behavior patterns by constructing entity relationship graphs. Main capabilities include: (1) association graph construction — using accounts, device fingerprints, IP addresses, phone numbers, shipping addresses, bank cards, and other entities as graph nodes, with the relationships between them as edges, to build a multi-dimensional association graph; (2) community detection — using community detection algorithms such as Louvain and Label Propagation to identify tightly connected node clusters and discover potential fraud groups; (3) anomaly propagation analysis — when a node is flagged as malicious, using graph propagation algorithms to assess the risk level of other nodes associated with it; (4) cycle detection — identifying cyclic structures in fund transfers and account associations to detect anomalous transaction patterns such as money laundering and self-dealing; (5) centrality analysis — calculating node degree centrality, betweenness centrality, and other metrics to identify core nodes and key intermediaries within a group; (6) temporal graph analysis — combining the time dimension to analyze dynamic changes in association relationships and identify abnormal association clusters that appear suddenly within a short time.
category: AC03
keywords: Graph Computing / Association Analysis
keywords: graph analytics
keywords: link analysis
keywords: graph-based fraud detection
keywords: entity relationship graph
keywords: fraud ring detection
keywords: knowledge graph risk control
keywords: connected component analysis
citation: Graph-Based Fraud Detection - Neo4j
updated: 2026-02-28
version: 1
effectiveness: high
limitation: The limitations of graph computing and association analysis include: (1) large-scale graph computation requires significant computational and storage resources, limiting real-time performance; (2) the quality of association relationship data directly affects analysis results, and missing or erroneous data can lead to misjudgments; (3) attackers can sever association links by isolating devices and using independent IPs; (4) normal users may also have legitimate association relationships (such as family members sharing a device), requiring fine-grained rules to avoid false positives; (5) graph models have relatively poor explainability, making it difficult for business personnel to understand and tune them.

Geofencing
type: Avoidance
break id: A0076
stix type: course-of-action
definition: Setting virtual boundaries based on geographic location information to restrict or monitor the geographic scope of business operations, preventing cross-region fraud and circumvention of location-based policies.
description: Geofencing is a location-based access control and risk defense technology that restricts or monitors business activity scope by defining virtual geographic boundaries. Main applications include: (1) login location restriction — triggering additional verification or restricting access when a user logs in from an anomalous geographic location; (2) transaction location validation — verifying the consistency between the transaction origin and the user's home location, shipping address, and other factors to identify cross-region card fraud risks; (3) regional promotion control — ensuring regional promotional activities are limited to target-area users to prevent location spoofing for coupon abuse; (4) regulatory geographic control — restricting certain business activities in restricted regions based on local laws and regulations; (5) delivery range validation — validating the reasonableness of order addresses against delivery ranges in local life services; (6) multi-source location cross-validation — combining GPS, cell towers, WiFi, IP addresses, and other positioning data for cross-validation to improve the reliability of location information.
category: AC01
keywords: Geofencing
keywords: geo-fence policy
keywords: location-based access control
keywords: GPS geofencing
keywords: virtual perimeter
keywords: region-based risk control
keywords: location anomaly detection
keywords: out-of-region blocking
citation: Creating and Monitoring Geofences - Android Developers
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of geofencing include: (1) VPNs, proxy servers, and GPS spoofing tools can forge geographic location information; (2) indoor positioning accuracy is limited and may produce location errors in large buildings; (3) normal user travel and business trips may trigger false positives; (4) different positioning technologies vary significantly in accuracy and reliability; (5) some users may refuse to authorize location information for privacy reasons.

Transaction Risk Monitoring
type: Avoidance
break id: A0077
stix type: course-of-action
definition: Real-time monitoring of multi-dimensional transaction characteristics including amount, frequency, counterparty, and time distribution, using rule engines and machine learning models to identify anomalous transaction patterns.
description: Transaction risk monitoring is a technical system for real-time risk identification of transaction behavior. Main monitoring dimensions and capabilities include: (1) amount anomaly detection — monitoring whether single transaction amounts and cumulative transaction amounts exceed historical baselines or preset thresholds to identify abnormally large transactions; (2) frequency anomaly detection — monitoring transaction frequency, order rate, and other metrics to identify abnormally dense transaction behavior within a short time; (3) counterparty analysis — analyzing the risk labels, historical behavior, and association relationships of transaction counterparties to identify transactions with high-risk entities; (4) time pattern analysis — analyzing the time distribution of transactions to identify anomalous time-period transactions such as those occurring late at night; (5) channel consistency validation — validating the consistency of transaction channels, devices, and IP addresses with the user's historical transaction habits; (6) cross-account association analysis — monitoring fund flow patterns between multiple accounts to identify anomalous fund chains such as circular transfers and dispersed transfers; (7) real-time decision engine — completing transaction risk assessment and decision-making at the millisecond level based on rule engines and real-time feature computation.
category: AC03
keywords: Transaction Risk Monitoring
keywords: real-time transaction monitoring
keywords: transaction anomaly detection
keywords: payment risk engine
keywords: fraud scoring
keywords: velocity checks
keywords: merchant risk monitoring
keywords: rules-based risk control
citation: Transaction Monitoring Best Practices - ACAMS
citation: Beijing National FinTech Risk Monitoring Center: Privacy-Preserving Computation for Inter-Institutional Fraud Risk Detection
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The limitations of transaction risk monitoring include: (1) rule strategies need continuous iteration and updates, as new fraud patterns may bypass existing rules; (2) overly strict monitoring strategies may cause legitimate transactions to be incorrectly blocked, affecting user experience; (3) high real-time requirements place strict demands on system performance and stability; (4) detection effectiveness for small-amount dispersed fraud is limited; (5) cross-platform and cross-institution transaction data integration faces barriers.

Endpoint Detection and Response
type: Avoidance
break id: A0078
stix type: course-of-action
definition: Endpoint Detection and Response (EDR) is a security technology that performs continuous monitoring, threat detection, event recording, and automated response at the endpoint device level, capable of real-time discovery and handling of malicious activity on endpoints.
description: Endpoint Detection and Response (EDR) is an endpoint security technology that deploys lightweight agent programs on user devices to achieve continuous monitoring and threat response. Main capabilities include: (1) process behavior monitoring — monitoring the creation, execution, and communication behavior of all processes on endpoints to identify threats such as malware, information stealers, and keyloggers; (2) file integrity monitoring — detecting anomalous modifications, additions, and deletions of critical system and application files; (3) network behavior analysis — monitoring endpoint network connections, DNS requests, data transfers, and other behaviors to identify anomalous external connections and data exfiltration; (4) memory analysis — scanning endpoint memory to detect fileless attacks and memory injection and other advanced threats; (5) automated response — automatically executing process isolation, network blocking, file quarantine, and other response actions upon threat detection; (6) threat hunting — supporting security analysts in proactively searching for potential threat indicators (IOCs) on endpoints; (7) incident tracing — recording complete endpoint behavior logs to support post-incident investigation and attack chain reconstruction.
category: AC02
keywords: Endpoint Detection and Response
keywords: EDR
keywords: endpoint telemetry
keywords: endpoint threat hunting
keywords: behavior-based detection
keywords: process injection detection
keywords: credential dumping detection
keywords: infostealer detection
citation: Endpoint Detection and Response - Glossary - NIST CSRC
citation: EDR Technology Development and Practice - CNCERT
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: The limitations of EDR include: (1) some performance impact on endpoints, potentially causing devices to run slower; (2) advanced attackers may bypass EDR detection through kernel-level rootkits or firmware attacks; (3) deployment and management is difficult in BYOD (bring your own device) scenarios; (4) large volumes of alerts generated by many endpoints require professional security teams for analysis and handling; (5) detection capability for encrypted communications and zero-day attacks is limited.

Privileged Access Management
type: Avoidance
break id: A0079
stix type: course-of-action
definition: Privileged Access Management (PAM) is a security mechanism for centralized control of accounts with elevated permissions, including access control, session recording, password vaulting, and approval management, to prevent privileged accounts from being abused or stolen.
description: Privileged Access Management (PAM) is a security control system for high-privilege accounts designed to prevent privileged accounts from being abused by insiders or stolen and exploited by external attackers. Main capabilities include: (1) privileged account discovery and onboarding — automatically discovering privileged accounts in the IT environment (such as root, admin, DBA) and bringing them under unified management; (2) password vault — centrally storing and managing privileged account passwords with automatic password rotation to avoid plaintext password exposure and long-term unchanged passwords; (3) least privilege principle — assigning the minimum necessary permissions based on work needs and limiting the scope and duration of privileged account use; (4) just-in-time (JIT) privilege elevation — granting privileges temporarily on demand and automatically revoking them after use to reduce the exposure window of privileged accounts; (5) session monitoring and recording — performing real-time monitoring and recording of privileged account operation sessions to support post-incident auditing and playback; (6) multi-level approval — requiring multi-level approval for high-risk operations to prevent single-person unauthorized actions; (7) anomalous behavior detection — monitoring privileged account usage behavior to detect suspicious activities such as anomalous login times and anomalous operation commands.
category: AC01
keywords: Privileged Access Management
keywords: PAM
keywords: privileged session management
keywords: password vaulting
keywords: just-in-time access
keywords: least privilege enforcement
keywords: privileged account discovery
keywords: session recording
citation: privileged user - Glossary - NIST Computer Security Resource Center
citation: Privileged Access Management Best Practices - CyberArk
updated: 2026-02-27
version: 1
effectiveness: high
limitation: The limitations of privileged access management include: (1) high deployment and integration complexity requiring deep integration with existing IT systems; (2) overly strict controls may affect operational efficiency, requiring a balance between security and efficiency; (3) privileged management in cloud-native environments faces new challenges such as temporary credentials and service accounts; (4) cannot completely prevent deliberate sabotage by insiders who have already obtained privileges; (5) password rotation may cause automated processes that depend on those passwords to break.

Data Classification and Grading
type: Avoidance
break id: A0080
stix type: course-of-action
definition: Classifying and grading data according to its sensitivity and business value, and implementing differentiated protection strategies and access controls for data at different levels.
description: Data classification and grading is foundational work in data security governance. By systematically classifying and grading data assets by sensitivity, it enables fine-grained data protection. Main practices include: (1) data asset inventory — comprehensively cataloging data assets within the organization, including structured data (databases, tables) and unstructured data (documents, logs, images, etc.); (2) classification framework — categorizing data by business attributes into user data, transaction data, operational data, system data, and other categories; (3) grading standards — typically divided into public, internal, sensitive, and confidential levels, or following national standards into general data, important data, and core data; (4) automated labeling — using natural language processing and pattern recognition to automatically identify and label sensitive data (such as ID numbers, phone numbers, bank card numbers, etc.); (5) differentiated protection — implementing different encryption, desensitization, access control, and audit strategies based on data level; (6) data flow control — monitoring and controlling the use, sharing, and export of data at different levels to prevent sensitive data leakage; (7) periodic review — regularly evaluating and updating data classification and grading results to ensure alignment with business development.
category: AC01
keywords: Data Classification and Grading
keywords: data classification
keywords: data grading
keywords: data labeling
keywords: sensitivity classification
keywords: data tiering
keywords: data inventory
keywords: structured data tagging
citation: Data Security Law - People's Republic of China
citation: Data Classification and Grading Guide - GB/T 43697-2024
updated: 2026-02-27
version: 1
effectiveness: high
limitation: The limitations of data classification and grading include: (1) data asset inventory is labor-intensive and dynamic data is difficult to cover comprehensively; (2) automated classification accuracy is limited and requires manual review; (3) developing grading standards requires close collaboration between business and security teams, and parties may disagree on sensitivity judgments; (4) data levels may change during processing and transfer, making dynamic management difficult; (5) excessive grading protection may affect normal data use and business efficiency.

Security Development Lifecycle
type: Avoidance
break id: A0081
stix type: course-of-action
definition: The Security Development Lifecycle (SDL) is a methodology for embedding security practices throughout the entire software development process, reducing security vulnerabilities at the source through requirements analysis, design review, secure coding, security testing, and other phases.
description: The Security Development Lifecycle (SDL) is a systematic approach that integrates security into the entire software development process. Main phases and practices include: (1) security requirements analysis — identifying security requirements and compliance needs in the requirements phase, conducting threat modeling, and defining security baselines; (2) security design review — conducting security reviews of system architecture and detailed design to identify design-level security flaws and ensure adherence to security principles such as least privilege and defense in depth; (3) secure coding standards — developing and promoting secure coding standards covering key areas such as input validation, output encoding, authentication and authorization, cryptographic handling, and error handling; (4) static application security testing (SAST) — automatically scanning source code for security vulnerabilities using static code analysis tools during the coding phase; (5) dynamic application security testing (DAST) — performing black-box security testing on running applications during the testing phase to discover runtime security vulnerabilities; (6) open-source component security management (SCA) — scanning project dependencies for security vulnerabilities and license compliance issues; (7) pre-launch security review — conducting security reviews and penetration testing before application launch to ensure security release standards are met; (8) security operations feedback — feeding online security incidents back into the development process to continuously improve security practices.
category: AC01
keywords: Security Development Lifecycle
keywords: SDL
keywords: secure SDLC
keywords: secure by design
keywords: threat modeling
keywords: security requirements engineering
keywords: security code review
keywords: DevSecOps
citation: Microsoft Security Development Lifecycle
citation: OWASP Software Assurance Maturity Model (SAMM)
updated: 2026-02-27
version: 1
effectiveness: high
limitation: The limitations of SDL include: (1) full SDL implementation increases development time and cost, and is difficult to implement in fast-iterating agile development; (2) false positives from security tools may affect development efficiency, causing developers to ignore security alerts; (3) security talent shortage makes it difficult to assign professional security personnel to every development team; (4) SDL cannot completely eliminate security vulnerabilities and still requires runtime protection and incident response capabilities; (5) security risks from third-party components and APIs are difficult to fully control through internal SDL processes.

Bug Bounty Program
type: Avoidance
break id: A0082
stix type: course-of-action
definition: A mechanism for publicly soliciting security vulnerabilities from external security researchers and rewarding them, leveraging the external security community to discover security risks in systems and supplement internal security testing capabilities.
description: A Bug Bounty Program is a mechanism that incentivizes external security researchers to discover and report security vulnerabilities. Main practices include: (1) scope definition — clearly defining the target systems, domains, and application scope covered by the program, as well as out-of-scope testing areas and prohibited actions; (2) severity levels and reward standards — setting different reward amounts based on vulnerability severity (e.g., CVSS scores) to incentivize researchers to find high-severity vulnerabilities; (3) security response process — establishing a standardized process for vulnerability intake, validation, triage, remediation, and confirmation to ensure timely handling; (4) safe harbor provisions — providing legal protection for good-faith security researchers, clearly stating that compliant testing within scope will not result in legal liability; (5) platform-based operations — managing the program through third-party bug bounty platforms such as HackerOne and Bugcrowd, or a self-built platform, to reduce operational costs; (6) continuous operations — running the bug bounty program as an ongoing security activity, regularly updating scope and reward standards to maintain researcher engagement; (7) vulnerability intelligence feedback — feeding collected vulnerability information back into the security development process to drive systematic security improvements.
category: AC02
keywords: Bug Bounty Program
keywords: vulnerability disclosure program
keywords: VDP
keywords: coordinated vulnerability disclosure
keywords: responsible disclosure
keywords: security researcher rewards
keywords: HackerOne
keywords: Bugcrowd
citation: HackerOne Bug Bounty Platform
citation: Vulnerability Disclosure and Bug Bounty Program Guide - ISO 29147
updated: 2026-02-27
version: 1
effectiveness: medium
limitation: The limitations of bug bounty programs include: (1) they require continuous financial investment and professional team operations; (2) large volumes of low-quality or invalid vulnerability reports may be received, increasing review burden; (3) researchers may leak or sell vulnerability information before reporting it; (4) they cannot cover all types of security risks, especially business-logic-level risks; (5) testing of internal systems and non-public assets carries security risks.

Shadow AI Detection and Governance
type: Avoidance
break id: A0083
stix type: course-of-action
definition: Security controls for detecting, monitoring, and governing employees' unauthorized use of third-party AI tools such as public large language models, AI writing assistants, and AI code generators.
description: Shadow AI refers to employees inputting sensitive data into third-party AI services or using unvetted AI tools for business purposes without formal organizational approval or security assessment. With the proliferation of generative AI, employees spontaneously using tools like ChatGPT and Claude to improve productivity has become commonplace, but this also introduces risks such as data leakage, compliance violations, and intellectual property exposure. Shadow AI detection and governance includes: ① AI traffic identification: recognizing data requests to known AI service endpoints through network traffic analysis; ② DLP integration: adding AI service sensitive data transfer rules to DLP policies; ③ AI tool catalog management: establishing approved AI tool allowlists and unapproved tool blocklists; ④ Usage audit logging: recording AI tool usage time, users, data types, and interaction content summaries; ⑤ Security awareness education: explaining Shadow AI risks and compliance requirements to employees; ⑥ Alternative solutions: providing employees with security-vetted enterprise-grade AI tools as alternatives to public services.
category: AC03
keywords: Shadow AI Detection and Governance
keywords: shadow AI
keywords: unsanctioned AI usage
keywords: AI app discovery
keywords: genAI data leakage prevention
keywords: AI SaaS governance
keywords: enterprise AI allowlist
keywords: AI usage monitoring
citation: Shadow AI Is Eroding Your Data Boundaries: How Enterprises Can Manage Invisible AI Usage Risks
citation: Cisco 2025 Data Privacy Benchmark Study
citation: NIST AI Risk Management Framework
updated: 2026-06-11
version: 1
effectiveness: high
limitation: AI service endpoints and tools continuously emerge, making detection rules difficult to fully cover; AI usage in encrypted traffic is hard to identify; employees may bypass enterprise network detection through personal devices; excessive restrictions may reduce employee productivity and innovation; auditing AI tool functionality depends on vendor transparency.

Network Segmentation Technology
type: Avoidance
break id: A0085
stix type: course-of-action
definition: A security technology that manages traffic between subnets and limits attackers' lateral movement by setting access policies for each network subnet.
description: Network segmentation divides the enterprise network into multiple logically or physically isolated subnets, and sets strict access control policies for each subnet. When an attacker intrudes into a subnet, segmentation technology can prevent them from moving laterally to other subnets, thereby limiting the scope and impact of the attack. This is an important component of zero trust architecture.
category: AC01
keywords: Network Segmentation Technology
keywords: network segmentation
keywords: microsegmentation
keywords: zero trust segmentation
keywords: east-west traffic control
keywords: VLAN segmentation
keywords: software-defined perimeter
keywords: blast radius reduction
citation: NIST SP 800-207: Zero Trust Architecture
citation: Zero Trust Maturity Model - CISA
updated: 2026-06-11
version: 1
effectiveness: high
limitation: High implementation cost, requiring network architecture re-planning; may affect normal communication between business systems; requires continuous maintenance and policy updates.

AI Agent Tool Governance and MCP Security Controls
type: Avoidance
break id: A0087
stix type: course-of-action
definition: Controls for governing AI agent tool use, external data access, permission boundaries, credential use, approval checkpoints, audit telemetry, and execution environments.
description: After AI agents connect to MCP servers, plugins, RAG knowledge bases, browsers, code executors, business APIs, and other external tools, they can move from generating content to executing actions. This control reduces prompt injection, tool misuse, unauthorized execution, sensitive data exposure, and automated attack orchestration by using tool allowlists, least privilege, short-lived credentials, parameter validation, source verification, instruction/data isolation, sandbox execution, network egress limits, step-up confirmation for high-risk actions, and tamper-resistant audit logs.
category: AC01
keywords: AI Agent Tool Governance and MCP Security Controls
keywords: MCP security
keywords: Model Context Protocol
keywords: agent tool allowlist
keywords: tool permission governance
keywords: function calling guardrails
keywords: agent action approval
keywords: tool invocation policy
citation: OWASP Gen AI Security Project
citation: OWASP Top 10 for Agentic Applications
citation: Cybersecurity Forecast 2026 - Google Cloud
updated: 2026-06-11
version: 1
effectiveness: high
limitation: AI agent behavior is uncertain, and external tools and data sources change continuously, so no single control fully eliminates risk. Overly restrictive permissions can reduce usability; auditing and human confirmation increase process cost; third-party MCP servers, plugins, and model services still require supplier transparency and continuous monitoring.

AI Content Provenance
type: Avoidance
break id: A0088
stix type: course-of-action
definition: A security control that adds verifiable source information and metadata identifiers to AI-generated content, making content origins traceable and verifiable.
description: AI content provenance uses technical means to add tamper-proof source identifiers and metadata information to AI-generated content, making the content's production process, AI model used, generation time, and other information traceable and verifiable. Unlike A0064 AI Content Detection which focuses on identifying whether content is AI-generated, AI Content Provenance focuses on establishing trusted proof of origin for content. Key technologies include: ① Content Credentials (C2PA standard): a content provenance authentication standard jointly promoted by Adobe, Microsoft, Google, and others, binding cryptographic signatures and provenance metadata to digital content; ② Digital watermark embedding: embedding invisible digital watermarks in AI-generated content containing information such as the generation model and timestamp; ③ Blockchain provenance: storing content generation records and change history on the blockchain to ensure immutability; ④ Model fingerprinting: recording the unique identifier information of the AI model used to generate the content; ⑤ Content signature chain: adding digital signatures for each edit and distribution of the content, forming a complete signature chain. This technology is critical for defending against AI deepfakes and disinformation dissemination.
category: AC01
keywords: AI Content Provenance
keywords: C2PA
keywords: Content Credentials
keywords: content authenticity
keywords: media provenance
keywords: signed media metadata
keywords: cryptographic watermarking
keywords: Content Authenticity Initiative
citation: C2PA Technical Specification
citation: Adobe Content Authenticity Initiative
citation: NIST AI RMF: AI Risk Management Framework
updated: 2026-06-11
version: 1
effectiveness: high
limitation: C2PA and other standards have not yet been fully adopted, with many platforms and devices not supporting them; digital watermarks may be erased or damaged by advanced techniques; blockchain provenance has high storage costs; model fingerprinting accuracy is affected by model updates; content signature chain complexity increases dramatically with the number of distribution events.

Agent Behavior Sandbox
type: Avoidance
break id: A0089
stix type: course-of-action
definition: A security control that runs AI agents in an isolated, controlled execution environment, monitoring and constraining their behavior, tool calls, and resource access.
description: Agent behavior sandbox is a security control technology that provides an isolated execution environment for AI agents, complementing A0087 AI Agent Tool Governance and MCP Security Control — A0087 manages permissions and access control, while the sandbox manages runtime behavior and the execution environment. Key functions include: ① Execution isolation: running agents in independent containers or virtual environments, limiting their access to the host system and network; ② Behavior monitoring: real-time monitoring of the agent's decision-making process, tool call sequences, and resource consumption; ③ Policy enforcement: restricting the range of operations an agent can execute based on security policies, such as prohibiting file deletion and outbound network connections; ④ Anomaly detection: detecting when agent behavior deviates from expected patterns, such as recursive calls or privilege escalation attempts; ⑤ Rollback mechanism: automatically suspending the agent and rolling back to a safe state when anomalous behavior is detected; ⑥ Audit logging: recording the complete execution trail of the agent for post-incident analysis and compliance auditing. This technology is one of the core controls in the OWASP Agentic Applications security standard.
category: AC01
keywords: Agent Behavior Sandbox
keywords: agent sandboxing
keywords: isolated tool execution
keywords: agent runtime isolation
keywords: policy-enforced execution
keywords: restricted execution environment
keywords: dry-run mode
keywords: behavior simulation
citation: OWASP Top 10 for Agentic Applications
citation: NIST AI 100-2 E2025: Adversarial Machine Learning - A Taxonomy and Terminology of Attacks and Mitigations
citation: Google DeepMind: Scalable Agent Alignment via Reward Modeling
updated: 2026-06-11
version: 1
effectiveness: high
limitation: The sandbox environment may not fully simulate the production environment, leading to differences in agent behavior; excessive restrictions may reduce the functionality and utility of the agent; sandbox performance overhead is significant in high-performance computing scenarios; complex toolchains and external dependencies may be difficult to run completely within the sandbox.

OAuth Permission Minimization
type: Avoidance
break id: A0090
stix type: course-of-action
definition: A security control that applies fine-grained control over application permissions in the OAuth authorization flow, ensuring applications only receive the minimum set of permissions needed to perform their functions.
description: OAuth permission minimization is a security control for the OAuth authorization flow that addresses Consent Phishing and OAuth authorization abuse. Unlike A0007 Multi-Factor Authentication which focuses on identity verification, OAuth permission minimization focuses on granular permission control after authorization. Key functions include: ① Permission scope review: conducting security reviews of OAuth application permission scope requests and rejecting overly broad permission requests; ② Incremental authorization: applications initially receive only basic permissions and progressively request additional permissions as needed; ③ Permission time-to-live control: setting expiration times for authorizations and periodically requiring users to re-confirm; ④ Permission monitoring and alerting: monitoring actual permission usage by OAuth applications and alerting on anomalous behavior; ⑤ Application risk rating: conducting security risk ratings for OAuth applications, with high-risk applications requiring additional approval; ⑥ Permission revocation mechanism: automatically revoking authorization for applications that are unused for extended periods or exhibit anomalous behavior. This technology is critical for defending against AiTM attacks, OAuth authorization abuse, and excessive third-party application permissions.
category: AC01
keywords: OAuth Permission Minimization
keywords: OAuth scope minimization
keywords: least privilege OAuth scopes
keywords: consent phishing prevention
keywords: granular delegated permissions
keywords: incremental authorization
keywords: app consent policies
keywords: OAuth app governance
citation: OAuth 2.0 Security Best Current Practice
citation: Microsoft: Securing OAuth Apps in Microsoft 365
citation: OWASP OAuth 2.0 Security Cheat Sheet
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Overly restricting OAuth permissions may affect normal application functionality and user experience; fine-grained permission control increases development and maintenance costs; users may not understand the meaning of permission requests and habitually consent; monitoring third-party application permission usage depends on platform support capabilities.

Quantum-Safe Cryptography Migration
type: Avoidance
break id: A0091
stix type: course-of-action
definition: Security controls for migrating existing cryptographic systems to Post-Quantum Cryptography (PQC) algorithms resistant to quantum computing attacks.
description: Quantum-safe cryptography migration is the security migration process of replacing an organization's existing classical cryptographic algorithms such as RSA and ECC with NIST-standardized Post-Quantum Cryptography (PQC) algorithms. Key components include: 1) Cryptographic inventory: cataloging all encryption usage scenarios in the organization, including TLS/SSL, digital signatures, key exchange, data encryption, etc.; 2) Risk assessment: evaluating the threat level of "Harvest Now, Decrypt Later" attacks faced by each encryption scenario; 3) Algorithm selection: selecting appropriate post-quantum algorithms based on NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) standards; 4) Hybrid deployment: adopting classical + post-quantum hybrid encryption schemes during the transition period to ensure backward compatibility; 5) Performance optimization: addressing performance and storage issues caused by the increased key and signature sizes of post-quantum algorithms; 6) Cryptographic agility: establishing an architecture that allows rapid replacement of cryptographic algorithms, preparing for future algorithm updates. NIST released the first post-quantum cryptography standards in 2024, with large-scale deployment beginning in 2026. Governments and financial institutions worldwide have begun mandating migration.
category: AC01
keywords: Quantum-Safe Cryptography Migration
keywords: post-quantum cryptography migration
keywords: PQC transition
keywords: crypto agility
keywords: hybrid key exchange
keywords: ML-KEM
keywords: ML-DSA
keywords: SLH-DSA
citation: Post-Quantum Cryptography - NIST CSRC
citation: NIST Releases First 3 Finalized Post-Quantum Encryption Standards
citation: NIST FIPS 203, 204, and 205 Finalized: An Important Step Towards a Quantum-Safe Future
updated: 2026-06-11
version: 1
effectiveness: high
limitation: Post-quantum algorithms have significantly larger key and signature sizes than classical algorithms, which may lead to performance degradation and increased storage requirements; the migration process is complex and time-consuming, involving the modification of numerous systems and protocols; the security of some post-quantum algorithms still requires time to validate; backward compatibility may create security weaknesses during the hybrid deployment period; migration costs are high, and small and medium enterprises may find it difficult to afford.

Mobile Threat Defense (MTD)
type: Avoidance
break id: A0092
stix type: course-of-action
definition: Specialized threat detection and defense technology deployed on mobile endpoints, protecting mobile devices from malicious applications, network attacks, and data leakage threats.
description: Mobile Threat Defense (MTD) is a threat detection and defense technology specifically designed for mobile endpoints. Unlike A0078 Endpoint Detection and Response (EDR) which primarily covers desktop and server endpoints, MTD focuses on the unique threat scenarios of mobile devices such as smartphones and tablets. Key functions include: ① Application security analysis: conducting behavioral analysis and risk assessment of installed applications on mobile devices, detecting malicious apps and suspicious permission requests; ② Network threat detection: detecting the security of WiFi hotspots connected by mobile devices, identifying man-in-the-middle attacks and rogue hotspots; ③ Device integrity verification: checking whether devices are jailbroken/rooted, whether malicious configuration profiles are installed, and verifying device integrity; ④ Data leakage prevention: monitoring data flow on mobile devices to prevent sensitive data from leaking through insecure applications or channels; ⑤ Phishing protection: real-time detection of phishing links and malicious content in mobile browsers and messaging applications; ⑥ Threat intelligence integration: integrating with mobile threat intelligence sources to provide real-time threat alerts. With the proliferation of BYOD and mobile work, MTD has become a core component of enterprise mobile security strategies.
category: AC02
keywords: Mobile Threat Defense (MTD)
keywords: MTD
keywords: mobile endpoint defense
keywords: mobile malware detection
keywords: mobile app reputation
keywords: on-device phishing protection
keywords: mobile network threat detection
keywords: device risk posture
citation: Definition and Value of Mobile Threat Defense (MTD)
citation: SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile ...
citation: OWASP Mobile Security Testing Guide
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: The closed nature of mobile operating systems limits MTD detection depth; iOS sandbox mechanisms make it difficult for MTD to obtain system-level information; increased user privacy awareness may lead to rejection of MTD app installation; mobile device battery and performance limitations affect continuous monitoring capabilities; some advanced mobile threats may bypass MTD detection.

AI Security Posture Management (AI-SPM)
type: Avoidance
break id: A0094
stix type: course-of-action
definition: A comprehensive situational awareness and governance approach for continuous monitoring, assessment, and governance of the security posture of AI systems.
description: AI Security Posture Management (AI-SPM) is a security posture management technology specifically designed for AI systems. Unlike A0087 AI Agent Tool Governance and MCP Security Controls which are specific control measures, AI-SPM is a global-level situational awareness and governance framework. Key functions include: ① AI asset discovery: automatically discovering and inventorying all AI models, training data, inference services, and agent applications within an organization; ② Vulnerability assessment: assessing security risks facing AI systems, including prompt injection, data poisoning, model theft, and adversarial examples; ③ Permission mapping: analyzing AI system permission configurations, identifying overly broad permission grants and insecure access paths; ④ Compliance monitoring: monitoring whether AI systems comply with regulatory requirements such as the EU AI Act and China's Generative AI Management Measures; ⑤ Attack surface management: continuously assessing changes in AI system attack surfaces and discovering new exposures; ⑥ Security scoring: generating security scores for each AI system to support security decision-making. AI-SPM is a key focus area for AI security identified by research organizations such as Gartner in 2026.
category: AC02
keywords: AI Security Posture Management (AI-SPM)
keywords: AI-SPM
keywords: AI asset inventory
keywords: AI misconfiguration detection
keywords: LLM security posture
keywords: model exposure monitoring
keywords: AI configuration drift
keywords: model risk visibility
citation: AI Security Governance Shifts to Proactive Defense: 2025 AI Browser Vulnerability Prevention, 2026 AI-SPM Deployment
citation: OWASP AI Security and Privacy Guide
citation: NIST AI Risk Management Framework (AI RMF)
updated: 2026-06-11
version: 1
effectiveness: medium
limitation: The complexity and dynamic nature of AI systems make comprehensive situational awareness difficult; lack of unified AI security standards and scoring systems; the "black box" nature of AI model internals limits the depth of security assessment; the AI-SPM tool market is still in its early stages with insufficient maturity; cross-cloud and cross-platform AI system management faces integration challenges.

Smart Contract Security Audit
type: Avoidance
break id: A0095
stix type: course-of-action
definition: A systematic manual review and professional analysis of smart contract code to identify potential security vulnerabilities and logical flaws.
description: A smart contract security audit is a critical defensive measure conducted before deployment, involving a comprehensive examination of the contract code by a professional security team. The audit process includes: code logic review, business logic verification, access control inspection, reentrancy attack prevention, integer overflow detection, gas optimization analysis, and more. Audits are categorized into internal audits and third-party professional audits, and it is recommended to complete at least one third-party audit before mainnet deployment. The audit report lists the severity levels of discovered vulnerabilities (Critical/High/Medium/Low) along with remediation recommendations. The development team is required to fix the issues based on the report and undergo a re-audit.
category: AC03
keywords: Smart Contract Security Audit
citation: Smart Contract Vulnerabilities and Mitigation Strategies
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Manual audits depend on the experience and expertise of the auditors, which may result in missed complex logical vulnerabilities. Audits involve high costs and long cycles. Additionally, audits are only applicable to a specific version of the code, and any subsequent modifications require a re-audit.

Smart Contract Code Auditing and Public Verification
type: Avoidance
break id: A0095-001
stix type: course-of-action
definition: Conduct third-party code audits before project launch and publicly verify the contract source code on blockchain explorers.
description: Reduce rug pull risks through transparency and professional review. Implementation points: Engage reputable auditing firms (e.g., CertiK, Quantstamp) to perform comprehensive code audits and publicly release audit reports; verify and publish contract source code on blockchain explorers such as Etherscan, allowing investors to inspect it; focus on checking for hidden mint functions, transaction pause functions, owner privileges, liquidity withdrawal backdoors, and other common rug pull techniques; examine upgrade permissions of proxy contracts to ensure they cannot be maliciously replaced; audited code should not be modified thereafter, and if modifications are required, a re-audit is necessary. Platforms like Coinbase recommend that investors prioritize projects that have undergone auditing.
category: AC03
keywords: Smart Contract Code Auditing and Public Verification
citation: Smart Contract Review Workflow
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Audits cannot guarantee the discovery of all vulnerabilities and are costly (ranging from tens of thousands to hundreds of thousands of dollars); audit reports may be falsified or taken out of context; even audited projects may still conduct rug pulls through other means (e.g., social engineering); open-source code does not equate to security.

Smart Contract Static Analysis Tools
type: Avoidance
break id: A0096
stix type: course-of-action
definition: Automated tools that scan smart contract source code or bytecode to identify common vulnerability patterns and security flaws.
description: Static analysis tools automatically detect security issues in smart contracts through techniques such as pattern matching, data flow analysis, and symbolic execution. Commonly used tools include Slither (static analysis based on Solidity AST), Mythril (symbolic execution and taint analysis), Securify (formal verification), and others. These tools can quickly identify common issues such as reentrancy vulnerabilities, integer overflows, unchecked external calls, and access control flaws. It is recommended to integrate them into the CI/CD pipeline during the development process to enable continuous security detection. Combining multiple tools can improve detection coverage and reduce the risk of false negatives.
category: AC03
keywords: Smart Contract Static Analysis Tools
citation: Avoiding Smart Contract Vulnerabilities
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Static analysis is prone to false positives and false negatives; it cannot detect complex business logic vulnerabilities; its ability to detect novel attack patterns is limited; it must be used in conjunction with manual auditing.

Formal Verification of Smart Contracts
type: Avoidance
break id: A0097
stix type: course-of-action
definition: The use of mathematical methods to rigorously prove the correctness of smart contract code, ensuring that the contract's behavior conforms to its intended specification.
description: Formal verification provides the highest level of assurance for smart contract security by validating correctness through mathematical proofs rather than testing. The verification process involves: defining formal specifications (describing what the contract should do using mathematical logic), constructing formal models, and verifying properties using theorem proving or model checking tools. It can prove critical properties such as fund conservation, state consistency, and permission correctness. Commonly used tools include the K Framework, Coq, Isabelle, and others. Formal verification is particularly suitable for high-value contracts (e.g., core DeFi protocol contracts, cross-chain bridge contracts) and the verification of critical security properties.
category: AC01
keywords: Formal Verification of Smart Contracts
citation: Smart Contract Security Audit
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Requires deep expertise in mathematics and formal methods; the verification process is complex and extremely costly; can only verify explicitly defined properties and cannot cover all possible security issues; the learning curve for verification tools is steep.

Oracle Price Verification Mechanism
type: Avoidance
break id: A0098
stix type: course-of-action
definition: A mechanism that uses multi-source price oracles and implements mechanisms such as Time-Weighted Average Price (TWAP) to prevent single-transaction price manipulation.
description: Flash loan attacks often manipulate decentralized exchange prices through single large transactions, causing DeFi protocols that rely on such prices to make erroneous judgments. Defensive measures include: using decentralized oracles like Chainlink instead of a single DEX price source; implementing TWAP (Time-Weighted Average Price) algorithms that calculate prices based on multiple blocks; setting price deviation thresholds, where execution is rejected if a single transaction causes a price change exceeding the threshold; and using multiple independent price sources for cross-validation. This mechanism makes it difficult for attackers to influence system judgment through a single flash loan transaction.
category: AC01
keywords: Oracle Price Verification Mechanism
citation: Formal Verification for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: The TWAP mechanism may lag behind the actual price during periods of extreme market volatility; multi-source oracles increase system complexity and gas costs; the oracle itself must still be protected from attacks.

Multi-Source Oracle Aggregation and Anomaly Detection
type: Avoidance
break id: A0098-001
stix type: course-of-action
definition: Simultaneously using multiple independent oracle data sources with aggregation algorithms and anomaly detection mechanisms to prevent single data source manipulation.
description: Relying on a single oracle is susceptible to manipulation, while multi-source aggregation raises the cost of attack. Implementation methods: Integrate multiple decentralized oracles such as Chainlink, Band Protocol, and API3; use median or weighted average algorithms to aggregate prices rather than directly using a single value; set anomaly detection thresholds to exclude or downgrade individual data sources when deviations are excessive; require consensus from at least N (e.g., 3) data sources before accepting a price update; monitor price deviations between data sources and trigger alerts when thresholds are exceeded. The OWASP Smart Contract Top 10 classifies oracle manipulation as an SC02-level vulnerability, emphasizing the importance of multi-source verification.
category: AC01
keywords: Multi-Source Oracle Aggregation and Anomaly Detection
keywords: oracle aggregation
keywords: price feed validation
keywords: oracle deviation monitoring
keywords: TWAP comparison
keywords: DeFi oracle security
citation: Smart Contract Monitoring and Alerting
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Multiple oracles increase gas costs and latency; all oracles may be affected by the same underlying data sources; aggregation algorithms may be studied and exploited by attackers; scenarios involving data source failures must be handled.

Time-Weighted Average Price (TWAP) Mechanism
type: Avoidance
break id: A0098-002
stix type: course-of-action
definition: A method that uses the weighted average price across multiple time points instead of the instantaneous price to prevent short-term manipulation.
description: Instantaneous prices are easily manipulated by single large transactions, whereas TWAP smooths out price fluctuations. Implementation details: record the cumulative price value from on-chain DEXs for each block; calculate the average price over a specified time window (e.g., 30 minutes); utilize the built-in TWAP oracle from Uniswap V2/V3 or implement a custom solution; set a reasonable time window—too short makes it susceptible to manipulation, while too long introduces significant lag; combine the instantaneous price with TWAP and set a maximum deviation threshold. Attackers would need to sustain price manipulation over a period of time to affect TWAP, significantly increasing the cost. Research by Cube Exchange indicates that TWAP is an effective defense against flash loan price manipulation.
category: AC01
keywords: Time-Weighted Average Price (TWAP) Mechanism
citation: Security Patch Management for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Price updates exhibit lag, making them untimely during severe market volatility; attackers may bypass the mechanism through sustained manipulation; storing historical prices on-chain increases gas costs; sufficient trading volume is required to support price discovery.

Automated Detection and Circuit Breaker for Oracle Manipulation
type: Avoidance
break id: A0098-003
stix type: course-of-action
definition: Using machine learning and rule engines to detect oracle data anomalies in real time and trigger circuit breaker mechanisms to protect the protocol.
description: Proactively monitor oracle behavior and automatically defend against attacks upon detection. Detection dimensions: price spike detection — price changes exceeding a threshold within a short time window; volume anomalies — price changes without matching trading volume; cross-market arbitrage discrepancies — a single market's price deviating excessively from others; oracle update frequency anomalies. Circuit breaker measures: suspending contract functions dependent on the oracle (e.g., lending, liquidation); switching to backup oracles or manual intervention; capping single-operation amounts; delaying sensitive operations until price stabilization. LLM-driven detection tools can identify novel manipulation patterns. A balance must be struck between false positive rate and response speed.
category: AC03
keywords: Automated Detection and Circuit Breaker for Oracle Manipulation
citation: Smart Contract Incident Response
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Circuit breaker mechanisms may be abused or become attack targets themselves; false positives can disrupt normal transactions; machine learning models require continuous training and updates; the detection system itself may become a single point of failure.

Flash Loan Limit Control
type: Avoidance
break id: A0099
stix type: course-of-action
definition: Setting caps on the borrowing amount and scope of impact for a single transaction to reduce the potential impact of flash loan attacks.
description: Mitigating attack risks by limiting the scale of flash loans. Specific measures include: setting a maximum amount cap for a single flash loan; limiting the maximum impact ratio of a single transaction on a liquidity pool (e.g., not exceeding 10% of the total pool); implementing rate limiting to restrict the frequency of large operations within a short timeframe; and adding extra verification steps or time delays for large transactions. These limitations ensure that even if an attack occurs, the losses are kept within an acceptable range, without affecting normal users' legitimate usage needs.
category: AC01
keywords: Flash Loan Limit Control
keywords: flash loan risk limit
keywords: borrow cap
keywords: protocol exposure limit
keywords: same-block abuse prevention
keywords: DeFi risk control
citation: Smart Contract Testing and Analysis
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Overly strict limits can impair the protocol's capital efficiency and user experience; limits need to be dynamically adjusted based on market conditions; cannot completely prevent small-scale arbitrage attacks.

Reentrancy Attack Protection
type: Avoidance
break id: A0100
stix type: course-of-action
definition: Implement reentrancy protection mechanisms to prevent bypassing security checks through reentrant calls during flash loan execution.
description: Flash loan attacks are often combined with reentrancy vulnerabilities, where the attacker re-calls contract functions within callback functions. Protective measures include: using OpenZeppelin's ReentrancyGuard modifier; adopting the Checks-Effects-Interactions pattern to complete state updates before making external calls; employing mutex lock mechanisms to prevent function reentrancy; and marking critical functions with the nonReentrant modifier. Implementation requires adding protection to all functions involving external calls and state changes to ensure state consistency.
category: AC01
keywords: Reentrancy Attack Protection
citation: Flash Loan Attacks: How They Work & How to Prevent Them
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Only protects against reentrancy attacks and cannot defend against other types of flash loan attacks; requires developers to correctly identify all functions that need protection; may increase gas consumption.

Decentralized Cross-Chain Verification Network
type: Avoidance
break id: A0101
stix type: course-of-action
definition: A mechanism that uses multiple independent decentralized node networks to verify cross-chain transactions, rather than relying on a single verifier or centralized signing mechanism.
description: The core security issue with cross-chain bridges lies in the centralization of the verification mechanism or an insufficient number of nodes. Defensive measures include: deploying independent decentralized verification networks for each cross-chain channel; requiring majority consensus (e.g., more than two-thirds of nodes) to finalize cross-chain transfers; mandating that verification nodes stake assets, which are subject to slashing in the event of malicious behavior; employing threshold signatures or multi-signature schemes to prevent single points of failure; and ensuring verification nodes are operated by different entities across geographically distributed locations and infrastructures. Chainlink CCIP adopts this architecture, reducing the attack surface by decentralizing trust.
category: AC01
keywords: Decentralized Cross-Chain Verification Network
citation: Flash Loan Risk Mitigation
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Decentralized verification networks increase system complexity and operational costs; verification speed may be slower than centralized solutions; incentive mechanisms are required to attract a sufficient number of independent verification nodes; node staking requirements may limit participation.

Cross-Chain Bridge Smart Contract Auditing and Monitoring
type: Avoidance
break id: A0102
stix type: course-of-action
definition: Conducting rigorous third-party audits of core cross-chain bridge contracts and implementing real-time monitoring mechanisms to detect anomalous transactions.
description: Vulnerabilities in cross-chain bridge smart contracts are a primary attack vector. Protective measures include: conducting security audits by multiple independent firms prior to deployment; performing formal verification of critical functions such as locking, minting, and burning; implementing on-chain monitoring systems to detect large transfers, abnormal minting, and unexpected contract calls; setting transaction limits and rate limiting, with additional verification or time delays required for single transfers exceeding thresholds; deploying emergency pause mechanisms to quickly freeze contracts upon detecting an attack; and conducting regular code reviews and bug bounty programs.
category: AC03
keywords: Cross-Chain Bridge Smart Contract Auditing and Monitoring
citation: Flash Loan Security Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Audits cannot guarantee the discovery of all vulnerabilities, and novel attack techniques may bypass known detection methods; emergency pause mechanisms may be abused or become attack targets themselves; monitoring systems may generate false positives, impacting normal operations.

Layer2 Bridge Security Audit
type: Avoidance
break id: A0102-001
stix type: course-of-action
definition: Professional audit of cross-chain bridge contracts, implementing multi-sig verification and delayed withdrawal mechanisms.
description: Professional audit of cross-chain bridge contracts, implementing multi-sig verification and delayed withdrawal mechanisms.
category: AC01
keywords: Layer2 Bridge Security Audit
citation: L2BEAT Layer2 Security Analysis
updated: 2026-06-16
version: 1
effectiveness: high

Chain-Agnostic Design and Redundant Architecture
type: Avoidance
break id: A0103
stix type: course-of-action
definition: A universal design approach independent of any specific blockchain, ensuring that the bridge protocol does not rely on the availability or security of a single chain.
description: Cross-chain bridges should not overly depend on the specific mechanisms of any single chain. Design principles include: protocol operation being completely independent of the operational status of a single chain; failure of the source chain should not affect asset security on the target chain; use of standardized cross-chain message formats to facilitate multi-chain integration; implementation of redundant verification mechanisms so that data from one chain can be verified by other chains; avoiding locking all assets in a single contract or on a single chain; designing an upgradeable architecture that allows rapid fixes without redeployment when issues are identified. This design enhances the system's risk resilience and long-term maintainability.
category: AC01
keywords: Chain-Agnostic Design and Redundant Architecture
citation: Oracle Security for DeFi
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Chain-agnostic design increases architectural complexity and incurs higher development and testing costs; it may sacrifice some performance in exchange for generality; given the significant differences in characteristics across chains, achieving full chain agnosticism may be impractical.

Hardware Security Module (HSM) Private Key Storage
type: Avoidance
break id: A0104
stix type: course-of-action
definition: A dedicated hardware device used to store and manage private keys, where keys never leave the hardware environment and all signing operations are performed within the hardware.
description: HSM represents the highest security level for protecting private keys against leakage. Private keys are generated inside the hardware and are never exported in plaintext; all signing and encryption operations are completed within the HSM, and applications can only invoke interfaces without directly accessing the private keys. HSMs feature physical protection mechanisms, where any attempt to physically tamper with the device triggers key self-destruction. They support access control and audit logging, recording all key usage. Compliant with security standards such as FIPS 140-2/140-3. Suitable for high-value scenarios such as exchange hot wallets, payment gateways, and CA certificate issuance. Cloud-based KMS offerings (e.g., AWS KMS, Azure Key Vault) represent managed forms of HSM.
category: AC01
keywords: Hardware Security Module (HSM) Private Key Storage
citation: DeFi Protocol Security Hardening
updated: 2026-06-16
version: 1
effectiveness: high
limitation: HSM devices are costly, with a single unit ranging from tens of thousands to hundreds of thousands of RMB. Cloud KMS charges per API call, leading to significant costs in high-frequency scenarios. Performance is constrained by hardware, and signing speeds are typically lower than software implementations. Requires additional operational maintenance and backup solutions.

Encrypted Storage and Password Protection of Private Keys
type: Avoidance
break id: A0105
stix type: course-of-action
definition: Private keys are encrypted using a strong password or key derivation function before storage, with the plaintext key only existing briefly in memory.
description: For scenarios where Hardware Security Modules (HSMs) are unavailable, encrypted storage serves as a fundamental safeguard. Implementation methods include: generating encryption keys from user passwords using key derivation functions such as PBKDF2 or Argon2; encrypting private keys with strong encryption algorithms like AES-256 before storage; decrypting the private key only for in-memory use and immediately zeroing it out after use; avoiding writing private keys to logs, temporary files, or swap partitions; protecting the encryption key itself by leveraging operating system keychains (macOS Keychain, Windows DPAPI); and restricting access to private key files with appropriate file permissions (Unix 600). This approach is widely adopted in blockchain wallets, such as BIP39 mnemonic phrase encryption.
category: AC01
keywords: Encrypted Storage and Password Protection of Private Keys
citation: Transaction Slippage Protection
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Security depends on the strength of the user password; weak passwords are susceptible to brute-force attacks. The plaintext private key in memory may still be extracted through memory dump attacks. This method cannot defend against malware or rootkits. If the user forgets the password, the private key will be permanently lost.

Source Code and Configuration File Secret Scanning
type: Avoidance
break id: A0106
stix type: course-of-action
definition: The use of automated tools to scan code repositories and configuration files to detect and prevent sensitive information such as private keys from being committed to version control systems.
description: Developers mistakenly committing private keys to version control systems like Git is a common leakage pathway. Protective measures include: using tools such as GitGuardian and TruffleHog to scan commits; integrating secret detection into Git pre-commit hooks to block commits when private keys are detected; scanning historical commits to identify leaked private keys and enforcing key rotation; using .gitignore to exclude private key files (e.g., .env, *.pem); enabling Secret Scanning features on platforms like GitHub; and conducting regular scans of public repositories. Upon discovering a leak, the certificate or permissions associated with the private key must be revoked immediately. Even if removed from Git history, the key must still be considered compromised.
category: AC03
keywords: Source Code and Configuration File Secret Scanning
citation: Reentrancy Attack Prevention
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Can only detect known private key formats and may miss custom formats; cannot prevent developers from leaking secrets through other channels; leaks that have already been pushed to remote repositories are difficult to completely revoke; scanning tools may produce false positives, impacting development efficiency.

IoT Device Firmware Security Update Mechanism
type: Avoidance
break id: A0107
stix type: course-of-action
definition: Establish an automated firmware update process to promptly patch device vulnerabilities and prevent attackers from exploiting known vulnerabilities to hijack devices.
description: Outdated firmware is a primary cause of smart device hijacking. Protective measures include: enabling automatic update features on devices, or regularly checking and installing firmware updates; using signature verification mechanisms to ensure firmware source authenticity and prevent malicious firmware from being implanted; deploying unified firmware management platforms (such as MDM) for enterprise IoT devices to manage updates at scale; monitoring vendor security advisories and promptly responding to high-risk vulnerabilities; and network-isolating or replacing legacy devices that can no longer be updated. Many botnet attacks (such as Mirai) exploit default credentials and unpatched vulnerabilities to achieve large-scale hijacking.
category: AC04
keywords: IoT Device Firmware Security Update Mechanism
citation: Access Control Hardening for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Some vendors do not provide long-term firmware support, leaving devices without updates after end-of-life; automatic updates may introduce compatibility issues or new vulnerabilities; devices may be temporarily unavailable during the update process; certain devices require manual updates, making large-scale management difficult.

Network Isolation and Access Control for IoT Devices
type: Avoidance
break id: A0108
stix type: course-of-action
definition: Deploying smart devices in a segregated network zone to restrict communication with critical systems and reduce the blast radius in the event of compromise.
description: Network isolation is an effective measure to prevent the lateral spread of a single device compromise. Implementation methods include: using dedicated IoT VLANs or subnets that are physically separated from office and production networks; enforcing strict Access Control Lists (ACLs) at the gateway to allow devices access only to necessary services; prohibiting lateral communication between IoT devices unless business-critical; deploying firewall rules to restrict outbound connections from devices to prevent them from becoming nodes in a botnet; and implementing IP whitelisting for device management interfaces, allowing access only from the administrator network. This defense-in-depth strategy ensures that even if a device is compromised, attackers face significant difficulty in moving laterally.
category: AC01
keywords: Network Isolation and Access Control for IoT Devices
citation: Parameter Validation for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Network isolation increases network architecture complexity and management overhead; it may affect device interoperability and collaborative functions; it requires specialized networking expertise to configure; and retrofitting already deployed devices can incur high costs.

Strong Authentication and Default Credential Changes for IoT Devices
type: Avoidance
break id: A0109
stix type: course-of-action
definition: Mandatory modification of factory default passwords, implementation of strong password policies or multi-factor authentication to prevent attackers from hijacking devices through weak credentials.
description: Weak credentials represent the most common entry point for large-scale hijacking of IoT devices. Protective measures include: forcing users to change default passwords during device initialization and prohibiting the use of factory passwords; enforcing password complexity requirements (length, character types); enabling multi-factor authentication or certificate-based authentication on supported devices; regularly rotating device credentials, especially for administrator accounts; disabling unnecessary management interfaces (Telnet, SSH, etc.) or restricting their listening addresses; scanning the network for devices using default credentials and enforcing changes. The Mirai botnet demonstrated rapid propagation precisely by scanning for devices using default usernames and passwords.
category: AC01
keywords: Strong Authentication and Default Credential Changes for IoT Devices
citation: Smart Contract Upgrade Safety
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Users may employ weak passwords or reuse passwords across multiple devices; some low-end devices do not support password modification or multi-factor authentication; forgotten passwords may lead to device lockout; mandatory password policies may negatively impact user experience.

Mandatory Initial Password Configuration
type: Avoidance
break id: A0109-001
stix type: course-of-action
definition: Devices are shipped without a default password, or users are forced to create a unique password upon first startup before the device can be used.
description: This approach fundamentally eliminates the risk associated with universal default passwords. Implementation methods include: shipping devices without any default password, requiring password creation during initial configuration; using a device-unique random initial password (e.g., derived from the MAC address) printed on a label; enforcing a mandatory password change upon first login and restricting device functionality until the change is completed; requiring passwords to meet complexity requirements (length, character types); providing real-time feedback on password strength; and maintaining a password change history to prevent reuse. The Cybersecurity Tech Accord advocates for the elimination of universal default passwords, and certification bodies such as TÜV SÜD have adopted this as an IoT security standard.
category: AC01
keywords: Mandatory Initial Password Configuration
citation: Risk Control for Cross-chain Bridges
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Users may set weak passwords or forget their passwords; increases the complexity of initial device configuration, impacting user experience; some users may skip security setup or use weak passwords; the password reset mechanism may become a new attack surface.

Firmware Secure Boot Mechanism
type: Avoidance
break id: A0110
stix type: course-of-action
definition: A security mechanism that ensures a device only runs trusted, untampered firmware through cryptographic signature verification.
description: Secure Boot verifies firmware integrity during device startup to prevent loading of tampered or malicious firmware. Implementation steps include: storing a hardware Root of Trust key; signing firmware images with the manufacturer's private key; verifying signatures with the public key at boot time and denying boot if verification fails; employing a layered verification approach where each stage validates the next (UEFI Secure Boot model); and using a hardware Trusted Platform Module (TPM) to store integrity measurements. This mechanism is widely deployed in critical devices such as servers, IoT devices, and routers to ensure an unbroken chain of trust from hardware to the operating system.
category: AC01
keywords: Firmware Secure Boot Mechanism
citation: Paused Mode and Circuit Breakers for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Requires hardware support (TPM or equivalent chip), increasing costs; key management is complex, as a private key compromise exposes the entire device series to risk; prevents users from installing custom firmware, limiting openness; implementation errors may render devices inoperable (bricking).

XR Device Trusted Boot
type: Avoidance
break id: A0110-001
stix type: course-of-action
definition: Implement firmware signature verification and secure boot in XR devices to prevent malicious firmware.
description: Implement firmware signature verification and secure boot in XR devices to prevent malicious firmware.
category: AC01
keywords: XR Device Trusted Boot
citation: Guidelines for Managing the Security of Mobile Devices in the ...
updated: 2026-06-16
version: 1
effectiveness: high

Firmware Update Signature Verification and Rollback Protection
type: Avoidance
break id: A0111
stix type: course-of-action
definition: Cryptographic signature verification of firmware update packages and prevention of downgrading to vulnerable older versions
description: Ensures firmware update sources are trusted and protected against downgrade attacks. Measures include: update packages signed with manufacturer's private key, with signature verification performed by the device before installation; monotonically increasing version number mechanism to reject firmware versions lower than the current installed version; recording the minimum installed security version number in tamper-proof storage; using encrypted channels (TLS) during the update process to prevent man-in-the-middle attacks; and automatic fallback to the last known working version upon failure rather than entering an unusable state. NHTSA guidance on vehicle firmware over-the-air updates emphasizes the importance of these measures.
category: AC01
keywords: Firmware Update Signature Verification and Rollback Protection
citation: Safe Multi-Signature Governance
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Monotonically increasing version numbers limit flexibility, making emergency rollback to previous versions difficult; improper implementation of rollback protection may render the device unrecoverable; a reliable time source is required to prevent time-based rollback attacks

Firmware OTA Update Signature Verification
type: Avoidance
break id: A0111-001
stix type: course-of-action
definition: Digital signature verification of firmware packages delivered via OTA to ensure trusted origin and integrity against tampering.
description: Prevents malicious firmware from being implanted through OTA. Measures: firmware packages signed with the vendor's private key; device-side verification using the embedded public key; secure hashing algorithms; certificate chain validation; anti-rollback version enforcement; automatic rollback upon update failure.
category: AC01
keywords: Firmware OTA Update Signature Verification
citation: Transaction Risk Control
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Complex key management; increased latency due to signature verification; certificate expiration requires handling.

Connected-Vehicle OTA Security Governance
type: Avoidance
break id: A0111-002
stix type: course-of-action
definition: Apply signature verification and security monitoring to vehicle OTA packages, upgrade channels, rollback policies, and phased releases.
description: Apply signature verification and security monitoring to vehicle OTA packages, upgrade channels, rollback policies, and phased releases.
category: AC01
keywords: Connected-Vehicle OTA Security Governance
keywords: OTA signature verification
keywords: vehicle update security
keywords: firmware rollback protection
keywords: canary rollout
keywords: automotive cybersecurity
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-17
version: 1
effectiveness: high

Firmware Integrity Monitoring and Physical Tamper Resistance
type: Avoidance
break id: A0112
stix type: course-of-action
definition: Continuously monitor firmware integrity and use physical protection mechanisms to detect and respond to hardware-level tampering attempts.
description: Detect firmware tampering at runtime and physically protect the chip. Techniques include: periodically computing firmware hashes and comparing them against a trusted baseline; using hardware tamper switches that trigger alerts or data wiping upon physical intrusion; incorporating tamper-evident traces in PCB designs that activate protection when broken; encapsulating critical chips with epoxy resin to increase the difficulty of physical reverse engineering; and deploying Remote Attestation mechanisms to allow a remote server to verify the firmware state of the device. Applicable to high-security scenarios such as ATMs, POS terminals, and industrial control systems.
category: AC02
keywords: Firmware Integrity Monitoring and Physical Tamper Resistance
citation: Token Permission Management
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Physical protection increases manufacturing costs; sophisticated attackers may still bypass physical safeguards; continuous monitoring consumes additional computing resources; false positives may render the device unavailable.

IoT Traffic Anomaly Detection and C&C Communication Blocking
type: Avoidance
break id: A0113
stix type: course-of-action
definition: Using machine learning models to detect abnormal network behavior in IoT devices, and identifying and blocking botnet C&C (Command and Control) communication.
description: Botnets rely on C&C servers to issue commands, and severing this communication can disrupt attacks. Detection methods: using machine learning to analyze device traffic characteristics and identify botnet features such as DGA domains, abnormal DNS queries, and non-standard port communication; deploying Deep Packet Inspection (DPI) at the gateway to identify known botnet protocols (e.g., Mirai variants); monitoring for sudden large-scale outbound connections and scanning behavior; establishing a baseline of normal traffic and triggering alerts upon deviation. Blocking measures: DNS filtering to block known C&C domains; firewall rules to restrict devices to whitelisted services only; automatically isolating infected devices upon detection.
category: AC03
keywords: IoT Traffic Anomaly Detection and C&C Communication Blocking
citation: On-chain Asset Risk Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Machine learning models require large amounts of training data and are prone to false positives; emerging botnets may use encrypted communication to evade detection; DGA domains are generated rapidly, making real-time blacklist updates difficult; limited effectiveness in detecting encrypted traffic.

IoT Traffic Monitoring and Anomaly Detection
type: Avoidance
break id: A0113-001
stix type: course-of-action
definition: Monitor IoT device network traffic to detect abnormal outbound connections.
description: Monitor IoT device network traffic to detect abnormal outbound connections.
category: AC03
keywords: IoT Traffic Monitoring and Anomaly Detection
keywords: IoT traffic analysis
keywords: device behavior baseline
keywords: network anomaly detection
keywords: C2 traffic detection
keywords: edge telemetry monitoring
citation: CISA ICS Security
updated: 2026-06-16
version: 1
effectiveness: high

IoT Device Security Configuration Enforcement
type: Avoidance
break id: A0114
stix type: course-of-action
definition: Enforcing minimum security standards for IoT devices through network access control and automated scanning before granting network access.
description: Preventing insecure devices from becoming nodes in botnets at the access layer. Implementation measures: Deploying NAC (Network Access Control) systems to check firmware versions, password strength, and open ports before devices join the network; using 802.1X authentication to isolate devices that fail security checks into a restricted VLAN; periodically scanning devices within the network to identify those using default credentials, outdated firmware, or unnecessary open ports and notifying administrators; automated remediation tools pushing security configurations (e.g., disabling Telnet, enforcing password changes); forcibly disconnecting devices that cannot be remediated. Security solutions such as BitLyft emphasize implementing security configurations from the deployment phase.
category: AC01
keywords: IoT Device Security Configuration Enforcement
citation: Risk Control for On-chain Lending
updated: 2026-06-16
version: 1
effectiveness: high
limitation: High deployment and maintenance costs for NAC; potential blocking of legitimate devices, impacting business operations; automated remediation may conflict with device functionality; difficulty retrofitting already-connected devices.

Default Credential Scanning and Auto-Remediation
type: Avoidance
break id: A0117
stix type: course-of-action
definition: The use of automated tools to periodically scan the network for devices using default credentials and push mandatory password change policies.
description: Conduct continuous security audits on deployed devices. Implementation methods: Deploy network scanning tools (e.g., Nmap, Nessus) to periodically probe devices and attempt login with common default credentials; establish a device asset inventory to record the credential status of each device; immediately alert and notify administrators upon discovering devices using default credentials; remotely push password modification commands through device management platforms (e.g., MDM); reduce network privileges or isolate devices that cannot be remotely remediated; establish a visualization dashboard to display the risk distribution of default credentials across the network. Research indicates that over 40% of xIoT devices present default credential risks.
category: AC03
keywords: Default Credential Scanning and Auto-Remediation
citation: Smart Contract Deployment Review
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Scanning may be mistaken for an attack; not all device types and credential combinations can be detected; remote remediation depends on device management interfaces; the scanning process itself may expose credential attempt logs; ineffective for devices that do not support remote management.

Certificate-Based Device Authentication
type: Avoidance
break id: A0118
stix type: course-of-action
definition: Using PKI certificates or hardware security keys instead of username and password combinations to fundamentally eliminate password-related risks.
description: Modern authentication methods prevent password guessing or credential leakage. Implementation approach: Issue a unique X.509 certificate to each device, authenticating with the certificate instead of a password at device startup; use hardware security keys (such as FIDO2 devices) for two-factor authentication; deploy a PKI infrastructure to manage the certificate lifecycle (issuance, revocation, renewal); store the certificate private key in the device's TPM or secure element to prevent extraction; support Certificate Revocation Lists (CRL) or Online Certificate Status Protocol (OCSP) for rapid revocation of compromised devices. Suitable for enterprise-grade IoT deployments, such as industrial sensors and smart building systems.
category: AC01
keywords: Certificate-Based Device Authentication
citation: Smart Contract Source Code Disclosure
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Requires a PKI infrastructure, resulting in high deployment and maintenance costs; legacy devices may not support certificate-based authentication; certificate management (renewal, revocation) is complex; delayed revocation after certificate compromise still poses a risk; difficult to promote for consumer-grade devices.

Time-Weighted Voting and Timelock Mechanism
type: Avoidance
break id: A0119
stix type: course-of-action
definition: A voting power calculation method weighted by token holding duration, combined with a mandatory delay on proposal execution, to prevent flash loan-based temporary acquisition of voting rights.
description: Flash loan attackers can borrow a large number of governance tokens, vote, and return them within a single transaction. A time-weighted mechanism can defend against such attacks. Implementation methods: Voting power is based not only on the number of tokens held but also on the holding duration (e.g., square root or linear weighting). Voting power is calculated at the time of the proposal snapshot, and tokens acquired after the snapshot cannot participate in that proposal's vote. An execution delay (timelock), typically 24–72 hours, is enforced after a proposal passes, giving the community time to detect malicious proposals and respond. An emergency veto mechanism (e.g., a multi-signature committee) is allowed during the delay period. The DAO governance framework proposed by a16z emphasizes the importance of the time dimension, significantly raising the cost of attacks.
category: AC01
keywords: Time-Weighted Voting and Timelock Mechanism
citation: Security Alerting for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Time weighting reduces the liquidity value of tokens and impacts market activity. The timelock mechanism lowers governance efficiency and slows emergency response. Calculating and storing historical holding data increases on-chain costs. The system may be manipulated by long-term holders.

Governance Scope Limitation and Multi-Signature Protection
type: Avoidance
break id: A0120
stix type: course-of-action
definition: Restrict the scope of operations that DAO governance can execute, and place high-risk operations under the protection of multi-signature or higher-threshold mechanisms.
description: Reduce attack value by limiting governance privileges. Design principles: Classify operations so that routine parameter adjustments can be voted on by the DAO, while high-risk operations such as fund transfers and contract upgrades require higher thresholds; implement dual governance, where major decisions require dual approval from both token holders and a multi-signature committee; set upper and lower bounds for governance-adjustable parameters to prevent system crashes caused by extreme parameter settings via governance votes; impose a single-transaction cap and a cooldown period on treasury fund transfers; use non-upgradeable designs for critical contracts or require extremely high voting thresholds for upgrades. QuillAudits research indicates that limiting governance privileges is key to protection.
category: AC01
keywords: Governance Scope Limitation and Multi-Signature Protection
citation: Security Operations for DeFi Protocols
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Reduces the flexibility and autonomy of the DAO; multi-signature introduces centralization risks, which may be exploited or subject to insider malfeasance; complex privilege segmentation leads to high implementation and communication costs; excessive restrictions may result in governance paralysis.

DAO Governance Proposal Monitoring and Emergency Response
type: Avoidance
break id: A0121
stix type: course-of-action
definition: Real-time monitoring of proposal content and voting behavior, triggering alerts and emergency response mechanisms upon detecting anomalous proposals.
description: Establish an active defense system to detect and respond to governance attacks. Monitoring scope: Automated analysis of proposal code to detect suspicious operations (e.g., large fund transfers, permission changes, contract self-destruction); monitoring voting patterns to identify anomalies (e.g., concentrated voting with large amounts of tokens in a short period, voting addresses suddenly acquiring substantial tokens); tracking proposer history and on-chain behavior; collaborating with security firms for manual review. Emergency mechanisms: Broadcasting warnings through community channels upon detecting malicious proposals; activating emergency pause (Guardian) mechanisms, allowing multi-signature or high-privilege accounts to freeze suspicious proposals; providing fast veto channels to lower the rejection threshold; continuous monitoring during the timelock period before proposal execution. Platforms like Guardrail offer dedicated DAO governance monitoring services.
category: AC02
keywords: DAO Governance Proposal Monitoring and Emergency Response
citation: Smart Contract Permission Separation
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Automated analysis may generate false positives or false negatives; requires 24/7 manual on-call support and community participation; emergency mechanisms may be abused; high costs for monitoring and response infrastructure; limited detection capability against novel attack vectors.

Liquidity Locking and Token Vesting Schedule
type: Avoidance
break id: A0123
stix type: course-of-action
definition: Locking liquidity pool tokens in time-lock contracts and implementing vesting periods for team tokens to prevent developers from abruptly withdrawing funds.
description: Restricting malicious developer capabilities through locking mechanisms. Specific measures include: locking Liquidity Provider Tokens (LP Tokens) in third-party escrow contracts (e.g., Unicrypt, Team Finance) with a set unlock time (typically 6+ months); implementing linear vesting for team and advisor tokens, releasing them in batches rather than all at once; making lock information publicly verifiable on-chain for investor verification; using multi-signature wallets to manage team tokens to prevent single-actor malicious behavior; voluntarily renouncing contract ownership or transferring ownership to a time-lock contract. Tools such as SolidityScan can detect whether a project has implemented these protections.
category: AC01
keywords: Liquidity Locking and Token Vesting Schedule
citation: Third-party Security Audit for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Rug pulls may still occur after the lock-up period expires, merely delaying the inevitable; developers may hold hidden tokens through other addresses; the locking contract itself may contain vulnerabilities; excessively long lock-up periods may hinder normal project operations.

Real-Time Rug Pull Detection and Insurance Mechanisms
type: Avoidance
break id: A0124
stix type: course-of-action
definition: Using on-chain monitoring systems to detect Rug Pull characteristics in real time and mitigate investor losses through insurance or recovery protocols.
description: Establishing early warning and loss compensation mechanisms. Detection methods: monitoring large-scale liquidity withdrawals, contract permission changes, abnormal token transfers, and other Rug Pull signals; analyzing token holding distribution to detect highly concentrated holdings (a small number of addresses holding the majority of tokens); tracking developer address behavior, such as suddenly transferring large amounts of tokens to exchanges; utilizing real-time detection engines from protocols like Rugsafe. Insurance mechanisms: investors purchase DeFi insurance (e.g., Nexus Mutual) and can receive compensation after a Rug Pull occurs; protocols like Rugsafe attempt to recover funds or compensate victims through multi-chain recovery mechanisms upon detecting a Rug Pull. This serves as the last line of passive defense.
category: AC03
keywords: Real-Time Rug Pull Detection and Insurance Mechanisms
citation: Smart Contract Attack Simulation
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Detection systems have latency and may fail to issue alerts before a Rug Pull is completed; false positives may trigger panic selling; insurance coverage is limited and costly; recovery mechanisms rely on community governance and are difficult to execute; not all types of Rug Pulls can be prevented.

Commit-Reveal Mechanism
type: Avoidance
break id: A0129
stix type: course-of-action
definition: A two-phase transaction scheme that splits the transaction into a commit phase (submitting a hash) and a reveal phase (disclosing the original content), concealing transaction details until front-running is no longer possible.
description: The two-phase commit prevents premature exposure of transaction contents. Implementation flow: In the first phase, the user submits a hash of the transaction parameters along with a random salt; after waiting for a certain number of block confirmations, the second phase begins; in the second phase, the user submits the original parameters, and the smart contract verifies that the hash matches before execution. A commit window is enforced, and if it expires, the transaction fails. Threshold encryption techniques can be employed so that decryption is only possible upon reaching a specific block height. This mechanism is suitable for fairness-sensitive scenarios such as auctions, voting, and order books. Game-theoretic analysis demonstrates that it can eliminate information asymmetry advantages.
category: AC01
keywords: Commit-Reveal Mechanism
citation: Contract Risk Disclosure
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Requires two transactions, doubling both gas costs and time costs; poor user experience due to extended waiting periods; unsuitable for scenarios requiring instant execution; attackers may still infer user intent through on-chain pattern analysis.

Transaction Slippage Protection and Limit Orders
type: Avoidance
break id: A0130
stix type: course-of-action
definition: Set a maximum slippage tolerance for transactions; if exceeded, the transaction automatically fails, preventing severe losses from sandwich attacks.
description: Slippage protection limits the profit potential of MEV attacks. Implementation methods: set the minAmountOut parameter during DEX transactions so that the transaction fails if the actual execution price falls below this value; calculate a reasonable slippage based on liquidity and transaction size (typically 0.5%–5%); use limit orders instead of market orders, waiting for the price to reach the desired level before execution; monitor the mempool and cancel transactions when signs of a sandwich attack are detected; split large transactions into multiple smaller ones to reduce the impact of each individual trade. While this cannot completely prevent MEV, it can keep losses within an acceptable range. CoW Protocol further mitigates MEV impact through a batch auction mechanism.
category: AC01
keywords: Transaction Slippage Protection and Limit Orders
citation: Key Management for Contract Administration
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Strict slippage limits may cause frequent transaction failures; cannot prevent all types of MEV attacks; difficult to set a reasonable slippage when liquidity is insufficient; limit orders may remain unfilled for extended periods.

Increasing Consensus Algorithm Attack Costs
type: Avoidance
break id: A0131
stix type: course-of-action
definition: Raising the economic and technical barriers to 51% attacks by increasing computational power/staking requirements and improving consensus mechanisms.
description: The feasibility of a 51% attack depends on the cost-to-benefit ratio. Defensive measures include: PoW chains increasing total hash power to make it difficult for attackers to acquire 51% of the computational power; PoS chains requiring high staking thresholds, forcing attackers to control a large number of tokens while facing slashing risks; adopting hybrid consensus (PoW+PoS) or Delegated Proof of Stake (DPoS) to decentralize control; implementing checkpoint mechanisms to periodically finalize blocks and prevent deep rollbacks; deploying slashing mechanisms that confiscate staked assets upon detecting malicious behavior. Bitcoin is largely immune to 51% attacks due to its immense hash power, but smaller PoW coins remain vulnerable.
category: AC01
keywords: Increasing Consensus Algorithm Attack Costs
citation: Security Education for Smart Contract Users
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Raising the barrier also increases network participation costs; it cannot completely eliminate the possibility of attacks; large mining pools or exchanges may accumulate sufficient control; centralization risks in PoS staking.

Consecutive Block Limit and Reorganization Detection
type: Avoidance
break id: A0131-001
stix type: course-of-action
definition: Restrict the number of consecutive blocks produced by a single miner and monitor chain reorganization behavior to promptly detect signs of a 51% attack.
description: Detect and limit an attacker's ability to control the chain. Technical implementation: restrict the number of consecutive blocks produced by the same miner/validator (e.g., no more than 3 consecutive blocks); monitor the depth and frequency of chain reorganizations, triggering alerts when thresholds are exceeded; track the number of confirmations for large transactions to detect double-spend attempts; exchanges and payment processors increase confirmation requirements (e.g., from 6 to 50+); deploy real-time monitoring systems to detect sudden concentration of hash power. Research by MIT DCI indicates that consecutive block limits can significantly increase the difficulty of attacks.
category: AC03
keywords: Consecutive Block Limit and Reorganization Detection
keywords: chain reorganization detection
keywords: consecutive block limit
keywords: reorg monitoring
keywords: consensus anomaly
keywords: block confirmation risk
citation: Smart Contract Code Review Checklist
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Limiting consecutive blocks may affect network efficiency; increasing confirmation requirements degrades user experience; monitoring systems may generate false positives; cannot prevent attacks, only delay detection.

Hashrate Rental Market Monitoring and Incident Response
type: Avoidance
break id: A0131-002
stix type: course-of-action
definition: Monitoring anomalous activities on hashrate rental platforms and activating incident response plans when suspected 51% attack preparations are detected
description: Attackers often rent hashrate through platforms such as NiceHash to launch attacks. Defense strategies include: monitoring hashrate rental markets to detect large-scale hashrate rentals targeting the local blockchain; tracking the hashrate sources and patterns of historical 51% attacks; cooperating with rental platforms to suspend services upon detecting suspicious rental behavior; establishing community alert mechanisms for rapid response by miners and node operators; and preparing contingency plans, including temporarily increasing confirmation requirements, suspending large withdrawals, and contacting exchanges to halt deposits and withdrawals. Platforms such as Bitpanda emphasize the importance of incident response.
category: AC02
keywords: Hashrate Rental Market Monitoring and Incident Response
citation: Secure Smart Contract Development Guidelines
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Reliance on external data and third-party cooperation; attackers may use their own hashrate to bypass monitoring; emergency measures may impact legitimate users; not all attack vectors can be prevented

Address Obfuscation and Privacy Protocol Usage
type: Avoidance
break id: A0134
stix type: course-of-action
definition: Avoiding address reuse and utilizing mixing services or privacy protocols (e.g., Tornado Cash, Zcash) to conceal transaction relationships.
description: On-chain transactions are publicly transparent, and address reuse leads to privacy leakage. Protection methods include: using a new address for each transaction (automatically derived by HD wallets); using privacy coins (Monero, Zcash) for sensitive transactions; breaking address linkage through mixing services (with compliance risks noted); adopting stealth address technology so that recipient addresses cannot be associated; and avoiding linking on-chain addresses to real-world identities (KYC platforms, social media). L2BEAT privacy best practices emphasize that address reuse is the greatest privacy risk.
category: AC01
keywords: Address Obfuscation and Privacy Protocol Usage
citation: Runtime Monitoring for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Privacy protocols may be exploited for money laundering and face regulatory pressure; mixing services may exit-scam or be shut down by law enforcement; full anonymity impacts compliance and business applications; advances in chain analysis techniques may eventually compromise privacy protections.

On-Chain Privacy Protection
type: Avoidance
break id: A0134-001
stix type: course-of-action
definition: Use mixing protocols, privacy coins or zero-knowledge proofs to protect transaction privacy.
description: Use mixing protocols, privacy coins or zero-knowledge proofs to protect transaction privacy.
category: AC01
keywords: On-Chain Privacy Protection
citation: Zcash: Privacy-protecting digital currency
updated: 2026-06-16
version: 1
effectiveness: high

Zero-Knowledge Proofs and On-Chain Privacy Contracts
type: Avoidance
break id: A0135
stix type: course-of-action
definition: Utilizing zero-knowledge proof technology to verify transaction validity without revealing transaction details, thereby achieving on-chain privacy protection.
description: ZK technology proves the truth of a statement without disclosing the underlying information. Application approaches: zk-SNARKs prove sufficient account balance without exposing the specific amount; zk-STARKs enable private smart contracts where execution results are verifiable but the process remains confidential; use privacy-focused smart contract platforms such as Aztec and Secret Network; implement a balanced approach to regulatory compliance by providing audit keys to oversight authorities. Research by Chainlink indicates that ZK is a key technology for achieving both on-chain privacy and compliance.
category: AC01
keywords: Zero-Knowledge Proofs and On-Chain Privacy Contracts
citation: Smart Contract Vulnerability Scanning
updated: 2026-06-16
version: 1
effectiveness: high
limitation: ZK proof generation is computationally intensive, resulting in high Gas costs; high technical complexity makes development and auditing difficult; potential conflicts with existing regulatory frameworks; the privacy contract ecosystem is still immature.

Off-Chain Transactions and State Channels
type: Avoidance
break id: A0136
stix type: course-of-action
definition: Moving the majority of transactions off-chain or to Layer 2, submitting aggregated data to the main chain only when necessary, thereby reducing on-chain privacy exposure.
description: Off-chain transactions are not publicly recorded, protecting privacy. Implementation methods: using state channels such as Lightning Network and Raiden for high-frequency, small-value transactions; adopting Rollup technologies (zkRollup, Optimistic Rollup) where transaction details are not posted on-chain, only proofs are submitted; conducting privacy-sensitive operations through sidechains or L2 solutions (Arbitrum, Optimism); using off-chain order books with only final settlement recorded on-chain. Stanford research indicates that off-chain solutions can meet compliance requirements while preserving privacy.
category: AC01
keywords: Off-Chain Transactions and State Channels
citation: DeFi Risk Warnings and Reminders
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Off-chain transactions require both parties to be online or rely on third-party coordination; exit mechanisms may leak information; L2 solutions may still record transaction data; increases system complexity and user comprehension costs.

Chain ID and Nonce Mechanism
type: Avoidance
break id: A0137
stix type: course-of-action
definition: A security mechanism that incorporates chain ID and unique nonce into signed messages to prevent transactions from being replayed across different chains or executed multiple times.
description: EIP-155 introduced chain ID to prevent cross-chain replay attacks. Key implementation points: transaction signatures include the chain ID of both source and target chains; each account maintains an incrementing nonce, and transactions with duplicate nonces are rejected; chain ID is modified during hard forks to enforce replay protection; cross-chain messages include the genesis hash or other chain-specific identifiers; EIP-712 structured signatures are used, incorporating a domain separator. The Zealynx security glossary emphasizes this as a fundamental anti-replay mechanism.
category: AC01
keywords: Chain ID and Nonce Mechanism
citation: Smart Contract Access Logging
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Legacy contracts may not support chain ID; improper nonce management can lead to stuck transactions; cross-chain bridges still require additional protection; cannot prevent authorization replay exploits.

Timestamp and Expiration Mechanism
type: Avoidance
break id: A0138
stix type: course-of-action
definition: A mechanism that attaches a creation timestamp and expiration time to signed messages, limiting their validity period to prevent old messages from being replayed.
description: Time constraints reduce the replay attack window. Implementation approach: include creation timestamp and expiration deadline in the signature; the contract verifies that the current time falls within the validity period; use block numbers instead of timestamps to avoid time manipulation; reject expired signatures immediately; record used signature hashes for dual verification. Cube Exchange notes that timestamps serve as an effective complement to nonces.
category: AC01
keywords: Timestamp and Expiration Mechanism
citation: Smart Contract Parameter Governance
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Clock desynchronization may cause verification failures; attackers can still replay messages within the validity window; expiration time must be reasonably configured to balance security and availability; block timestamps may be slightly manipulated by miners.

Signature Consumption and State Tracking
type: Avoidance
break id: A0139
stix type: course-of-action
definition: Records used signatures or message hashes, rejects reuse, and marks them as consumed immediately after verification.
description: Prevents the same signature from being used multiple times. Implementation details: Maintain a hash mapping of used signatures (used mapping); mark the signature as used immediately after successful verification; use Bloom filters to optimize storage; periodically clean up expired signature records; ensure the marking operation is non-reversible (even if subsequent logic fails). The Cyfrin Solodit checklist emphasizes that the nonce should not be rolled back after consumption.
category: AC01
keywords: Signature Consumption and State Tracking
citation: Smart Contract Code Freeze Before Deployment
updated: 2026-06-16
version: 1
effectiveness: high
limitation: High on-chain storage costs, with large volumes of signature records consuming significant gas; requires storage cleanup to prevent unbounded growth; state synchronization delays may occur in distributed systems; improper implementation may lead to DoS.

Proxy Contract Upgrade Pattern
type: Avoidance
break id: A0140
stix type: course-of-action
definition: A pattern that uses a proxy contract to enable upgradeable contract logic while keeping data storage unchanged, allowing bug fixes without state loss.
description: Contracts are immutable once deployed, but the proxy pattern enables upgradeability. Common patterns include: Transparent Proxy, where user calls are forwarded to an implementation contract; UUPS (Universal Upgradeable Proxy Standard), where upgrade logic resides in the implementation contract; Beacon Proxy, where multiple proxies share a single implementation; and the Diamond Pattern, which enables modular upgrades. Key considerations: the proxy contract holds the data while the implementation contract contains only logic; upgrades require strict access controls (multi-signature or timelocks); and storage slot collisions must be carefully avoided. The Ethereum.org documentation provides detailed best practices for upgrades.
category: AC04
keywords: Proxy Contract Upgrade Pattern
citation: Protected Deployment for Smart Contracts
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Increases system complexity and gas costs; storage layout management is difficult and error-prone; centralized upgrade authority may be abused; the proxy contract itself is non-upgradeable, creating a single point of failure.

Contract Upgrade and Emergency Pause
type: Avoidance
break id: A0140-001
stix type: course-of-action
definition: Implementing upgradeable contract designs and emergency pause mechanisms to address vulnerabilities
description: Reserve controlled upgrade capability for smart contracts and configure emergency pause, tiered permissions, multisig approval, and timelock mechanisms so teams can contain losses and deploy fixes when severe vulnerabilities, cross-chain bridge anomalies, or abnormal asset flows are detected.
category: AC04
keywords: Contract Upgrade and Emergency Pause
citation: Smart Contract Attack Surface Reduction
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Upgrade and pause mechanisms introduce governance centralization, privilege abuse, and key-custody risks. If permission boundaries, approval workflows, or timelocks are poorly designed, the protection mechanism itself can become an attack entry point.

Modular and Minimal Contract Design
type: Avoidance
break id: A0141
stix type: course-of-action
definition: Decomposing complex systems into independent modules, keeping each contract simple to reduce vulnerability risks and audit difficulty.
description: Simple contracts are easier to audit and verify. Design principles: single responsibility—each contract performs only one function; modular design—composing functionality through interfaces; using audited libraries (OpenZeppelin) rather than custom implementations; avoiding over-optimization that compromises code readability; keeping functions short with clear logic; and maintaining thorough code comments and documentation. Best practices from Kaia and Dotsquares emphasize that simplicity is the foundation of security.
category: AC01
keywords: Modular and Minimal Contract Design
citation: Smart Contract Rollback Strategy
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Modularization increases interaction complexity between contracts; multiple contract calls incur higher gas costs; interface changes may lead to compatibility issues; excessive decomposition can hinder maintainability.

Comprehensive Auditing and Formal Verification
type: Avoidance
break id: A0142
stix type: course-of-action
definition: Conducting multiple rounds of code auditing and formal verification before deployment to ensure that immutable contracts are as defect-free as possible.
description: Defects in immutable contracts cannot be fixed, so thorough review before deployment is essential. Measures include: audits by at least two independent auditing firms; automated scanning with tools such as Slither and Mythril; formal verification of critical properties (fund conservation, permission correctness); internal code review and peer review; public disclosure of code for community review; running a comprehensive test suite covering edge cases; long-term testing on testnets; and establishing a bug bounty program. ADforensics emphasizes the critical role of auditing for immutable contracts.
category: AC01
keywords: Comprehensive Auditing and Formal Verification
citation: Smart Contract Security Baseline
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Audits are costly and time-consuming; there is no guarantee that all defects will be discovered; formal verification has a high technical barrier; passing an audit does not equate to absolute security; attack techniques continue to evolve.

Hardware Side-Channel Protection Design
type: Avoidance
break id: A0143
stix type: course-of-action
definition: Implementing protective measures at the hardware level to reduce the risk of leaking sensitive information through side channels such as power consumption and electromagnetic emissions.
description: Side-channel attacks infer sensitive data such as cryptographic keys by analyzing physical characteristics of a device, including power consumption, timing, and electromagnetic radiation. Countermeasures include: using constant-time algorithms to avoid data-dependent operation timing; adding random delays and noise to interfere with measurements; implementing power masking techniques; employing hardware security modules to protect key operations; applying physical shielding to reduce electromagnetic leakage; and conducting regular audits of cryptographic implementations.
category: AC01
keywords: Hardware Side-Channel Protection Design
citation: 2023 Automotive Technology and Equipment Development Forum: processor vulnerability discovery and analysis...
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Hardware-based protections increase costs; introduce performance overhead; achieving complete protection is difficult; and specialized expertise is required.

Software-Level Side-Channel Mitigation
type: Avoidance
break id: A0144
stix type: course-of-action
definition: Reducing side-channel information leakage through software implementation techniques
description: Software-level protection: constant-time cryptographic libraries; avoiding key-dependent branching; memory access pattern obfuscation; using bit masks instead of conditionals; periodic key rotation; minimizing privileged code scope.
category: AC01
keywords: Software-Level Side-Channel Mitigation
citation: Oracle Source Validation
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Software-based methods have limited effectiveness; may impact performance; difficult to completely eliminate leakage.

Side-Channel Attack Detection and Monitoring
type: Avoidance
break id: A0145
stix type: course-of-action
definition: Deploy monitoring systems to detect side-channel attack attempts against devices
description: Detection measures: abnormal power consumption monitoring; physical access logging; anomalous probe signal detection; tamper-evident enclosure sensors; intrusion alarm systems.
category: AC03
keywords: Side-Channel Attack Detection and Monitoring
citation: Cross-chain Bridge Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Passive defense; attackers may bypass monitoring

Industrial Network Isolation and Segmentation
type: Avoidance
break id: A0146
stix type: course-of-action
definition: Physically or logically isolating the industrial control network from the IT network and segmenting security zones to limit the spread of attacks.
description: Purdue model network layering: Isolation between Levels 0–2 (production floor) and Levels 3–5 (enterprise network); deployment of firewalls and data diodes for unidirectional data flow; dedicated VLANs for OT devices; DMZ zone buffering; strict access control.
category: AC01
keywords: Industrial Network Isolation and Segmentation
citation: On-chain Asset Alerting
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Complete isolation impacts remote operations and maintenance; high retrofit costs; requires specialized planning.

Industrial Protocol Security Hardening
type: Avoidance
break id: A0147
stix type: course-of-action
definition: Implementing authentication and encryption for industrial protocols such as Modbus and OPC to prevent unauthorized access and tampering.
description: Industrial protocols often lack built-in security design. Hardening measures include: using encrypted versions (OPC UA, Modbus/TCP with TLS); deploying protocol gateways to filter anomalies; restricting commands via whitelisting; detecting abnormal behavior; and conducting regular audits.
category: AC01
keywords: Industrial Protocol Security Hardening
citation: DeFi Threat Intelligence Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Legacy device incompatibility; performance impact; compatibility issues.

Industrial Protocol Deep Packet Inspection
type: Avoidance
break id: A0147-001
stix type: course-of-action
definition: Deep packet inspection of industrial protocols to identify and block attack traffic.
description: Deep packet inspection of industrial protocols to identify and block attack traffic.
category: AC03
keywords: Industrial Protocol Deep Packet Inspection
citation: Industrial Control Systems Security: Recommendations for Europe ...
updated: 2026-06-16
version: 1
effectiveness: high

ICS Security Monitoring and Incident Response
type: Avoidance
break id: A0148
stix type: course-of-action
definition: Real-time monitoring of industrial control system operational status, with an established incident response mechanism for rapid security event handling.
description: Monitoring architecture: IDS/IPS dedicated to ICS traffic; SIEM for security event correlation; baseline behavior modeling; anomaly alerting; emergency response plan drills; backup systems.
category: AC02
keywords: ICS Security Monitoring and Incident Response
citation: Smart Contract Exception Handling
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Shortage of specialized personnel; high false positive rate; incident response may disrupt production operations.

OTA Channel Encryption and Integrity Protection
type: Avoidance
break id: A0150
stix type: course-of-action
definition: Using encryption protocols such as TLS to protect the transmission process of OTA updates and prevent man-in-the-middle attacks.
description: Transport layer protection: Enforce HTTPS/TLS communication; Certificate pinning to prevent MITM; Integrity checksum verification; Chunked transmission verification; Resumable download protection; Server identity authentication.
category: AC01
keywords: OTA Channel Encryption and Integrity Protection
citation: Contract Upgrade Authorization Control
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Requires reliable network; Certificate management; Poor support for legacy devices.

Phased OTA Deployment and Canary Release
type: Avoidance
break id: A0151
stix type: course-of-action
definition: A strategy of deploying updates through small-scale pilots and gradual rollout to minimize the impact of batch update failures or malicious updates.
description: Cautious deployment strategy: small-scale canary testing; monitoring the status of updated devices; emergency suspension in case of anomalies; A/B testing; automatic rollback mechanism; user-selectable update timing.
category: AC04
keywords: Phased OTA Deployment and Canary Release
citation: Smart Contract Source Code Verification
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Extended deployment cycle; high management complexity; slow response to emergency updates.

On-Chain Asset Ownership Verification and Traceability in the Metaverse
type: Avoidance
break id: A0152
stix type: course-of-action
definition: Leveraging blockchain-based NFT technology to verify ownership of virtual assets and establish a traceable transaction history.
description: Blockchain-based ownership verification: NFTs record ownership; metadata stored on IPFS; publicly auditable transaction history; smart contract-managed transfers; double-spending prevention; cross-platform interoperability standards.
category: AC01
keywords: On-Chain Asset Ownership Verification and Traceability in the Metaverse
citation: Smart Contract Security Regression Testing
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Dependence on blockchain availability; complexity of cross-chain asset management; persistent control by centralized platforms.

Virtual Land Trading Platform Review Mechanism
type: Avoidance
break id: A0153
stix type: course-of-action
definition: Establishing a platform review and user reporting mechanism to identify and delist fraudulent virtual assets.
description: Platform governance: project review and admission; abnormal transaction monitoring; user rating system; fraud reporting channel; blacklist mechanism; dispute arbitration; fund custody.
category: AC03
keywords: Virtual Land Trading Platform Review Mechanism
citation: DeFi Risk Assessment
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Centralized review may be unfair; cannot cover all fraud; cross-platform regulation is difficult.

Virtual Asset Valuation and Information Disclosure
type: Avoidance
break id: A0154
stix type: course-of-action
definition: Establishing a transparent asset valuation system and mandatory information disclosure mechanism to help users make rational judgments
description: Information transparency: public disclosure of historical transaction data; project team background disclosure; development roadmap; financial status; risk warnings; third-party ratings; prohibition of false advertising.
category: AC03
keywords: Virtual Asset Valuation and Information Disclosure
citation: Contract State Change Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Valuation standards are difficult to unify; information may be falsified; users may still behave irrationally

Decentralized On-Chain Identity Verification
type: Avoidance
break id: A0155
stix type: course-of-action
definition: The use of decentralized identity technologies such as DID to achieve identity verification without relying on centralized authorities.
description: DID scheme: W3C DID standard; on-chain identity anchoring; verifiable credentials; selective disclosure; self-sovereign identity; cross-platform interoperability.
category: AC01
keywords: Decentralized On-Chain Identity Verification
citation: Risk Monitoring for Yield Farming
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Immature ecosystem; poor user experience; low regulatory acceptance.

Decentralized Identity Credential Verification
type: Avoidance
break id: A0155-001
stix type: course-of-action
definition: Verify DID and VC issuers, revocation status, and presentation policies to reduce credential forgery risk.
description: Verify DID and VC issuers, revocation status, and presentation policies to reduce credential forgery risk.
category: AC01
keywords: Decentralized Identity Credential Verification
keywords: DID verification
keywords: verifiable credential validation
keywords: issuer trust
keywords: VC revocation check
keywords: presentation policy
citation: W3C Decentralized Identifiers (DIDs) v1.0
updated: 2026-06-17
version: 1
effectiveness: high

On-Chain Reputation and Credit Systems
type: Avoidance
break id: A0156
stix type: course-of-action
definition: A trust scoring mechanism built on on-chain behavioral data, serving as an alternative to traditional KYC identity verification.
description: Reputation systems: on-chain transaction history; smart contract interactions; DeFi credit scores; social graphs; Sybil resistance; soulbound tokens.
category: AC01
keywords: On-Chain Reputation and Credit Systems
citation: Smart Contract Alert Thresholds
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Insufficient historical data; risk of manipulation; privacy leakage; lack of standardized frameworks.

Zero-Knowledge KYC and Privacy Protection
type: Avoidance
break id: A0157
stix type: course-of-action
definition: Using zero-knowledge proofs to complete identity verification, proving compliance without exposing specific information.
description: Privacy-preserving KYC: zk-SNARKs for proving age/nationality; selective attribute disclosure; off-chain verification with on-chain proof; regulatory auditability; user-controlled data.
category: AC01
keywords: Zero-Knowledge KYC and Privacy Protection
citation: Smart Contract Behavior Analytics
updated: 2026-06-16
version: 1
effectiveness: high
limitation: High technical complexity; unknown regulatory acceptance; high computational cost.

Code Audit and Bug Bounty
type: Avoidance
break id: A0160
stix type: course-of-action
definition: Conduct multi-party audits and establish bug bounty programs to incentivize vulnerability discovery
description: Introduce internal code review, third-party security audits, public bug bounty programs, and continuous retesting before and after launch to encourage researchers to report issues in contract logic, permissions, asset flows, cross-chain interactions, and dependent components.
category: AC02
keywords: Code Audit and Bug Bounty
citation: Smart Contract Secure Release Process
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Audits and bug bounties cannot guarantee that all defects are found. Effectiveness depends on scope, depth, bounty incentives, and remediation follow-through, and business-logic changes require renewed assessment.

On-Chain Data Access Control
type: Avoidance
break id: A0161
stix type: course-of-action
definition: Implementing encryption and access control mechanisms for sensitive data to restrict unauthorized read access.
description: Data Protection: Store sensitive data off-chain; retain only hashes on-chain; encrypt data before uploading to the chain; utilize access control lists; apply proxy re-encryption; enforce threshold decryption.
category: AC01
keywords: On-Chain Data Access Control
keywords: on-chain access control
keywords: smart contract permission
keywords: data visibility control
keywords: privacy-preserving access
keywords: wallet authorization
citation: On-chain Anomaly Detection
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Reduced transparency; complex key management; performance overhead.

Data Minimization and Purpose Limitation
type: Avoidance
break id: A0163
stix type: course-of-action
definition: Collect only necessary data and restrict its usage scope to reduce the risk of data breaches
description: Data governance: minimization principle; purpose limitation; retention period; regular purging; anonymization; de-identification; privacy impact assessment.
category: AC01
keywords: Data Minimization and Purpose Limitation
citation: Smart Contract Security Metrics
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Conflict with business requirements; changes in regulatory requirements; purging may affect functionality

Multi-Chain Asset Mapping and Tracking
type: Avoidance
break id: A0164
stix type: course-of-action
definition: Establish cross-chain asset mapping relationships to track the flow of assets across different blockchains.
description: Tracking system: on-chain mapping table; cross-chain indexing; asset fingerprinting; flow path analysis; aggregate monitoring; anomaly alerting; forensic support.
category: AC03
keywords: Multi-Chain Asset Mapping and Tracking
citation: DeFi Security Operations Dashboard
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Difficulties in cross-chain data integration; challenges in tracking privacy coins; delays in new chain integration.

Blockchain Analysis Tool Application
type: Avoidance
break id: A0165
stix type: course-of-action
definition: Using professional tools such as Chainalysis to analyze suspicious transactions and addresses
description: Analysis tools: address labeling database; transaction graph; fund flow tracking; correlation analysis; risk scoring; compliance check; AML screening.
category: AC03
keywords: Blockchain Analysis Tool Application
citation: Smart Contract Continuous Monitoring
updated: 2026-06-16
version: 1
effectiveness: high
limitation: High tool costs; adversarial privacy techniques; false positive issues; requires professional personnel

On-Chain Compliance and Regulatory Collaboration
type: Avoidance
break id: A0166
stix type: course-of-action
definition: Collaborating with regulatory authorities to establish on-chain monitoring mechanisms and compliance reporting
description: Compliance framework: Travel Rule implementation; suspicious transaction reporting; blacklist sharing; regulatory nodes; on-chain regulatory technology; cross-border collaboration; forensic interfaces.
category: AC04
keywords: On-Chain Compliance and Regulatory Collaboration
citation: On-chain Privacy and Financial Compliance - TRM Labs
updated: 2026-06-16
version: 1
effectiveness: medium
limitation: Inconsistent regulatory standards; conflict between decentralization and regulation; enforcement challenges

Blockchain Supply Chain Security Audit
type: Avoidance
break id: A0167
stix type: course-of-action
definition: Security audit of blockchain development tools, SDKs, wallet plugins to detect malicious code and backdoors.
description: Security audit of blockchain development tools, SDKs, wallet plugins to detect malicious code and backdoors.
category: AC01
keywords: Blockchain Supply Chain Security Audit
citation: Defending Against Software Supply Chain Attacks - CISA
updated: 2026-06-16
version: 1
effectiveness: high

EIP Security Verification Mechanism
type: Avoidance
break id: A0168
stix type: course-of-action
definition: Security verification of transaction requests from new proposals, alerting users to potential risks.
description: Security verification of transaction requests from new proposals, alerting users to potential risks.
category: AC01
keywords: EIP Security Verification Mechanism
citation: Ethereum Improvement Proposals
updated: 2026-06-16
version: 1
effectiveness: high

Telegram Official Verification
type: Avoidance
break id: A0169
stix type: course-of-action
definition: Use Telegram official verification badges to identify authentic bots and communities, avoiding phishing.
description: Use Telegram official verification badges to identify authentic bots and communities, avoiding phishing.
category: AC02
keywords: Telegram Official Verification
citation: Page Verification Guidelines
updated: 2026-06-16
version: 1
effectiveness: medium

Multi-Sig Timelock Mechanism
type: Avoidance
break id: A0170
stix type: course-of-action
definition: Set mandatory waiting period for multi-signature wallet transactions to prevent social engineering emergency attacks.
description: Set mandatory waiting period for multi-signature wallet transactions to prevent social engineering emergency attacks.
category: AC01
keywords: Multi-Sig Timelock Mechanism
citation: GitHub - gnosis/MultiSigWallet: Allows multiple parties to agree on ...
updated: 2026-06-16
version: 1
effectiveness: high

Token Economic Model Audit
type: Avoidance
break id: A0171
stix type: course-of-action
definition: Audit smart contract minting/burning permissions and supply control logic.
description: Audit smart contract minting/burning permissions and supply control logic.
category: AC01
keywords: Token Economic Model Audit
citation: ConsenSys Smart Contract Audit
updated: 2026-06-16
version: 1
effectiveness: high

On-Chain Royalty Enforcement
type: Avoidance
break id: A0172
stix type: course-of-action
definition: Enforce NFT royalties at protocol level through smart contracts, making them unbypasable.
description: Enforce NFT royalties at protocol level through smart contracts, making them unbypasable.
category: AC01
keywords: On-Chain Royalty Enforcement
citation: EIP-2981: NFT Royalty Standard
updated: 2026-06-16
version: 1
effectiveness: high

Account Abstraction Security Audit
type: Avoidance
break id: A0174
stix type: course-of-action
definition: Audit ERC-4337 related contracts, verifying UserOperation and Paymaster security.
description: Audit ERC-4337 related contracts, verifying UserOperation and Paymaster security.
category: AC01
keywords: Account Abstraction Security Audit
citation: EIP-4337: Account Abstraction
updated: 2026-06-16
version: 1
effectiveness: high

DApp Frontend Integrity Verification
type: Avoidance
break id: A0176
stix type: course-of-action
definition: Ensure frontend is not tampered through Subresource Integrity (SRI), IPFS hash verification, etc.
description: Ensure frontend is not tampered through Subresource Integrity (SRI), IPFS hash verification, etc.
category: AC01
keywords: DApp Frontend Integrity Verification
citation: MDN Subresource Integrity
updated: 2026-06-16
version: 1
effectiveness: high

MEV Protection Mechanism
type: Avoidance
break id: A0177
stix type: course-of-action
definition: Use private mempools, transaction encryption, fair ordering to prevent front-running.
description: Use private mempools, transaction encryption, fair ordering to prevent front-running.
category: AC01
keywords: MEV Protection Mechanism
citation: Flashbots Documentation
updated: 2026-06-16
version: 1
effectiveness: high

Private Mempool and MEV Protection Services
type: Avoidance
break id: A0177-001
stix type: course-of-action
definition: Submitting transactions through private mempools to bypass public mempools and avoid being monitored and front-run by MEV bots.
description: Pending transactions in the public mempool can be analyzed and front-run by MEV bots. Protection solutions include: using services such as Flashbots Protect and MEV Blocker to send transactions directly to validators; transactions do not enter the public mempool, thereby avoiding surveillance; validators commit not to engage in front-running or sandwich attacks; users can set transaction privacy levels and maximum acceptable MEV; partial MEV rebates may be returned to users. Suitable for high-value scenarios such as large transactions, NFT minting, and DeFi operations. Research by CoW DAO indicates that this can effectively defend against front-running and sandwich attacks.
category: AC01
keywords: Private Mempool and MEV Protection Services
citation: User-side Transaction Risk Warning
updated: 2026-06-16
version: 1
effectiveness: high
limitation: Reliance on the integrity of third-party services; validators themselves may still front-run transactions; mature private mempools are not available on all chains; may reduce transaction execution speed; protection effectiveness of L2 private mempools is limited.

AIoT Model Security Protection
type: Avoidance
break id: A0178
stix type: course-of-action
definition: Defend AI models against adversarial examples and poisoning attacks to ensure decision reliability.
description: Defend AI models against adversarial examples and poisoning attacks to ensure decision reliability.
category: AC01
keywords: AIoT Model Security Protection
citation: NIST AI Risk Management Framework
updated: 2026-06-16
version: 1
effectiveness: high

IoT Hardware Security Module
type: Avoidance
break id: A0179
stix type: course-of-action
definition: Integrate Trusted Execution Environment (TEE) or security chips in IoT devices to defend against hardware attacks.
description: Integrate Trusted Execution Environment (TEE) or security chips in IoT devices to defend against hardware attacks.
category: AC01
keywords: IoT Hardware Security Module
citation: GlobalPlatform TEE Internal Core API Specification v1.4
updated: 2026-06-16
version: 1
effectiveness: high

eSIM Security Management
type: Avoidance
break id: A0180
stix type: course-of-action
definition: Strengthen eSIM remote provisioning authentication and authorization to prevent unauthorized hijacking.
description: Strengthen eSIM remote provisioning authentication and authorization to prevent unauthorized hijacking.
category: AC01
keywords: eSIM Security Management
citation: eSIM Compliance - GSMA
updated: 2026-06-16
version: 1
effectiveness: high

Medical Device Security Gateway
type: Avoidance
break id: A0181
stix type: course-of-action
definition: Deploy dedicated security gateway to isolate medical IoT devices with strict access control.
description: Deploy dedicated security gateway to isolate medical IoT devices with strict access control.
category: AC01
keywords: Medical Device Security Gateway
citation: FDA Medical Device Cybersecurity
updated: 2026-06-16
version: 1
effectiveness: high

Smart Home Privacy Switch
type: Avoidance
break id: A0184
stix type: course-of-action
definition: Provide physical or software privacy switches for smart devices, allowing users to actively disconnect audio/video collection.
description: Provide physical or software privacy switches for smart devices, allowing users to actively disconnect audio/video collection.
category: AC02
keywords: Smart Home Privacy Switch
citation: Securing Your Internet-Connected Devices at Home
updated: 2026-06-16
version: 1
effectiveness: medium

V2X PKI Authentication System
type: Avoidance
break id: A0185
stix type: course-of-action
definition: Establish V2X public key infrastructure to ensure authenticity and integrity of V2X communications.
description: Establish V2X public key infrastructure to ensure authenticity and integrity of V2X communications.
category: AC01
keywords: V2X PKI Authentication System
citation: ISO/SAE 21434 Vehicle Cybersecurity
updated: 2026-06-16
version: 1
effectiveness: high

Edge Computing Security Container
type: Avoidance
break id: A0186
stix type: course-of-action
definition: Use security container technology to isolate edge computing nodes and prevent lateral movement.
description: Use security container technology to isolate edge computing nodes and prevent lateral movement.
category: AC01
keywords: Edge Computing Security Container
citation: Kubernetes Security Best Practices
updated: 2026-06-16
version: 1
effectiveness: high

Metaverse Identity Federation
type: Avoidance
break id: A0188
stix type: course-of-action
definition: Establish cross-platform decentralized identity (DID) authentication system to prevent impersonation.
description: Establish cross-platform decentralized identity (DID) authentication system to prevent impersonation.
category: AC01
keywords: Metaverse Identity Federation
citation: W3C Decentralized Identifiers
updated: 2026-06-16
version: 1
effectiveness: high

Virtual Asset Cross-Chain Verification
type: Avoidance
break id: A0189
stix type: course-of-action
definition: Use cross-chain bridges and atomic swaps to ensure security of virtual asset transfers.
description: Use cross-chain bridges and atomic swaps to ensure security of virtual asset transfers.
category: AC01
keywords: Virtual Asset Cross-Chain Verification
citation: Ethereum Token Standards
updated: 2026-06-16
version: 1
effectiveness: high

Spatial Data Privacy Protection
type: Avoidance
break id: A0191
stix type: course-of-action
definition: Apply differential privacy and localization to sensitive sensor data like eye tracking and gestures.
description: Apply differential privacy and localization to sensitive sensor data like eye tracking and gestures.
category: AC01
keywords: Spatial Data Privacy Protection
citation: The XRSI Privacy and Safety Framework
updated: 2026-06-16
version: 1
effectiveness: high

3D Content AI Moderation
type: Avoidance
break id: A0192
stix type: course-of-action
definition: Use AI technology to automatically identify violating elements in 3D virtual content.
description: Use AI technology to automatically identify violating elements in 3D virtual content.
category: AC03
keywords: 3D Content AI Moderation
citation: How we enforce our policies - Transparency Center - Meta
updated: 2026-06-16
version: 1
effectiveness: high

Virtual Economy Regulation Mechanism
type: Avoidance
break id: A0193
stix type: course-of-action
definition: Establish virtual asset transaction regulation and anti-monopoly mechanisms to prevent economic manipulation.
description: Establish virtual asset transaction regulation and anti-monopoly mechanisms to prevent economic manipulation.
category: AC03
keywords: Virtual Economy Regulation Mechanism
citation: BIS Virtual Economy Regulation
updated: 2026-06-16
version: 1
effectiveness: high

Cross Virtual-Real Identity Isolation
type: Avoidance
break id: A0194
stix type: course-of-action
definition: Isolate virtual and real identities at technical and regulatory levels to prevent correlation analysis.
description: Isolate virtual and real identities at technical and regulatory levels to prevent correlation analysis.
category: AC02
keywords: Cross Virtual-Real Identity Isolation
citation: GDPR Privacy Regulation
updated: 2026-06-16
version: 1
effectiveness: medium

API Asset Discovery and Catalog Governance
type: Avoidance
break id: A0195
stix type: course-of-action
definition: Maintain a unified API asset catalog, shadow API discovery, interface ownership, and lifecycle governance to reduce unknown interface exposure.
description: Maintain a unified API asset catalog, shadow API discovery, interface ownership, and lifecycle governance to reduce unknown interface exposure.
category: AC03
keywords: API Asset Discovery and Catalog Governance
keywords: API asset inventory
keywords: shadow API discovery
keywords: API ownership
keywords: endpoint lifecycle
keywords: API governance
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

Strong API Authorization and Object-Level Access Control
type: Avoidance
break id: A0196
stix type: course-of-action
definition: Enforce server-side authorization for API objects, tenants, resources, and actions to prevent unauthorized access.
description: Enforce server-side authorization for API objects, tenants, resources, and actions to prevent unauthorized access.
category: AC01
keywords: Strong API Authorization and Object-Level Access Control
keywords: object-level access control
keywords: tenant authorization
keywords: resource ownership check
keywords: BOLA prevention
keywords: API authorization
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

API Input Validation and Contract Testing
type: Avoidance
break id: A0198
stix type: course-of-action
definition: Validate input through OpenAPI contracts, type constraints, and payload testing to reduce injection and parameter pollution.
description: Validate input through OpenAPI contracts, type constraints, and payload testing to reduce injection and parameter pollution.
category: AC01
keywords: API Input Validation and Contract Testing
keywords: OpenAPI contract testing
keywords: input validation
keywords: schema validation
keywords: parameter pollution
keywords: API fuzzing
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

Least-Privilege CI/CD Pipeline Governance
type: Avoidance
break id: A0199
stix type: course-of-action
definition: Limit permissions for pipeline tokens, runners, artifact repositories, and deployment credentials to reduce build-chain abuse.
description: Limit permissions for pipeline tokens, runners, artifact repositories, and deployment credentials to reduce build-chain abuse.
category: AC01
keywords: Least-Privilege CI/CD Pipeline Governance
keywords: CI/CD least privilege
keywords: runner hardening
keywords: pipeline token scope
keywords: deployment credential control
keywords: build security
citation: OWASP Top 10 CI/CD Security Risks
updated: 2026-06-17
version: 1
effectiveness: high

Build Artifact Signing and Provenance
type: Avoidance
break id: A0200
stix type: course-of-action
definition: Generate signatures, SLSA provenance, and verifiable release records for build outputs, images, and dependencies.
description: Generate signatures, SLSA provenance, and verifiable release records for build outputs, images, and dependencies.
category: AC01
keywords: Build Artifact Signing and Provenance
keywords: artifact signing
keywords: build provenance
keywords: SLSA attestation
keywords: image signing
keywords: release integrity
citation: Software Bill of Materials - CISA
updated: 2026-06-17
version: 1
effectiveness: high

Dependency Pinning and Malicious Package Detection
type: Avoidance
break id: A0201
stix type: course-of-action
definition: Use lock files, private proxy repositories, malicious-package scanning, and dependency audits to control supply-chain poisoning.
description: Use lock files, private proxy repositories, malicious-package scanning, and dependency audits to control supply-chain poisoning.
category: AC03
keywords: Dependency Pinning and Malicious Package Detection
keywords: dependency pinning
keywords: lock file
keywords: malicious package scanning
keywords: private package proxy
keywords: supply-chain defense
citation: Software Bill of Materials - CISA
updated: 2026-06-17
version: 1
effectiveness: high

SBOM Generation and Vulnerability Impact Analysis
type: Avoidance
break id: A0202
stix type: course-of-action
definition: Generate SBOMs for applications, images, and firmware, and quickly locate affected assets when new vulnerabilities are disclosed.
description: Generate SBOMs for applications, images, and firmware, and quickly locate affected assets when new vulnerabilities are disclosed.
category: AC03
keywords: SBOM Generation and Vulnerability Impact Analysis
keywords: SBOM generation
keywords: component inventory
keywords: vulnerability impact analysis
keywords: software bill of materials
keywords: asset exposure
citation: Software Bill of Materials - CISA
updated: 2026-06-17
version: 1
effectiveness: high

Cloud Identity Permission Reduction
type: Avoidance
break id: A0203
stix type: course-of-action
definition: Continuously detect excessive cloud permissions, long-lived keys, and cross-account trusts, then enforce least privilege and temporary credentials.
description: Continuously detect excessive cloud permissions, long-lived keys, and cross-account trusts, then enforce least privilege and temporary credentials.
category: AC01
keywords: Cloud Identity Permission Reduction
keywords: cloud IAM review
keywords: least privilege
keywords: temporary credentials
keywords: cross-account trust
keywords: permission reduction
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Cloud Configuration Baselines and Drift Detection
type: Avoidance
break id: A0204
stix type: course-of-action
definition: Establish baselines for cloud storage, network, security group, KMS, and logging configurations, and detect configuration drift.
description: Establish baselines for cloud storage, network, security group, KMS, and logging configurations, and detect configuration drift.
category: AC03
keywords: Cloud Configuration Baselines and Drift Detection
keywords: cloud baseline
keywords: configuration drift
keywords: security group review
keywords: KMS configuration
keywords: cloud posture
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

SaaS Application Permission Audit
type: Avoidance
break id: A0205
stix type: course-of-action
definition: Inventory SaaS administrators, OAuth grants, external sharing, and third-party apps to identify high-risk authorization.
description: Inventory SaaS administrators, OAuth grants, external sharing, and third-party apps to identify high-risk authorization.
category: AC03
keywords: SaaS Application Permission Audit
keywords: SaaS permission audit
keywords: OAuth grant review
keywords: third-party app inventory
keywords: admin role review
keywords: external sharing
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Enterprise Collaboration Data Loss Prevention
type: Avoidance
break id: A0206
stix type: course-of-action
definition: Apply sensitive-data discovery, sharing control, and outbound audit to cloud drives, IM, email, knowledge bases, and collaboration documents.
description: Apply sensitive-data discovery, sharing control, and outbound audit to cloud drives, IM, email, knowledge bases, and collaboration documents.
category: AC02
keywords: Enterprise Collaboration Data Loss Prevention
keywords: collaboration DLP
keywords: cloud drive sharing control
keywords: sensitive data discovery
keywords: outbound audit
keywords: document protection
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: medium

Payment Account and Merchant Onboarding Review
type: Avoidance
break id: A0207
stix type: course-of-action
definition: Review merchants, collection accounts, legal entities, devices, and historical risk during onboarding and continuous review.
description: Review merchants, collection accounts, legal entities, devices, and historical risk during onboarding and continuous review.
category: AC01
keywords: Payment Account and Merchant Onboarding Review
keywords: merchant onboarding
keywords: payment account review
keywords: KYB
keywords: device risk review
keywords: merchant fraud control
citation: PCI Data Security Standard
updated: 2026-06-17
version: 1
effectiveness: high

Refund and Dispute Risk-Control Strategy
type: Avoidance
break id: A0208
stix type: course-of-action
definition: Build behavior models, evidence-chain validation, and manual review for refunds, chargebacks, after-sales cases, and claims.
description: Build behavior models, evidence-chain validation, and manual review for refunds, chargebacks, after-sales cases, and claims.
category: AC03
keywords: Refund and Dispute Risk-Control Strategy
keywords: refund risk control
keywords: chargeback monitoring
keywords: dispute evidence review
keywords: claims fraud detection
keywords: after-sales abuse
citation: PCI Data Security Standard
updated: 2026-06-17
version: 1
effectiveness: high

Ad Delivery and Attribution Anti-Fraud
type: Avoidance
break id: A0209
stix type: course-of-action
definition: Detect fake impressions, click injection, attribution hijacking, install farms, and abnormal conversion chains.
description: Detect fake impressions, click injection, attribution hijacking, install farms, and abnormal conversion chains.
category: AC03
keywords: Ad Delivery and Attribution Anti-Fraud
keywords: ad attribution anti-fraud
keywords: click injection detection
keywords: install farm detection
keywords: fake conversion detection
keywords: traffic quality
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Affiliate Marketing and Channel Quality Scoring
type: Avoidance
break id: A0210
stix type: course-of-action
definition: Score affiliate channels, creatives, landing pages, conversion devices, and commission behavior for quality and fraud risk.
description: Score affiliate channels, creatives, landing pages, conversion devices, and commission behavior for quality and fraud risk.
category: AC03
keywords: Affiliate Marketing and Channel Quality Scoring
keywords: affiliate quality scoring
keywords: channel fraud detection
keywords: commission abuse
keywords: landing page review
keywords: conversion device scoring
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Data-Sharing Approval and Purpose Limitation
type: Avoidance
break id: A0211
stix type: course-of-action
definition: Apply approval, minimization, and purpose constraints to data sharing, export, training, analytics, and third-party use.
description: Apply approval, minimization, and purpose constraints to data sharing, export, training, analytics, and third-party use.
category: AC01
keywords: Data-Sharing Approval and Purpose Limitation
keywords: data sharing approval
keywords: purpose limitation
keywords: data minimization
keywords: third-party data governance
keywords: export review
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Privacy Impact Assessment and Compliance Evidence
type: Avoidance
break id: A0212
stix type: course-of-action
definition: Perform PIA/DPIA for new businesses, models, and data-processing activities, and retain compliance evidence.
description: Perform PIA/DPIA for new businesses, models, and data-processing activities, and retain compliance evidence.
category: AC03
keywords: Privacy Impact Assessment and Compliance Evidence
keywords: privacy impact assessment
keywords: DPIA
keywords: PIA evidence
keywords: privacy compliance
keywords: processing activity review
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

AI Training Data Governance
type: Avoidance
break id: A0213
stix type: course-of-action
definition: Govern training-data provenance, authorization, sensitive information, copyright risk, and data-poisoning detection.
description: Govern training-data provenance, authorization, sensitive information, copyright risk, and data-poisoning detection.
category: AC01
keywords: AI Training Data Governance
keywords: training data provenance
keywords: dataset authorization
keywords: AI data governance
keywords: poisoning detection
keywords: copyright review
citation: NIST AI Risk Management Framework
updated: 2026-06-17
version: 1
effectiveness: high

Model Output Safety Evaluation
type: Avoidance
break id: A0214
stix type: course-of-action
definition: Evaluate model outputs for harmful content, privacy leakage, hallucination, bias, and unauthorized advice.
description: Evaluate model outputs for harmful content, privacy leakage, hallucination, bias, and unauthorized advice.
category: AC03
keywords: Model Output Safety Evaluation
keywords: model output evaluation
keywords: harmful content testing
keywords: privacy leakage testing
keywords: hallucination review
keywords: AI safety
citation: NIST AI Risk Management Framework
updated: 2026-06-17
version: 1
effectiveness: high

RAG Knowledge-Base Permission Isolation
type: Avoidance
break id: A0215
stix type: course-of-action
definition: Isolate RAG indexes and retrieval results by tenant, role, and document sensitivity to prevent cross-permission recall.
description: Isolate RAG indexes and retrieval results by tenant, role, and document sensitivity to prevent cross-permission recall.
category: AC01
keywords: RAG Knowledge-Base Permission Isolation
keywords: RAG permission isolation
keywords: tenant-aware retrieval
keywords: document sensitivity label
keywords: vector index access control
keywords: knowledge base security
citation: OWASP Top 10 for Large Language Model Applications
updated: 2026-06-17
version: 1
effectiveness: high

Prompt Injection Defense and Context Isolation
type: Avoidance
break id: A0216
stix type: course-of-action
definition: Separate system instructions, user input, and external content, and apply policy checks to tool-call parameters.
description: Separate system instructions, user input, and external content, and apply policy checks to tool-call parameters.
category: AC01
keywords: Prompt Injection Defense and Context Isolation
keywords: prompt injection defense
keywords: context isolation
keywords: tool call policy
keywords: external content filtering
keywords: LLM security
citation: OWASP Top 10 for Large Language Model Applications
updated: 2026-06-17
version: 1
effectiveness: high

MFA Fatigue Resistance and High-Risk Verification
type: Avoidance
break id: A0217
stix type: course-of-action
definition: Use number matching, risk-based verification, and cooldown controls for MFA bombing, push fatigue, and abnormal logins.
description: Use number matching, risk-based verification, and cooldown controls for MFA bombing, push fatigue, and abnormal logins.
category: AC01
keywords: MFA Fatigue Resistance and High-Risk Verification
keywords: MFA fatigue defense
keywords: number matching
keywords: risk-based verification
keywords: push cooldown
keywords: account takeover prevention
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Session Token Binding and Replay Detection
type: Avoidance
break id: A0218
stix type: course-of-action
definition: Bind sessions to device, network, and client attestation, and detect cookie or token replay.
description: Bind sessions to device, network, and client attestation, and detect cookie or token replay.
category: AC01
keywords: Session Token Binding and Replay Detection
keywords: session token binding
keywords: cookie replay detection
keywords: client attestation
keywords: device binding
keywords: session security
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

Webhook Signature Verification and Replay Protection
type: Avoidance
break id: A0219
stix type: course-of-action
definition: Verify webhook signatures, timestamp windows, idempotency, and event origin.
description: Verify webhook signatures, timestamp windows, idempotency, and event origin.
category: AC01
keywords: Webhook Signature Verification and Replay Protection
keywords: webhook signature verification
keywords: timestamp window
keywords: replay protection
keywords: idempotency key
keywords: event origin validation
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1
effectiveness: high

Mobile App Integrity and Runtime Protection
type: Avoidance
break id: A0220
stix type: course-of-action
definition: Detect repackaging, hooking, debugging, emulation, and runtime tampering to protect client-side business logic.
description: Detect repackaging, hooking, debugging, emulation, and runtime tampering to protect client-side business logic.
category: AC01
keywords: Mobile App Integrity and Runtime Protection
keywords: mobile app integrity
keywords: repackaging detection
keywords: hook detection
keywords: runtime protection
keywords: anti-tampering
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Edge and CDN Rule Change Audit
type: Avoidance
break id: A0221
stix type: course-of-action
definition: Audit CDN, WAF, edge-function, and cache-rule changes to prevent edge configuration abuse.
description: Audit CDN, WAF, edge-function, and cache-rule changes to prevent edge configuration abuse.
category: AC03
keywords: Edge and CDN Rule Change Audit
keywords: CDN rule audit
keywords: edge function change review
keywords: WAF rule audit
keywords: cache rule governance
keywords: edge security
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1
effectiveness: high

Black SIM Cards
type: AttackTool
break id: AT0001
stix type: tool
description: Black SIM cards, also known as 'black phone cards', refer to mobile phone cards (including wireless data cards) that have not been registered under a real name and are used by criminals for illegal activities. Since the implementation of phone real-name registration in September 2013, new users in China have largely completed real-name registration. However, due to lax enforcement and large existing stock, unregistered phone cards still number as many as 180 million, giving criminals opportunities to spread obscene content, commit telecommunications fraud, and organize terrorist activities. The main sources of black SIM cards are physical carrier cards, virtual carrier cards, and overseas phone cards.
keywords: Black SIM Cards
keywords: anonymous SIM
keywords: unregistered SIM card
keywords: burner SIM
keywords: black phone card
keywords: non-real-name SIM
keywords: virtual carrier SIM
keywords: overseas SIM card
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Bulk Fake Account Manipulation
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Promotional Activity Cheating
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
mitigated by: Phone Number Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
mitigated by: Legal Action
citation: China's Successful Anti-Fraud Practices
updated: 2026-06-13
version: 1

Modem Pool SIM Cards
type: AttackTool
break id: AT0001-002
stix type: tool
description: Black SIM cards used with a 'modem pool' — a network communication hardware device that enables simultaneous multi-number calling and bulk SMS sending.
keywords: Modem Pool SIM Cards
keywords: SIM bank card
keywords: GOIP SIM
keywords: SIM box card
keywords: modem pool card
keywords: bulk SMS SIM
keywords: voice gateway SIM
keywords: GSM gateway SIM
directly causes: Malicious Traffic Diversion
directly causes: Malicious User Harassment
directly causes: Phishing Attack
directly causes: Platform Pornography Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Interceptor Card Registration
indirectly supports: Coupon Enumeration
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
mitigated by: Real-Name Identity Verification
mitigated by: Phone Number Intelligence
mitigated by: Legal Action
citation: Jiangsu Mobile Cracks Down on Modem Pools, Providing 6,363 GOIP Clues to Police
updated: 2026-06-13
version: 1

Intercept SIM Cards
type: AttackTool
break id: AT0001-003
stix type: tool
description: SIM cards that, via malware or trojans, grant unauthorized control over a real user's SMS and verification code reception, typically sourced from intercept card platforms.
keywords: Intercept SIM Cards
keywords: SMS interception SIM
keywords: OTP intercept SIM
keywords: verification code interception card
keywords: intercept card platform
keywords: SMS hijack card
keywords: trojan-controlled SIM
keywords: SMS forwarding SIM
directly causes: Bulk Fake Account Manipulation
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Interceptor Card Registration
directly causes: User Privacy Leakage
directly causes: Real-World Identity Theft
directly causes: Fake Identity Authentication
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Overseas Number Registration
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: AI Deepfake Risk
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Promotional Activity Cheating
mitigated by: Real-Name Identity Verification
mitigated by: Phone Number Intelligence
mitigated by: Facial Recognition
mitigated by: Complaint and Reporting Channel
citation: Black Market Big Data: 2025 Annual Summary of Internet Black-Grey Market Trends
updated: 2026-06-13
version: 1

Mobile Phone Emulator
type: AttackTool
break id: AT0002
stix type: tool
description: Also known as Android emulator or game emulator, it is a simulation program that can emulate an independent mobile phone system on a computer, enabling mobile apps to run on a PC. Originally designed for players to run mobile games on computers, some features have been exploited by gray/black market actors. The Root permissions provided by emulators enable value modification cheats, while the multi-instance feature is used by script studios for batch AFK farming and traffic inflation. Additionally, emulators can be used for batch account registration, simulated click traffic inflation, ranking manipulation, and other black/gray market activities. Some emulators support toggling Root permissions in real-time without restarting, further increasing detection difficulty.
keywords: Mobile Phone Emulator
keywords: Android emulator
keywords: device emulator
keywords: virtual Android
keywords: PC mobile emulator
keywords: emulator farm
keywords: BlueStacks
keywords: LDPlayer
keywords: MuMu emulator
directly causes: Process Automation
directly causes: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Automated Login Risk
mitigated by: Emulator Detection
mitigated by: Device Fingerprinting
mitigated by: Anomalous Access Behavior Detection
citation: ICBC Releases 2022 Cyber Financial Black Market Research Report
updated: 2026-06-11
version: 1

Bulk Account Registration Tool
type: AttackTool
break id: AT0003
stix type: tool
description: An automation tool specifically designed for bulk registration of business accounts. Normal registration requires complex operations such as phone verification and CAPTCHA recognition, making it tedious to register even one account. However, gray/black market actors need large numbers of business accounts to support activities such as traffic inflation, deal abuse, and fraud. Bulk registration tools automate the registration process to quickly register large numbers of accounts. They are typically used in combination with SMS verification code platforms, CAPTCHA solving platforms, and proxy IP pools, forming a complete bulk registration industry chain that automates the entire process from obtaining phone numbers and solving CAPTCHAs to filling in registration information.
keywords: Bulk Account Registration Tool
keywords: account creator bot
keywords: bulk signup bot
keywords: auto registration tool
keywords: account generation script
keywords: registration farm software
keywords: auto signup bot
keywords: phone-verified account creator
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Bulk Fake Account Manipulation
directly causes: Fake Viral Referral
directly causes: Unauthorized Promotional Redirection
directly causes: Malicious Benefit Abuse
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Proxy Detection
mitigated by: Anomalous Access Behavior Detection
citation: OWASP Automated Threat: OAT-019 Account Creation
updated: 2026-06-11
version: 1

Modem Pool
type: AttackTool
break id: AT0004
stix type: tool
description: A modem pool (Modem POOL) is a telephone-based expansion device that connects a large number of modems together using special dial-up request access equipment, allowing simultaneous dial-up connections from multiple users. A modem pool can synchronously dial large numbers of user phone numbers, and fraudsters use it to improve the efficiency of their calling operations, making it a commonly used tool for telecom fraudsters. In the gray/black market domain, modem pools are also widely used to manage large numbers of SIM cards simultaneously, with supporting software enabling batch SMS receiving and sending. They are commonly used for batch spam account registration and deal abuse on major platforms. The phone cards used in modem pools are often non-real-name cheap cards obtained through black market channels. In recent years, modem pools are often used in conjunction with GOIP devices, and public security authorities have repeatedly dismantled modem pool operations in the 'Account Cutoff' campaign.
keywords: Modem Pool
keywords: GOIP gateway
keywords: SIM box
keywords: GSM gateway
keywords: VoIP GSM gateway
keywords: modem bank
keywords: SIM bank
keywords: bulk SMS gateway
directly causes: SMS Resource Exhaustion
indirectly supports: Bulk Account Registration
indirectly supports: Malicious User Harassment
mitigated by: Phone Number Intelligence
mitigated by: Legal Action
mitigated by: Complaint and Reporting Channel
citation: Jiangsu Mobile Cracks Down on Modem Pools, Providing 6,363 GOIP Clues to Police
updated: 2026-06-13
version: 1

Web Scraping Tools
type: AttackTool
break id: AT0005
stix type: tool
description: Web crawlers, also known as 'web spiders' or 'web robots', are a network information collection technology in the internet era. They can be understood as computer programs that automatically simulate human operations online. These crawlers follow specific programs along certain paths, simulating manual operations to extract and store data from websites and applications. In the gray/black market domain, web scraping tools are widely used for data extraction, price monitoring, ticket grabbing, credential stuffing and account theft, and attacking computer systems, posing serious threats to enterprise data security and business order. With the development of big data and AI technology, web scraping tools have become increasingly intelligent, making anti-scraping countermeasures increasingly challenging.
keywords: Web Scraping Tools
keywords: web crawler
keywords: web spider
keywords: scraper bot
keywords: data extraction tool
keywords: Scrapy
keywords: Selenium scraper
keywords: Playwright scraper
keywords: Puppeteer scraper
directly causes: Protocol-Level Automation
directly causes: Web Scraping Risk
indirectly supports: Data Exfiltration Risk
indirectly supports: Bulk Account Enumeration
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Real-Name Identity Verification
mitigated by: Resource Access Restriction
mitigated by: User Profiling
mitigated by: Business-Level Honeypot
mitigated by: Return Fake Data (Data Poisoning)
mitigated by: Data Parsing Interference
mitigated by: Single-Device Login
mitigated by: Data Obfuscation
mitigated by: Data Desensitization (Masking)
mitigated by: Resource ID Encryption
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
mitigated by: Account Ban
citation: OWASP Automated Threats to Web Applications
citation: Scrapy at a glance - Scrapy Documentation
updated: 2026-06-13
version: 1

SMS Verification Code Platform
type: AttackTool
break id: AT0006
stix type: tool
description: SMS verification code platforms are cloud service platforms that use virtual or physical phone numbers to receive SMS verification codes. Their principle is to connect phone numbers provided by card merchants to the platform, which then provides them to consumers. SMS verification codes are used in internet businesses to filter low-value users, based on the premise that phone numbers essentially implement real-name authentication. However, the gray/black market has developed SMS verification code platforms that stockpile large numbers of SIM cards to provide SMS sending and receiving services. Large platforms have been found to hold millions of SIM cards, while smaller ones hold tens of thousands. These platforms belong to the illegal gray industry that undermines internet real-name registration and has a severe impact on cybersecurity. In recent years, the platform model has evolved toward a decentralized 'group code receiving' model, where card merchants provide code receiving services directly to multiple black/gray market actors through social messaging tools, bypassing traditional platform account systems, reducing transaction costs and enhancing privacy, making enforcement even more difficult.
keywords: SMS Verification Code Platform
keywords: SMS receive platform
keywords: OTP receiving platform
keywords: SMS activation service
keywords: virtual number SMS platform
keywords: temporary phone number service
keywords: SMS code rental
keywords: online SMS receiver
directly causes: Bulk Fake Account Manipulation
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Inactive Number Registration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Promotional Activity Cheating
indirectly supports: Fake Viral Referral
indirectly supports: Malicious Benefit Abuse
indirectly supports: Fake Viewer Count Inflation
mitigated by: Phone Number Intelligence
mitigated by: User Profiling
mitigated by: Real-Name Identity Verification
mitigated by: SIM Card Security Verification
mitigated by: Account Ban
citation: What Do SMS Verification Code Platforms Do?
updated: 2026-06-11
version: 1

Device Spoofing Tools
type: AttackTool
break id: AT0007
stix type: tool
description: Device spoofing tools are important tools relied upon by criminal gangs for large-scale operations. By modifying device parameters or forging device fingerprints, the same device can be identified as multiple different devices, thereby bypassing business risk controls. The core functions of device spoofing tools include modifying IMEI, IMSI, hardware serial numbers, MAC addresses, and other device identifiers, as well as the 'one-click new device' feature that quickly simulates device parameters from different manufacturers. Technically, device spoofing tools can use frameworks like Xposed and tools like Frida Hook to intercept and tamper with system calls without modifying APKs, and there are also Root-free spoofing solutions. Device spoofing tools are commonly used for batch account registration, batch account farming, bypassing device bans, and other scenarios. Some advanced tools also support one-click backup and restore functions, enabling quick switching and operation of multiple accounts on a single device.
keywords: Device Spoofing Tools
keywords: device fingerprint spoofing
keywords: device ID changer
keywords: Android ID spoof
keywords: IMEI changer
keywords: Xposed module
keywords: Frida script
keywords: MagiskHide
directly causes: Unauthorized Plugin Promotion
directly causes: Third-Party Price Comparison
directly causes: Access Link Hijacking
directly causes: Unauthorized Promotional Redirection
directly causes: Unauthorized Plugin Cashback
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: ROOT/Jailbreak Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Debugger Detection
mitigated by: Virtual Machine Detection
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Device Fingerprinting
mitigated by: User Profiling
citation: In-Depth: 315 Gala Exposes Black Market High-Frequency IP Switching
citation: Xposed - A framework service that affects program execution (modifies the system) without modifying APK
citation: Frida - A convenient and easy-to-use cross-platform Hook tool
updated: 2026-06-11
version: 1

Hardware ROM Modification Tools
type: AttackTool
break id: AT0007-001
stix type: tool
description: Android is an open-source operating system, allowing developers to customize ROMs. Some developers with malicious intent create ROMs that can arbitrarily modify phone operating system parameters, known as 'hardware modification'. This method is more difficult for developers but makes changes at the OS framework level that apps cannot detect at all. Hardware-modified devices can generate device parameters locally at random or dynamically receive real parameters from other devices via a cloud device library.
keywords: Hardware ROM Modification Tools
keywords: ROM cooking tool
keywords: firmware flashing tool
keywords: system image patcher
keywords: SP Flash Tool
keywords: Odin flash tool
keywords: fastboot flash utility
keywords: ROM editor
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
citation: Excerpts from 'Risk Control Essentials'
updated: 2026-06-11
version: 1

CAPTCHA Solving Platform
type: AttackTool
break id: AT0008
stix type: tool
description: A platform that provides CAPTCHA solving services through automated or human means. Simple character CAPTCHAs can no longer effectively block automated behavior and can be cracked using OCR recognition tools. More complex CAPTCHAs can be solved with high accuracy using deep learning (such as convolutional neural networks). For high-difficulty CAPTCHAs, human-powered solving platforms organize real people (commonly known as 'code slaves') to perform recognition and submit verification results. In recent years, with the development of AIGC technology, the confrontation between CAPTCHAs and solving platforms has entered a new AI-versus-AI stage — CAPTCHAs use generative adversarial networks to produce more complex adversarial examples, while solving platforms use deep learning models to continuously improve their cracking capabilities, forming a continuously escalating offensive-defensive game.
keywords: CAPTCHA Solving Platform
keywords: captcha solving service
keywords: human solver platform
keywords: captcha farm
keywords: 2Captcha
keywords: Anti-Captcha
keywords: CapSolver
keywords: image captcha bypass service
directly causes: Instant Bid Sniping
indirectly supports: Process Automation
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Bulk Account Registration
indirectly supports: CAPTCHA Bypass
mitigated by: Behavioral CAPTCHA
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Silent CAPTCHA
mitigated by: Human Verification Technology
mitigated by: Image-Text CAPTCHA
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1

Mass Control Systems
type: AttackTool
break id: AT0009
stix type: tool
description: A mass control system uses automated control integration technology to map multiple phone interfaces directly to a computer monitor, enabling one computer to control dozens or even hundreds of phones simultaneously. The system numbers each phone's interface on the control computer, corresponding to the same-numbered phone, achieving one-to-one phone operation control. Traditional mass control systems typically consist of software and hardware components, with the hardware including a control host, HUB, computer, and terminal phones, and the software using a control system with sub-control functionality operating in a local LAN environment. In recent years, mass control has evolved into a 'cloud control' model, where large numbers of phones are remotely controlled through cloud-based software without physical connections. A single computer can control tens of thousands of phones, commonly used for livestream traffic inflation, short video likes and comments, and other black/gray market activities.
keywords: Mass Control Systems
keywords: mass-control platform
keywords: phone farm controller
keywords: mobile device farm
keywords: multi-device control platform
keywords: one-to-many phone control
keywords: Android device matrix control
keywords: device orchestration panel
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Bulk Account Registration
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Gold Farming
mitigated by: Terminal Abnormal Environment Detection
mitigated by: ROOT/Jailbreak Detection
mitigated by: Cheat/Plugin Detection
mitigated by: IP Intelligence
mitigated by: Device Fingerprinting
mitigated by: Device Profiling
mitigated by: Anomalous Access Behavior Detection
citation: ICBC Releases 2022 Cyber Financial Black Market Research Report
updated: 2026-06-11
version: 1

Dark Web
type: AttackTool
break id: AT0010
stix type: tool
description: The Dark Web refers to a part of the internet whose content is not indexed by traditional search engines and typically requires specific software or authorization to access. Websites on the dark web usually use highly anonymous browsers such as Tor (The Onion Router) to hide users' identities and locations. This anonymity makes the dark web a venue for activities requiring concealment, including illegal trading of drugs, hacking tools, cyberattack services, illegal weapons, and other illegal services.
keywords: Dark Web
keywords: darknet market
keywords: Tor network
keywords: onion site
keywords: Tor hidden service
keywords: darknet forum
keywords: hidden services
keywords: underground market
directly causes: Prohibited and Illegal Products
directly causes: Trade Secret Leakage
directly causes: Money Laundering Risk
directly causes: Data Breach
indirectly supports: Account Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Illegal Cash-Out
mitigated by: Threat Intelligence
citation: Internet Organised Crime Threat Assessment (IOCTA)
updated: 2026-06-13
version: 1

Social Engineering Database
type: AttackTool
break id: AT0012
stix type: tool
description: A Social Engineering Database (SEDB) is a product of combining hacking with big data, where hackers integrate and analyze leaked user data and archive it centrally. It is a database query platform built from user data from major websites. Hackers obtain data packages through database breaches and credential stuffing that contain not only account passwords but also additional data from different industries. Information in social engineering databases often involves user privacy, making such sites illegal.
keywords: Social Engineering Database
keywords: SEDB
keywords: breach data lookup
keywords: combo list database
keywords: fullz database
keywords: dox database
keywords: PII lookup platform
keywords: breach corpus
directly causes: Bulk Fake Account Manipulation
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
indirectly supports: Account Reselling
indirectly supports: Carding Attack
indirectly supports: Employee Account Compromise
mitigated by: Multi-Factor Authentication
mitigated by: Threat Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
citation: Ministry of Public Security: Crack Down on Crimes Infringing on Citizens' Personal Information
updated: 2026-06-13
version: 1

Trojan Virus
type: AttackTool
break id: AT0013
stix type: tool
description: A computer trojan virus is a piece of malicious code with special functions hidden in a normal program. It is a backdoor program capable of destroying and deleting files, sending passwords, recording keystrokes, and attacking systems. Trojan programs appear harmless on the surface and may even be attractive to unsuspecting users, often hidden in games or graphics software. A complete trojan program generally consists of two parts: a server-side component and a controller-side component.
keywords: Trojan Virus
keywords: remote access trojan
keywords: RAT malware
keywords: banking trojan
keywords: loader trojan
keywords: dropper malware
keywords: keylogger trojan
keywords: backdoor trojan
directly causes: Ad Fraud
directly causes: Ad Link Hijacking
directly causes: Account Takeover
directly causes: File or Document Theft
directly causes: Device Malware Infection
directly causes: Employee Account Compromise
directly causes: Office Environment Risk
directly causes: Bring Your Own Device (BYOD) Risk
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Unauthorized Account Sharing
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Unauthorized Device Connection
indirectly supports: Surveillance and Eavesdropping
mitigated by: Terminal Abnormal Environment Detection
citation: Notice on the 'Dark Cloud' Trojan Program
updated: 2026-06-13
version: 1

Pre-installed Mobile Trojan Backdoor
type: AttackTool
break id: AT0013-001
stix type: tool
description: Attackers pre-install trojans primarily through two methods: first, through 'flashing' or APP (re-Root) methods, installing malware on phones before they reach users, such as RottenSys malware disguised as 'System WiFi Service'; second, some niche phone brand manufacturers collect user traffic through various means and even pre-install malware like StealthBot to compensate for their market share.
keywords: Pre-installed Mobile Trojan Backdoor
keywords: preloaded malware
keywords: factory-installed trojan
keywords: system app trojan
keywords: ROM trojan
keywords: supply chain malware
keywords: RottenSys
keywords: Triada
keywords: preinstalled backdoor
directly causes: Malicious Flash Sale Grabbing
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Fake Viral Referral
directly causes: Ad Fraud
directly causes: Ad Link Hijacking
directly causes: Bulk Account Registration
directly causes: Login Credential Reuse
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Stolen Card Fraud
directly causes: Points Theft
directly causes: File or Document Theft
directly causes: Device Malware Infection
directly causes: Employee Account Compromise
directly causes: Bring Your Own Device (BYOD) Risk
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Employee Sabotage
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Unauthorized Device Connection
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Electronic File Seal
mitigated by: Mobile Threat Defense (MTD)
citation: 360 Fully Exposes Mobile Phone Black Market: Wild Growth at Massive Scale
updated: 2026-06-11
version: 1

Packet Capture Tools
type: AttackTool
break id: AT0014
stix type: tool
description: Packet capture tools are software that intercepts and inspects the contents of network data packets. Because they can capture all IP packets during data communication and perform layer-by-layer unpacking analysis, they have long been commonly used troubleshooting tools in traditional fixed-network maintenance. Popular packet capture software includes Wireshark, SnifferPro, Snoop, and Tcpdump. On the mobile side, tools like Fiddler, Charles, and mitmproxy are also widely used, often for mobile application interface analysis and man-in-the-middle (MITM) attacks. Black-grey market actors can use packet capture tools to obtain communication data between apps and servers, steal sensitive information, or reverse-engineer API interfaces to carry out automated attacks.
keywords: Packet Capture Tools
keywords: network sniffer
keywords: packet analyzer
keywords: Wireshark
keywords: tcpdump
keywords: mitmproxy
keywords: Charles Proxy
keywords: Fiddler
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Auction Sniping
directly causes: Web Scraping Risk
directly causes: Credential Brute Force
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Privilege Escalation / Unauthorized Access
mitigated by: API Signature Verification
mitigated by: Traffic Encryption
mitigated by: Transport Protocol Encryption
mitigated by: Request Data Encryption
mitigated by: Response Data Encryption
mitigated by: Custom Transport Protocol
mitigated by: Return Fake Data (Data Poisoning)
mitigated by: Data Parsing Interference
mitigated by: Certificate Pinning (SSL Pinning)
citation: Wireshark User's Guide
updated: 2026-06-13
version: 1

Packet Sending/Modification Tools
type: AttackTool
break id: AT0014-001
stix type: tool
description: Packet sending and modification tools are network debugging tools primarily used to capture, analyze, and edit network data packets. Through these tools, users can monitor network traffic, analyze protocols, and debug network issues. For example, Burp Suite is a web application security testing tool that can capture, analyze, and modify HTTP/HTTPS packets. These tools are widely used in network security, system debugging, and network performance analysis.
keywords: Packet Sending/Modification Tools
keywords: packet crafting
keywords: packet injection
keywords: packet editor
keywords: packet manipulation
keywords: request tampering
keywords: intercepting proxy
keywords: Burp Suite
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Ad Link Hijacking
directly causes: Web Scraping Risk
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Automated Account Seasoning
directly causes: HTTP Request Analysis
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
mitigated by: Human Verification Technology
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Traffic Encryption
mitigated by: Digital Certificate
mitigated by: HTTPS Digital Certificate
mitigated by: Return Fake Data (Data Poisoning)
mitigated by: Data Parsing Interference
citation: Domestic Traffic Diversion and Group Harvesting: Exposing Cross-Border Pornography Black Market Chain
updated: 2026-06-11
version: 1

Debugging Tools
type: AttackTool
break id: AT0015
stix type: tool
description: A debugger is a computer program and tool used to debug other programs. It allows code to be inspected and selectively run in an instruction set simulator (ISS) for troubleshooting and debugging. Beyond debugging, a debugger is also frequently used as a tool for cracking software, such as bypassing copy protection, breaking serial number verification, and other software protection features.
keywords: Debugging Tools
keywords: debugger
keywords: dynamic analysis tool
keywords: GDB
keywords: LLDB
keywords: x64dbg
keywords: OllyDbg
keywords: IDA debugger
directly causes: Protocol-Level Automation
directly causes: Application Reverse Engineering
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Risk Device Identification Bypass
mitigated by: Client Application Hardening
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Debugger Detection
citation: GDB Documentation
updated: 2026-06-13
version: 1

Cloud Phone
type: AttackTool
break id: AT0016
stix type: tool
description: A cloud phone applies cloud computing technology to network terminal services, implementing virtual phone functionality through cloud servers. Based on end-cloud integrated virtualization technology, cloud phones elastically adapt to user needs through cloud networking, security, and AI capabilities, offloading hardware resources and loading massive cloud applications on demand. Users can remotely control cloud phones in real time via video streaming, enabling Android native apps and mobile games to run in the cloud. In the black-grey market, cloud phones are commonly used for batch account registration, traffic inflation, coupon abuse, mass-controlled order grabbing, and other cheating activities. Black-grey market actors obtain cloud phone access through membership or rental, leveraging remote connections to attack, simultaneously controlling large numbers of cloud phone instances for scaled automated cheating.
keywords: Cloud Phone
keywords: cloud mobile phone
keywords: Android cloud hosting
keywords: remote Android instance
keywords: virtual phone farm
keywords: phone farm
keywords: cloud emulator
keywords: device cloud
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Risk Device Identification Bypass
directly causes: Device Malware Infection
indirectly supports: Malicious Benefit Abuse
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Virtual Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cloud Phone Detection
mitigated by: Device Fingerprinting
citation: Cloud Phones: The Invisible Threat
updated: 2026-06-13
version: 1

Multi-Instance Tools
type: AttackTool
break id: AT0017
stix type: tool
description: Multi-instance software allows running multiple clients of the same software simultaneously on one device, with each client operating normally. It is a tool that removes restrictions on single-instance software programs and games, enabling multiple clients to run without a virtual machine.
keywords: Multi-Instance Tools
keywords: app cloner
keywords: multi-open tool
keywords: multi-login app
keywords: Parallel Space
keywords: dual app tool
keywords: instance manager
keywords: multi-client launcher
directly causes: Process Automation
directly causes: Unauthorized Account Sharing
directly causes: Bulk Account Registration
directly causes: Risk Device Identification Bypass
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Automated Account Seasoning
indirectly supports: Game Storage Accounts
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Multi-Instance Detection
mitigated by: Device Fingerprinting
citation: How to configure mobile windowed multi-instance software? Recommended tools for mobile multi-instance use...
updated: 2026-06-11
version: 1

Root/Jailbreak Tools
type: AttackTool
break id: AT0018
stix type: tool
description: Root refers to obtaining superuser administrator privileges on Android phones. After gaining root access, the Android superuser account can be used to flash custom ROMs, modify files, or enable originally disabled features. The account has permissions to access and modify almost all files on the phone. Jailbreaking is the equivalent of Root on Apple's iOS system.
keywords: Root/Jailbreak Tools
keywords: Android root tool
keywords: iPhone jailbreak tool
keywords: Magisk
keywords: checkra1n
keywords: unc0ver
keywords: bootloader unlock
keywords: privilege escalation toolkit
directly causes: Process Automation
directly causes: Cheating Tools / Game Hacks
directly causes: Automated Account Seasoning
directly causes: Risk Device Identification Bypass
indirectly supports: Web Scraping Risk
mitigated by: Terminal Abnormal Environment Detection
mitigated by: ROOT/Jailbreak Detection
mitigated by: Device Fingerprinting
citation: What Are Root Tools?
updated: 2026-06-11
version: 1

Custom Browsers
type: AttackTool
break id: AT0021
stix type: tool
description: Custom browsers (also known as fingerprint browsers or anti-detect browsers) are tools that modify browser cores or create independent browser environments to customize browser fingerprint parameters (such as User-Agent, Canvas, WebGL, font lists, etc.), achieving the goal of forging new browser identities. Many professional companies abroad sell such paid browser software, including Antidetect, Multilogin, GoLogin, and AdsPower. They also provide features such as automatic proxy, mass control, cookie robots, and device standard libraries, with visual interfaces for easy operation. Black-grey market actors use custom browsers to simultaneously operate a large number of uncorrelated browser identities on the same computer for batch registration, multi-account operation, traffic inflation, coupon abuse, and other cheating activities.
keywords: Custom Browsers
keywords: anti-detect browser
keywords: fingerprint browser
keywords: browser profile manager
keywords: browser fingerprint spoofing
keywords: Multilogin
keywords: GoLogin
keywords: AdsPower
keywords: Incogniton
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Unfair Resource Seizure
indirectly supports: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Ad Fraud
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Web Scraping Risk
indirectly supports: Bulk Account Registration
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Device Profiling
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Ban
citation: Excerpts from 'Risk Control Essentials'
updated: 2026-06-11
version: 1

Headless Browsers
type: AttackTool
break id: AT0022
stix type: tool
description: A headless browser is a browser without a graphical user interface (GUI) but with a complete browser core (including JavaScript parsing engine, rendering engine, etc.). It can be programmatically controlled via scripts to simulate real browser usage scenarios for page access, form submission, screenshots, and other operations. Common headless browser tools include Puppeteer (Chrome), Playwright (multi-browser), and Selenium. In the black-grey market, headless browsers are primarily used for web scraping to capture various types of data on the web, and are also commonly used for batch registration, automated traffic inflation, price monitoring, and other scenarios. Due to their interface-free nature, they run efficiently and are difficult to detect.
keywords: Headless Browsers
keywords: headless Chrome
keywords: headless Chromium
keywords: Puppeteer
keywords: Playwright
keywords: Selenium WebDriver
keywords: browser automation framework
keywords: undetected chromedriver
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Unfair Resource Seizure
indirectly supports: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Web Scraping Risk
indirectly supports: Bulk Account Registration
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
mitigated by: Device Profiling
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Ban
citation: Puppeteer Documentation
updated: 2026-06-13
version: 1

Automation Scripts
type: AttackTool
break id: AT0023
stix type: tool
description: Automation scripts automate repetitive operations that would otherwise require manual execution through code. In many cases, they do not involve exploiting system vulnerabilities but simply automate manual operations through machines, a common means for developers to improve daily work efficiency. In the black-grey market, automation scripts are commonly used for batch registration, automated traffic inflation, grabbing red packets, snapping up coupons, auto-order grabbing, and other scenarios, serving as an important tool for black-grey market actors to achieve scaled cheating.
keywords: Automation Scripts
keywords: bot script
keywords: macro script
keywords: RPA script
keywords: auto-click script
keywords: workflow automation script
keywords: task automation bot
keywords: browser automation script
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Gold Farming
mitigated by: Human Verification Technology
mitigated by: Behavioral CAPTCHA
mitigated by: Silent CAPTCHA
mitigated by: API Signature Verification
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Ban
citation: ICBC Releases 2022 Cyber Financial Black Market Research Report
updated: 2026-06-11
version: 1

GPS Spoofing Tools
type: AttackTool
break id: AT0024
stix type: tool
description: GPS spoofing tools (also known as virtual location tools or location disguise tools) are software that modifies device GPS positioning information to disguise the geographic location of a phone or device to any specified location. Using fake location apps, users can disguise their location and simulate GPS coordinates in any country, allowing them to search for any location they want to spoof. In the black-grey market, GPS spoofing tools are commonly used for virtual location check-ins, faking rider locations, remote coupon abuse, false sign-ins, and other scenarios. Additionally, more advanced GPS spoofing methods include using SDR (Software Defined Radio) devices to forge satellite signals, affecting GPS receivers within a target area.
keywords: GPS Spoofing Tools
keywords: fake GPS
keywords: mock location app
keywords: location spoofer
keywords: virtual location tool
keywords: geo spoofing app
keywords: GPS joystick
keywords: location changer
directly causes: Risk Device Identification Bypass
directly causes: Geolocation Fraud
indirectly supports: Process Automation
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Protocol-Level Automation
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: User Profiling
citation: GPS Spoofing: Everything You Need to Know
updated: 2026-06-11
version: 1

Deobfuscation Tools
type: AttackTool
break id: AT0025
stix type: tool
description: Deobfuscation tools are tools used to restore obfuscated code to a readable form. Obfuscation is a common code protection technique used to hide the true intent and functionality of code, increasing the difficulty of reverse engineering. Deobfuscation tools help developers analyze and understand obfuscated code for vulnerability analysis and security auditing. They typically use static analysis techniques to syntactically and semantically analyze code and restore it to a readable form.
keywords: Deobfuscation Tools
keywords: unobfuscator
keywords: JavaScript deobfuscator
keywords: AST deobfuscation
keywords: de4js
keywords: JSNice
keywords: unpacker tool
keywords: control flow deobfuscation
directly causes: Process Automation
directly causes: HTTP Request Analysis
indirectly supports: Automated Account Seasoning
indirectly supports: Third-Party Account Aggregation
indirectly supports: Facial Recognition Bypass
indirectly supports: Application Reverse Engineering
indirectly supports: Application Traffic Interception
indirectly supports: Protocol-Level Automation
indirectly supports: Fake Viral Referral
indirectly supports: Unauthorized Plugin Promotion
indirectly supports: Third-Party Price Comparison
indirectly supports: Access Link Hijacking
mitigated by: API Signature Verification
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Traffic Encryption
citation: Prerequisite Knowledge for AST Deobfuscation: Concepts
citation: JS Reverse Engineering: AST Restoration of Geetest Obfuscated JS in Practice
updated: 2026-06-13
version: 1

Score-Running Platforms
type: AttackTool
break id: AT0026
stix type: tool
description: Score-running platforms are online platforms that illegally provide payment settlement services for illegal activities (such as gambling, pornography, and fraud) through third-party payment platforms, partner banks, and other service provider interfaces. When gamblers top up funds on overseas gambling websites, this information is published on score-running platforms, and registered members grab orders in a manner similar to ride-hailing. After successfully grabbing an order, the gambling platform displays a corresponding payment QR code, and the gambler transfers funds directly to the platform member via the QR code.
keywords: Score-Running Platforms
keywords: transaction laundering platform
keywords: merchant laundering network
keywords: payment pass-through platform
keywords: money mule payment hub
keywords: funds routing platform
keywords: underground settlement platform
keywords: merchant laundering platform
directly causes: Money Laundering Risk
directly causes: Illegal Cash-Out
directly causes: Payment Channel Abuse
directly causes: Platform-Facilitated Gambling
directly causes: Platform Pornography Risk
indirectly supports: Stolen Card Payment
mitigated by: Real-Name Identity Verification
mitigated by: Risk Control Strategy
mitigated by: Data Profiling
mitigated by: Complaint and Reporting Channel
mitigated by: Legal Action
citation: ICBC Releases 2022 Cyber Financial Black Market Research Report
citation: Harm Analysis and Regulatory Recommendations for Money Laundering via Payment Platforms
updated: 2026-06-11
version: 1

Card Vending Platforms
type: AttackTool
break id: AT0027
stix type: tool
description: Card vending platforms (auto-delivery card platforms) are online platforms that provide automated transaction services for virtual goods. Merchants can input virtual product information (such as game activation codes, accounts, membership keys, phone recharge cards, etc.) into the platform, and the system automatically delivers goods upon payment, enabling 24/7 unmanned transactions. In the black/gray market, these platforms are widely used for selling and distributing illegal accounts, personal information, black card keys, and other prohibited virtual goods, serving as critical infrastructure for the black/gray market resource trading network. Due to their typical features of anonymity, automated transactions, and rapid fund flow, many criminal groups use them for batch selling of illegal virtual goods and fund settlement.
keywords: Card Vending Platforms
keywords: auto-delivery card platform
keywords: digital goods vending platform
keywords: cdkey vending site
keywords: activation code marketplace
keywords: digital card marketplace
keywords: gift card vending panel
keywords: automated key delivery
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Account Reselling
indirectly supports: Bulk Account Registration
mitigated by: Phone Number Intelligence
mitigated by: Silent CAPTCHA
mitigated by: Device Fingerprinting
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
citation: Behind the Scaling of Gray/Black Markets: The Resource Trading Network Composed of Card Vending Platforms
updated: 2026-06-11
version: 1

Decompilation Tools
type: AttackTool
break id: AT0028
stix type: tool
description: Computer software reverse engineering refers to performing reverse analysis and research on another party's software target program (such as an executable program) to deduce the design elements such as ideas, principles, structure, algorithms, processing procedures, and operating methods used in their software product, and in certain cases possibly deriving the source code. Android reverse engineering is a technique for decompiling packaged APPs and analyzing source code to understand APP implementation logic.
keywords: Decompilation Tools
keywords: disassembler
keywords: reverse engineering suite
keywords: JADX
keywords: apktool
keywords: Ghidra
keywords: IDA Pro
keywords: dnSpy
directly causes: Application Reverse Engineering
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
indirectly supports: Cheating Tools / Game Hacks
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Traffic Encryption
citation: Mobile App Tampering and Reverse Engineering - OWASP MASTG
citation: MASTG-TEST-0048: Testing Reverse Engineering Tools Detection - OWASP
updated: 2026-06-13
version: 1

Image CAPTCHA Recognition Tools
type: AttackTool
break id: AT0029
stix type: tool
description: Image CAPTCHA recognition tools are technical tools used to automatically identify and crack various types of graphical CAPTCHAs. Early versions were primarily based on OCR (Optical Character Recognition) technology, which confirms character shapes by examining light and dark patterns in images and converts them into computer text. With the evolution of CAPTCHA technology and the development of deep learning, modern CAPTCHA recognition tools widely use deep learning-based image recognition models (such as CNN and Caffe-based frameworks), significantly improving recognition rates for multiple CAPTCHA types including character CAPTCHAs, slider CAPTCHAs, and click-selection CAPTCHAs. In the black/gray market, such tools typically operate as CAPTCHA-solving services, providing batch automated CAPTCHA recognition. Criminal groups encapsulate captured CAPTCHA challenges as tasks and submit them to these services, which return results through AI models or human labor, thereby bypassing websites' CAPTCHA security protections.
keywords: Image CAPTCHA Recognition Tools
keywords: captcha OCR
keywords: image captcha solver
keywords: OCR-based captcha bypass
keywords: Tesseract OCR
keywords: CNN captcha solver
keywords: Geetest solver
keywords: OCR captcha cracker
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
indirectly supports: Protocol-Level Automation
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: CAPTCHA Bypass
mitigated by: Human Verification Technology
mitigated by: Behavioral CAPTCHA
mitigated by: Silent CAPTCHA
citation: Tesseract OCR Documentation
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1

Cookie Login Tools
type: AttackTool
break id: AT0030
stix type: tool
description: By extracting, stealing, or purchasing cookies from already-logged-in accounts, these tools perform credential reuse to achieve 'login-free' authentication for accounts.
keywords: Cookie Login Tools
keywords: session hijacking
keywords: session cookie theft
keywords: pass-the-cookie
keywords: cookie injection
keywords: stolen session replay
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Account Takeover
directly causes: Login Credential Reuse
directly causes: Login Credential Theft
directly causes: Account Renting / Lending
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Automated Account Seasoning
indirectly supports: Third-Party Account Aggregation
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Security Audit
mitigated by: Device Fingerprinting
mitigated by: User Profiling
mitigated by: Anomalous Access Behavior Detection
citation: Session Hijacking Attack - OWASP
updated: 2026-06-13
version: 1

Crowdsourcing Platforms
type: AttackTool
break id: AT0031
stix type: tool
description: Crowdsourcing refers to a model where gangs or organizations recruit large numbers of volunteer workers online to complete tasks in bulk for small rewards. Due to current technological limitations, no intelligent or automated technology can match normal human operation levels. Therefore, crowdsourcing can easily bypass various security protections and identification strategies. Since all resource requesters are real users, even if crowdsourcing behavior can be identified, it is difficult to implement countermeasures without causing significant impact and complaints.
keywords: Crowdsourcing Platforms
keywords: crowdturfing platform
keywords: microtask marketplace
keywords: paid task platform
keywords: click farm platform
keywords: human solver service
keywords: captcha farm
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
indirectly supports: Auction Sniping
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: CAPTCHA Bypass
indirectly supports: Fake Viral Referral
indirectly supports: Fake Transactions
mitigated by: Identity Authentication (Login)
mitigated by: Single-Device Login
mitigated by: Identity Security Audit
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: Revealing the Current State of Micro-Crowdsourcing Industry: Gray/Black Markets Flourish, Opportunities and Challenges Coexist
updated: 2026-06-11
version: 1

Browser Extensions
type: AttackTool
break id: AT0032
stix type: tool
description: Includes but is not limited to malicious promotional extensions, price comparison extensions, ad-blocking extensions, and membership benefit acquisition extensions.
keywords: Browser Extensions
keywords: browser add-on
keywords: browser plugin
keywords: Chrome extension
keywords: Firefox add-on
keywords: Edge extension
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Unauthorized Plugin Promotion
directly causes: Third-Party Price Comparison
directly causes: Access Link Hijacking
directly causes: Unauthorized Promotional Redirection
directly causes: Unauthorized Plugin Cashback
directly causes: Ad Fraud
directly causes: Ad Link Hijacking
directly causes: Ad Blocking
directly causes: Account Takeover
indirectly supports: Process Automation
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Search Result Manipulation
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
citation: Case Report on Unfair Competition by Browser Extensions
updated: 2026-06-11
version: 1

Hijacking Extensions
type: AttackTool
break id: AT0032-001
stix type: tool
description: Browser extensions that hijack legitimate traffic through unconventional means such as viruses, trojans, unauthorized bundled installs, forced homepage changes, browser or address bar hijacking, page hijacking, search engine manipulation, or user data tampering. They may also hijack traffic by modifying URL parameters or injecting pop-ups during normal user browsing. An example is monitoring IE access via Microsoft's COM connection point technology (the traditional BHO method) to generate or modify affiliate URLs.
keywords: Hijacking Extensions
keywords: browser hijacker
keywords: Browser Helper Object
keywords: BHO
keywords: traffic hijacking extension
keywords: affiliate hijacking plugin
keywords: search hijacker
keywords: ad injection extension
directly causes: Unauthorized Plugin Promotion
directly causes: Ad Link Hijacking
directly causes: Ad Blocking
directly causes: File or Document Theft
directly causes: Employee Account Compromise
indirectly supports: Fake Viral Referral
indirectly supports: Third-Party Price Comparison
indirectly supports: Access Link Hijacking
indirectly supports: Unauthorized Promotional Redirection
indirectly supports: Unauthorized Plugin Cashback
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Red Packet Grabbing Bot
indirectly supports: Game Cheating Software
indirectly supports: Automated Account Seasoning
indirectly supports: Third-Party Account Aggregation
mitigated by: Human Verification Technology
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
citation: Easy Location Spoofing? Fake Location Tool Principle Analysis and Countermeasures
updated: 2026-06-11
version: 1

Surveillance and Eavesdropping Devices
type: AttackTool
break id: AT0033
stix type: tool
description: Surveillance and eavesdropping devices are tools used for monitoring and intercepting communications, typically used illegally or without authorization. These devices are designed to obtain people's private information, eavesdrop on conversations, or collect sensitive data, potentially leading to privacy breaches, illegal surveillance, and other security threats.
keywords: Surveillance and Eavesdropping Devices
keywords: bugging device
keywords: wiretap device
keywords: listening device
keywords: spy camera
keywords: hidden microphone
keywords: audio surveillance device
directly causes: Trade Secret Leakage
directly causes: Office Environment Risk
directly causes: Unauthorized Physical Access
directly causes: Surveillance and Eavesdropping
indirectly supports: File or Document Theft
indirectly supports: Employee Sabotage
indirectly supports: Unauthorized Device Connection
indirectly supports: Device Loss
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Employee Policy Violations
indirectly supports: Physical Damage and Destruction
indirectly supports: Prohibited and Illegal Products
indirectly supports: MFA Fatigue Attack
mitigated by: Access Control System
mitigated by: Access Control
mitigated by: Security Awareness Training
mitigated by: Video Surveillance
mitigated by: Legal Action
citation: Public Security Organs Crack Down on Illegal Eavesdropping and Surveillance Devices
updated: 2026-06-13
version: 1

Covert Recording Devices
type: AttackTool
break id: AT0033-001
stix type: tool
description: Covert recording devices are equipment or tools used for illegal or unauthorized recording of photos, videos, or audio. These tools are typically designed to be very discreet, intended to record without attracting the attention of the monitored subject. Such tools may include cameras, audio recorders, hidden camera devices, or other eavesdropping equipment, and may be misused to violate personal privacy, illegally obtain confidential information, or serve other illegal purposes.
keywords: Covert Recording Devices
keywords: hidden camera
keywords: spy recorder
keywords: pinhole camera
keywords: concealed recorder
keywords: body-worn recorder
keywords: mini DVR
directly causes: Trade Secret Leakage
directly causes: Unauthorized Device Connection
directly causes: Surveillance and Eavesdropping
indirectly supports: Office Environment Risk
indirectly supports: Unauthorized Physical Access
indirectly supports: Employee Sabotage
indirectly supports: Physical Damage and Destruction
indirectly supports: Employee Error Risk
indirectly supports: File or Document Theft
indirectly supports: Device Loss
indirectly supports: Wireless Network Risk
indirectly supports: MFA Fatigue Attack
indirectly supports: Employee Corruption
mitigated by: Access Control System
mitigated by: Access Control
mitigated by: Security Awareness Training
mitigated by: Internal Review Mechanism
mitigated by: Video Surveillance
citation: Public Security Cyber Departments Crack Down on Eavesdropping and Covert Recording Crimes
updated: 2026-06-13
version: 1

Risk IP Addresses
type: AttackTool
break id: AT0034
stix type: tool
description: Risk IP addresses are IP addresses considered unsafe in the network security domain. They may be malicious IPs, IPs being maliciously exploited, or IPs that have been misjudged. Risk IP addresses are classified into three risk levels: high, medium, and low. High-risk IPs are considered malicious, medium-risk IPs are being maliciously exploited, and low-risk IPs are misjudged.
keywords: Risk IP Addresses
keywords: IP reputation
keywords: malicious IP list
keywords: bad IP feed
keywords: high-risk IP
keywords: threat intelligence IP
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Automated Simulator
indirectly supports: Auction Sniping
indirectly supports: Blocklisted IP Bypass
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Metric Manipulation / Ranking Fraud
mitigated by: Identity Authentication (Login)
mitigated by: IP Intelligence
mitigated by: IP Profiling
citation: Microsoft Defender TI Reputation Scoring
updated: 2026-06-11
version: 1

Proxy IP
type: AttackTool
break id: AT0034-001
stix type: tool
description: A proxy IP is a network proxy technique used to conceal a device's real IP address. The client first connects to the proxy IP, which then forwards the request to the target website, leaving only the proxy IP in the site's access logs. Common proxy IP types include HTTP proxies, HTTPS proxies, and SOCKS proxies.
keywords: Proxy IP
keywords: proxy server
keywords: forward proxy
keywords: SOCKS5 proxy
keywords: HTTP proxy
keywords: HTTPS proxy
keywords: rotating proxy
directly causes: Automated Simulator
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Malicious Benefit Abuse
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Order Brushing
directly causes: Web Scraping Risk
directly causes: Bulk Account Registration
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Third-Party Account Aggregation
directly causes: Carding Attack
directly causes: Proxy Login / Proxy Order Placement
indirectly supports: Process Automation
indirectly supports: Coupon Enumeration
indirectly supports: Resource Exhaustion Attack
indirectly supports: Distributed Denial of Service
indirectly supports: Blocklisted IP Bypass
mitigated by: IP Intelligence
mitigated by: IP Profiling
mitigated by: Proxy Detection
mitigated by: Network Proxy Detection
citation: What Is a Proxy IP?
updated: 2026-06-11
version: 1

Second-Dial IP
type: AttackTool
break id: AT0034-002
stix type: tool
description: A 'second-dial IP' exploits the fact that home broadband connections obtain a new IP address each time they reconnect. Criminals rent large numbers of home broadband lines and rapidly generate millions of IP addresses to form an 'IP pool', which is then provided to cybercrime groups. The resulting massive volume of IP addresses circumvents normal IP-based restrictions, making it extremely difficult for law enforcement to trace criminal activity.
keywords: Second-Dial IP
keywords: redial IP
keywords: broadband redial IP
keywords: dynamic residential IP
keywords: residential proxy
keywords: ISP proxy
keywords: IP pool
directly causes: Automated Simulator
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Bot Scalping Risk
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Malicious Benefit Abuse
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Order Brushing
directly causes: Web Scraping Risk
directly causes: Bulk Account Registration
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Third-Party Account Aggregation
directly causes: Carding Attack
directly causes: Proxy Login / Proxy Order Placement
indirectly supports: Process Automation
indirectly supports: Coupon Enumeration
indirectly supports: Unfair Resource Seizure
indirectly supports: Resource Exhaustion Attack
indirectly supports: Distributed Denial of Service
indirectly supports: Blocklisted IP Bypass
mitigated by: IP Intelligence
mitigated by: IP Profiling
mitigated by: Proxy Detection
mitigated by: Network Proxy Detection
citation: What Is a Residential Proxy? Definition, Risks & Detection
updated: 2026-06-11
version: 1

Device Wipe Tools
type: AttackTool
break id: AT0036
stix type: tool
description: Device wipe tools completely reset a device to factory settings, clearing all user data, modifying device fingerprint data, and clearing all locally stored data from installed apps. After wiping, the device is theoretically a brand new device.
keywords: Device Wipe Tools
keywords: factory reset tool
keywords: phone wipe tool
keywords: device reset utility
keywords: mobile data wipe
keywords: device reflash tool
keywords: anti-forensics wipe
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
indirectly supports: Automated Simulator
indirectly supports: Risk Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
citation: Guidelines for Managing the Security of Mobile Devices in the Enterprise - NIST SP 800-124r2
updated: 2026-06-13
version: 1

Phone Backup and Restore Tools
type: AttackTool
break id: AT0037
stix type: tool
description: These tools perform comprehensive backups of a phone's current state, data, and device fingerprints, and restore them when needed. They can back up all files generated by a target app during runtime, then restore those files on a new device to deceive the app's server into thinking the account has always been operated on the same device, gradually increasing account permissions for account nurturing and user retention purposes.
keywords: Phone Backup and Restore Tools
keywords: mobile backup tool
keywords: phone cloning tool
keywords: app data migration
keywords: full device backup
keywords: device fingerprint migration
keywords: backup restore utility
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
indirectly supports: Automated Simulator
indirectly supports: Risk Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
citation: A Comprehensive Analysis of Device Intelligence Spoofing ...
updated: 2026-06-11
version: 1

Account Rental Platforms
type: AttackTool
break id: AT0038
stix type: tool
description: Account rental platforms are online trading platforms that provide account rental services. Users can select rental accounts for desired games and server regions, make secure payments, and then experience the game. Account rental platforms allow players to enjoy better gaming experiences at minimal cost.
keywords: Account Rental Platforms
keywords: account leasing platform
keywords: game account rental
keywords: shared account marketplace
keywords: account sharing service
keywords: gaming account escrow
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Account Reselling
indirectly supports: Unauthorized Account Sharing
indirectly supports: Minor Age Verification Bypass
indirectly supports: Account Renting / Lending
indirectly supports: Game Storage Accounts
mitigated by: Force Session Logout
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
mitigated by: Account Penalty
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: User Profiling
mitigated by: Contractual Clause Restrictions
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
citation: How Does a Part-Time Side Hustle Turn You Into a Tool for Crime?
updated: 2026-06-11
version: 1

Identity Document Set (4-Piece)
type: AttackTool
break id: AT0039
stix type: tool
description: The 4-piece identity document set refers to an ID card, the corresponding phone SIM card, the corresponding bank card, and an online banking USB key. This complete identity impersonation package is known as the '4-piece set' in black markets. Generally, the bank cards already have online banking activated, and some SIM cards even have prepaid credit. More sophisticated 4-piece set dealers can even customize specific hometown, gender, age, mobile carrier, and bank for buyers.
keywords: Identity Document Set (4-Piece)
keywords: 4-piece set
keywords: four-piece set
keywords: identity package
keywords: KYC bundle
keywords: bank card SIM package
directly causes: Coupon Enumeration
directly causes: Bulk Fake Account Manipulation
directly causes: Account Privilege Reselling
directly causes: Points Redemption Reselling
directly causes: Minor Age Verification Bypass
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Real-World Identity Theft
indirectly supports: Fake Identity Authentication
mitigated by: Additional Identity Authorization
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: 3,200 People Used '4-Piece Sets' and '8-Piece Sets' to Commit Crimes
updated: 2026-06-11
version: 1

Money Laundering Bank Cards
type: AttackTool
break id: AT0039-001
stix type: tool
description: Bank cards used by criminal networks to launder illicit funds (i.e., to legitimize proceeds of crime). For example, gambling and fraud rings use these cards to transfer and launder money via purchases and bank transfers.
keywords: Money Laundering Bank Cards
keywords: money mule card
keywords: mule bank card
keywords: laundering card
keywords: cash-out bank card
keywords: drop bank card
directly causes: Money Laundering Risk
directly causes: Credit Card Fraud
directly causes: Platform Online Loan Fraud
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Account Privilege Reselling
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Interceptor Card Registration
mitigated by: Threat Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Supreme People's Court: Judicial Interpretation on Money Laundering Criminal Cases
updated: 2026-06-11
version: 1

Money Laundering Digital Wallets
type: AttackTool
break id: AT0039-002
stix type: tool
description: Encrypted digital currency accounts or digital wallets used by criminal networks to launder illicit funds. For example, criminals transfer funds via digital currency payments and transfers, exploiting the anonymity of digital currencies to evade regulatory scrutiny.
keywords: Money Laundering Digital Wallets
keywords: mule wallet
keywords: crypto mule wallet
keywords: laundering wallet
keywords: cash-out wallet
keywords: digital currency mule account
directly causes: Money Laundering Risk
directly causes: Cryptocurrency Money Laundering Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Account Privilege Reselling
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Interceptor Card Registration
mitigated by: Threat Intelligence
mitigated by: Real-Name Identity Verification
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: Zhejiang Shaoxing Yuecheng Police Crack Money Laundering Case Using Digital Yuan Accounts
updated: 2026-06-11
version: 1

Corporate Identity Document Set (8-Piece)
type: AttackTool
break id: AT0040
stix type: tool
description: The 8-piece corporate identity document set refers to 8 items: corporate bank card, USB key, legal representative ID card, business license, corporate account, company seal, legal representative personal seal, and corporate account opening permit. These are essential tools for implementing telecom network fraud and money laundering. The key step in telecom fraud is transferring stolen funds, and criminals purchase these personal or corporate accounts through various illegal channels at high prices to achieve their illegal purposes.
keywords: Corporate Identity Document Set (8-Piece)
keywords: 8-piece set
keywords: eight-piece set
keywords: corporate account package
keywords: company registration package
keywords: shell company kit
keywords: corporate KYC bundle
directly causes: Coupon Enumeration
directly causes: Bulk Fake Account Manipulation
directly causes: Account Privilege Reselling
directly causes: Points Redemption Reselling
directly causes: Minor Age Verification Bypass
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Real-World Identity Theft
indirectly supports: Fake Identity Authentication
mitigated by: Additional Identity Authorization
mitigated by: Risk Control Strategy
mitigated by: Facial Recognition
mitigated by: Legal Action
citation: 3,200 People Used '4-Piece Sets' and '8-Piece Sets' to Commit Crimes
updated: 2026-06-11
version: 1

Money Laundering Corporate Bank Accounts
type: AttackTool
break id: AT0040-001
stix type: tool
description: Corporate bank accounts used by criminal networks to launder illicit funds. Because corporate accounts support high transaction limits and frequent transfers, they are commonly used as both collection hubs and distribution points for laundering illicit money.
keywords: Money Laundering Corporate Bank Accounts
keywords: corporate mule account
keywords: mule business account
keywords: shell company bank account
keywords: laundering merchant account
keywords: drop company account
directly causes: Transfer Fraud
directly causes: Money Laundering Risk
directly causes: Illegal Cash-Out
directly causes: Payment Channel Abuse
indirectly supports: Coupon Enumeration
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Traffic Attribution Fraud
indirectly supports: Prohibited and Illegal Products
indirectly supports: Web Scraping Risk
indirectly supports: Return Fraud
indirectly supports: Flash Return Arbitrage
indirectly supports: Credit Card / Loan Cash-Out
indirectly supports: Platform Fraud Risk
indirectly supports: Cryptocurrency Money Laundering Risk
mitigated by: Threat Intelligence
mitigated by: Risk Control Strategy
mitigated by: Legal Action
citation: 3,200 People Exploiting '4-Piece' and '8-Piece' Sets — Chenzhou Police Dismantle Large-Scale SIM/Bank Card Black Market
updated: 2026-06-11
version: 1

Offer Wall Tools
type: AttackTool
break id: AT0041
stix type: tool
description: An Offer Wall Tool is an advertising or marketing tool typically used with mobile apps or online platforms. Its main purpose is to earn virtual points, reward points, or coupons by having users complete specific tasks, activities, or transactions. These tasks typically include participating in surveys, trying other apps, registering memberships, and watching ad videos. Offer wall tools are usually provided by advertising platforms or third-party providers and integrated into apps or websites to increase user engagement and retention.
keywords: Offer Wall Tools
keywords: offerwall
keywords: rewarded offerwall
keywords: CPA offerwall
keywords: incentivized traffic platform
keywords: reward task wall
keywords: app install offerwall
directly causes: Promotional Activity Cheating
directly causes: Click Fraud
directly causes: Fake App Installs
directly causes: Malicious Benefit Abuse
indirectly supports: Ad Fraud
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Access Source Tracking
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Anomalous Access Behavior Detection
mitigated by: Anomalous Access Source Detection
citation: 2021 Mobile Advertising Anti-Fraud White Paper
updated: 2026-06-13
version: 1

Credential Stuffing Tools
type: AttackTool
break id: AT0042
stix type: tool
description: Credential stuffing tools use leaked username and password data (typically from data breaches on one website) to automate batch login attempts on other websites or systems. The core principle of credential stuffing is that many users reuse the same username and password across different websites. Attackers only need to obtain a batch of leaked credentials to attempt bulk logins on numerous target websites within a short time. Credential stuffing differs from brute force attacks: brute force tries all possible password combinations, while credential stuffing directly uses real leaked credentials for matching, making it far more efficient. These tools typically feature batch import of leaked credentials, multi-threaded concurrent login attempts, automatic CAPTCHA recognition (paired with CAPTCHA-solving platforms), proxy IP rotation to evade rate limits and IP bans, and automatic extraction of account information after successful logins.
keywords: Credential Stuffing Tools
keywords: account checker
keywords: combo checker
keywords: combo list checker
keywords: OpenBullet
keywords: SilverBullet
keywords: Sentry MBA
keywords: checker config
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Verification Code Brute Force
directly causes: Employee Account Compromise
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Protocol-Level Automation
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Process Automation
indirectly supports: Instant Bid Sniping
indirectly supports: Automated Login Risk
indirectly supports: Bulk Account Enumeration
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Multi-Factor Authentication
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Force Session Logout
mitigated by: Forced Password Reset
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Biometric Identification
mitigated by: Data Profiling
mitigated by: Response Status Obfuscation
mitigated by: Proxy Detection
mitigated by: Legal Action
mitigated by: Anomalous Access Behavior Detection
mitigated by: Password Complexity Requirements
mitigated by: Account Ban
citation: Credential Stuffing - OWASP
updated: 2026-06-13
version: 1

Anonymous Communication Tools
type: AttackTool
break id: AT0043
stix type: tool
description: Anonymous instant messaging tools are communication applications designed to hide user identity information to provide higher levels of privacy protection, commonly used by criminal groups for covert communication and illegal activity coordination. Common tools include: Telegram — an instant messaging app providing end-to-end encrypted secret chats, self-destructing messages, anonymous usernames, channels, and groups. Due to its strong encryption and difficulty of legal jurisdiction, it has become a widely used communication tool in the black/gray market for data trading, illegal information dissemination, and criminal coordination. Signal — a privacy-focused instant messaging app with end-to-end encrypted message transmission ensuring only communicating parties can read messages. Signal requires a phone number for registration but supports setting usernames to hide the phone number. Features such as end-to-end encryption, self-destructing messages, and anonymity make these tools useful for privacy protection while also being exploited by criminal groups to evade regulation and law enforcement tracking.
keywords: Anonymous Communication Tools
keywords: anonymous messenger
keywords: encrypted chat app
keywords: secure messaging app
keywords: burner chat
keywords: secret chat
keywords: self-destructing messages
directly causes: Trade Secret Leakage
directly causes: Money Laundering Risk
directly causes: Data Breach
indirectly supports: Insider-Outsider Collusion
mitigated by: Threat Intelligence
mitigated by: Digital Watermark/Text Watermark
mitigated by: Text Watermark
citation: Telegram Becomes a 'Hotbed' for Black/Gray Markets
updated: 2026-06-13
version: 1

Click Simulation Tools
type: AttackTool
break id: AT0044
stix type: tool
description: Click simulation tools are software or applications designed to simulate user click or touch operations to automatically execute tasks related to graphical user interface (GUI) interaction. These tools are typically used to automate and simplify repetitive tasks, especially in software testing, screen recording, automation script writing, and data collection. Features include mouse simulation, touch simulation, keyboard simulation, screen coordinate control, recording and playback, and multi-platform support.
keywords: Click Simulation Tools
keywords: auto clicker
keywords: click bot
keywords: tap bot
keywords: mouse macro
keywords: auto tapper
keywords: GUI automation
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Auction Sniping
directly causes: Click Fraud
directly causes: Red Packet Grabbing Bot
directly causes: Game Cheating Software
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Web Scraping Risk
indirectly supports: Automated Account Seasoning
indirectly supports: Automated Login Risk
indirectly supports: Gold Farming
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Device Profiling
mitigated by: Proxy Detection
mitigated by: Feature Randomization
mitigated by: DOM Randomization
mitigated by: Random Event Workflow
mitigated by: Anomalous Access Behavior Detection
mitigated by: Credit Level Restriction
mitigated by: Account Ban
citation: Click Simulator Software Collection
updated: 2026-06-11
version: 1

Flash Sale Tools
type: AttackTool
break id: AT0045
stix type: tool
description: Flash sale tools are software that assists users in grabbing items on shopping platforms by automatically identifying and simulating manual operations to achieve fast order placement. These tools are typically used to grab hot-selling or discounted items, helping users improve their chances of success. Features include automatic product information recognition, automatic order form filling, automatic order submission, and automatic page refresh.
keywords: Flash Sale Tools
keywords: flash sale bot
keywords: shopping bot
keywords: checkout bot
keywords: purchase bot
keywords: sniping bot
keywords: auto checkout
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
indirectly supports: Protocol-Level Automation
indirectly supports: Automated Reselling
indirectly supports: Buy Low, Sell High
indirectly supports: Dropshipping Store
indirectly supports: Store Cluster
indirectly supports: Coupon Enumeration
indirectly supports: Automated Login Risk
indirectly supports: Bulk Account Enumeration
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Verification Code Brute Force
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Cloud-Side Anti-Crawling
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Biometric Identification
mitigated by: Data Profiling
mitigated by: Access Source Tracking
mitigated by: Proxy Detection
mitigated by: Feature Randomization
mitigated by: Random Event Workflow
mitigated by: Anomalous Access Behavior Detection
mitigated by: Credit Level Restriction
mitigated by: Account Ban
citation: Recommended Taobao Flash Sale Tools
updated: 2026-06-11
version: 1

Ranking Manipulation Tools
type: AttackTool
break id: AT0046
stix type: tool
description: Ranking manipulation tools simulate manual operations to inflate network clicks, views, comments, and other metrics. These tools generally fall into two categories: human-powered and machine-powered. Human-powered means real users download specified apps — this method has the lowest risk and best results but higher cost. Machine-powered tools either simulate user search, download, and install data from different regions without needing real phones, or establish studios with large numbers of phones running automated scripts and one-click device spoofing programs.
keywords: Ranking Manipulation Tools
keywords: app ranking bot
keywords: search boost bot
keywords: install farm panel
keywords: review manipulation service
keywords: engagement boosting tool
keywords: vote bot
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Order Brushing
directly causes: Fake Reviews
indirectly supports: Promotional Activity Cheating
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Threat Intelligence
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Device Profiling
mitigated by: Proxy Detection
mitigated by: Credit Level Restriction
mitigated by: Account Ban
citation: Astroturfing - Wikipedia
updated: 2026-06-11
version: 1

Task Completion Tools
type: AttackTool
break id: AT0047
stix type: tool
description: Task completion tools are automated or semi-automated tools used to execute repetitive or tedious tasks to improve work efficiency and quality. These tools can automatically or semi-automatically complete various tasks such as data entry, information scraping, web crawling, and process automation according to user needs and custom settings.
keywords: Task Completion Tools
keywords: task bot
keywords: automation script
keywords: macro runner
keywords: workflow bot
keywords: RPA bot
keywords: web automation
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Automated Simulator
directly causes: Metric Manipulation / Ranking Fraud
indirectly supports: Promotional Activity Cheating
indirectly supports: Automated Account Seasoning
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Time Limiting
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Biometric Identification
mitigated by: Device Profiling
mitigated by: Feature Randomization
mitigated by: Contractual Clause Restrictions
mitigated by: Anomalous Access Behavior Detection
mitigated by: Credit Level Restriction
mitigated by: Account Ban
citation: Game Automation Script Tools and Black Market Activity Analysis
updated: 2026-06-11
version: 1

Virtual Machine
type: AttackTool
break id: AT0048
stix type: tool
description: A Virtual Machine (VM) is a software entity that simulates an actual computer system on computer hardware. Through software-level virtualization technology, it divides a physical computer into multiple independent and mutually isolated virtual environments, each called a virtual machine.
keywords: Virtual Machine
keywords: VM
keywords: virtualized environment
keywords: guest OS
keywords: device emulator
keywords: Android emulator
keywords: multi-instance emulator
directly causes: Process Automation
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Virtual Machine Detection
mitigated by: Device Fingerprinting
mitigated by: Device Tagging
citation: What is a Virtual Machine? - VMware
updated: 2026-06-13
version: 1

Game Cheats
type: AttackTool
break id: AT0049
stix type: tool
description: Game cheats refer to modifying or manipulating games through illegal means or third-party software to gain unfair game advantages or engage in other violations. Cheats may include cheat software that modifies game memory, files, or data to achieve functions not allowed by game design such as invincibility, auto-aim, and wallhacks; automation scripts that simulate player behavior to automatically perform operations like auto-grinding and auto-leveling; external modification tools; virtual currency and equipment trading; and cheat codes and vulnerability exploitation.
keywords: Game Cheats
keywords: aimbot
keywords: wallhack
keywords: ESP cheat
keywords: triggerbot
keywords: trainer
keywords: mod menu
keywords: memory editor
directly causes: Automated Simulator
directly causes: Cheating Tools / Game Hacks
directly causes: Game Cheating Software
directly causes: AFK / Idle Behavior
directly causes: Boosting (Carry Service)
directly causes: Spectator Wallhack
directly causes: Escort Cheating
directly causes: Gold Farming
indirectly supports: Process Automation
indirectly supports: Access Link Hijacking
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Unauthorized Plugin Promotion
indirectly supports: Third-Party Price Comparison
indirectly supports: Unauthorized Promotional Redirection
indirectly supports: Unauthorized Plugin Cashback
indirectly supports: Fake Viewer Count Inflation
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Risk Control Strategy
mitigated by: Anomalous Access Behavior Detection
mitigated by: Account Penalty
citation: A Systematic Review of Technical Defenses Against Software-Based Cheating in Online Multiplayer Games
updated: 2026-06-13
version: 1

Offline Game Bots
type: AttackTool
break id: AT0049-001
stix type: tool
description: Offline game bots are specially designed programs that use a large number of computer hosts (compromised machines or proxy service providers) to simulate normal game clients sending and receiving data packets to game servers. Game servers cannot distinguish the true source of these large numbers of data packets, often causing server load to exceed maximum limits, resulting in login failures, connection timeouts, server crashes, or other serious consequences.
keywords: Offline Game Bots
keywords: game bot
keywords: botting software
keywords: auto-grinding bot
keywords: leveling bot
keywords: farming bot
keywords: macro bot
keywords: offline automation bot
directly causes: Process Automation
directly causes: Cheating Tools / Game Hacks
directly causes: AFK / Idle Behavior
directly causes: Gold Farming
indirectly supports: Risk Device Identification Bypass
indirectly supports: Application Reverse Engineering
indirectly supports: Application Traffic Interception
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Cheat/Plugin Detection
mitigated by: Silent CAPTCHA
mitigated by: Client Application Hardening
mitigated by: Anti-Tampering Mechanism
mitigated by: Traffic Encryption
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1

Auto-Posting Bots
type: AttackTool
break id: AT0050
stix type: tool
description: An auto-posting bot is an automated tool that can bulk-post messages, comments, or replies on forums, social media platforms, and blogs for purposes such as spam flooding, traffic diversion, promotion, or public opinion manipulation. These bots typically feature multi-account management, content template variable substitution, scheduled posting, auto-bumping, CAPTCHA recognition, and the ability to simulate real user behavior to bypass basic platform defenses. In gray/black market scenarios, auto-posting bots are widely used for spam campaigns, astroturfing, SEO backlink building, and fake content dissemination.
keywords: Auto-Posting Bots
keywords: spam bot
keywords: forum poster bot
keywords: comment bot
keywords: auto reply bot
keywords: bump bot
keywords: posting automation
keywords: social media poster bot
directly causes: Automated Simulator
directly causes: Malicious Negative Reviews
directly causes: Spam Content
directly causes: Malicious Traffic Diversion
directly causes: Fake Reviews
directly causes: Platform Pornography Risk
indirectly supports: Process Automation
indirectly supports: Protocol-Level Automation
indirectly supports: Coupon Enumeration
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Upload Abuse
indirectly supports: Image Hosting Abuse
indirectly supports: Cloud Storage Abuse
indirectly supports: Automated Reselling
indirectly supports: SMS Bombing as a Service
mitigated by: Human Verification Technology
mitigated by: Silent CAPTCHA
mitigated by: Rate Limiting
mitigated by: Quantity Limiting
mitigated by: Malicious Content Detection
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Risk Control Strategy
mitigated by: Identity Authentication (Login)
mitigated by: Account Penalty
mitigated by: Device Fingerprinting
mitigated by: Traffic Encryption
mitigated by: Biometric Identification
mitigated by: Real-Name Identity Verification
mitigated by: Data Profiling
mitigated by: Proxy Detection
mitigated by: Anomalous Access Behavior Detection
mitigated by: PR Crisis Response
mitigated by: Account Ban
citation: How Are Auto-Scripting Tools Like Key Wizard Punished
updated: 2026-06-11
version: 1

Risk Email Accounts
type: AttackTool
break id: AT0051
stix type: tool
description: From a defense perspective against gray/black markets, risk email accounts are email accounts that may be exploited by criminal actors. They mainly fall into two categories: first, large numbers of legitimate email accounts obtained through malicious registration, fraud, and cyberattacks, used for illegal activities such as sending spam, online fraud, and data breaches; second, temporary email accounts (disposable emails) that can be quickly obtained without real-name registration and are heavily used by criminal actors for batch registration of fake accounts and bypassing email verification.
keywords: Risk Email Accounts
keywords: disposable email
keywords: temporary email
keywords: burner email
keywords: throwaway email
keywords: aged email account
keywords: bulk mailbox
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
mitigated by: Real-Name Identity Verification
mitigated by: Threat Intelligence
mitigated by: User Profiling
mitigated by: Account Ban
citation: Black Market Big Data: Malicious Email Accounts See New Surge
updated: 2026-06-11
version: 1

Malicious Peripherals
type: AttackTool
break id: AT0052
stix type: tool
description: Malicious peripherals are devices into which malicious software writes malicious code via USB interfaces or other means. When the peripheral is plugged into a computer, the malicious code automatically runs, thereby attacking the computer.
keywords: Malicious Peripherals
keywords: rogue USB device
keywords: malicious USB
keywords: weaponized peripheral
keywords: USB attack device
keywords: hardware implant
directly causes: Device Malware Infection
directly causes: Office Environment Risk
directly causes: Unauthorized Device Connection
directly causes: Physical Damage and Destruction
directly causes: Surveillance and Eavesdropping
indirectly supports: Unauthorized Physical Access
mitigated by: Video Surveillance
mitigated by: Access Control
mitigated by: Endpoint Detection and Response
citation: Hardware Additions - MITRE ATT&CK T1200
updated: 2026-06-13
version: 1

KON-Boot
type: AttackTool
break id: AT0052-001
stix type: tool
description: KON-Boot is a tool that bypasses Windows and macOS login passwords. It boots from a USB device to circumvent the login authentication process.
keywords: KON-Boot
keywords: password bypass tool
keywords: Windows password bypass
keywords: macOS password bypass
keywords: bootable login bypass
directly causes: File or Document Theft
directly causes: Employee Account Compromise
directly causes: Privilege Escalation / Unauthorized Access
directly causes: Office Environment Risk
directly causes: Unauthorized Device Connection
indirectly supports: Unauthorized Physical Access
indirectly supports: Surveillance and Eavesdropping
mitigated by: Video Surveillance
mitigated by: Access Control
mitigated by: Endpoint Detection and Response
citation: Kon-Boot FAQ / Troubleshooting
updated: 2026-06-13
version: 1

USB Killer
type: AttackTool
break id: AT0052-002
stix type: tool
description: USB Killer is a device that injects high-voltage electrical current into a computer via the USB port, instantly burning out hardware components such as the motherboard, CPU, and RAM.
keywords: USB Killer
keywords: USB kill stick
keywords: USB voltage attack
keywords: power surge USB device
keywords: hardware destruction USB
directly causes: Employee Sabotage
directly causes: Office Environment Risk
directly causes: Unauthorized Device Connection
directly causes: Physical Damage and Destruction
indirectly supports: Unauthorized Physical Access
indirectly supports: Surveillance and Eavesdropping
mitigated by: Video Surveillance
mitigated by: Access Control
citation: Nearly 1,000 Data Breaches in Q1 2023, Affecting 1,204 Companies Across 38 Industries
updated: 2026-06-13
version: 1

BadUSB
type: AttackTool
break id: AT0052-003
stix type: tool
description: BadUSB is a USB device pre-loaded with malicious code. When inserted into a computer, the malicious code executes automatically, enabling attacks such as keystroke injection, data exfiltration, or malware installation.
keywords: BadUSB
keywords: USB firmware attack
keywords: malicious HID
keywords: HID spoofing
keywords: keystroke injection USB
keywords: Rubber Ducky
directly causes: File or Document Theft
directly causes: Device Malware Infection
directly causes: Employee Account Compromise
directly causes: Office Environment Risk
directly causes: Unauthorized Device Connection
directly causes: Surveillance and Eavesdropping
indirectly supports: Unauthorized Physical Access
mitigated by: Video Surveillance
mitigated by: Access Control
mitigated by: Endpoint Detection and Response
citation: BadUSB - On Accessories that Turn Evil - Black Hat USA 2014
updated: 2026-06-13
version: 1

Malicious AI Applications
type: AttackTool
break id: AT0053
stix type: tool
description: The term 'malicious AI applications' describes practices that use artificial intelligence technology for malicious purposes or illegal activities. These technologies may be abused in violation of laws and ethical standards, causing potential harm. Related concepts include Deepfake technology for generating realistic fake content, fusion of malware with AI to evade detection, social engineering using natural language processing, AI-powered cyberattacks, automated large-scale network attacks, and AI-generated online fraud content.
keywords: Malicious AI Applications
keywords: AI-enabled cybercrime
keywords: AI-powered scam tools
keywords: malicious generative AI
keywords: AI social engineering
keywords: AI malware augmentation
directly causes: False Advertising
directly causes: Game Cheating Software
directly causes: Malicious Negative Reviews
directly causes: Spam Content
directly causes: Content Theft
directly causes: Fake Reviews
directly causes: Generative AI Risk
directly causes: Phishing Attack
directly causes: Platform Pornography Risk
directly causes: AI Deepfake Risk
indirectly supports: CAPTCHA Bypass
indirectly supports: Facial Recognition Bypass
mitigated by: Automated AI-Generated Content Detection
citation: AI as a 'Repackaging' Black Market Tool? Boss of Dalan Aodai Sued for Plagiarism and Assembly Line Production
updated: 2026-06-13
version: 1

AI Fraud Chatbots
type: AttackTool
break id: AT0053-001
stix type: tool
description: AI fraud chatbots are chatbots built with artificial intelligence and natural language processing capabilities, designed to conduct deceptive and fraudulent activities. They simulate realistic conversations to trick users into revealing personal or financial information, or into taking harmful actions. Typical fraud scenarios include social engineering (gaining trust to extract sensitive credentials), fake investment advice (promoting fraudulent opportunities to steal funds), romance scams (simulating relationships to solicit money), fake customer service (impersonating legitimate companies to harvest credentials), and malicious link distribution (embedding phishing links within conversations).
keywords: AI Fraud Chatbots
keywords: AI scam bot
keywords: scam chatbot
keywords: social engineering chatbot
keywords: fake customer support bot
keywords: romance scam chatbot
directly causes: Malicious Traffic Diversion
directly causes: Malicious User Harassment
directly causes: In-Platform Message Harassment
directly causes: Platform Fraud Risk
indirectly supports: Malicious Ad Placement
indirectly supports: AI-Generated Fake Reviews
mitigated by: Malicious Content Detection
mitigated by: Automated AI-Generated Content Detection
mitigated by: Legal Action
citation: How to Escape the Precision Scams Woven by Big Data
updated: 2026-06-13
version: 1

AI Deepfake Video
type: AttackTool
break id: AT0053-002
stix type: tool
description: Criminal networks use AI face-swapping tools at scale to produce deepfake videos for identity verification bypass services. For example, when a social media account triggers a platform's risk control and requires facial authentication, criminals use AI face-swapping to pass the check. Additionally, cases of fraud via conferencing software combined with real-time AI face-swapping are increasingly common — scammers instruct victims to install a video conferencing app, then impersonate a trusted acquaintance through real-time face-swapping to gain the victim's trust and steal funds.
keywords: AI Deepfake Video
keywords: deepfake video
keywords: face swap video
keywords: real-time face swap
keywords: deepfake KYC bypass
keywords: video call impersonation
directly causes: Facial Recognition Bypass
directly causes: Platform Fraud Risk
directly causes: AI Deepfake Risk
indirectly supports: Transfer Fraud
indirectly supports: AI-Generated Low-Quality Content
indirectly supports: AI-Generated Fake Reviews
indirectly supports: AI Voice Cloning Fraud
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Automated AI-Generated Content Detection
mitigated by: Malicious Content Detection
mitigated by: Legal Action
citation: Maliciously Fabricated Pornographic Videos: What Black-Grey Markets Has AI Spawned? How to Identify Them?
updated: 2026-06-13
version: 1

AI Deepfake Tools
type: AttackTool
break id: AT0053-003
stix type: tool
description: AI deepfake tools are a collection of tools that use deep learning technology (particularly Generative Adversarial Networks and diffusion models) to generate highly realistic fake face images, videos, and audio. These tools can implement face swapping, face reenactment, expression transfer, and full-body synthesis. Representative tools include DeepFaceLab, FaceSwap, Wav2Lip, and various commercial AI face-swapping applications. Attackers use these tools to forge identities for fraud, bypass facial recognition authentication, create fake videos for extortion or opinion manipulation.
keywords: AI Deepfake Tools
keywords: DeepFaceLab
keywords: FaceSwap
keywords: Wav2Lip
keywords: face swapping
keywords: face reenactment
keywords: deepfake generator
directly causes: Facial Recognition Bypass
directly causes: Phishing Attack
directly causes: Real-World Identity Theft
directly causes: AI Deepfake Risk
directly causes: AI Face-Swap Fraud
directly causes: AI Synthetic Video Fraud
directly causes: AI Voice Cloning Fraud
indirectly supports: Digital Avatar Live Stream Fraud
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: AI Hallucination Risk
indirectly supports: Platform-Facilitated Gambling
indirectly supports: Platform Pornography Risk
indirectly supports: Malicious Player Poaching
indirectly supports: AI-Generated Fake Reviews
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Biometric Identification
mitigated by: Facial Recognition
mitigated by: Real-Name Identity Verification
mitigated by: Malicious Content Detection
mitigated by: Complaint and Reporting Channel
mitigated by: AI Content Provenance
mitigated by: PR Crisis Response
citation: DeepFaceLab - GitHub
citation: AI Security Governance Research Report (2025) - CAICT
updated: 2026-06-11
version: 1

LLM Automated Attack Tools
type: AttackTool
break id: AT0053-004
stix type: tool
description: LLM automated attack tools use the capabilities of large language models (such as GPT, Claude, etc.) to automate and enhance traditional cyberattacks. These tools can automatically generate phishing emails and social engineering scripts, write malicious code and exploit scripts, automate vulnerability scanning and penetration testing, batch generate fake content and reviews, and automate CAPTCHA recognition and bypass. Attackers use prompt engineering, fine-tuning, and agent orchestration techniques to transform general large models into specialized attack assistance tools. They also include tools targeting LLM services themselves, such as prompt injection frameworks, jailbreak toolkits, AI-agent attack orchestration tools, and MCP tool-call abuse tools.
keywords: LLM Automated Attack Tools
keywords: WormGPT
keywords: FraudGPT
keywords: phishing email generator
keywords: malware code generator
keywords: prompt injection framework
keywords: agentic attack toolkit
keywords: LLM jailbreak tool
directly causes: Phishing Attack
directly causes: LLM Prompt Injection Risk
directly causes: Direct Prompt Injection
directly causes: Indirect Prompt Injection
directly causes: AI-Automated Attack Escalation
directly causes: AI Agent Tool Misuse / Excessive Autonomy Risk
indirectly supports: Protocol-Level Automation
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Shadow AI Risk
mitigated by: LLM Security Protection
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Privileged Access Management
mitigated by: API Security Gateway
mitigated by: Human Verification Technology
mitigated by: Rate Limiting
mitigated by: Risk Control Strategy
mitigated by: AI Content Detection
citation: OWASP Top 10 for LLM Applications
citation: Global Cybersecurity Outlook 2025 - WEF
updated: 2026-06-11
version: 1

Digital Human Generation Tools
type: AttackTool
break id: AT0053-005
stix type: tool
description: Digital human generation tools use AI technology to create virtual digital human avatars and drive them for real-time interaction. These tools can generate highly realistic virtual character images based on a small amount of real person photos or video material, and achieve real-time lip sync, facial expression changes, and body movements through text-driven or voice-driven methods. In live streaming scenarios, digital humans can conduct 24-hour uninterrupted live-stream e-commerce and interactive chat. Attackers use digital human tools for fake live-stream e-commerce fraud, impersonating real people for social fraud, and batch generating fake account content.
keywords: Digital Human Generation Tools
keywords: AI avatar generator
keywords: digital human platform
keywords: virtual presenter
keywords: real-time avatar
keywords: lip-sync avatar
keywords: virtual influencer generator
directly causes: False Advertising
directly causes: AI-Generated Low-Quality Content
directly causes: AI Deepfake Risk
directly causes: AI-Generated Fake Reviews
directly causes: Digital Avatar Live Stream Fraud
indirectly supports: AI Synthetic Video Fraud
indirectly supports: Platform-Facilitated Gambling
indirectly supports: Malicious Ad Placement
indirectly supports: Content Compliance Risk
indirectly supports: Spam Content
indirectly supports: Malicious Traffic Diversion
indirectly supports: AI Hallucination Risk
indirectly supports: Platform Pornography Risk
indirectly supports: Fake Shipment
indirectly supports: Content Infringement
mitigated by: AI Content Detection
mitigated by: Deepfake Detection
mitigated by: Malicious Content Detection
mitigated by: Manual Content Review
mitigated by: Account Penalty
mitigated by: Complaint and Reporting Channel
citation: AI Digital Human Technology Development Report
citation: Virtual Digital Human In-depth Industry Report
updated: 2026-06-11
version: 1

AI Voice Cloning Tools
type: AttackTool
break id: AT0053-006
stix type: tool
description: AI voice cloning tools use deep learning technology to generate synthetic voices highly similar to a target person based on a small amount of voice samples (typically only a few seconds to a few minutes). These tools use Text-to-Speech (TTS) and Voice Conversion technology to generate cloned voices of any content in real time or offline. Representative technologies include VALL-E, Bark, and Tortoise-TTS. Attackers use voice cloning tools for phone fraud (impersonating friends or leaders), bypassing voiceprint authentication systems, and creating fake audio evidence.
keywords: AI Voice Cloning Tools
keywords: voice cloning
keywords: speaker cloning
keywords: voice conversion
keywords: real-time voice changer
keywords: VALL-E
keywords: Bark
keywords: Tortoise-TTS
directly causes: Transfer Fraud
directly causes: Phishing Attack
directly causes: Real-World Identity Theft
directly causes: AI Deepfake Risk
directly causes: AI Voice Cloning Fraud
indirectly supports: AI Face-Swap Fraud
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
indirectly supports: Credential Brute Force
indirectly supports: Login Credential Theft
indirectly supports: Stolen Card Payment
indirectly supports: Stolen Card Fraud
indirectly supports: Points Theft
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
mitigated by: Deepfake Detection
mitigated by: Biometric Identification
mitigated by: Multi-Factor Authentication
mitigated by: Customer Service Follow-Up Confirmation
mitigated by: AI Content Provenance
mitigated by: PR Crisis Response
citation: VALL-E: Neural Codec Language Models
citation: AI Voice Cloning Security Risk Analysis
updated: 2026-06-11
version: 1

Fake Call Spoofing Tool
type: AttackTool
break id: AT0053-007
stix type: tool
description: Fake call spoofing tools combine AI voice cloning technology with caller ID spoofing to disguise caller identity and voice during phone calls. Unlike AT0059 AI Voice Cloning Tool which only provides voice synthesis capabilities, fake call spoofing tools add telecom-level number forgery and call path manipulation capabilities. Key features and attack methods include: ① Caller ID spoofing: altering caller display numbers through VoIP gateways or SS7 signaling vulnerabilities, making the victim's phone display the real number of the target person or institution; ② AI real-time voice cloning: converting the attacker's voice to the target person's voice during calls in real-time, supporting two-way real-time dialogue; ③ Call scenario scripts: providing dialogue scripts and contingency response talking points for common scam scenarios; ④ Multi-line concurrent calling: supporting simultaneous spoofed calls to multiple targets for large-scale fraud; ⑤ Call recording and analysis: automatically recording call content for script improvement and subsequent extortion. This tool is key to the AI-driven evolution of telecom fraud, with global AI voice cloning fraud losses exceeding $400 billion in 2025.
keywords: Fake Call Spoofing Tool
keywords: caller ID spoofing
keywords: call spoofing
keywords: spoofed VoIP call
keywords: vishing kit
keywords: SS7 spoofing
keywords: real-time voice changer call
directly causes: Phishing Attack
directly causes: Platform Fraud Risk
directly causes: AI Voice Cloning Fraud
indirectly supports: Facial Recognition Bypass
indirectly supports: Real-World Identity Theft
indirectly supports: AI Deepfake Risk
indirectly supports: SIM Swap Attack
mitigated by: Real-Time Deepfake Detection
mitigated by: Fake Call Detection
mitigated by: SIM Card Security Verification
mitigated by: Customer Service Follow-Up Confirmation
citation: Google Android Fake Call Detection Announcement
citation: Combating Spoofed Robocalls with Caller ID Authentication
updated: 2026-06-11
version: 1

System/Application Vulnerability Exploitation Tools
type: AttackTool
break id: AT0054
stix type: tool
description: Vulnerability exploitation tools are software or hardware tools used to discover and exploit security vulnerabilities in computer systems or network systems. These tools can be used for vulnerability scanning, vulnerability mining, and vulnerability attacks to assess system security or conduct penetration testing.
keywords: System/Application Vulnerability Exploitation Tools
keywords: exploit framework
keywords: exploit kit
keywords: PoC exploit
keywords: 0day exploit
keywords: 1day exploit
keywords: Metasploit module
keywords: RCE exploit
directly causes: Data Exfiltration Risk
directly causes: Ransomware Attack
directly causes: Server Cryptomining
directly causes: Business Logic Tampering Risk
directly causes: Privilege Escalation / Unauthorized Access
indirectly supports: Verification Code Brute Force
indirectly supports: Critical Information Infrastructure (CII) Compliance Risk
indirectly supports: Classified Protection (MLPS) Compliance Risk
indirectly supports: Supply Chain Risk
indirectly supports: Software Supply Chain Risk
indirectly supports: Hardware Supply Chain Risk
indirectly supports: Cloud Service Supply Chain Risk
indirectly supports: Outsourced Personnel Risk
indirectly supports: Ransomware as a Service (RaaS)
indirectly supports: User Privacy Leakage
mitigated by: Vulnerability Identification
mitigated by: Vulnerability Remediation
citation: MITRE ATT&CK - Software
updated: 2026-06-13
version: 1

CI/CD Credential Scanning and Poisoning Tool
type: AttackTool
break id: AT0054-001
stix type: tool
description: Toolsets for finding pipeline credentials, modifying build scripts, or injecting malicious code into artifacts.
keywords: CI/CD Credential Scanning and Poisoning Tool
keywords: CI/CD credential scanning
keywords: pipeline poisoning
keywords: build script tampering
keywords: artifact injection
keywords: supply-chain tooling
directly causes: CI/CD Pipeline Credential Exposure
directly causes: Build Artifact Poisoning Risk
directly causes: Dependency Confusion and Malicious Package Poisoning
indirectly supports: SBOM Absence Hiding Vulnerability Impact
mitigated by: Least-Privilege CI/CD Pipeline Governance
mitigated by: Build Artifact Signing and Provenance
mitigated by: Dependency Pinning and Malicious Package Detection
citation: OWASP Top 10 CI/CD Security Risks
updated: 2026-06-17
version: 1

Cloud Configuration Scanning and Key Abuse Tool
type: AttackTool
break id: AT0054-002
stix type: tool
description: Tools for enumerating cloud resources, detecting public storage, exploiting leaked keys, and moving laterally.
keywords: Cloud Configuration Scanning and Key Abuse Tool
keywords: cloud configuration scanner
keywords: leaked key exploitation
keywords: public bucket discovery
keywords: cloud lateral movement
keywords: IAM enumeration
directly causes: Public Cloud Storage Bucket Exposure
directly causes: Cloud IAM Over-Permissioning
indirectly supports: Vendor Remote Access Abuse
mitigated by: Cloud Identity Permission Reduction
mitigated by: Cloud Configuration Baselines and Drift Detection
mitigated by: Privileged Access Management
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Data Export and DLP Bypass Tool
type: AttackTool
break id: AT0054-003
stix type: tool
description: Tools for bulk-exporting collaboration documents, splitting archives, bypassing watermarking, and evading outbound audits.
keywords: Data Export and DLP Bypass Tool
keywords: bulk data export
keywords: DLP bypass
keywords: archive splitting
keywords: watermark evasion
keywords: outbound audit evasion
directly causes: Unauthorized Use of Shared Data
directly causes: Customer Success and Support Ticket Data Exposure
indirectly supports: Collaborative Document Link Exposure
mitigated by: Enterprise Collaboration Data Loss Prevention
mitigated by: Data-Sharing Approval and Purpose Limitation
mitigated by: Data Loss Prevention
mitigated by: Legal Action
mitigated by: Risk Control Strategy
mitigated by: Zero Trust Architecture
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

MFA Bombing and Session Hijacking Tool
type: AttackTool
break id: AT0054-004
stix type: tool
description: Tools for MFA fatigue attacks, cookie theft, token replay, and session takeover.
keywords: MFA Bombing and Session Hijacking Tool
keywords: MFA bombing
keywords: push fatigue automation
keywords: cookie theft
keywords: token replay
keywords: session takeover
directly causes: MFA Fatigue Attack
directly causes: Session Token Replay
indirectly supports: Account Takeover
mitigated by: MFA Fatigue Resistance and High-Risk Verification
mitigated by: Session Token Binding and Replay Detection
mitigated by: Credential Reuse Detection
mitigated by: Legal Action
mitigated by: Threat Intelligence
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

CDN and Edge Configuration Attack Tool
type: AttackTool
break id: AT0054-005
stix type: tool
description: Tools for testing cache keys, header pollution, edge functions, and WAF rule defects.
keywords: CDN and Edge Configuration Attack Tool
keywords: CDN cache testing
keywords: cache key confusion
keywords: header pollution
keywords: edge function abuse
keywords: WAF rule testing
directly causes: CDN Cache Poisoning
directly causes: Edge Function Configuration Abuse
indirectly supports: Shadow API Exposure Risk
mitigated by: Edge and CDN Rule Change Audit
mitigated by: Cloud Configuration Baselines and Drift Detection
mitigated by: API Input Validation and Contract Testing
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Dependency Poisoning Toolkit
type: AttackTool
break id: AT0054-006
stix type: tool
description: Tools and methods for publishing malicious packages to open-source repositories (npm, PyPI, Maven, RubyGems, Go Modules). Attack techniques include: typosquatting (registering packages with names similar to popular ones); dependency confusion (exploiting priority vulnerabilities between internal and public packages); maintainer account takeover; and installation hook exploitation. Typical consequences include credential theft, reverse shells, and cryptocurrency mining.
keywords: Dependency Poisoning
keywords: Malicious Package
keywords: Supply Chain Poisoning
keywords: npm Poisoning
keywords: PyPI Poisoning
keywords: Typosquatting
keywords: Dependency Confusion
directly causes: Dependency Confusion and Malicious Package Poisoning
directly causes: Data Breach
indirectly supports: Automated Account Seasoning
indirectly supports: Unauthorized Outbound Connection and C2 Control
indirectly supports: Insufficient Employee Security Awareness
mitigated by: Supply Chain Security Audit
mitigated by: Dependency Pinning and Malicious Package Detection
mitigated by: SBOM Generation and Vulnerability Impact Analysis
mitigated by: Threat Intelligence
mitigated by: Legal Action
mitigated by: Vulnerability Identification
citation: MITRE ATT&CK: Supply Chain Compromise - Compromise Software Supply Chain (T1195.002)
citation: OpenSSF Package Analysis Project
updated: 2026-06-26
version: 1

Container Escape & K8s Attack Toolkit
type: AttackTool
break id: AT0054-007
stix type: tool
description: Attack tools targeting containerized environments and Kubernetes clusters. Key capabilities include: container escape via kernel vulnerabilities or privileged configurations; K8s API abuse through misconfigured RBAC permissions or exposed API servers; lateral movement via ServiceAccount tokens and secret leakage; and persistence through malicious CronJobs, DaemonSets, or Admission Webhooks. Representative tools include CDK, PEIRATES, and kube-hunter.
keywords: Container Escape
keywords: Kubernetes Attack
keywords: K8s Penetration
keywords: Docker Escape
keywords: Pod Privilege Escalation
keywords: RBAC Abuse
directly causes: Data Breach
directly causes: Unauthorized Outbound Connection and C2 Control
indirectly supports: Automated Account Seasoning
indirectly supports: Insufficient Employee Security Awareness
mitigated by: Network Segmentation Technology
mitigated by: Zero Trust Architecture
mitigated by: Endpoint Detection and Response
mitigated by: Vulnerability Identification
mitigated by: Threat Intelligence
mitigated by: Legal Action
citation: MITRE ATT&CK: Container Administration Command (T1609)
citation: Kubernetes Security Best Practices - CISA
updated: 2026-06-26
version: 1

Cryptocurrency Mixers
type: AttackTool
break id: AT0060
stix type: tool
description: A cryptocurrency mixer (also known as a tumbler) is a tool or service that obscures fund flows by mixing cryptocurrency transactions from multiple users. The mixer pools multiple users' cryptocurrencies, processes them through multiple splits, delays, and randomization, then sends equivalent amounts (minus fees) to user-specified new addresses, severing the link between original transactions and final receiving addresses. Common mixing techniques include CoinJoin protocol, zero-knowledge proof mixing (such as Tornado Cash), and cross-chain bridge mixing. Attackers use mixers for money laundering, ransomware payment transfers, dark web transaction fund laundering, and evading financial regulation.
keywords: Cryptocurrency Mixers
keywords: crypto tumbler
keywords: coin mixer
keywords: tumbling service
keywords: CoinJoin
keywords: Tornado Cash
keywords: transaction obfuscation
directly causes: Money Laundering Risk
directly causes: Cryptocurrency Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: NFT Fraud Risk
mitigated by: Threat Intelligence
mitigated by: IP Intelligence
mitigated by: Risk Address Intelligence
mitigated by: Data Profiling
mitigated by: Risk Control Strategy
mitigated by: Legal Action
mitigated by: Compliance Governance
mitigated by: Multi-Chain Asset Mapping and Tracking
mitigated by: Blockchain Analysis Tool Application
mitigated by: On-Chain Compliance and Regulatory Collaboration
citation: Tornado Cash Sanctions Event - OFAC
citation: Cryptocurrency Mixing Technology Analysis
updated: 2026-06-11
version: 1

API Automated Abuse Tools
type: AttackTool
break id: AT0061
stix type: tool
description: API automated abuse tools are a collection of tools specifically targeting Web API interfaces for automated attacks and abuse. These tools can automatically discover and enumerate API endpoints, bypass API rate limits and authentication mechanisms, and batch-call API interfaces for data scraping or business logic abuse. Main functions include API endpoint discovery and enumeration, authentication bypass (token forgery, JWT attacks, OAuth abuse), rate limit bypass (IP rotation, distributed requests, parameter mutation), and business logic abuse (bulk registration, bulk ordering, price tampering).
keywords: API Automated Abuse Tools
keywords: API bot
keywords: endpoint enumerator
keywords: API scraper
keywords: rate limit bypass tool
keywords: JWT attack tool
keywords: business logic abuse automation
directly causes: Web Scraping Risk
directly causes: Denial of Service Risk
directly causes: API Abuse Risk
directly causes: API Enumeration Attack
directly causes: API Rate Limit Bypass
directly causes: API Business Logic Abuse
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Benefit Abuse
indirectly supports: Resource Exhaustion Attack
indirectly supports: AI-Automated Attack Escalation
indirectly supports: Protocol-Level Automation
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
mitigated by: API Security Gateway
mitigated by: Rate Limiting
mitigated by: API Signature Verification
mitigated by: Improving Service Availability
mitigated by: Risk Control Strategy
mitigated by: Additional Identity Authorization
citation: OWASP API Security Top 10 2023
citation: Analysis of API security protection
updated: 2026-06-11
version: 1

API Enumeration and Authorization Testing Tool
type: AttackTool
break id: AT0061-001
stix type: tool
description: Automation for enumerating API paths, parameters, object IDs, and authorization boundaries.
keywords: API Enumeration and Authorization Testing Tool
keywords: API enumeration
keywords: object ID testing
keywords: authorization boundary testing
keywords: BOLA testing
keywords: API security testing
directly causes: Shadow API Exposure Risk
directly causes: API Object-Level Authorization Risk
directly causes: API Bulk Call Resource Exhaustion
directly causes: Session Token Replay
indirectly supports: Webhook Forgery and Event Replay
mitigated by: API Asset Discovery and Catalog Governance
mitigated by: Strong API Authorization and Object-Level Access Control
mitigated by: API Rate Limiting and Quota Control
mitigated by: Session Token Binding and Replay Detection
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1

Webhook Replay Tool
type: AttackTool
break id: AT0061-002
stix type: tool
description: Tooling that captures, modifies, and replays webhook events to test signature verification and idempotency defects.
keywords: Webhook Replay Tool
keywords: webhook replay
keywords: event capture
keywords: signature bypass testing
keywords: idempotency testing
keywords: timestamp replay
directly causes: Webhook Forgery and Event Replay
indirectly supports: API Object-Level Authorization Risk
mitigated by: Webhook Signature Verification and Replay Protection
mitigated by: API Input Validation and Contract Testing
mitigated by: Risk Control Strategy
mitigated by: Rate Limiting
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1

SaaS OAuth Abuse Tool
type: AttackTool
break id: AT0061-003
stix type: tool
description: Tools for inducing authorization, enumerating SaaS permissions, and exporting mail or drive data at scale.
keywords: SaaS OAuth Abuse Tool
keywords: OAuth grant abuse
keywords: SaaS permission enumeration
keywords: mailbox export
keywords: drive data extraction
keywords: third-party app abuse
directly causes: SaaS Third-Party App Authorization Abuse
directly causes: Collaborative Document Link Exposure
indirectly supports: Customer Success and Support Ticket Data Exposure
mitigated by: SaaS Application Permission Audit
mitigated by: Enterprise Collaboration Data Loss Prevention
mitigated by: OAuth Permission Minimization
mitigated by: Legal Action
mitigated by: Risk Control Strategy
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Payment Fraud Automation Tool
type: AttackTool
break id: AT0061-004
stix type: tool
description: Automation for bulk ordering, fake transactions, refund abuse, and forged chargeback evidence.
keywords: Payment Fraud Automation Tool
keywords: payment fraud automation
keywords: bulk ordering script
keywords: refund abuse tooling
keywords: chargeback evidence forgery
keywords: merchant cash-out
directly causes: Merchant Cash-Out and Fake Transaction Fraud
directly causes: Chargeback and Refund Abuse
directly causes: Payment Tokenization Misconfiguration
indirectly supports: Promotional Activity Cheating
mitigated by: Payment Account and Merchant Onboarding Review
mitigated by: Refund and Dispute Risk-Control Strategy
mitigated by: Transaction Risk Monitoring
mitigated by: Legal Action
mitigated by: Risk Control Strategy
citation: PCI Data Security Standard
updated: 2026-06-17
version: 1

Ad Attribution Fraud Tool
type: AttackTool
break id: AT0061-005
stix type: tool
description: Tooling for click injection, install farms, fake conversions, and affiliate commission fraud.
keywords: Ad Attribution Fraud Tool
keywords: click injection tooling
keywords: install farm automation
keywords: fake conversion script
keywords: affiliate fraud
keywords: attribution hijacking
directly causes: Ad Click Injection
directly causes: Fake Conversion and Install Farm
directly causes: Affiliate Marketing Commission Fraud
indirectly supports: Ad Fraud
mitigated by: Ad Delivery and Attribution Anti-Fraud
mitigated by: Affiliate Marketing and Channel Quality Scoring
mitigated by: Device Fingerprinting
mitigated by: Legal Action
mitigated by: Risk Control Strategy
mitigated by: Credit Level Restriction
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

SIM Swap Toolkit
type: AttackTool
break id: AT0062
stix type: tool
description: A SIM swap toolkit is a collection of tools and resources used to carry out SIM swap attacks. A SIM swap attack involves an attacker using social engineering to deceive telecom carrier customer service staff into transferring a target user's phone number to a SIM card controlled by the attacker, thereby taking over the target's phone number and intercepting SMS verification codes to bypass SMS-based two-factor authentication. The toolkit typically includes forged identity document templates, carrier customer service scripts, automated tools for calling carrier customer service, tools for batch verifying phone number status, and accompanying social engineering information collection tools.
keywords: SIM Swap Toolkit
keywords: SIM swapping kit
keywords: port-out fraud kit
keywords: carrier impersonation script
keywords: SMS OTP interception
keywords: number port-out scam
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Transfer Fraud
directly causes: Points Theft
directly causes: Real-World Identity Theft
directly causes: SIM Swap Attack
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Unauthorized Account Sharing
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
indirectly supports: Credential Brute Force
indirectly supports: Login Credential Theft
indirectly supports: Automated Login Risk
mitigated by: SIM Card Security Verification
mitigated by: Real-Name Identity Verification
mitigated by: Multi-Factor Authentication
mitigated by: Biometric Identification
mitigated by: Credential Reuse Detection
mitigated by: Force Session Logout
citation: SIM Swap Fraud - FBI IC3
citation: SIM Card Swap Attack Prevention Guide - CISA
updated: 2026-06-11
version: 1

Phishing Kits
type: AttackTool
break id: AT0063
stix type: tool
description: A phishing kit is a complete set of tools for quickly deploying phishing attacks, lowering the technical barrier for phishing. Kits typically include: page template libraries with pre-built high-fidelity login page templates for major banks, e-commerce platforms, and social media; credential collection backends for receiving and managing victim-submitted credentials; domain management tools for automated registration and configuration of lookalike domains and SSL certificates; email/SMS bulk sending modules; anti-detection mechanisms including anti-crawling, geo-restrictions, and User-Agent filtering; AiTM (Adversary-in-the-Middle) real-time relay functionality in advanced kits that uses reverse proxy technology to relay victim input to the real website in real-time, intercepting credentials and dynamic verification codes during the login process to bypass multi-factor authentication (MFA); and PhaaS (Phishing-as-a-Service) subscription-based models with technical support, automated updates, and attack analytics, forming a complete underground business model. Representative tools include Gophish (open source) and various commercial phishing kits circulating in underground markets.
keywords: Phishing Kits
keywords: phish kit
keywords: credential harvesting kit
keywords: phishing page builder
keywords: AiTM phishing kit
keywords: reverse proxy phishing kit
keywords: Gophish
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Phishing Attack
directly causes: Fake Identity Authentication
directly causes: Domain / Brand Impersonation
indirectly supports: Man-in-the-Middle Attack
indirectly supports: OAuth / SSO Authorization Abuse
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: MFA Bypass Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Credential Stuffing
mitigated by: Endpoint Detection and Response
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Multi-Factor Authentication
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Threat Intelligence
mitigated by: Domain & Link Threat Intelligence
mitigated by: Credential Reuse Detection
mitigated by: Legal Action
mitigated by: Email Digital Certificate
citation: Phishing Kit Analysis - APWG
citation: Phishing Attack Toolkit Technical Analysis
updated: 2026-06-11
version: 1

Phishing-as-a-Service (PhaaS) Platform
type: AttackTool
break id: AT0063-001
stix type: tool
description: Phishing-as-a-Service (PhaaS) is a black market service model that provides complete phishing attack hosting. Unlike AT0063 Phishing Toolkit which provides downloadable phishing tools and templates, PhaaS platforms operate in a SaaS model where attackers don't need to set up their own servers, register domains, or configure email delivery systems. They simply pay subscription fees to access a full suite of services from phishing page hosting, email/SMS delivery, credential collection to two-factor authentication token theft. Key features include: ① Phishing page hosting: providing highly realistic login page hosting with automatic HTTPS certificate configuration and anti-detection mechanisms; ② Email/SMS delivery services: integrated email and SMS sending channels with capabilities to bypass spam filters; ③ Credential and token collection: real-time collection of victim-entered credentials and 2FA tokens, with some platforms supporting AiTM session hijacking; ④ Anti-detection and evasion: integrating CAPTCHA bypass, anti-bot mechanisms, domain rotation, and cloud service abuse techniques; ⑤ Analytics dashboard: providing data analysis, conversion rate statistics, and victim management for phishing campaigns. Representative platforms include EvilProxy and Storm-0443's PhaaS platform. PhaaS significantly lowers the technical barrier for phishing attacks, enabling non-technical personnel to launch large-scale high-quality phishing campaigns.
keywords: Phishing-as-a-Service (PhaaS) Platform
keywords: PhaaS
keywords: phishing SaaS
keywords: hosted phishing kit
keywords: EvilProxy
keywords: Tycoon 2FA
keywords: LabHost
keywords: session cookie phishing service
directly causes: Account Takeover
directly causes: Phishing Attack
directly causes: AI-Enhanced Phishing Attack
directly causes: OAuth / SSO Authorization Abuse
indirectly supports: Multi-Factor Authentication (MFA) Bypass
indirectly supports: Employee Account Compromise
indirectly supports: Fake Identity Authentication
indirectly supports: Man-in-the-Middle Attack
indirectly supports: Domain / Brand Impersonation
mitigated by: Endpoint Detection and Response
mitigated by: Threat Intelligence
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: Credential Reuse Detection
mitigated by: Domain & Link Threat Intelligence
mitigated by: Legal Action
mitigated by: Email Digital Certificate
citation: Proofpoint PhaaS Threat Report 2025
citation: Microsoft Digital Defense Report 2025
updated: 2026-06-11
version: 1

Infostealers
type: AttackTool
break id: AT0064
stix type: tool
description: Infostealers are a class of malware specifically designed to steal sensitive information from victim devices, primarily targeting browser-saved passwords, cookies, autofill data, and cryptocurrency wallet keys. Representative families include RedLine, Raccoon, Vidar, LummaC2 (Lumma), StealC, and Meta. In 2025-2026, infostealers have become the top threat for global data breaches, with single incidents leading to billions of credentials being leaked. Main functions include: (1) Browser data theft: extracting saved login credentials, cookies, credit card information, and autofill data from Chrome, Firefox, Edge, and other browsers. (2) Cryptocurrency wallet theft: searching for and stealing key files and mnemonic phrases from MetaMask, Exodus, and other wallets. (3) Session token theft: stealing session tokens from Discord, Telegram, Steam, and other applications for password-free login. (4) Screenshots and keylogging: periodically capturing screen content and recording keyboard input to harvest unsaved credentials. (5) System information collection: gathering OS version, hardware information, and installed software lists. (6) Data exfiltration: sending stolen data through encrypted channels to attacker-controlled servers or Telegram bots. Infostealers typically spread through phishing emails, fake software downloads, cracked software, and fake VPN applications, with stolen data sold in bulk on dark web markets as 'logs'.
keywords: Infostealers
keywords: info stealer
keywords: stealer malware
keywords: RedLine Stealer
keywords: Raccoon Stealer
keywords: Vidar
keywords: LummaC2
keywords: StealC
keywords: cookie stealer
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: OAuth / SSO Authorization Abuse
directly causes: Non-Human Identity and API Key Abuse Risk
indirectly supports: Process Automation
indirectly supports: Protocol-Level Automation
indirectly supports: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Traffic Attribution Fraud
indirectly supports: Data Breach
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Automated Login Risk
indirectly supports: Man-in-the-Middle Attack
mitigated by: Endpoint Detection and Response
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Credential Reuse Detection
mitigated by: Biometric Identification
mitigated by: Privileged Access Management
citation: Infostealer Malware Analysis - MITRE ATT&CK
citation: RedLine Stealer Technical Analysis Report
updated: 2026-06-11
version: 1

Keyloggers
type: AttackTool
break id: AT0064-001
stix type: tool
description: A keylogger is a monitoring tool that records user keyboard input, used to steal passwords, credit card numbers, chat content, and other sensitive information. Keyloggers come in software and hardware types. Software keylogger implementations include API hooking (intercepting keyboard messages via SetWindowsHookEx), kernel-level drivers, form grabbing directly from browser form submissions, and screen recording assistance. Hardware keyloggers include USB interface devices and wireless keyboard signal interceptors. Modern keyloggers typically exist as functional modules within infostealers or may be embedded in legitimate software as spyware.
keywords: Keyloggers
keywords: keystroke logger
keywords: keyboard logger
keywords: hardware keylogger
keywords: software keylogger
keywords: form grabber
keywords: SetWindowsHookEx
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Fake Identity Authentication
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
indirectly supports: Credential Brute Force
indirectly supports: Login Credential Theft
indirectly supports: Stolen Card Payment
indirectly supports: Stolen Card Fraud
indirectly supports: Transfer Fraud
indirectly supports: Points Theft
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
mitigated by: USB Key Digital Certificate
mitigated by: Endpoint Detection and Response
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Multi-Factor Authentication
mitigated by: Biometric Identification
mitigated by: Mobile Threat Defense (MTD)
citation: Keylogger - MITRE ATT&CK T1056.001
updated: 2026-06-11
version: 1

Fake Apps
type: AttackTool
break id: AT0066
stix type: tool
description: Fake apps are malicious mobile applications that impersonate legitimate applications by mimicking the names, icons, and interface designs of well-known apps to deceive users into downloading and installing them, then implementing phishing, information theft, or backdoor implantation. Main characteristics include high-fidelity interfaces, permission abuse, malicious code implantation, push phishing, SMS interception on Android devices, and distribution through third-party app stores, phishing websites, and social media links.
keywords: Fake Apps
keywords: trojanized app
keywords: lookalike app
keywords: fake APK
keywords: repackaged app
keywords: rogue app store app
keywords: banking trojan app
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Fake Identity Authentication
directly causes: Man-in-the-Middle Attack
directly causes: Domain / Brand Impersonation
indirectly supports: OAuth / SSO Authorization Abuse
mitigated by: Endpoint Detection and Response
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Security Development Lifecycle
mitigated by: Bug Bounty Program
citation: Fake Apps - Google Play Protect
citation: Regulations on the Administration of Mobile Internet Application Information Services
updated: 2026-06-11
version: 1

Malicious QR Code Generators
type: AttackTool
break id: AT0067
stix type: tool
description: Malicious QR code generators are tools for generating QR codes pointing to phishing pages, malicious download links, or malicious payment requests. They exploit users' inability to visually identify QR code content to commit fraud. Main attack methods include phishing QR codes, malicious download QR codes, payment hijacking QR codes, WiFi phishing QR codes, dynamic QR codes that can be remotely updated, and QR code overlay attacks replacing legitimate QR codes in shared bikes and parking payment scenarios.
keywords: Malicious QR Code Generators
keywords: quishing kit
keywords: QR phishing
keywords: malicious QR code
keywords: dynamic QR code lure
keywords: payment QR replacement
keywords: WiFi QR phishing
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Phishing Attack
directly causes: QR Code Phishing (Quishing)
directly causes: Man-in-the-Middle Attack
directly causes: Domain / Brand Impersonation
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Automated Login Risk
indirectly supports: OAuth / SSO Authorization Abuse
indirectly supports: MFA Bypass Risk
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Endpoint Detection and Response
mitigated by: Credential Reuse Detection
citation: QR Code Security Risks - NIST
citation: QR Code Security Risks and Prevention
updated: 2026-06-11
version: 1

Password Dictionaries/Rainbow Tables
type: AttackTool
break id: AT0068
stix type: tool
description: Password dictionaries and rainbow tables are pre-computed datasets used for password cracking and credential stuffing attacks. Password dictionaries are text collections containing common passwords, leaked passwords, and rule-generated passwords; rainbow tables are pre-computed mapping tables of hash values to plaintext passwords. Types include general password dictionaries, leaked password databases for credential stuffing, rule-generated dictionaries, social engineering dictionaries based on target personal information, rainbow tables for common hash algorithms (MD5, SHA1), and localized dictionaries. Representative tools include rockyou.txt, SecLists, and cracking tools like Hashcat and John the Ripper.
keywords: Password Dictionaries/Rainbow Tables
keywords: password wordlist
keywords: wordlist
keywords: combo list
keywords: rainbow table
keywords: rockyou.txt
keywords: SecLists
keywords: Hashcat
keywords: John the Ripper
directly causes: Account Takeover
directly causes: Credential Brute Force
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Fake Identity Authentication
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Bulk Account Registration
indirectly supports: Third-Party Account Aggregation
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Automated Login Risk
indirectly supports: Bulk Account Enumeration
indirectly supports: SIM Swap Attack
indirectly supports: Membership / Subscription Abuse
mitigated by: Multi-Factor Authentication
mitigated by: Credential Reuse Detection
mitigated by: Human Verification Technology
mitigated by: Behavioral Biometrics
mitigated by: Password Complexity Requirements
citation: Password Cracking - MITRE ATT&CK T1110
citation: SecLists - OWASP
updated: 2026-06-11
version: 1

Evil Twin WiFi
type: AttackTool
break id: AT0069
stix type: tool
description: Evil Twin WiFi is an attack tool that intercepts user network traffic and steals credentials by spoofing public WiFi hotspots. Attackers deploy malicious hotspots with the same or similar names as legitimate WiFi in public places (such as cafes, airports, and shopping malls), inducing users to connect and then conducting man-in-the-middle attacks. Main functions include hotspot spoofing, captive portal phishing, traffic interception, SSL stripping, DNS spoofing, and session hijacking. Representative tools include WiFi-Pumpkin, Fluxion, and Airgeddon.
keywords: Evil Twin WiFi
keywords: evil twin attack
keywords: rogue access point
keywords: SSID spoofing
keywords: captive portal phishing
keywords: WiFi-Pumpkin
keywords: Fluxion
keywords: Airgeddon
directly causes: Account Takeover
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Phishing Attack
directly causes: Man-in-the-Middle Attack
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: OAuth / SSO Authorization Abuse
indirectly supports: MFA Bypass Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
mitigated by: HTTPS Digital Certificate
mitigated by: Endpoint Detection and Response
mitigated by: Terminal Abnormal Environment Detection
mitigated by: Credential Reuse Detection
mitigated by: Multi-Factor Authentication
citation: Securing Wireless Networks - CISA
citation: Public WiFi Security Risk Advisory - CNCERT
updated: 2026-06-11
version: 1

Fraud-as-a-Service (FaaS) Platform
type: AttackTool
break id: AT0070
stix type: tool
description: Fraud-as-a-Service (FaaS) is a black market service model where cybercriminals tool and platform the entire fraud process, including pig butchering, investment fraud, and identity impersonation. Unlike AT0063 Phishing Toolkit which provides single-point phishing capabilities, FaaS platforms offer a complete fraud chain as a managed service from script generation, fake platform setup, victim screening, trust cultivation to money laundering. Key features and services include: ① Script libraries and training: providing multi-language, multi-scenario scam script templates and role-play training materials; ② Fake investment platform setup: providing customizable fake trading platform frontends and backend management systems supporting simulated trading quotes and fake profit displays; ③ Victim screening tools: identifying high-value potential victims through social media data crawling and analysis; ④ AI-assisted communication: integrating AI chatbots to assist or replace humans in daily communication and trust cultivation; ⑤ Payment channel integration: providing multi-channel fund reception and transfer solutions; ⑥ Money laundering service connections: seamlessly integrating with cryptocurrency mixers, underground banks, and other money laundering channels. FaaS platforms significantly lower the technical barriers and organizational costs of fraud, enabling non-professional criminal groups to conduct large-scale complex scams.
keywords: Fraud-as-a-Service (FaaS) Platform
keywords: FaaS
keywords: scam-as-a-service
keywords: fraud platform
keywords: pig butchering platform
keywords: investment scam platform
keywords: fraud panel
directly causes: Transfer Fraud
directly causes: Fake Identity Authentication
directly causes: Pig Butchering / Investment Fraud Risk
indirectly supports: Malware-Free Attack Risk
mitigated by: Graph Computing / Association Analysis
mitigated by: Data Profiling
mitigated by: Endpoint Detection and Response
citation: Chainalysis 2026 Crypto Crime Report
citation: UNODC Transnational Organized Fraud Report
updated: 2026-06-11
version: 1

AiTM Adversary-in-the-Middle Attack Tool
type: AttackTool
break id: AT0072
stix type: tool
description: Adversary-in-the-Middle (AiTM) attack tools are specifically designed to bypass multi-factor authentication (MFA) based on traditional man-in-the-middle attacks. Unlike AT0069 Fake WiFi which focuses on network-layer traffic interception, AiTM tools target application-layer authentication session interception and theft. Key features and attack methods include: ① Reverse proxy architecture: establishing a reverse proxy between the attacker-controlled server and the target website, forwarding requests and responses in real-time; ② Session token theft: when victims log in through the AiTM proxy, the tool steals post-authentication session cookies and tokens, enabling attackers to access victim accounts without passwords or MFA; ③ MFA bypass: since MFA verification completes normally during the proxy process, attackers obtain sessions that have already passed MFA verification, completely bypassing MFA protection; ④ Phishing page disguise: hosting AiTM proxy entry points on legitimate or similar domains to lure victims; ⑤ Session persistence: stolen session tokens can be used for extended periods, with some tools supporting automatic session refresh. Representative tools include Evilginx2 and Modlishka open-source frameworks. AiTM attacks have become one of the primary methods for stealing enterprise account credentials, and even MFA cannot effectively defend against them.
keywords: AiTM Adversary-in-the-Middle Attack Tool
keywords: AiTM
keywords: adversary-in-the-middle
keywords: reverse proxy phishing
keywords: Evilginx2
keywords: Modlishka
keywords: MFA bypass proxy
keywords: session cookie theft
directly causes: Account Takeover
directly causes: Man-in-the-Middle Attack
directly causes: MFA Bypass Risk
indirectly supports: Automated Login Risk
indirectly supports: OAuth / SSO Authorization Abuse
mitigated by: Passkeys / Phishing-Resistant Authentication
mitigated by: HTTPS Digital Certificate
mitigated by: Endpoint Detection and Response
mitigated by: Credential Reuse Detection
citation: Microsoft Digital Defense Report 2025 - AiTM Phishing
citation: CISA Guidance on AiTM Phishing Attacks
updated: 2026-06-11
version: 1

AI Agent Hijacking Tools
type: AttackTool
break id: AT0074
stix type: tool
description: Attack tools designed to hijack deployed AI agents. Unlike AT0057 LLM Automated Attack Tools which use LLMs to launch attacks, AI Agent Hijacking Tools target already deployed and running AI agents, forcing them to execute attacker-specified operations. Main capabilities and attack methods include: 1) Prompt injection hijacking: injecting carefully crafted prompts into AI agents to override original instructions and force execution of attacker-specified operations; 2) Tool call hijacking: manipulating an agent's tool invocation chain to call malicious tools or pass malicious parameters to legitimate tools; 3) Memory poisoning: tampering with an agent's memory or knowledge base to produce attacker-expected behaviors in subsequent interactions; 4) Privilege escalation: exploiting agent permission configuration vulnerabilities to gain system access beyond authorized scope; 5) Lateral movement: accessing other agents or system resources in the same environment through a hijacked agent. AI Agent hijacking is a novel attack method emerging with the widespread deployment of AI agents, posing a serious threat to enterprise AI automation systems.
keywords: AI Agent Hijacking Tools
keywords: agent hijacking
keywords: prompt injection toolkit
keywords: indirect prompt injection
keywords: tool-call injection
keywords: memory poisoning
keywords: agent jailbreak
keywords: MCP attack
directly causes: Account Takeover
directly causes: AI Agent Tool Misuse / Excessive Autonomy Risk
directly causes: Non-Human Identity and API Key Abuse Risk
indirectly supports: Multi-Factor Authentication (MFA) Bypass
indirectly supports: Phishing Attack
indirectly supports: LLM Prompt Injection Risk
indirectly supports: AI-Automated Attack Escalation
indirectly supports: Shadow AI Risk
mitigated by: AI Agent Tool Governance and MCP Security Controls
mitigated by: Agent Behavior Sandbox
mitigated by: Privileged Access Management
citation: Strengthening AI Agent Hijacking Evaluations
citation: Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild
citation: Agent Hijacking: How Prompt Injection Leads to Full AI System Compromise
updated: 2026-06-11
version: 1

ClickFix Deception Tools
type: AttackTool
break id: AT0075
stix type: tool
description: ClickFix deception tools are a novel phishing tool that disguises itself as CAPTCHA repair or system update prompts to trick users into executing malicious PowerShell or CMD commands. Unlike AT0063 Phishing Toolkits which steal information through forged web pages, ClickFix exploits users' trust in system repair prompts, disguising malicious code execution as legitimate system operations. Main attack techniques include: 1) CAPTCHA repair disguise: displaying forged CAPTCHA display error prompts, claiming that repair commands need to be run for normal display; 2) Clipboard hijacking: copying malicious commands to the clipboard, guiding users to paste and execute them in a terminal or run dialog; 3) CAPTCHA bypass prompt: disguising as a CAPTCHA verification step, requiring users to execute specific commands to prove they are human; 4) Error page disguise: displaying forged browser error pages, prompting users to run repair scripts; 5) Multi-step induction: using multi-step interactive guidance to gradually lower user vigilance, ultimately tricking them into executing malicious code. ClickFix attacks were reported to have grown significantly by Proofpoint and other security vendors in 2025, and were listed as an emerging threat in the ENISA 2025 Threat Landscape Report.
keywords: ClickFix Deception Tools
keywords: ClickFix
keywords: fake CAPTCHA lure
keywords: clipboard hijack lure
keywords: PowerShell paste lure
keywords: verify you are human scam
keywords: fake browser repair prompt
directly causes: Data Exfiltration Risk
directly causes: Phishing Attack
directly causes: ClickFix Deception Risk
indirectly supports: AI-Enhanced Phishing Attack
indirectly supports: QR Code Phishing (Quishing)
mitigated by: Security Awareness Training
mitigated by: Endpoint Detection and Response
mitigated by: Threat Intelligence
citation: Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
citation: ClickFix: How to Infect Your PC in Three Easy Steps
citation: Beyond The Click: Unveiling Fake CAPTCHA Campaigns
updated: 2026-06-11
version: 1

Smart Contract Exploitation Framework
type: AttackTool
break id: AT0076
stix type: tool
description: An automated toolset for discovering, validating, and chaining smart-contract vulnerabilities. It combines bytecode analysis, ABI call construction, transaction simulation, reentrancy and access-control testing, timestamp-dependency checks, and proxy-upgrade path analysis to help attackers locate profitable flaws and generate exploit transactions. Legitimate security teams may use similar capabilities in audits and red-team exercises, while adversaries use them for mainnet asset theft, contract-state manipulation, and vulnerability scanning at scale.
keywords: Smart Contract Exploitation Framework
keywords: smart contract exploit framework
directly causes: Smart Contract Vulnerabilities
directly causes: Timestamp Dependence Attack
directly causes: Immutable Contract Design Flaws
indirectly supports: Flash Loan Attacks
indirectly supports: Cross-Chain Bridge Attacks
indirectly supports: DAO Governance Attacks
indirectly supports: Oracle Manipulation
indirectly supports: Blockchain Replay Attack
mitigated by: Smart Contract Security Audit
mitigated by: Smart Contract Static Analysis Tools
mitigated by: Formal Verification of Smart Contracts
mitigated by: Comprehensive Auditing and Formal Verification
mitigated by: Code Audit and Bug Bounty
mitigated by: Legal Action
citation: Trail of Bits Slither
citation: Foundry Ethereum development toolkit
citation: Consensys Smart Contract Best Practices
updated: 2026-06-16
version: 1

DeFi Attack Scripts
type: AttackTool
break id: AT0077
stix type: tool
description: Automated attack scripts and arbitrage execution tools for DeFi protocols. They are commonly used for flash-loan call chains, oracle price manipulation, MEV frontrunning or sandwich trading, liquidity-pool manipulation, rug-pull fund withdrawal, and governance-vote manipulation. These scripts orchestrate lending, swapping, collateral, liquidation, and governance calls into one transaction or a small transaction set, using simulation and gas-strategy optimization to improve success rates.
keywords: DeFi Attack Scripts
keywords: DeFi attack automation
directly causes: Flash Loan Attacks
directly causes: Oracle Manipulation
directly causes: MEV Attacks (Miner Extractable Value)
directly causes: DAO Governance Attacks
directly causes: Rug Pull (Exit Scam)
directly causes: Gas Fee Manipulation
indirectly supports: Smart Contract Vulnerabilities
indirectly supports: Gas Fee Manipulation and Frontrunning
mitigated by: Oracle Price Verification Mechanism
mitigated by: Flash Loan Limit Control
mitigated by: Reentrancy Attack Protection
mitigated by: Multi-Source Oracle Aggregation and Anomaly Detection
mitigated by: Time-Weighted Average Price (TWAP) Mechanism
mitigated by: Automated Detection and Circuit Breaker for Oracle Manipulation
mitigated by: Private Mempool and MEV Protection Services
mitigated by: Commit-Reveal Mechanism
mitigated by: Transaction Slippage Protection and Limit Orders
mitigated by: MEV Protection Mechanism
mitigated by: Legal Action
citation: Aave Flash Loans documentation
citation: Flash Boys 2.0: Frontrunning in Decentralized Exchanges
citation: Chainlink Oracle Security Considerations
updated: 2026-06-16
version: 1

Blockchain Node and Consensus Attack Tools
type: AttackTool
break id: AT0078
stix type: tool
description: Toolsets targeting blockchain P2P networks and consensus layers. They can construct malicious nodes, generate many node identities, manipulate peer connections, simulate chain reorganizations, hide or delay block propagation, and validate 51 percent, Sybil, eclipse, long-range, or selfish-mining strategies in test or private networks. These tools usually require control of node infrastructure, hash power, stake weight, or network connectivity.
keywords: Blockchain Node and Consensus Attack Tools
keywords: consensus attack tooling
directly causes: 51% Attack (Double-Spend Attack)
directly causes: Sybil Attack
directly causes: Eclipse Attack
directly causes: Long-Range Attack / Nothing-at-Stake
directly causes: Selfish Mining
indirectly supports: Blockchain Replay Attack
mitigated by: Increasing Consensus Algorithm Attack Costs
mitigated by: Consecutive Block Limit and Reorganization Detection
mitigated by: Hashrate Rental Market Monitoring and Incident Response
mitigated by: On-Chain Reputation and Credit Systems
mitigated by: Legal Action
citation: Bitcoin Eclipse Attacks and Countermeasures
citation: Selfish Mining in Bitcoin
citation: Ethereum Proof-of-Stake Consensus Specifications
updated: 2026-06-16
version: 1

Wallet Phishing and Drainer Tools
type: AttackTool
break id: AT0079
stix type: tool
description: Phishing and authorization-drainer tools targeting crypto wallet users. They commonly impersonate airdrops, NFT mints, DApp logins, transaction confirmations, or EIP authorization pages to trick users into revealing seed phrases, private keys, or signing malicious approvals. Advanced kits combine Telegram bots, fake wallet extensions, clipboard hijacking, malicious DApp frontends, and on-chain monitoring to automatically transfer authorized assets.
keywords: Wallet Phishing and Drainer Tools
keywords: wallet drainer
directly causes: Private Key Leakage and Management Risks
directly causes: Blockchain Replay Attack
directly causes: EIP and Protocol Phishing Attack
directly causes: Telegram Bot Phishing
directly causes: Multi-Signature Wallet Social Engineering
directly causes: Account Abstraction Wallet Risk
indirectly supports: Virtual World Asset Theft
indirectly supports: DApp Frontend Hijacking
mitigated by: Hardware Security Module (HSM) Private Key Storage
mitigated by: Encrypted Storage and Password Protection of Private Keys
mitigated by: Source Code and Configuration File Secret Scanning
mitigated by: EIP Security Verification Mechanism
mitigated by: Telegram Official Verification
mitigated by: Multi-Sig Timelock Mechanism
mitigated by: DApp Frontend Integrity Verification
mitigated by: Legal Action
mitigated by: Threat Intelligence
citation: MetaMask Security: Protect your wallet
citation: Wallet drainers and approval phishing overview
citation: EIP-712 Typed structured data hashing and signing
updated: 2026-06-16
version: 1

On-Chain Privacy Analysis Tools
type: AttackTool
break id: AT0080
stix type: tool
description: Analytics tools for tracing on-chain addresses, transaction paths, and cross-chain asset flows. Legitimate organizations use them for compliance, anti-money laundering, and incident response, while attackers may use similar capabilities to deanonymize addresses, identify high-value targets, link wallet identities, or track virtual-asset movement in support of targeted phishing, extortion, and asset theft.
keywords: On-chain Privacy Analysis Tools
keywords: blockchain analytics tooling
directly causes: On-Chain Privacy Leakage
indirectly supports: Private Key Leakage and Management Risks
indirectly supports: Virtual World Asset Theft
indirectly supports: On-Chain Data Privacy Exposure
mitigated by: Address Obfuscation and Privacy Protocol Usage
mitigated by: Zero-Knowledge Proofs and On-Chain Privacy Contracts
mitigated by: Off-Chain Transactions and State Channels
mitigated by: On-Chain Data Access Control
mitigated by: Privacy-Preserving Computation Technology Applications
mitigated by: Data Minimization and Purpose Limitation
mitigated by: On-Chain Privacy Protection
citation: Chainalysis Reactor
citation: MITRE ATT&CK: Gather Victim Identity Information
citation: Zcash privacy technology
updated: 2026-06-16
version: 1

IoT Firmware and Device Exploitation Tools
type: AttackTool
break id: AT0081
stix type: tool
description: Toolsets for vulnerability scanning, firmware extraction, reverse engineering, default-credential testing, and remote exploitation of IoT devices. Attackers use them to discover exposed devices, analyze firmware backdoors, implant malicious firmware, hijack device control, or enroll devices into botnets.
keywords: IoT Firmware and Device Exploitation Tools
keywords: IoT exploitation toolkit
directly causes: Smart Device Hijacking
directly causes: Firmware Tampering and Backdoors
directly causes: IoT Default Credential Risks
directly causes: OTA Update Hijacking
indirectly supports: IoT Botnets
indirectly supports: IoT Hardware Supply Chain Attack
mitigated by: IoT Device Firmware Security Update Mechanism
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Strong Authentication and Default Credential Changes for IoT Devices
mitigated by: Firmware Secure Boot Mechanism
mitigated by: Firmware Update Signature Verification and Rollback Protection
mitigated by: Firmware Integrity Monitoring and Physical Tamper Resistance
mitigated by: Mandatory Initial Password Configuration
mitigated by: Default Credential Scanning and Auto-Remediation
mitigated by: Certificate-Based Device Authentication
mitigated by: Legal Action
mitigated by: Threat Intelligence
mitigated by: Network Segmentation Technology
citation: OWASP Firmware Security Testing Methodology
citation: Binwalk firmware analysis tool
citation: OWASP Internet of Things
updated: 2026-06-16
version: 1

IoT Botnet and C2 Tools
type: AttackTool
break id: AT0082
stix type: tool
description: Malware and command-and-control tools used to infect, control, and schedule large numbers of IoT devices. They commonly scan for weak passwords or known vulnerabilities, deploy lightweight malware, and issue DDoS, mining, proxy, or lateral-movement tasks through C2 servers. They may also tamper with device data or disrupt normal service.
keywords: IoT Botnet and C2 Tools
keywords: IoT botnet tooling
directly causes: IoT Botnets
directly causes: IoT Data Tampering Attack
indirectly supports: Smart Device Hijacking
indirectly supports: IoT Default Credential Risks
indirectly supports: Sensor Spoofing Attack
mitigated by: IoT Traffic Anomaly Detection and C&C Communication Blocking
mitigated by: IoT Device Security Configuration Enforcement
mitigated by: IoT Botnet Traffic Filtering and Rate Limiting
mitigated by: IoT Traffic Monitoring and Anomaly Detection
mitigated by: Endpoint Detection and Response
mitigated by: Threat Intelligence
citation: Mirai Botnet source code
citation: CISA Securing Internet of Things Devices
citation: ENISA Baseline Security Recommendations for IoT
updated: 2026-06-16
version: 1

Industrial and Vehicle Protocol Exploitation Tools
type: AttackTool
break id: AT0083
stix type: tool
description: Scanning and exploitation tools for industrial control, connected-vehicle V2X, medical IoT, and edge-device protocols. Attackers may exploit protocol flaws or misconfigurations in Modbus, OPC-UA, Profinet, CAN, V2X, BLE, MQTT, and similar systems to perform unauthorized access, command injection, sensor-data forgery, medical-device control, or connected-vehicle message spoofing.
keywords: Industrial and Vehicle Protocol Exploitation Tools
keywords: ICS and V2X exploitation tools
directly causes: Industrial IoT (IIoT) Security Risks
directly causes: Connected Vehicle (V2X) Security Risks
directly causes: Internet of Medical Things (IoMT) Security Risks
directly causes: IoT Side-Channel Attacks
directly causes: Sensor Spoofing Attack
directly causes: Industrial Protocol Exploitation
indirectly supports: IoT Data Tampering Attack
indirectly supports: AIoT Convergence Attack
mitigated by: Industrial Network Isolation and Segmentation
mitigated by: Industrial Protocol Security Hardening
mitigated by: ICS Security Monitoring and Incident Response
mitigated by: Medical Device Security Gateway
mitigated by: Industrial Protocol Deep Packet Inspection
mitigated by: V2X PKI Authentication System
mitigated by: Network Isolation and Access Control for IoT Devices
mitigated by: Certificate-Based Device Authentication
mitigated by: Legal Action
mitigated by: Threat Intelligence
mitigated by: Network Segmentation Technology
citation: Nmap NSE modbus-discover Script
citation: CANard CAN bus toolkit
citation: OWASP Internet of Things Project
updated: 2026-06-16
version: 1

Metaverse and XR Attack Tools
type: AttackTool
break id: AT0084
stix type: tool
description: Toolsets targeting metaverse platforms, virtual-asset transactions, XR devices, and immersive social environments. Common capabilities include virtual-asset transaction fraud scripts, virtual-identity impersonation, spatial-data collection, XR firmware exploitation, 3D content abuse, automated virtual harassment, and cross-platform asset-transfer deception.
keywords: Metaverse and XR Attack Tools
keywords: XR attack toolkit
directly causes: Virtual Land/Asset Fraud
directly causes: Metaverse Identity Theft
directly causes: Virtual World Asset Theft
directly causes: AR/VR Device Security Risks
directly causes: Virtual World Harassment and Violence
indirectly supports: Metaverse Social Engineering Attack
indirectly supports: XR Device Firmware Attack
indirectly supports: Metaverse Content Moderation Challenge
mitigated by: On-Chain Asset Ownership Verification and Traceability in the Metaverse
mitigated by: Virtual Land Trading Platform Review Mechanism
mitigated by: Virtual Asset Valuation and Information Disclosure
mitigated by: Metaverse Identity Federation
mitigated by: Virtual Asset Cross-Chain Verification
mitigated by: XR Device Trusted Boot
mitigated by: Spatial Data Privacy Protection
mitigated by: 3D Content AI Moderation
mitigated by: Virtual Economy Regulation Mechanism
mitigated by: Cross Virtual-Real Identity Isolation
mitigated by: Legal Action
mitigated by: Risk Control Strategy
citation: XRSI Standards for Safety and Security in XR Environments
citation: XR Safety Initiative
citation: NIST Cybersecurity for IoT Program
updated: 2026-06-16
version: 1

AI Data Poisoning and Prompt Injection Tool
type: AttackTool
break id: AT0093
stix type: tool
description: Tooling that generates poisoning samples, prompt-injection payloads, unauthorized RAG retrieval probes, and model-output tests.
keywords: AI Data Poisoning and Prompt Injection Tool
keywords: data poisoning payload
keywords: prompt injection testing
keywords: RAG retrieval probe
keywords: model output probing
keywords: LLM attack tooling
directly causes: Training Data Poisoning Risk
directly causes: RAG Unauthorized Retrieval
directly causes: Sensitive Information Leakage in Model Output
indirectly supports: Training Data Copyright and Licensing Risk
mitigated by: AI Training Data Governance
mitigated by: RAG Knowledge-Base Permission Isolation
mitigated by: Prompt Injection Defense and Context Isolation
mitigated by: Legal Action
citation: OWASP Top 10 for Large Language Model Applications
updated: 2026-06-17
version: 1

Mobile App Repackaging Toolchain
type: AttackTool
break id: AT0095
stix type: tool
description: A toolchain for decompiling, modifying, signing, and distributing repackaged mobile applications.
keywords: Mobile App Repackaging Toolchain
keywords: APK decompilation
keywords: mobile app repackaging
keywords: app resigning
keywords: runtime patching
keywords: fake app distribution
directly causes: Mobile App Repackaging Fraud
indirectly supports: Application Reverse Engineering
mitigated by: Mobile App Integrity and Runtime Protection
mitigated by: Client Application Hardening
mitigated by: Vulnerability Identification
mitigated by: Legal Action
mitigated by: Endpoint Detection and Response
mitigated by: Supply Chain Security Audit
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Connected-Vehicle OTA and Interface Testing Tool
type: AttackTool
break id: AT0097
stix type: tool
description: Tools for testing OTA package signatures, connected-vehicle APIs, diagnostic interfaces, and V2X communication security.
keywords: Connected-Vehicle OTA and Interface Testing Tool
keywords: OTA signature testing
keywords: vehicle API testing
keywords: diagnostic interface testing
keywords: V2X security testing
keywords: automotive security tooling
directly causes: Automotive OTA Update Hijacking
directly causes: Vehicle Data Interface Abuse
indirectly supports: Vehicle V2X Attack
mitigated by: Connected-Vehicle OTA Security Governance
mitigated by: V2X PKI Authentication System
mitigated by: Firmware OTA Update Signature Verification
mitigated by: Legal Action
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-17
version: 1

Freebie Hunters
type: ThreatActor
break id: TA0001
stix type: threat-actor
description: Freebie hunters are individuals who actively participate in platform activities to obtain various virtual or real benefits, rewards, and rebates. They typically focus on quickly completing tasks to collect promotions, points, and cash rebates offered by platforms. Freebie hunters operate at scale, usually focusing on short-term obtainable benefits with relatively low concern for the platform's long-term development.
keywords: Freebie Hunters
keywords: bonus hunters
keywords: coupon abusers
keywords: promotion abusers
keywords: rebate hunters
keywords: reward arbitrage users
keywords: freebie farming
builds tools: Automation Scripts
uses tools: Black SIM Cards
uses tools: Bulk Account Registration Tool
uses tools: SMS Verification Code Platform
uses tools: Multi-Instance Tools
uses tools: Browser Extensions
uses tools: Proxy IP
uses tools: Flash Sale Tools
uses tools: Risk Email Accounts
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Automated Simulator
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Fake Viral Referral
directly causes: Click Fraud
directly causes: Malicious Benefit Abuse
directly causes: Red Packet Grabbing Bot
directly causes: Subsidy Fraud
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: Sub-Account Abuse
directly causes: Points Redemption Reselling
directly causes: CAPTCHA Bypass
directly causes: Proxy Login / Proxy Order Placement
directly causes: Flash Return Arbitrage
directly causes: Unauthorized Discount Purchase
directly causes: Coupon Restriction Bypass
directly causes: Order-Splitting Arbitrage
indirectly supports: Bot Scalping Risk
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Search Result Manipulation
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Fake Identity Authentication
indirectly supports: Gold Farming
indirectly supports: Game Storage Accounts
citation: 2024 H1 Internet Black-Grey Industry Research Report
updated: 2026-06-13
version: 1

Freebie Hunt Organizer
type: ThreatActor
break id: TA0001-001
stix type: threat-actor
description: The organizer and leader of a freebie hunting group. They possess extensive experience and strong organizational skills, are well-versed in platform rules, and excel at identifying promotions and tasks. They coordinate the group to act collectively and efficiently, maximizing the acquisition of benefits and rewards. Organizers may also share activity information and devise strategies to guide members toward more effective coordinated action.
keywords: Freebie Hunt Organizer
keywords: bonus hunting ring leader
keywords: coupon abuse organizer
keywords: promotion farming organizer
keywords: rebate arbitrage coordinator
keywords: freebie ring leader
builds tools: Automation Scripts
uses tools: Web Scraping Tools
uses tools: Packet Capture Tools
uses tools: Packet Sending/Modification Tools
uses tools: Risk Email Accounts
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
directly causes: Bulk Fake Account Manipulation
directly causes: Web Scraping Risk
directly causes: Risk Device Identification Bypass
directly causes: Virtual Device Identification Bypass
directly causes: Application Reverse Engineering
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
directly causes: Coupon Restriction Bypass
directly causes: Fake Identity Authentication
indirectly supports: Bot Scalping Risk
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
indirectly supports: Privilege Escalation / Unauthorized Access
citation: Daily Legal Watch: Ministry of Public Security Releases Top 10 Financial Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1

Scalpers
type: ThreatActor
break id: TA0002
stix type: threat-actor
description: In the gray/black market, scalpers refer to individuals or organizations that seek excessive profits through illegitimate means. In ticketing, they obtain tickets for popular events through illegal means and resell them at inflated prices, often using automated bots to bulk-purchase tickets. In other domains, scalpers may acquire limited-edition goods such as shoes or electronics through illegitimate means and resell them at a premium.
keywords: Scalpers
keywords: ticket scalper
keywords: reseller bot operator
keywords: sneaker scalper
keywords: ticket broker
keywords: bulk buyer
keywords: inventory hoarder
builds tools: Flash Sale Tools
builds tools: Ranking Manipulation Tools
uses tools: Black SIM Cards
uses tools: Modem Pool SIM Cards
uses tools: Mobile Phone Emulator
uses tools: Bulk Account Registration Tool
uses tools: SMS Verification Code Platform
uses tools: Device Spoofing Tools
uses tools: CAPTCHA Solving Platform
uses tools: Mass Control Systems
uses tools: Cloud Phone
uses tools: Multi-Instance Tools
uses tools: Custom Browsers
uses tools: Headless Browsers
uses tools: Automation Scripts
uses tools: GPS Spoofing Tools
uses tools: Card Vending Platforms
uses tools: Image CAPTCHA Recognition Tools
uses tools: Cookie Login Tools
uses tools: Browser Extensions
uses tools: Proxy IP
uses tools: Packet Sending/Modification Tools
uses tools: Identity Document Set (4-Piece)
uses tools: Click Simulation Tools
uses tools: Risk Email Accounts
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Automated Simulator
directly causes: Malicious Flash Sale Grabbing
directly causes: Unfair Resource Seizure
directly causes: Bulk Fake Account Manipulation
directly causes: Account Reselling
directly causes: Game Account Reselling
directly causes: Account Privilege Reselling
directly causes: Cheating Tools / Game Hacks
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: CAPTCHA Bypass
directly causes: Proxy Login / Proxy Order Placement
directly causes: Recycled Phone Number Takeover
directly causes: Automated Login Risk
indirectly supports: Coupon Enumeration
indirectly supports: Instant Bid Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Promotional Activity Cheating
indirectly supports: Fake Viral Referral
indirectly supports: Malicious Benefit Abuse
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Web Scraping Risk
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
indirectly supports: Fake Identity Authentication
indirectly supports: Gold Farming
citation: MPS launches campaign against ticket scalping crimes
updated: 2026-06-13
version: 1

Compute Scalper / Compute Black Market
type: ThreatActor
break id: TA0002-001
stix type: threat-actor
description: Cybercriminals who illegally acquire and resell GPU compute resources. With the explosive growth of GPU compute demand for AI large model training, compute scalpers acquire compute resources through illegal channels and resell them at high prices or use them for mining profit. Key characteristics include: ① Cloud account theft: stealing others' cloud service accounts and using their GPU quotas for mining or AI training; ② Compute reselling: marking up and reselling compute resources acquired from various channels to AI startups or research institutions with urgent needs; ③ Fake compute platforms: building fake compute sharing platforms to defraud users' compute resources or funds; ④ GPU scalping: hoarding and reselling GPU graphics cards in large quantities, driving up market prices and exploiting supply-demand imbalances for profit; ⑤ Compute-based money laundering: using cryptocurrency generated from compute mining for money laundering activities. Compute scalpers / compute black market operators are a new type of cybercrime spawned by the AI compute economy.
keywords: Compute Scalper / Compute Black Market
keywords: GPU compute broker
keywords: cloud GPU reseller
keywords: stolen cloud compute
keywords: GPU scalping
keywords: compute black market operator
builds tools: Automation Scripts
uses tools: Virtual Machine
uses tools: Cryptocurrency Mixers
directly causes: Server Cryptomining
directly causes: Compute Resource Theft Risk
indirectly supports: Process Automation
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Cryptocurrency Money Laundering Risk
citation: FBI: Cloud Computing Fraud and Resource Abuse
citation: Unit 42: GPU Compute Abuse and Cloud Account Takeover
citation: Microsoft: GPU Supply Chain and Black Market Report
updated: 2026-06-11
version: 1

SIM Card Dealers (Phone Numbers)
type: ThreatActor
break id: TA0003
stix type: threat-actor
description: In the gray/black market, phone SIM card dealers are individuals or organizations specializing in illegal or fraudulent SIM card transactions. They may sell unregistered SIM cards, steal others' identity information to obtain phone cards, or provide false identity information to circumvent regulations. These dealers primarily operate on black markets or the dark web, attracting clients seeking to conceal their identity or engage in illegal activities.
keywords: SIM Card Dealers (Phone Numbers)
keywords: SIM broker
keywords: burner SIM vendor
keywords: pre-activated SIM dealer
keywords: anonymous SIM seller
keywords: phone number broker
keywords: SMS verification number seller
builds tools: Black SIM Cards
builds tools: Modem Pool SIM Cards
builds tools: Intercept SIM Cards
uses tools: SMS Verification Code Platform
uses tools: Dark Web
uses tools: Anonymous Communication Tools
directly causes: Bulk Fake Account Manipulation
directly causes: Malicious Traffic Diversion
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Interceptor Card Registration
directly causes: Malicious User Harassment
directly causes: Phishing Attack
directly causes: User Privacy Leakage
directly causes: Real-World Identity Theft
directly causes: Fake Identity Authentication
directly causes: Platform Pornography Risk
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Fake Viral Referral
indirectly supports: Malicious Benefit Abuse
indirectly supports: Account Reselling
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Data Exfiltration Risk
indirectly supports: Overseas Number Registration
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Insider-Outsider Collusion
indirectly supports: AI Deepfake Risk
citation: Is China telecom trying to scam me? : r/chinalife - Reddit
updated: 2026-06-11
version: 1

Bank Card Dealers
type: ThreatActor
break id: TA0004
stix type: threat-actor
description: In the gray/black market, bank card dealers are individuals or organizations involved in illegal bank card information trading. They specialize in stealing, purchasing, or exchanging credit card and debit card information for fraudulent activities such as illegal purchases and fund theft. They primarily operate on the dark web or black markets, buying and selling stolen bank card data including card numbers, expiration dates, CVV codes, and cardholder details.
keywords: Bank Card Dealers
keywords: bank card broker
keywords: carding vendor
keywords: credit card data seller
keywords: debit card mule supplier
keywords: cash-out card supplier
keywords: stolen card broker
builds tools: Identity Document Set (4-Piece)
builds tools: Money Laundering Bank Cards
builds tools: Corporate Identity Document Set (8-Piece)
builds tools: Money Laundering Corporate Bank Accounts
uses tools: Dark Web
uses tools: Anonymous Communication Tools
uses tools: Card Vending Platforms
directly causes: Transfer Fraud
directly causes: Money Laundering Risk
directly causes: Illegal Cash-Out
directly causes: Payment Channel Abuse
directly causes: Credit Card Fraud
directly causes: Platform Online Loan Fraud
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Traffic Attribution Fraud
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Account Reselling
indirectly supports: Account Privilege Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Bulk Account Registration
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Interceptor Card Registration
indirectly supports: Carding Attack
indirectly supports: Stolen Card Payment
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Insider-Outsider Collusion
indirectly supports: Real-World Identity Theft
indirectly supports: Fake Identity Authentication
citation: Card Severing Chronicle: Liaoyuan Police Dismantles Money Laundering Chain Behind Telecom Fraud
updated: 2026-06-11
version: 1

Data Brokers
type: ThreatActor
break id: TA0005
stix type: threat-actor
description: In the gray/black market, data brokers are individuals or organizations specializing in illegally obtaining and trading sensitive information. They sell various types of data including personal identity information, credit card details, passwords, and identity document sets. They collect this information through hacking, social engineering, or other illegal means, then resell it to criminal gangs, cyber attackers, or other participants in illegal activities.
keywords: Data Brokers
keywords: stolen data vendor
keywords: identity data broker
keywords: PII seller
keywords: fullz vendor
keywords: breach data seller
builds tools: Social Engineering Database
builds tools: Card Vending Platforms
uses tools: Dark Web
uses tools: Credential Stuffing Tools
uses tools: Identity Document Set (4-Piece)
uses tools: Corporate Identity Document Set (8-Piece)
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Verification Code Brute Force
directly causes: Carding Attack
directly causes: User Privacy Leakage
directly causes: Bulk Account Enumeration
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Account Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Real-World Identity Theft
indirectly supports: Fake Identity Authentication
citation: Ministry of Public Security Announces Top 10 Financial Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1

Card Farmer
type: ThreatActor
break id: TA0005-001
stix type: threat-actor
description: A criminal who supplies large quantities of bank cards to data brokers or card dealers for use as fund-transfer accounts, profiting illegally from the arrangement.
keywords: Card Farmer
keywords: bank card supplier
keywords: mule account supplier
keywords: bank account source
keywords: fund transfer account supplier
builds tools: Identity Document Set (4-Piece)
builds tools: Money Laundering Bank Cards
builds tools: Corporate Identity Document Set (8-Piece)
uses tools: Card Vending Platforms
directly causes: Money Laundering Risk
directly causes: Fake Identity Authentication
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Account Reselling
indirectly supports: Bulk Account Registration
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Illegal Cash-Out
indirectly supports: Real-World Identity Theft
citation: Ministry of Public Security Announces Top 10 Financial Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1

Data Harvester
type: ThreatActor
break id: TA0005-002
stix type: threat-actor
description: An individual who collects personal information through various channels — including e-commerce platforms, courier services, social networks, property management companies, hospitals, and even tax or business registration authorities — and sells it illegally.
keywords: Data Harvester
keywords: personal information harvester
keywords: PII collector
keywords: data collection ring
keywords: lead harvester
builds tools: Social Engineering Database
builds tools: Card Vending Platforms
uses tools: Dark Web
uses tools: Anonymous Communication Tools
directly causes: Web Scraping Risk
directly causes: User Privacy Leakage
directly causes: Fake Identity Authentication
indirectly supports: Account Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Credential Stuffing
indirectly supports: Carding Attack
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Insider-Outsider Collusion
indirectly supports: Employee Account Compromise
citation: Ministry of Public Security Announces Top 10 Black-Grey Market Crime Cases
updated: 2026-06-13
version: 1

Crowdsourced Workers
type: ThreatActor
break id: TA0006
stix type: threat-actor
description: In the gray/black market, crowdsourced workers are large numbers of individuals organized or hired to participate in illegal activities through online platforms. Their tasks often include fraudulent activities such as installing specific software for arbitrage, clicking ad links, or making purchases for fake orders. This form of illegal crowdsourcing enables fraud at scale, posing serious challenges to legitimate businesses and digital platforms.
keywords: Crowdsourced Workers
keywords: fraud task workers
keywords: click farm workers
keywords: black market crowdworkers
keywords: paid task workforce
builds tools: Crowdsourcing Platforms
uses tools: CAPTCHA Solving Platform
uses tools: Crowdsourcing Platforms
uses tools: Task Completion Tools
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Automated Simulator
directly causes: Instant Bid Sniping
directly causes: Metric Manipulation / Ranking Fraud
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Ad Fraud
indirectly supports: Malicious Benefit Abuse
indirectly supports: Malicious Negative Reviews
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Fake Transactions
indirectly supports: Order Brushing
indirectly supports: Bulk Account Registration
indirectly supports: Automated Account Seasoning
indirectly supports: CAPTCHA Bypass
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Fake Reviews
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-13
version: 1

CAPTCHA Solver
type: ThreatActor
break id: TA0006-001
stix type: threat-actor
description: Individuals hired or organized to manually or automatically break CAPTCHAs, bypassing access restrictions to mass-register accounts or carry out other illegal activities such as malicious promotion, fraud, and spam registration.
keywords: CAPTCHA Solver
keywords: captcha farm
keywords: captcha solving service
keywords: human captcha farm
keywords: captcha bypass service
builds tools: CAPTCHA Solving Platform
uses tools: CAPTCHA Solving Platform
uses tools: Crowdsourcing Platforms
directly causes: Process Automation
directly causes: Bot Scalping Risk
directly causes: CAPTCHA Bypass
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Auction Sniping
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Ad Fraud
indirectly supports: Malicious Benefit Abuse
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Bulk Account Registration
citation: OAT-009 CAPTCHA Defeat - OWASP
updated: 2026-06-13
version: 1

Voice CAPTCHA Solver
type: ThreatActor
break id: TA0006-002
stix type: threat-actor
description: Individuals hired or organized specifically to break voice CAPTCHAs. They analyze audio content manually or with technical tools to bypass voice-based security verification, enabling malicious promotion, fraud, or other illegal activities that require circumventing voice CAPTCHAs.
keywords: Voice CAPTCHA Solver
keywords: audio captcha solver
keywords: voice captcha bypass
keywords: voice challenge solving service
keywords: audio challenge farm
builds tools: CAPTCHA Solving Platform
uses tools: CAPTCHA Solving Platform
uses tools: Crowdsourcing Platforms
directly causes: Bot Scalping Risk
directly causes: CAPTCHA Bypass
indirectly supports: Process Automation
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Auction Sniping
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Ad Fraud
indirectly supports: Malicious Benefit Abuse
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Bulk Account Registration
citation: SMS PVA: Underground Service for Cybercriminals
updated: 2026-06-13
version: 1

Score Runner
type: ThreatActor
break id: TA0006-003
stix type: threat-actor
description: Individuals who serve money laundering operations by conducting fictitious transactions and other means to obscure the origin of illicit funds, making them appear legitimate. Their activities may span financial systems, e-commerce platforms, virtual currencies, and other domains, making it significantly harder for law enforcement to detect illegal fund flows.
keywords: Score Runner
keywords: money mule
keywords: payment mule
keywords: fund laundering runner
keywords: transaction runner
builds tools: Score-Running Platforms
uses tools: Score-Running Platforms
uses tools: Crowdsourcing Platforms
uses tools: Offer Wall Tools
uses tools: Task Completion Tools
directly causes: Money Laundering Risk
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Stolen Card Payment
indirectly supports: Illegal Cash-Out
indirectly supports: Payment Channel Abuse
citation: Case Study: Operating a Money Laundering Platform for Cyber Black-Grey Market Merchants
updated: 2026-06-13
version: 1

Account Dealers
type: ThreatActor
break id: TA0007
stix type: threat-actor
description: Also known as account merchants. In the gray/black market, account dealers are individuals specializing in providing illegal or fraudulent accounts to support money laundering, fraud, and cyberattacks. These accounts may include stolen bank accounts, fabricated identity information, and electronic payment accounts. They operate on black markets or the dark web, attracting those seeking to conceal their identity or conduct illegal transactions.
keywords: Account Dealers
keywords: account merchant
keywords: account seller
keywords: bulk account vendor
keywords: verified account broker
keywords: aged account seller
builds tools: Bulk Account Registration Tool
builds tools: Social Engineering Database
builds tools: Card Vending Platforms
builds tools: Account Rental Platforms
builds tools: Risk Email Accounts
uses tools: Bulk Account Registration Tool
uses tools: Dark Web
uses tools: Social Engineering Database
uses tools: Identity Document Set (4-Piece)
uses tools: Credential Stuffing Tools
uses tools: Risk Email Accounts
directly causes: Bulk Fake Account Manipulation
directly causes: Account Reselling
directly causes: Game Account Reselling
directly causes: Account Privilege Reselling
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Login Credential Reuse
directly causes: Login Credential Theft
directly causes: Recycled Phone Number Takeover
directly causes: User Privacy Leakage
directly causes: Bulk Account Enumeration
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Carding Attack
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Fake Identity Authentication
indirectly supports: Game Storage Accounts
citation: Shanghai's First Batch Game Account Registration Case: Is Mass Account Creation Illegal?
updated: 2026-06-11
version: 1

Gou Tui (Telecom Fraud Operatives)
type: ThreatActor
break id: TA0008
stix type: threat-actor
description: In the gray/black market, 'Gou Tui' (literally 'dog pushers') is the term for low-level operatives in overseas telecom fraud compounds, primarily in Southeast Asia. They engage in front-line scam activities, including: building trust with targets under fake identities on social platforms to execute 'pig butchering' scams; impersonating stock market gurus to lure victims into fake investment platforms; recruiting downlines for online gambling under the guise of high-paying jobs. Gou Tui are typically organized within overseas fraud compounds with long working hours and strict performance targets. Some are victims lured abroad by fake job offers, while others participate voluntarily. High-performing operatives can earn substantial commissions. Beyond telecom fraud, some also engage in online gambling promotion and adult content traffic redirection.
keywords: Gou Tui (Telecom Fraud Operatives)
keywords: gou tui
keywords: pig butchering sales agent
keywords: fraud chat operator
keywords: scam compound salesman
keywords: front-line telecom fraud operative
builds tools: Auto-Posting Bots
builds tools: Fraud-as-a-Service (FaaS) Platform
uses tools: Modem Pool SIM Cards
uses tools: Bulk Account Registration Tool
uses tools: Modem Pool
uses tools: Automation Scripts
uses tools: Ranking Manipulation Tools
uses tools: Auto-Posting Bots
uses tools: Risk Email Accounts
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Search Result Manipulation
directly causes: Malicious Traffic Diversion
directly causes: Platform Fraud Risk
directly causes: Platform Pornography Risk
directly causes: Malicious Ad Placement
indirectly supports: Coupon Enumeration
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Inactive Number Registration
citation: Governance Path for Advertising-Promotion Cyber Black-Grey Crime
updated: 2026-06-11
version: 1

Malicious Merchants
type: ThreatActor
break id: TA0009
stix type: threat-actor
description: Malicious merchants are commercial entities or individuals engaged in fraud, deception, or other illegitimate means to profit. They typically use fraudulent sales tactics including false advertising, deceptive pricing, and fictitious goods or services to mislead consumers. They may also engage in fake refunds, unauthorized charges, illegal sale of personal information, fake ad clicks, order manipulation, and other activities that harm the digital economy.
keywords: Malicious Merchants
keywords: fraudulent seller
keywords: merchant fraud
keywords: fake storefront operator
keywords: dishonest merchant
keywords: seller scam ring
builds tools: Ranking Manipulation Tools
uses tools: Money Laundering Corporate Bank Accounts
uses tools: Auto-Posting Bots
uses tools: Risk Email Accounts
directly causes: Fake Shipment
directly causes: Promotional Activity Cheating
directly causes: False Advertising
directly causes: Unauthorized Plugin Promotion
directly causes: Unauthorized Plugin Cashback
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Fake Viewer Count Inflation
directly causes: Bulk Following
directly causes: Fake Transactions
directly causes: Order Brushing
directly causes: Subsidy Fraud
directly causes: Search Result Manipulation
directly causes: Content Compliance Risk
directly causes: Spam Content
directly causes: Content Infringement
directly causes: Content Theft
directly causes: Malicious Traffic Diversion
directly causes: Prohibited and Illegal Products
directly causes: Sub-Account Abuse
directly causes: Ghost Stores
directly causes: Merchant Disappearance / Runaway
directly causes: Fake Inventory
directly causes: Low Price, High Shipping
directly causes: Malicious User Harassment
directly causes: Fake Reviews
directly causes: Category / Brand Miscategorization
directly causes: Price Fraud
directly causes: Money Laundering Risk
directly causes: Duplicate Product Listings
directly causes: Automated Reselling
directly causes: Buy Low, Sell High
directly causes: Dropshipping Store
directly causes: Store Cluster
directly causes: Malicious Ad Placement
indirectly supports: Process Automation
indirectly supports: Protocol-Level Automation
indirectly supports: Coupon Enumeration
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Traffic Attribution Fraud
indirectly supports: Web Scraping Risk
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-11
version: 1

Malicious Users
type: ThreatActor
break id: TA0010
stix type: threat-actor
description: Malicious users are individuals who participate in shopping or trading activities through fraud, deception, or other improper means. They may attempt to gain improper economic benefits through false complaints, fraudulent returns, and fake payment disputes, causing losses to sellers and trading platforms. They may abuse promotions, manipulate orders for extra benefits, and undermine fair trading through dishonest means.
keywords: Malicious Users
keywords: abusive buyer
keywords: refund abuser
keywords: chargeback abuser
keywords: promo abuser
keywords: fake complaint user
builds tools: Task Completion Tools
uses tools: Crowdsourcing Platforms
uses tools: Offer Wall Tools
uses tools: Click Simulation Tools
uses tools: Flash Sale Tools
uses tools: Task Completion Tools
uses tools: Auto-Posting Bots
uses tools: Money Laundering Corporate Bank Accounts
uses tools: Risk Email Accounts
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Coupon Enumeration
directly causes: Malicious Flash Sale Grabbing
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Bot Scalping Risk
directly causes: Unfair Resource Seizure
directly causes: Promotional Activity Cheating
directly causes: Cheating Tools / Game Hacks
directly causes: Red Packet Grabbing Bot
directly causes: Inventory Denial
directly causes: Malicious Negative Reviews
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Fake Viewer Count Inflation
directly causes: Bulk Following
directly causes: Minor Age Verification Bypass
directly causes: Malicious Returns
directly causes: Bulk Refunds
directly causes: Return Fraud
directly causes: Flash Return Arbitrage
directly causes: Malicious Refusal of Delivery
directly causes: Order-Splitting Arbitrage
indirectly supports: Protocol-Level Automation
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Ad Fraud
indirectly supports: Fake Transactions
indirectly supports: Web Scraping Risk
indirectly supports: Automated Account Seasoning
indirectly supports: Third-Party Account Aggregation
indirectly supports: CAPTCHA Bypass
indirectly supports: Illegal Cash-Out
indirectly supports: Credit Card / Loan Cash-Out
indirectly supports: After-Sales Rights Abuse
indirectly supports: Malicious Complaints
indirectly supports: Malicious Claims
indirectly supports: Automated Reselling
indirectly supports: Automated Login Risk
indirectly supports: Credit Card Fraud
indirectly supports: Platform Online Loan Fraud
citation: OWASP Automated Threats to Web Applications
updated: 2026-06-11
version: 1

IP Providers
type: ThreatActor
break id: TA0011
stix type: threat-actor
description: In the gray/black market, IP providers are individuals or organizations specializing in providing fake, forged, or stolen IP addresses to hide network identities, evade blocks, conduct cyberattacks, or perform other malicious activities. These IP addresses may be used for fraudulent ad clicks, online scams, and malware distribution.
keywords: IP Providers
keywords: proxy provider
keywords: residential proxy seller
keywords: rotating proxy vendor
keywords: SOCKS5 proxy service
keywords: IP leasing service
builds tools: Proxy IP
builds tools: Second-Dial IP
uses tools: Black SIM Cards
uses tools: Dark Web
directly causes: Blocklisted IP Bypass
indirectly supports: Process Automation
indirectly supports: Coupon Enumeration
indirectly supports: Account Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Resource Exhaustion Attack
indirectly supports: Distributed Denial of Service
indirectly supports: Fake Registration
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Order Brushing
indirectly supports: Web Scraping Risk
indirectly supports: Bulk Account Registration
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
indirectly supports: Credential Brute Force
indirectly supports: Third-Party Account Aggregation
indirectly supports: Carding Attack
indirectly supports: Proxy Login / Proxy Order Placement
citation: The Rotating IP Black Market Spawned by Online Fraud and Its Victims
updated: 2026-06-11
version: 1

Malware Developers
type: ThreatActor
break id: TA0012
stix type: threat-actor
description: In the gray/black market, malware developers are individuals or organizations specializing in writing, publishing, and distributing malicious software. Their goals typically include stealing personal information, conducting cyberattacks, extortion, and other illegal activities. They create malicious software such as viruses, trojans, and ransomware using vulnerability exploitation, social engineering, and other technical means.
keywords: Malware Developers
keywords: malware author
keywords: trojan builder
keywords: ransomware developer
keywords: botnet developer
keywords: loader developer
keywords: crypter developer
builds tools: Pre-installed Mobile Trojan Backdoor
builds tools: Trojan Virus
builds tools: Deobfuscation Tools
builds tools: Hijacking Extensions
builds tools: Malicious AI Applications
builds tools: AI Fraud Chatbots
builds tools: AI Deepfake Video
builds tools: System/Application Vulnerability Exploitation Tools
builds tools: AI Deepfake Tools
builds tools: LLM Automated Attack Tools
builds tools: AI Voice Cloning Tools
builds tools: Infostealers
builds tools: Fake Apps
uses tools: Mobile Phone Emulator
uses tools: Packet Capture Tools
uses tools: Debugging Tools
uses tools: Cloud Phone
uses tools: Multi-Instance Tools
uses tools: Custom Browsers
uses tools: Headless Browsers
uses tools: Decompilation Tools
uses tools: Proxy IP
uses tools: Packet Sending/Modification Tools
uses tools: Anonymous Communication Tools
uses tools: Click Simulation Tools
uses tools: Virtual Machine
directly causes: Cheating Tools / Game Hacks
directly causes: Game Cheating Software
directly causes: Application Reverse Engineering
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
directly causes: Device Malware Infection
directly causes: Ransomware Attack
directly causes: Non-Human Identity and API Key Abuse Risk
indirectly supports: Process Automation
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Automated Login Risk
citation: Qianxin 2024 AI Security Report
updated: 2026-06-13
version: 1

Scraping Gangs
type: ThreatActor
break id: TA0013
stix type: threat-actor
description: In the gray/black market, scraping gangs are individuals or organizations specializing in writing and deploying web crawlers to scrape not only web data but also app data. Their goal is to obtain large amounts of data through automated programs simulating human behavior, which may include sensitive information, user personal data, or other confidential content for illegal purposes.
keywords: Scraping Gangs
keywords: web scraping ring
keywords: app scraping ring
keywords: data scraping operation
keywords: crawler farm
keywords: content scraping gang
builds tools: Web Scraping Tools
builds tools: Automation Scripts
uses tools: Mobile Phone Emulator
uses tools: SMS Verification Code Platform
uses tools: Device Spoofing Tools
uses tools: CAPTCHA Solving Platform
uses tools: Packet Capture Tools
uses tools: Debugging Tools
uses tools: Cloud Phone
uses tools: Root/Jailbreak Tools
uses tools: Custom Browsers
uses tools: Headless Browsers
uses tools: Deobfuscation Tools
uses tools: Image CAPTCHA Recognition Tools
uses tools: Cookie Login Tools
uses tools: Proxy IP
uses tools: Second-Dial IP
uses tools: Packet Sending/Modification Tools
uses tools: Click Simulation Tools
uses tools: Virtual Machine
uses tools: API Automated Abuse Tools
directly causes: Protocol-Level Automation
directly causes: Automated Simulator
directly causes: Web Scraping Risk
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: Sub-Account Abuse
directly causes: Recycled Phone Number Takeover
indirectly supports: Process Automation
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Automated Account Seasoning
indirectly supports: CAPTCHA Bypass
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
indirectly supports: Application Reverse Engineering
indirectly supports: Application Traffic Interception
indirectly supports: HTTP Request Analysis
indirectly supports: Automated Login Risk
citation: 2024 H1 Internet Black-Grey Industry Research Report
updated: 2026-06-13
version: 1

Money Laundering Gangs
type: ThreatActor
break id: TA0014
stix type: threat-actor
description: Money laundering gangs are criminal organizations or individuals specializing in laundering activities. Their primary purpose is to transfer, hide, or conceal funds from illegal sources to make them appear to come from legitimate channels. This involves complex financial transactions and investments designed to make criminal proceeds appear legitimate and difficult to trace within the economic system.
keywords: Money Laundering Gangs
keywords: laundering ring
keywords: fund washing network
keywords: money laundering syndicate
keywords: transaction laundering ring
builds tools: Score-Running Platforms
uses tools: Identity Document Set (4-Piece)
uses tools: Money Laundering Bank Cards
uses tools: Money Laundering Digital Wallets
uses tools: Corporate Identity Document Set (8-Piece)
uses tools: Score-Running Platforms
uses tools: Money Laundering Corporate Bank Accounts
directly causes: Money Laundering Risk
directly causes: Payment Channel Abuse
directly causes: Cryptocurrency Money Laundering Risk
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Illegal Cash-Out
indirectly supports: Real-World Identity Theft
indirectly supports: Fake Identity Authentication
citation: How Much Do You Know About 'Money Laundering Rooms'?
updated: 2026-06-11
version: 1

ATM Runner
type: ThreatActor
break id: TA0014-001
stix type: threat-actor
description: A person who withdraws fraud proceeds from ATMs in exchange for a commission. They are commonly called 'runners' because they typically travel by motorcycle or electric scooter to carry out the withdrawals.
keywords: ATM Runner
keywords: cash-out runner
keywords: ATM cash-out crew
keywords: ATM mule
keywords: cash mule
builds tools: Score-Running Platforms
uses tools: Black SIM Cards
uses tools: Money Laundering Bank Cards
uses tools: Score-Running Platforms
directly causes: Transfer Fraud
directly causes: Money Laundering Risk
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Account Privilege Reselling
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Inactive Number Registration
citation: A Batch of 'ATM Runners' Arrested with 2.7 Million Cash Seized — Why Have They Resurfaced After Years of Silence?
updated: 2026-06-11
version: 1

Telecom Fraud Gangs
type: ThreatActor
break id: TA0015
stix type: threat-actor
description: Telecom fraud gangs are criminal organizations or individuals specializing in telecommunications fraud. They use phone calls, SMS, and online communications to commit fraud through deception, false advertising, and social engineering to illegally obtain others' property. These gangs are typically well-organized with clear division of labor, using highly technical and sophisticated methods.
keywords: Telecom Fraud Gangs
keywords: telecom scam ring
keywords: phone scam ring
keywords: fraud call center
keywords: social engineering fraud ring
keywords: pig butchering ring
builds tools: AI Fraud Chatbots
builds tools: Phishing Kits
builds tools: Phishing-as-a-Service (PhaaS) Platform
builds tools: Fake Call Spoofing Tool
uses tools: Black SIM Cards
uses tools: Modem Pool SIM Cards
uses tools: Social Engineering Database
uses tools: Trojan Virus
uses tools: Identity Document Set (4-Piece)
uses tools: Money Laundering Bank Cards
uses tools: Money Laundering Digital Wallets
uses tools: Corporate Identity Document Set (8-Piece)
uses tools: Money Laundering Corporate Bank Accounts
uses tools: Risk Email Accounts
uses tools: AI Deepfake Video
uses tools: Fake Apps
uses tools: Malicious QR Code Generators
uses tools: Fraud-as-a-Service (FaaS) Platform
uses tools: ClickFix Deception Tools
directly causes: QR Code Login Fraud
directly causes: Transfer Fraud
directly causes: Money Laundering Risk
directly causes: Social Engineering Risk
directly causes: Payment Channel Abuse
directly causes: Credit Card Fraud
directly causes: Platform Fraud Risk
directly causes: Malicious Ad Placement
directly causes: Consumer Loan Fraud (Genuine Retroactive Payment)
directly causes: Pig Butchering / Investment Fraud Risk
directly causes: Phishing Attack
directly causes: QR Code Phishing (Quishing)
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Registration
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Interceptor Card Registration
citation: Anti-Telecom and Online Fraud Law of the People's Republic of China
updated: 2026-06-13
version: 1

Fraud Kingpin
type: ThreatActor
break id: TA0015-001
stix type: threat-actor
description: The top boss of a fraud gang — either a single individual or a group of shareholders. They set up operations overseas, build server rooms and infrastructure, recruit and train gang members, purchase data and bank cards from harvesters and card farmers, and supply fraud scripts. After a successful operation, they distribute the proceeds to runners and money laundering rooms.
keywords: Fraud Kingpin
keywords: scam boss
keywords: fraud ringleader
keywords: syndicate boss
keywords: fraud mastermind
builds tools: Money Laundering Bank Cards
builds tools: Money Laundering Corporate Bank Accounts
uses tools: Anonymous Communication Tools
uses tools: Identity Document Set (4-Piece)
uses tools: Money Laundering Bank Cards
directly causes: Platform Fraud Risk
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Account Privilege Reselling
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: IoT SIM Card Registration
indirectly supports: Money Laundering Risk
citation: Two Departments Jointly Expose Financial Black-Grey Market Typical Cases
updated: 2026-06-13
version: 1

Online Gambling Gangs
type: ThreatActor
break id: TA0016
stix type: threat-actor
description: Online gambling gangs are criminal organizations or individuals specializing in organizing and operating online gambling activities. They use internet platforms to provide various gambling services including online casinos, betting websites, and virtual game gambling. These gangs attract gamblers through cleverly designed websites, attractive reward schemes, and advertising. Their operations typically involve gambling fund laundering, illegal profits, and manipulation of gambling results.
keywords: Online Gambling Gangs
keywords: illegal online casino ring
keywords: betting platform operator
keywords: offshore gambling ring
keywords: online betting syndicate
builds tools: Automation Scripts
builds tools: Game Cheats
uses tools: Dark Web
uses tools: Score-Running Platforms
uses tools: Money Laundering Bank Cards
uses tools: Money Laundering Digital Wallets
uses tools: Money Laundering Corporate Bank Accounts
directly causes: Money Laundering Risk
directly causes: Payment Channel Abuse
directly causes: Platform-Facilitated Gambling
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Account Privilege Reselling
indirectly supports: Inactive Number Registration
indirectly supports: Virtual Number Registration
indirectly supports: Stolen Card Payment
indirectly supports: Illegal Cash-Out
citation: MPS Cross-Border Gambling Crackdown Report
updated: 2026-06-13
version: 1

Criminal Organizations
type: ThreatActor
break id: TA0017
stix type: threat-actor
description: Criminal organizations are groups or individuals specializing in illegal, fraudulent, or malicious activities. These organizations are typically economically motivated, using technical means, cybercrime, or other illegal methods to profit. Their activities may include cyberattacks, data breaches, malware development, online fraud, money laundering, and illegal trading. They are typically tightly organized and may operate globally.
keywords: Criminal Organizations
keywords: organized crime group
keywords: criminal syndicate
keywords: cybercrime syndicate
keywords: fraud syndicate
builds tools: Black SIM Cards
builds tools: Modem Pool
builds tools: SMS Verification Code Platform
builds tools: CAPTCHA Solving Platform
builds tools: Pre-installed Mobile Trojan Backdoor
builds tools: Social Engineering Database
builds tools: Trojan Virus
builds tools: Score-Running Platforms
builds tools: Card Vending Platforms
builds tools: Crowdsourcing Platforms
builds tools: Hijacking Extensions
builds tools: Proxy IP
builds tools: Account Rental Platforms
builds tools: Offer Wall Tools
builds tools: Game Cheats
uses tools: Mass Control Systems
uses tools: Dark Web
uses tools: Social Engineering Database
uses tools: Trojan Virus
uses tools: Credential Stuffing Tools
uses tools: Anonymous Communication Tools
uses tools: Money Laundering Corporate Bank Accounts
uses tools: AI Deepfake Tools
uses tools: Cryptocurrency Mixers
uses tools: Password Dictionaries/Rainbow Tables
uses tools: Evil Twin WiFi
directly causes: Bulk Fake Account Manipulation
directly causes: Fake Viral Referral
directly causes: Access Link Hijacking
directly causes: Ad Fraud
directly causes: Ad Link Hijacking
directly causes: Click Fraud
directly causes: Fake App Installs
directly causes: Impression Fraud
directly causes: Traffic Attribution Fraud
directly causes: Unauthorized Third-Party Top-Up Services
directly causes: Game Cheating Software
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Fake Viewer Count Inflation
directly causes: Bulk Following
directly causes: Subsidy Fraud
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: QR Code Login Fraud
directly causes: Carding Attack
directly causes: Stolen Card Payment
directly causes: Stolen Card Fraud
directly causes: Points Theft
directly causes: Points Redemption Reselling
directly causes: Money Laundering Risk
directly causes: Recycled Phone Number Takeover
directly causes: Game Account Laundering
directly causes: Payment Channel Abuse
directly causes: Credit Card Fraud
directly causes: Gold Farming
directly causes: AI Deepfake Risk
directly causes: Cryptocurrency Money Laundering Risk
indirectly supports: Process Automation
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Account Reselling

Qianxin 2024 Mid-Year Cybersecurity Threat Report
type: CreativeWork

Malicious Hackers
type: ThreatActor
break id: TA0018
stix type: threat-actor
description: Malicious hackers are individuals or organizations specializing in illegal intrusion, destruction, information theft, and other malicious activities. Using deep computer knowledge, they employ various means to infiltrate computer systems, networks, or applications for illegal purposes. Their activities may include cyberattacks, data breaches, malware development, extortion, and online fraud.
keywords: Malicious Hackers
keywords: black hat operator
keywords: intrusion operator
keywords: exploit operator
keywords: unauthorized access crew
keywords: network intrusion team
builds tools: Social Engineering Database
builds tools: Trojan Virus
builds tools: Credential Stuffing Tools
builds tools: Malicious AI Applications
builds tools: Malicious Peripherals
builds tools: KON-Boot
builds tools: USB Killer
builds tools: BadUSB
uses tools: Black SIM Cards
uses tools: Dark Web
uses tools: Social Engineering Database
uses tools: Trojan Virus
uses tools: Packet Capture Tools
uses tools: Debugging Tools
uses tools: Packet Sending/Modification Tools
uses tools: Credential Stuffing Tools
uses tools: Virtual Machine
uses tools: Malicious Peripherals
uses tools: KON-Boot
uses tools: USB Killer
uses tools: BadUSB
uses tools: Surveillance and Eavesdropping Devices
uses tools: Risk Email Accounts
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: LLM Automated Attack Tools
uses tools: Infostealers
uses tools: API Automated Abuse Tools
uses tools: AiTM Adversary-in-the-Middle Attack Tool
directly causes: Data Exfiltration Risk
directly causes: Denial of Service Risk
directly causes: SMS Resource Exhaustion
directly causes: Resource Exhaustion Attack
directly causes: CC Attack
directly causes: Distributed Denial of Service
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Verification Code Brute Force
directly causes: Login Credential Theft
directly causes: Multi-Factor Authentication (MFA) Bypass
directly causes: Carding Attack
directly causes: Card Cracking
directly causes: Stolen Card Fraud
directly causes: Points Theft
directly causes: Risk Device Identification Bypass
directly causes: Virtual Device Identification Bypass
directly causes: Application Reverse Engineering
directly causes: Application Traffic Interception
directly causes: HTTP Request Analysis
directly causes: Trade Secret Leakage
directly causes: File or Document Theft
directly causes: Device Malware Infection
directly causes: Supply Chain Risk
directly causes: Software Supply Chain Risk
directly causes: Hardware Supply Chain Risk
directly causes: Cloud Service Supply Chain Risk
directly causes: Outsourced Personnel Risk
directly causes: Employee Account Compromise
directly causes: Social Engineering Risk
directly causes: Phishing Attack
directly causes: Ransomware Attack
directly causes: Server Cryptomining
directly causes: Business Logic Tampering Risk
directly causes: User Privacy Leakage
directly causes: Bulk Account Enumeration
directly causes: Real-World Identity Theft
directly causes: Credit Card Fraud
directly causes: Privilege Escalation / Unauthorized Access

MITRE ATT&CK - Threat Groups
type: CreativeWork

Astroturfing Networks
type: ThreatActor
break id: TA0019
stix type: threat-actor
description: Astroturfing networks are hired or organized groups that post large volumes of fake comments, likes, and reposts on the internet to influence public opinion, create false impressions, or push specific agendas. Members operate multiple accounts manually or through automation to rapidly generate large amounts of content, obscuring real users' voices and creating a false social media atmosphere.
keywords: Astroturfing Networks
keywords: comment farm
keywords: like farm
keywords: engagement manipulation network
keywords: sockpuppet farm
keywords: paid posting network
builds tools: Auto-Posting Bots
uses tools: Black SIM Cards
uses tools: Mobile Phone Emulator
uses tools: Bulk Account Registration Tool
uses tools: SMS Verification Code Platform
uses tools: CAPTCHA Solving Platform
uses tools: Mass Control Systems
uses tools: Cloud Phone
uses tools: Automation Scripts
uses tools: Image CAPTCHA Recognition Tools
uses tools: Crowdsourcing Platforms
uses tools: Proxy IP
uses tools: Second-Dial IP
uses tools: Ranking Manipulation Tools
uses tools: Risk Email Accounts
uses tools: Malicious AI Applications
uses tools: Digital Human Generation Tools
directly causes: Process Automation
directly causes: Search Result Manipulation
directly causes: Malicious Traffic Diversion
directly causes: Fake Registration
directly causes: Bulk Account Registration
directly causes: Third-Party Account Risk
directly causes: Overseas Number Registration
directly causes: Inactive Number Registration
directly causes: Virtual Number Registration
directly causes: IoT SIM Card Registration
directly causes: Generative AI Risk
directly causes: AI-Generated Low-Quality Content
directly causes: AI-Generated Fake Reviews
directly causes: Digital Avatar Live Stream Fraud
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Fake Viewer Count Inflation
indirectly supports: CAPTCHA Bypass
indirectly supports: Risk Device Identification Bypass
citation: CAC Crackdown on Traffic Fraud and Astroturfing
updated: 2026-06-13
version: 1

Personal Data Traffickers
type: ThreatActor
break id: TA0020
stix type: threat-actor
description: Criminals who illegally obtain and bulk-resell citizens' personal information.
keywords: Personal Data Traffickers
keywords: PII trafficker
keywords: identity data reseller
keywords: personal information seller
keywords: bulk PII vendor
builds tools: Social Engineering Database
uses tools: Web Scraping Tools
uses tools: Dark Web
uses tools: Automation Scripts
uses tools: Credential Stuffing Tools
directly causes: Process Automation
directly causes: Protocol-Level Automation
directly causes: Coupon Enumeration
directly causes: Instant Bid Sniping
directly causes: Auction Sniping
directly causes: Web Scraping Risk
directly causes: Account Takeover
directly causes: Credential Stuffing
directly causes: Password Spraying
directly causes: Credential Brute Force
directly causes: Verification Code Brute Force
directly causes: Employee Account Compromise
indirectly supports: Automated Simulator
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Account Reselling
indirectly supports: Data Exfiltration Risk
indirectly supports: Carding Attack
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: Automated Login Risk
indirectly supports: Bulk Account Enumeration
indirectly supports: Fake Identity Authentication
indirectly supports: Gold Farming
citation: Two Departments Jointly Expose Financial Black-Grey Market Typical Cases
updated: 2026-06-11
version: 1

Security-Unaware Employees
type: ThreatActor
break id: TA0021
stix type: threat-actor
description: Security-unaware employees are personnel lacking sufficient information security awareness and training, who may easily become potential security risks due to insufficient understanding of security threats and best practices. This weak security awareness may lead employees to make security mistakes, inadvertently leak sensitive information, click malicious links, or take other actions that are vulnerable to attack.
keywords: Security-Unaware Employees
keywords: phishing-prone employee
keywords: security awareness gap
keywords: untrained employee risk
keywords: human factor security risk
uses tools: Phishing Kits
directly causes: QR Code Login Fraud
directly causes: Trade Secret Leakage
directly causes: Employee Error Risk
directly causes: File or Document Theft
directly causes: Device Loss
directly causes: Device Malware Infection
directly causes: Insufficient Employee Security Awareness
directly causes: Employee Account Compromise
directly causes: Social Engineering Risk
directly causes: Phishing Attack
directly causes: Employee Account Sharing
directly causes: Office Environment Risk
directly causes: Bring Your Own Device (BYOD) Risk
directly causes: Unauthorized Physical Access
directly causes: Unauthorized Device Connection
indirectly supports: User Privacy Leakage
citation: Insider Threat - Wikipedia
updated: 2026-06-11
version: 1

Competitors
type: ThreatActor
break id: TA0022
stix type: threat-actor
description: Competitors are enterprises in the same industry with the same or similar products or services, facing the same or similar customers, thus creating a competitive relationship. Competitor attack behavior is primarily aimed at obtaining the opponent's trade secrets to gain a competitive advantage.
keywords: Competitors
keywords: industrial espionage
keywords: trade secret theft
keywords: competitive intelligence abuse
keywords: unfair competition
builds tools: Web Scraping Tools
uses tools: Modem Pool
uses tools: Trojan Virus
uses tools: Hijacking Extensions
uses tools: Surveillance and Eavesdropping Devices
uses tools: Risk Email Accounts
uses tools: Covert Recording Devices
directly causes: Access Link Hijacking
directly causes: Malicious User Poaching
directly causes: Web Scraping Risk
directly causes: Denial of Service Risk
directly causes: SMS Resource Exhaustion
directly causes: Resource Exhaustion Attack
directly causes: CC Attack
directly causes: Distributed Denial of Service
directly causes: Negative Public Opinion
directly causes: Trade Secret Leakage
directly causes: File or Document Theft
directly causes: Insider-Outsider Collusion
directly causes: Employee Account Compromise
directly causes: Social Engineering Risk
directly causes: Office Environment Risk
directly causes: Unauthorized Physical Access
directly causes: Physical Damage and Destruction
directly causes: Surveillance and Eavesdropping
indirectly supports: Fake Viral Referral
indirectly supports: Third-Party Price Comparison
indirectly supports: Unauthorized Promotional Redirection
indirectly supports: Data Exfiltration Risk
indirectly supports: Bulk Account Registration
indirectly supports: MFA Fatigue Attack
indirectly supports: Malicious User Harassment
indirectly supports: Device Loss
indirectly supports: Employee Sabotage
indirectly supports: Bulk Account Enumeration
citation: Industrial Espionage - Wikipedia
updated: 2026-06-11
version: 1

Risky Third-Party Partners
type: ThreatActor
break id: TA0023
stix type: threat-actor
description: Third parties with a cooperative relationship with the platform who use malicious means to profit improperly.
keywords: Risky Third-Party Partners
keywords: third-party risk
keywords: partner abuse
keywords: vendor fraud
keywords: supply chain partner risk
builds tools: API Automated Abuse Tools
uses tools: Bulk Account Registration Tool
uses tools: Web Scraping Tools
uses tools: Automation Scripts
uses tools: Money Laundering Corporate Bank Accounts
uses tools: Ranking Manipulation Tools
directly causes: Ad Fraud
directly causes: Click Fraud
directly causes: Fake App Installs
directly causes: Impression Fraud
directly causes: Traffic Attribution Fraud
directly causes: File or Document Theft
directly causes: Partner Data Breach
directly causes: Supply Chain Risk
directly causes: Software Supply Chain Risk
directly causes: Hardware Supply Chain Risk
directly causes: Cloud Service Supply Chain Risk
directly causes: Outsourced Personnel Risk
directly causes: Business Logic Tampering Risk
directly causes: Office Environment Risk
directly causes: Unauthorized Physical Access
directly causes: Unauthorized Device Connection
directly causes: Surveillance and Eavesdropping
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Third-Party Account Aggregation
indirectly supports: User Privacy Leakage
indirectly supports: Bulk Account Enumeration
citation: Insider Threat - Wikipedia
updated: 2026-06-11
version: 1

Malicious Insiders
type: ThreatActor
break id: TA0024
stix type: threat-actor
description: Malicious insiders are employees within an organization who intentionally engage in destructive, unethical, or illegal activities. These activities may be for personal gain, revenge, dissatisfaction with the company, or other motivations. Malicious insider behavior can pose serious threats to an organization's operations, reputation, and security.
keywords: Malicious Insiders
keywords: insider threat actor
keywords: rogue employee
keywords: insider fraud
keywords: privileged access abuse
keywords: insider sabotage
builds tools: Infostealers
builds tools: Keyloggers
uses tools: Trojan Virus
uses tools: Surveillance and Eavesdropping Devices
uses tools: Virtual Machine
uses tools: Malicious Peripherals
uses tools: KON-Boot
uses tools: USB Killer
uses tools: BadUSB
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Covert Recording Devices
directly causes: Trade Secret Leakage
directly causes: File or Document Theft
directly causes: Employee Corruption
directly causes: Insider-Outsider Collusion
directly causes: Employee Sabotage
directly causes: Business Logic Tampering Risk
directly causes: User Privacy Leakage
directly causes: Employee Business-Level Backdoor
directly causes: Office Environment Risk
directly causes: Bring Your Own Device (BYOD) Risk
directly causes: Unauthorized Physical Access
directly causes: Unauthorized Device Connection
directly causes: Physical Damage and Destruction
directly causes: Surveillance and Eavesdropping
directly causes: Non-Human Identity and API Key Abuse Risk
indirectly supports: Process Automation
indirectly supports: Prohibited and Illegal Products
indirectly supports: Verification Code Brute Force
indirectly supports: MFA Fatigue Attack
indirectly supports: Risk Device Identification Bypass
indirectly supports: Virtual Device Identification Bypass
indirectly supports: Device Loss
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Employee Policy Violations
citation: Insider Threat - Wikipedia
updated: 2026-06-11
version: 1

Gold Farming Studios
type: ThreatActor
break id: TA0025
stix type: threat-actor
description: Gold farming studios are service organizations or individuals that provide virtual currencies, game items, and other virtual wealth. Their main business is providing in-game virtual currency, items, and characters to players through professional players or automated scripts in exchange for real money.
keywords: Gold Farming Studios
keywords: gold farm
keywords: RMT farm
keywords: MMO farming studio
keywords: game currency farming service
builds tools: Offline Game Bots
builds tools: Game Cheats
uses tools: Black SIM Cards
uses tools: Mobile Phone Emulator
uses tools: Bulk Account Registration Tool
uses tools: SMS Verification Code Platform
uses tools: Device Spoofing Tools
uses tools: CAPTCHA Solving Platform
uses tools: Mass Control Systems
uses tools: Cloud Phone
uses tools: Multi-Instance Tools
uses tools: Root/Jailbreak Tools
uses tools: Offline Game Bots
uses tools: Hardware ROM Modification Tools
uses tools: Automation Scripts
uses tools: Proxy IP
uses tools: Device Wipe Tools
uses tools: Phone Backup and Restore Tools
uses tools: Click Simulation Tools
uses tools: Task Completion Tools
uses tools: Virtual Machine
uses tools: Game Cheats
directly causes: Process Automation
directly causes: Unauthorized Third-Party Top-Up Services
directly causes: Game Account Reselling
directly causes: Gold Farming
directly causes: Game Storage Accounts
indirectly supports: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Bulk Account Registration
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
citation: Gold Farming - Wikipedia
updated: 2026-06-11
version: 1

In-Game Currency Dealer
type: ThreatActor
break id: TA0025-001
stix type: threat-actor
description: Individuals who sell in-game points or gold coins, typically acquired in bulk through various in-game methods, and resell them to other players at prices below the official rate. This behavior can negatively impact the game economy, disrupt balance, and degrade other players' experience. Game operators typically counter this with account bans and enhanced security detection.
keywords: In-Game Currency Dealer
keywords: gold seller
keywords: RMT seller
keywords: game currency seller
keywords: virtual currency dealer
builds tools: Automation Scripts
builds tools: Game Cheats
uses tools: Multi-Instance Tools
uses tools: Offline Game Bots
uses tools: Click Simulation Tools
uses tools: Task Completion Tools
directly causes: Process Automation
directly causes: Unauthorized Third-Party Top-Up Services
directly causes: Gold Farming
directly causes: Game Storage Accounts
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Application Reverse Engineering
indirectly supports: Application Traffic Interception
citation: Real-Money Trading - Wikipedia
updated: 2026-06-11
version: 1

Game Boosters
type: ThreatActor
break id: TA0025-002
stix type: threat-actor
description: Game boosters are professional players or teams who play games on behalf of other players, providing boosting services. This service typically involves helping other players level up game characters, obtain virtual items, and complete specific tasks or challenges. Game boosters usually have extensive game experience and skills to quickly and efficiently complete tasks.
keywords: Game Boosters
keywords: elo booster
keywords: rank boosting service
keywords: account boosting
keywords: pilot service
builds tools: Automation Scripts
uses tools: Mobile Phone Emulator
uses tools: Device Spoofing Tools
uses tools: Multi-Instance Tools
uses tools: Root/Jailbreak Tools
uses tools: Offline Game Bots
uses tools: Proxy IP
uses tools: Device Wipe Tools
uses tools: Click Simulation Tools
uses tools: Game Cheats
directly causes: Process Automation
directly causes: Game Account Boosting Service
directly causes: Gold Farming
directly causes: Game Storage Accounts
indirectly supports: Automated Simulator
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Automated Login Risk
citation: Boosting (Video Games) - Wikipedia
updated: 2026-06-11
version: 1

Match Fixers
type: ThreatActor
break id: TA0025-003
stix type: threat-actor
description: Generally refers to players in games who engage in score-giving and score-taking behavior, manipulating match results within the same game session. This malicious behavior generally appears in MOBA game matches and sometimes in FPS games.
keywords: Match Fixers
keywords: win trading
keywords: rank manipulation
keywords: match result collusion
keywords: boosting collusion
builds tools: Game Cheats
uses tools: Mobile Phone Emulator
uses tools: Proxy IP
uses tools: Virtual Machine
uses tools: Game Cheats
directly causes: Match Fixing
indirectly supports: Process Automation
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Cheating Tools / Game Hacks
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Automated Account Seasoning
indirectly supports: Risk Device Identification Bypass
indirectly supports: Automated Login Risk
citation: Match Fixing - Wikipedia
updated: 2026-06-11
version: 1

Malicious Players
type: ThreatActor
break id: TA0028
stix type: threat-actor
description: Malicious players are players in gaming environments who intentionally interfere, cheat, disrupt, or violate game rules. These players may seek personal gain through illegitimate means, disrupt game balance, or simply cause trouble for other players. Malicious player behavior may include cheating and hacking, fraud and deception, disrupting game balance, malicious score or experience farming, toxic speech and harassment, and team sabotage.
keywords: Malicious Players
keywords: griefer
keywords: toxic player
keywords: team saboteur
keywords: game cheater
keywords: account abuser
builds tools: Game Cheats
uses tools: Offline Game Bots
uses tools: Automation Scripts
uses tools: Proxy IP
uses tools: Click Simulation Tools
directly causes: Process Automation
directly causes: Automated Simulator
directly causes: Unfair Resource Seizure
directly causes: Cheating Tools / Game Hacks
directly causes: Game Cheating Software
directly causes: AFK / Idle Behavior
directly causes: Intentional Feeding
directly causes: Boosting (Carry Service)
directly causes: Spectator Wallhack
directly causes: Escort Cheating
directly causes: Account Renting / Lending
directly causes: Game Account Boosting Service
directly causes: Match Fixing
directly causes: Malicious Player Poaching
directly causes: Game Storage Accounts
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Malicious Benefit Abuse
indirectly supports: Risk Device Identification Bypass
indirectly supports: Application Reverse Engineering
indirectly supports: Application Traffic Interception
indirectly supports: Gold Farming
citation: Cheating in Online Games - Wikipedia
updated: 2026-06-11
version: 1

Anti-Collection Gangs
type: ThreatActor
break id: TA0029
stix type: threat-actor
description: Anti-collection gangs are organizations or individuals specializing in helping debtors evade debts through various illegitimate means, harming creditors' legitimate rights. These gangs typically operate under the guise of debt consulting, rights representation, and repayment negotiation, inducing or forcing debtors to take illegal measures to evade debts while extracting high profits.
keywords: Anti-Collection Gangs
keywords: anti-collection agency
keywords: debt evasion service
keywords: debt relief scam
keywords: anti debt collection gang
keywords: loan overdue mediation scam
builds tools: Automation Scripts
uses tools: Black SIM Cards
uses tools: Proxy IP
directly causes: Anti-Collection Risk
directly causes: Data Breach
directly causes: Insufficient Employee Security Awareness
indirectly supports: Platform Online Loan Fraud
indirectly supports: Application Reverse Engineering
indirectly supports: Account Takeover
citation: JD Finance Cooperates with Police to Successfully Crack Down on Anti-Collection Black Market Gangs
citation: Over 40 Arrested! Mashang Consumer Finance Assists in Cracking Down on Anti-Collection Gangs
updated: 2026-06-11
version: 1

Corporate Spies
type: ThreatActor
break id: TA0030
stix type: threat-actor
description: Also known as economic spies. Corporate spies are individuals or teams hired by a company or organization to obtain competitors' trade secrets, strategic plans, or other sensitive information to gain a business advantage. Corporate espionage may involve illegal means, violating laws and ethical norms, and is considered unfair competition and unethical business behavior.
keywords: Corporate Spies
keywords: economic espionage
keywords: industrial spy
keywords: trade secret theft
keywords: competitive intelligence espionage
builds tools: Infostealers
builds tools: Keyloggers
uses tools: Black SIM Cards
uses tools: Dark Web
uses tools: Social Engineering Database
uses tools: Trojan Virus
uses tools: Hijacking Extensions
uses tools: Surveillance and Eavesdropping Devices
uses tools: Proxy IP
uses tools: Phone Backup and Restore Tools
uses tools: Anonymous Communication Tools
uses tools: Risk Email Accounts
uses tools: Malicious Peripherals
uses tools: KON-Boot
uses tools: USB Killer
uses tools: BadUSB
uses tools: AI Deepfake Video
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Covert Recording Devices
directly causes: Malicious User Poaching
directly causes: Trade Secret Leakage
directly causes: File or Document Theft
directly causes: Employee Corruption
directly causes: Insider-Outsider Collusion
directly causes: Device Loss
directly causes: Employee Account Compromise
directly causes: Social Engineering Risk
directly causes: Employee Policy Violations
directly causes: Employee Account Sharing
directly causes: Employee Business-Level Backdoor
directly causes: Office Environment Risk
directly causes: Unauthorized Physical Access
directly causes: Unauthorized Device Connection
directly causes: Surveillance and Eavesdropping
directly causes: Wireless Network Risk
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Account Reselling
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: MFA Fatigue Attack
indirectly supports: Money Laundering Risk
indirectly supports: Employee Sabotage
indirectly supports: Physical Damage and Destruction
citation: What is economic espionage? - FBI
updated: 2026-06-13
version: 1

AI Fraud Gangs
type: ThreatActor
break id: TA0031
stix type: threat-actor
description: AI fraud gangs are organized criminal gangs specializing in using artificial intelligence technologies (particularly deepfakes, large language models, and voice cloning) to commit various types of fraud. These gangs typically have strong AI technical capabilities and can develop or customize various AI attack tools. Main activities include: video call fraud using AI face-swapping, phone fraud impersonating friends or leaders using voice cloning, batch generation of high-quality phishing content using LLMs, bypassing facial recognition and voiceprint authentication systems using AI, and fake live-stream e-commerce using digital human technology.
keywords: AI Fraud Gangs
keywords: deepfake fraud ring
keywords: voice cloning scam
keywords: AI phishing ring
keywords: AI scam syndicate
keywords: digital human fraud
builds tools: AI Deepfake Tools
builds tools: LLM Automated Attack Tools
builds tools: AI Voice Cloning Tools
uses tools: AI Deepfake Tools
uses tools: LLM Automated Attack Tools
uses tools: Digital Human Generation Tools
uses tools: AI Voice Cloning Tools
uses tools: Web Scraping Tools
uses tools: Social Engineering Database
uses tools: Malicious AI Applications
directly causes: Phishing Attack
directly causes: Real-World Identity Theft
directly causes: AI Deepfake Risk
directly causes: AI Face-Swap Fraud
directly causes: AI Synthetic Video Fraud
directly causes: AI-Automated Attack Escalation
directly causes: AI-Generated Fake Reviews
directly causes: AI Voice Cloning Fraud
directly causes: Digital Avatar Live Stream Fraud
directly causes: AI Agent Tool Misuse / Excessive Autonomy Risk
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Credential Stuffing
indirectly supports: AI Hallucination Risk
indirectly supports: Employee Account Compromise
indirectly supports: Platform-Facilitated Gambling
indirectly supports: Platform Pornography Risk
indirectly supports: Malicious Player Poaching
citation: AI-Driven Cybercrime Trends - Europol
citation: AI Fraud Case Analysis - Ministry of Public Security
updated: 2026-06-11
version: 1

Digital Human Operation Gangs
type: ThreatActor
break id: TA0032
stix type: threat-actor
description: Digital human operation gangs are gangs that use AI digital human technology for large-scale fake live streaming, fake content production, and social fraud. These gangs typically operate digital human accounts in bulk, using AI-generated virtual anchors for 24-hour uninterrupted live-stream e-commerce, fake interactions, and content migration. Main characteristics include: bulk registration and operation of live-streaming accounts, using AI digital humans to replace real anchors to reduce operating costs, creating fake popularity with automated bullet comments and fake viewer data, selling counterfeit goods or making false advertising, and impersonating celebrities or influencers for live streaming.
keywords: Digital Human Operation Gangs
keywords: AI avatar live stream fraud
keywords: virtual influencer scam
keywords: digital human live commerce
keywords: deepfake livestream operation
keywords: synthetic anchor operation
builds tools: Digital Human Generation Tools
uses tools: AI Deepfake Tools
uses tools: Digital Human Generation Tools
uses tools: Risk Email Accounts
uses tools: Bulk Account Registration Tool
directly causes: False Advertising
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Order Brushing
directly causes: Fake Reviews
directly causes: AI-Generated Low-Quality Content
directly causes: AI-Generated Fake Reviews
directly causes: Digital Avatar Live Stream Fraud
indirectly supports: Fake Shipment
indirectly supports: Content Compliance Risk
indirectly supports: Spam Content
indirectly supports: Content Infringement
indirectly supports: Malicious Traffic Diversion
indirectly supports: AI Hallucination Risk
indirectly supports: Platform-Facilitated Gambling
indirectly supports: Platform Pornography Risk
indirectly supports: Malicious Ad Placement
indirectly supports: AI Synthetic Video Fraud
citation: Analysis of AI Digital Human Live Streaming Chaos
updated: 2026-06-11
version: 1

Cross-border Criminal Organizations
type: ThreatActor
break id: TA0033
stix type: threat-actor
description: Cross-border criminal organizations are organized cybercrime gangs operating illegal activities across multiple countries and regions, exploiting regulatory differences and law enforcement cooperation difficulties between jurisdictions to evade crackdowns. Main activities include: cross-border telecom fraud, cryptocurrency money laundering, cross-border fake orders and fraudulent transactions, illegal fund transfers through cross-border payment channels, and cross-border counterfeiting and smuggling.
keywords: Cross-border Criminal Organizations
keywords: transnational crime syndicate
keywords: cross-border fraud ring
keywords: international cybercrime ring
keywords: cross-border money laundering network
builds tools: Cryptocurrency Mixers
uses tools: Cryptocurrency Mixers
uses tools: SIM Swap Toolkit
uses tools: Black SIM Cards
uses tools: Proxy IP
uses tools: Risk Email Accounts
uses tools: Card Vending Platforms
uses tools: Identity Document Set (4-Piece)
uses tools: Corporate Identity Document Set (8-Piece)
directly causes: Stolen Card Payment
directly causes: Transfer Fraud
directly causes: Money Laundering Risk
directly causes: Payment Channel Abuse
directly causes: Platform Fraud Risk
directly causes: Fake Identity Authentication
directly causes: Cryptocurrency Money Laundering Risk
directly causes: SIM Swap Attack
indirectly supports: Bot Scalping Risk
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Illegal Cash-Out
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
indirectly supports: Real-World Identity Theft
citation: Cross-border Cybercrime Crackdown Operations - Interpol
citation: Combating Cross-border Telecom Network Fraud
updated: 2026-06-11
version: 1

Professional Counterfeit Claimants
type: ThreatActor
break id: TA0034
stix type: threat-actor
description: Professional counterfeit claimants are groups that exploit punitive compensation clauses in consumer protection and food safety laws to bulk-purchase products with labeling defects or non-compliant advertising, then file claims for profit. This is a gray market phenomenon unique to China's e-commerce sector. Main behavioral characteristics include: targeted product selection, bulk ordering, evidence preservation, multi-channel pressure, team-based operations, and knowledge base sharing.
keywords: Professional Counterfeit Claimants
keywords: professional anti-counterfeit claimant
keywords: serial compensation claimant
keywords: label defect claimant
keywords: punitive compensation claim
builds tools: Web Scraping Tools
uses tools: Bulk Account Registration Tool
directly causes: Malicious Returns
directly causes: Fake Reviews
directly causes: Friendly Fraud / Chargeback Fraud
directly causes: Malicious Complaints
directly causes: Malicious Claims
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
citation: Consumer Rights Protection Law
citation: Supreme People's Court Provisions on Several Issues Concerning the Application of Law in Adjudicating Food and Drug Dispute Cases
updated: 2026-06-11
version: 1

Professional Negative Reviewers
type: ThreatActor
break id: TA0035
stix type: threat-actor
description: Professional negative reviewers are groups that use negative reviews or threats of negative reviews to extort money from merchants, or are hired by competitors to maliciously attack target merchants. Main behavioral patterns include: extortion-type negative reviews, competitor attack-type negative reviews, organized operations, multi-account operations, carefully crafted content, and exploitation of platform rules.
keywords: Professional Negative Reviewers
keywords: review extortion
keywords: bad review blackmail
keywords: negative review farm
keywords: competitor review attack
keywords: malicious review service
builds tools: Automation Scripts
uses tools: Bulk Account Registration Tool
uses tools: Web Scraping Tools
uses tools: Risk Email Accounts
directly causes: Metric Manipulation / Ranking Fraud
directly causes: Fake Transactions
directly causes: Fake Reviews
directly causes: Generative AI Risk
directly causes: Malicious Negative Reviews
indirectly supports: Ad Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
citation: E-commerce Platform Malicious Review Governance
updated: 2026-06-11
version: 1

Piracy/Infringement Gangs
type: ThreatActor
break id: TA0036
stix type: threat-actor
description: Piracy/infringement gangs are criminal gangs that systematically steal digital content (online courses, software, films, e-books, music, etc.) and redistribute it for profit. Main operating models include: content recording, cracking and distribution, membership sharing, low-price resale, ad monetization, and cross-platform content migration.
keywords: Piracy/Infringement Gangs
keywords: content piracy ring
keywords: warez group
keywords: course piracy network
keywords: crack distribution group
keywords: pirated content reseller
builds tools: Deobfuscation Tools
builds tools: Packet Sending/Modification Tools
uses tools: Bulk Account Registration Tool
uses tools: Web Scraping Tools
uses tools: Risk IP Addresses
uses tools: Risk Email Accounts
directly causes: Content Infringement
directly causes: Content Farm Risk
indirectly supports: Instant Bid Sniping
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
citation: Copyright Law of the People's Republic of China
citation: Online Copyright Protection - National Copyright Administration
updated: 2026-06-11
version: 1

Fraudulent Claims Gangs
type: ThreatActor
break id: TA0037
stix type: threat-actor
description: Fraudulent claims gangs are organized criminal gangs specializing in defrauding insurance claims or e-commerce platform after-sales compensation. They defraud compensation through fabricating accidents, exaggerating losses, and colluding with insiders. Main operating models include: insurance fraud, e-commerce after-sales fraud, logistics claims fraud, medical insurance fraud, insider collusion, and industry chain division of labor.
keywords: Fraudulent Claims Gangs
keywords: insurance fraud ring
keywords: claims fraud syndicate
keywords: after-sales fraud ring
keywords: refund fraud gang
keywords: staged accident ring
builds tools: Automation Scripts
uses tools: Bulk Account Registration Tool
uses tools: Web Scraping Tools
uses tools: Risk Email Accounts
directly causes: Malicious Returns
directly causes: Fake Reviews
directly causes: Synthetic Identity Fraud
directly causes: Friendly Fraud / Chargeback Fraud
directly causes: After-Sales Rights Abuse
directly causes: Malicious Claims
indirectly supports: Ad Fraud
indirectly supports: Malicious Negative Reviews
indirectly supports: Metric Manipulation / Ranking Fraud
indirectly supports: Fake Viewer Count Inflation
indirectly supports: Order Brushing
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
citation: Insurance Fraud Risk Prevention - China Banking and Insurance Regulatory Commission
citation: E-commerce After-sales Fraud Governance
updated: 2026-06-11
version: 1

Underground Money Houses
type: ThreatActor
break id: TA0038
stix type: threat-actor
description: Underground money houses are underground organizations that illegally engage in cross-border fund transfers, currency exchange, and other financial businesses without approval from national financial regulators. Unlike TA0014 money laundering rooms which primarily handle domestic criminal fund laundering, underground money houses focus on cross-border illegal fund flows. Main operating models include: mirror transfer, cross-border e-commerce channels, cryptocurrency channels, underground insurance policies, fake investments, and multi-layer nesting.
keywords: Underground Money Houses
keywords: underground bank
keywords: illegal money exchange
keywords: cross-border fund transfer ring
keywords: shadow banking network
keywords: hawala-style transfer
builds tools: Score-Running Platforms
uses tools: Proxy IP
uses tools: Cryptocurrency Mixers
directly causes: Money Laundering Risk
directly causes: Cryptocurrency Money Laundering Risk
indirectly supports: Process Automation
indirectly supports: Coupon Enumeration
indirectly supports: Resource Exhaustion Attack
indirectly supports: Distributed Denial of Service
indirectly supports: Illegal Cash-Out
indirectly supports: Blocklisted IP Bypass
citation: Anti-Money Laundering Law - People's Bank of China
citation: Underground Money House Crime Crackdown - Ministry of Public Security
updated: 2026-06-11
version: 1

Cryptocurrency Fraud Syndicate
type: ThreatActor
break id: TA0039
stix type: threat-actor
description: Organized criminal groups specializing in cryptocurrency ecosystem fraud. Unlike TA0015 Telecom Fraud Groups, which focus on traditional telecom fraud, cryptocurrency fraud syndicates use blockchain infrastructure and cryptocurrency as their core operational tools and financial channels. Key characteristics and operating models include: ① Pig-butchering operations: cultivating trust through social media and dating apps, then guiding victims to invest in fake cryptocurrency investment platforms; ② Fake DeFi projects: creating disguised decentralized finance projects that attract investors with false high-yield promises before executing rug pulls; ③ NFT fraud: issuing fake or plagiarized NFT projects for scams; ④ Cryptocurrency impersonation: posing as well-known crypto projects, exchanges, or KOLs for social engineering fraud; ⑤ Cross-border money laundering: using cryptocurrency mixers, privacy coins, and cross-chain bridges for fund cleaning and cross-border transfers; ⑥ Scam-compound operations: establishing large-scale scam compounds in Southeast Asia and other regions, coercing or employing large numbers of people to conduct cryptocurrency fraud. These groups are often closely associated with transnational criminal networks, underground banks, and scam compounds.
keywords: Cryptocurrency Fraud Syndicate
keywords: pig butchering crypto scam
keywords: crypto investment scam
keywords: DeFi rug pull ring
keywords: NFT fraud ring
keywords: crypto laundering network
builds tools: Fraud-as-a-Service (FaaS) Platform
uses tools: Cryptocurrency Mixers
uses tools: AI Voice Cloning Tools
uses tools: Black SIM Cards
directly causes: Transfer Fraud
directly causes: Cryptocurrency Money Laundering Risk
directly causes: Pig Butchering / Investment Fraud Risk
directly causes: Rug Pull (Exit Scam)
directly causes: NFT Fraud Risk
indirectly supports: Credential Stuffing
indirectly supports: Password Spraying
indirectly supports: Credential Brute Force
indirectly supports: Login Credential Theft
indirectly supports: Stolen Card Payment
indirectly supports: Stolen Card Fraud
indirectly supports: Points Theft
indirectly supports: Money Laundering Risk
indirectly supports: Illegal Cash-Out
indirectly supports: AI Face-Swap Fraud
citation: FBI IC3 Cryptocurrency Fraud Report
citation: Chainalysis 2026 Crypto Crime Report
citation: DOJ and SEC crypto exchange enforcement in the United States
updated: 2026-06-11
version: 1

Data Broker
type: ThreatActor
break id: TA0040
stix type: threat-actor
description: Intermediaries specializing in personal data trading on the dark web and underground markets. Unlike TA0007 Account Dealers who focus on account trading and TA0005 Data Suppliers who focus on bank card and identity data supply, data brokers are cross-data-type trading intermediaries that aggregate various types of personal data (identity information, contact details, behavioral data, medical records, etc.) for wholesale and retail. Key characteristics include: ① Data aggregation: collecting personal data from multiple data breaches, crawler scraping, insider channels, and other sources to build integrated personal information databases; ② Classification and grading: classifying data (identity information, financial data, medical data, etc.) and grading it (pricing by data freshness, completeness, and value); ③ Channel operations: operating data trading businesses on dark web forums, Telegram groups, dedicated trading platforms, and other channels; ④ Custom services: providing targeted data packages for specific populations, regions, or industries based on buyer needs; ⑤ Data verification: providing data authenticity verification services to ensure the validity of sold data. Data brokers are a critical intermediary link in the cybercrime ecosystem, providing data support for various downstream crimes.
keywords: Data Broker
keywords: dark web data broker
keywords: breach data aggregator
keywords: PII marketplace vendor
keywords: fullz broker
keywords: data resale intermediary
builds tools: Web Scraping Tools
builds tools: Infostealers
uses tools: Social Engineering Database
uses tools: Identity Document Set (4-Piece)
uses tools: Risk Email Accounts
directly causes: Data Exfiltration Risk
directly causes: Trade Secret Leakage
directly causes: Real-World Identity Theft
directly causes: Synthetic Identity Fraud
indirectly supports: Unauthorized Third-Party Top-Up Services
indirectly supports: Account Reselling
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Credential Stuffing
indirectly supports: Carding Attack
indirectly supports: Stolen Card Payment
indirectly supports: Transfer Fraud
indirectly supports: Proxy Login / Proxy Order Placement
indirectly supports: Employee Account Compromise
citation: Europol: Internet Organised Crime Threat Assessment
citation: FBI IC3 Annual Report
citation: Kaspersky: Data Broker Activities on the Dark Web
updated: 2026-06-11
version: 1

AI Tool Abusers
type: ThreatActor
break id: TA0041
stix type: threat-actor
description: Actors who use AI tools specifically designed for cybercrime (such as WormGPT, Mythos, etc.) to carry out various cyberattacks. Unlike TA0012 Malware Developers who are the creators of AI tools, AI Tool Abusers are the end users of these criminal AI tools. Main characteristics include: 1) Criminal AI tool usage: using large language models specifically customized for cybercrime such as WormGPT, Mythos, and FraudGPT, which are free from safety restrictions and can generate phishing emails, malicious code, and social engineering scripts; 2) AI-enhanced phishing: using AI tools to batch generate personalized and highly realistic phishing emails, significantly improving phishing success rates; 3) AI-assisted social engineering: using AI tools to analyze target information and generate customized social engineering attack plans; 4) AI malicious code generation: using AI tools to assist in writing malicious code, exploit scripts, and attack tools; 5) Automated attack orchestration: using AI tools to automate the planning and execution of attack chains, improving attack efficiency. AI Tool Abusers represent the new trend of cybercrime transitioning toward AI, making attacks that originally required advanced skills accessible to a broader audience.
keywords: AI Tool Abusers
keywords: WormGPT user
keywords: FraudGPT operator
keywords: uncensored LLM abuse
keywords: AI-assisted phishing
keywords: LLM-enabled cybercrime
builds tools: LLM Automated Attack Tools
uses tools: AI Agent Hijacking Tools
uses tools: AI Fraud Chatbots
uses tools: AI Deepfake Video
uses tools: AI Deepfake Tools
uses tools: LLM Automated Attack Tools
uses tools: Digital Human Generation Tools
uses tools: AI Voice Cloning Tools
directly causes: AI-Enhanced Phishing Attack
directly causes: AI Deepfake Risk
directly causes: AI-Automated Attack Escalation
directly causes: AI Agent Tool Misuse / Excessive Autonomy Risk
directly causes: LLM Prompt Injection Risk
directly causes: Direct Prompt Injection
directly causes: Indirect Prompt Injection
indirectly supports: Protocol-Level Automation
indirectly supports: Automated Simulator
indirectly supports: Coupon Enumeration
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Instant Bid Sniping
indirectly supports: Auction Sniping
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
citation: AI Goes on Offense: How LLMs Are Redefining the Cybercrime Landscape
citation: The Dual-Use Dilemma of AI: Malicious LLMs
citation: From WormGPT to Mythos: AI in Cybersecurity 2021-2026
updated: 2026-06-13
version: 1

Scam Compound Operator
type: ThreatActor
break id: TA0042
stix type: threat-actor
description: Organizers and managers who operate large-scale telecommunications fraud and cryptocurrency scam compounds. Unlike TA0015 Fraud Gangs that directly carry out scams, scam compound operators are the "platform providers" that supply infrastructure, workplaces, and management frameworks. Key characteristics include: ① Compound construction: establishing enclosed scam compounds in weak-regulation areas, equipped with offices, communication equipment, and technical facilities; ② Personnel management: acquiring large numbers of people for scam operations through recruitment, deception, or even coercion; ③ Technical support: providing technical tools, script training, and management systems for scam teams within the compound; ④ Division of labor management: dividing the compound into multiple business groups responsible for different types of scams (pig butchering, investment fraud, impersonation of customer service, etc.); ⑤ Fund channels: establishing complete fund receiving and laundering channels, interfacing with underground money changers and cryptocurrency mixers; ⑥ Counter-surveillance measures: deploying counter-surveillance technologies, frequently changing communication devices and IP addresses to evade law enforcement tracking. Representative cases include Cambodia's Taishan Group, and the UNODC reports that the scale of Southeast Asian scam compounds has reached hundreds of thousands of people.
keywords: Scam Compound Operator
keywords: scam center operator
keywords: fraud compound manager
keywords: pig butchering compound boss
keywords: scam park owner
keywords: scam call center operator
builds tools: Fraud-as-a-Service (FaaS) Platform
uses tools: Black SIM Cards
uses tools: Web Scraping Tools
uses tools: AI Voice Cloning Tools
uses tools: Fake Call Spoofing Tool
uses tools: Cryptocurrency Mixers
directly causes: Transfer Fraud
directly causes: Phishing Attack
directly causes: Pig Butchering / Investment Fraud Risk
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Promotional Activity Cheating
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Data Exfiltration Risk
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Bulk Account Enumeration
indirectly supports: AI Face-Swap Fraud
citation: UNODC: Transnational Organized Crime in Southeast Asia
citation: [PDF] Transnational Crime in Southeast Asia
citation: Cambodia: Government allows slavery and torture to flourish inside ...
updated: 2026-06-11
version: 1

Scam Compound Technician
type: ThreatActor
break id: TA0042-001
stix type: threat-actor
description: Technical personnel responsible for technology development, system maintenance, and tool deployment within scam compounds. Unlike TA0012 Malware Developers who develop general-purpose malware, scam compound technicians specialize in developing and maintaining customized technical tools and platforms for scam operations. Key responsibilities include: ① Phishing platform development: developing and maintaining high-fidelity phishing websites and platforms targeting specific victims; ② Communication system maintenance: maintaining VoIP phone systems, SMS mass-sending platforms, and instant messaging tools; ③ Data analysis tools: developing victim data analysis and screening tools to improve scam precision; ④ Anti-detection technology: deploying and updating anti-detection mechanisms, including domain rotation, CAPTCHA bypass, and anti-blocking strategies; ⑤ Technical training: providing training on technical tool usage for scam operators within the compound; ⑥ System operations: maintaining IT infrastructure within the compound to ensure all systems operate normally. Scam compound technicians are the key support for technical capabilities in scam compounds and typically possess strong programming and network technology skills.
keywords: Scam Compound Technician
keywords: scam center technician
keywords: phishing kit maintainer
keywords: VoIP fraud technician
keywords: anti-detection engineer
keywords: scam infrastructure admin
builds tools: Phishing Kits
builds tools: Malicious QR Code Generators
builds tools: Phishing-as-a-Service (PhaaS) Platform
builds tools: ClickFix Deception Tools
uses tools: LLM Automated Attack Tools
uses tools: AI Voice Cloning Tools
uses tools: Black SIM Cards
uses tools: Fake Call Spoofing Tool
uses tools: CAPTCHA Solving Platform
uses tools: Phishing Kits
directly causes: Phishing Attack
directly causes: AI-Enhanced Phishing Attack
directly causes: Pig Butchering / Investment Fraud Risk
directly causes: ClickFix Deception Risk
indirectly supports: Malicious Flash Sale Grabbing
indirectly supports: Bot Scalping Risk
indirectly supports: Unfair Resource Seizure
indirectly supports: Bulk Fake Account Manipulation
indirectly supports: Fake Viral Referral
indirectly supports: Fake Registration
indirectly supports: Bulk Account Registration
indirectly supports: Credential Stuffing
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Employee Account Compromise
citation: INTERPOL: Operation First Light Targets Social Engineering Fraud
citation: Trend Micro: Cybercriminals Behind Southeast Asian Scam Operations
citation: Group-IB: Scam Centers in Southeast Asia Technical Report
updated: 2026-06-13
version: 1

DeFi Protocol Attackers
type: ThreatActor
break id: TA0045
stix type: threat-actor
description: Hackers or groups that target smart contracts and DeFi protocols, usually with Solidity, EVM, on-chain transaction simulation, and fund-flow planning capabilities. Their goals include exploiting contract vulnerabilities to steal funds, manipulating oracle prices, launching flash-loan attack chains, frontrunning or sandwich trading, manipulating DAO governance, and attacking cross-chain bridges.
keywords: DeFi Protocol Attackers
builds tools: Smart Contract Exploitation Framework
builds tools: DeFi Attack Scripts
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Smart Contract Exploitation Framework
uses tools: DeFi Attack Scripts
uses tools: Cryptocurrency Mixers
directly causes: Smart Contract Vulnerabilities
directly causes: Immutable Contract Design Flaws
directly causes: Timestamp Dependence Attack
directly causes: Blockchain Replay Attack
directly causes: Cross-Chain Bridge Attacks
directly causes: Flash Loan Attacks
directly causes: Oracle Manipulation
directly causes: MEV Attacks (Miner Extractable Value)
directly causes: DAO Governance Attacks
directly causes: Gas Fee Manipulation
indirectly supports: Cryptocurrency Money Laundering Risk
indirectly supports: On-Chain Privacy Leakage
citation: Chainalysis Crypto Crime Report
citation: CertiK Web3 Security Reports
citation: Immunefi Crypto Losses Reports
updated: 2026-06-16
version: 1

Malicious Blockchain Node Operators
type: ThreatActor
break id: TA0046
stix type: threat-actor
description: Actors who control blockchain nodes, mining pools, validators, or large numbers of forged node identities to influence P2P networks and consensus processes. Their behaviors include Sybil attacks, eclipse attacks, chain reorganizations, long-range attacks, selfish mining, 51 percent attacks, and transaction-replay abuse, often requiring node resources, hash power, stake weight, or network connectivity control.
keywords: Malicious Blockchain Node Operators
builds tools: Blockchain Node and Consensus Attack Tools
uses tools: Blockchain Node and Consensus Attack Tools
directly causes: 51% Attack (Double-Spend Attack)
directly causes: Sybil Attack
directly causes: Eclipse Attack
directly causes: Long-Range Attack / Nothing-at-Stake
directly causes: Selfish Mining
directly causes: Blockchain Replay Attack
indirectly supports: Gas Fee Manipulation
citation: Bitcoin Eclipse Attacks and Countermeasures
citation: Selfish Mining in Bitcoin
citation: Ethereum Proof-of-Stake Consensus Specifications
updated: 2026-06-16
version: 1

Wallet Drainer Groups
type: ThreatActor
break id: TA0047
stix type: threat-actor
description: Groups that steal crypto assets by targeting wallets, seed phrases, private keys, and DApp authorizations. They commonly use phishing pages, malicious browser extensions, Telegram bots, fake airdrops, counterfeit wallet apps, clipboard hijacking, and malicious signing requests to trick users into revealing secrets or authorizing asset transfer.
keywords: Wallet Drainer Groups
builds tools: Wallet Phishing and Drainer Tools
uses tools: Phishing Kits
uses tools: Infostealers
uses tools: Keyloggers
uses tools: Phishing-as-a-Service (PhaaS) Platform
uses tools: Wallet Phishing and Drainer Tools
uses tools: Cryptocurrency Mixers
uses tools: On-Chain Privacy Analysis Tools
directly causes: Private Key Leakage and Management Risks
directly causes: On-Chain Privacy Leakage
directly causes: Virtual World Asset Theft
indirectly supports: EIP and Protocol Phishing Attack
indirectly supports: Telegram Bot Phishing
indirectly supports: Multi-Signature Wallet Social Engineering
indirectly supports: Account Abstraction Wallet Risk
indirectly supports: DApp Frontend Hijacking
citation: Chainalysis: Crypto Drainers
citation: MetaMask Security Center
citation: FBI Cryptocurrency Investment Fraud
updated: 2026-06-16
version: 1

IoT Botnet Operators
type: ThreatActor
break id: TA0048
stix type: threat-actor
description: Attackers who control large numbers of IoT devices through vulnerability exploitation, default-credential attacks, firmware backdoors, and malware infection. Their goals include DDoS, proxy forwarding, mining, lateral movement, data tampering, and device extortion, and they may also use industrial, medical, or connected-vehicle devices to create physical-world impact.
keywords: IoT Botnet Operators
builds tools: IoT Firmware and Device Exploitation Tools
builds tools: IoT Botnet and C2 Tools
uses tools: IoT Firmware and Device Exploitation Tools
uses tools: IoT Botnet and C2 Tools
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Trojan Virus
directly causes: Smart Device Hijacking
directly causes: Firmware Tampering and Backdoors
directly causes: IoT Botnets
directly causes: IoT Default Credential Risks
directly causes: OTA Update Hijacking
directly causes: IoT Data Tampering Attack
directly causes: Sensor Spoofing Attack
indirectly supports: IoT Side-Channel Attacks
indirectly supports: AIoT Convergence Attack
indirectly supports: IoT Hardware Supply Chain Attack
citation: Mirai Botnet source code
citation: CISA Securing IoT Devices
citation: ENISA Baseline Security Recommendations for IoT
updated: 2026-06-23
version: 1

Industrial and Connected Vehicle Attackers
type: ThreatActor
break id: TA0049
stix type: threat-actor
description: Attackers targeting industrial control, connected vehicles, medical IoT, and critical infrastructure devices. They typically understand industrial protocols, in-vehicle networks, medical-device communication, and sensor spoofing. Their attacks may cause production interruption, vehicle misjudgment, medical-device abnormality, sensor-data pollution, or physical safety incidents.
keywords: Industrial and Connected Vehicle Attackers
builds tools: Industrial and Vehicle Protocol Exploitation Tools
uses tools: Industrial and Vehicle Protocol Exploitation Tools
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Evil Twin WiFi
directly causes: Industrial IoT (IIoT) Security Risks
directly causes: Connected Vehicle (V2X) Security Risks
directly causes: Internet of Medical Things (IoMT) Security Risks
directly causes: IoT Side-Channel Attacks
directly causes: Sensor Spoofing Attack
indirectly supports: IoT Data Tampering Attack
indirectly supports: Industrial Protocol Exploitation
citation: MITRE ATT&CK for ICS
citation: OWASP Internet of Things Project
citation: CISA Industrial Control Systems
updated: 2026-06-16
version: 1

Connected-Vehicle Attackers
type: ThreatActor
break id: TA0049-001
stix type: threat-actor
description: Actors targeting connected-vehicle APIs, OTA updates, diagnostic interfaces, and in-vehicle data.
keywords: Connected-Vehicle Attackers
keywords: vehicle API attacker
keywords: OTA attacker
keywords: diagnostic interface abuser
keywords: connected-car data thief
keywords: V2X attacker
builds tools: Connected-Vehicle OTA and Interface Testing Tool
uses tools: Connected-Vehicle OTA and Interface Testing Tool
uses tools: Industrial and Vehicle Protocol Exploitation Tools
directly causes: Automotive OTA Update Hijacking
directly causes: Vehicle Data Interface Abuse
indirectly supports: Vehicle V2X Attack
citation: ISO/SAE 21434 Road vehicles Cybersecurity
updated: 2026-06-17
version: 1

Metaverse and XR Fraud Groups
type: ThreatActor
break id: TA0050
stix type: threat-actor
description: Fraud groups that profit from metaverse platforms, virtual assets, XR devices, and immersive social spaces. Their activities include virtual land or asset fraud, virtual identity theft, virtual asset theft, XR device exploitation, excessive spatial-data collection, and automated virtual harassment.
keywords: Metaverse and XR Fraud Groups
builds tools: Metaverse and XR Attack Tools
uses tools: Metaverse and XR Attack Tools
uses tools: Phishing Kits
uses tools: Wallet Phishing and Drainer Tools
uses tools: Digital Human Generation Tools
directly causes: Virtual Land/Asset Fraud
directly causes: Metaverse Identity Theft
directly causes: Virtual World Asset Theft
directly causes: AR/VR Device Security Risks
directly causes: Virtual World Harassment and Violence
indirectly supports: Metaverse Social Engineering Attack
indirectly supports: XR Device Firmware Attack
indirectly supports: Metaverse Content Moderation Challenge
citation: XRSI Standards for Safety and Security in XR Environments
citation: XR Safety Initiative
citation: Interpol Global Crime Trend Report
updated: 2026-06-16
version: 1

API Abusers
type: ThreatActor
break id: TA0051
stix type: threat-actor
description: Attackers focused on enumerating and abusing public APIs, shadow APIs, webhooks, and session tokens.
keywords: API Abusers
keywords: API enumeration actor
keywords: shadow API abuse
keywords: webhook abuse
keywords: session token replay
keywords: API fraud operator
uses tools: API Enumeration and Authorization Testing Tool
uses tools: Webhook Replay Tool
uses tools: MFA Bombing and Session Hijacking Tool
directly causes: Shadow API Exposure Risk
directly causes: API Object-Level Authorization Risk
directly causes: API Bulk Call Resource Exhaustion
directly causes: Webhook Forgery and Event Replay
directly causes: Session Token Replay
indirectly supports: Process Automation
citation: OWASP API Security Top 10 2023
updated: 2026-06-17
version: 1

Supply-Chain Poisoners
type: ThreatActor
break id: TA0052
stix type: threat-actor
description: Attackers who poison dependency packages, build chains, artifact repositories, and release processes.
keywords: Supply-Chain Poisoners
keywords: dependency poisoner
keywords: build-chain attacker
keywords: artifact tampering actor
keywords: malicious package publisher
keywords: release pipeline compromise
builds tools: CI/CD Credential Scanning and Poisoning Tool
uses tools: CI/CD Credential Scanning and Poisoning Tool
uses tools: Dependency Poisoning Toolkit
directly causes: CI/CD Pipeline Credential Exposure
directly causes: Build Artifact Poisoning Risk
directly causes: Dependency Confusion and Malicious Package Poisoning
directly causes: SBOM Absence Hiding Vulnerability Impact
indirectly supports: Employee Corruption
citation: Software Bill of Materials - CISA
updated: 2026-06-17
version: 1

Cloud Resource Abusers
type: ThreatActor
break id: TA0053
stix type: threat-actor
description: Attackers who use cloud keys, excessive privileges, and misconfiguration to access cloud resources or extract data value.
keywords: Cloud Resource Abusers
keywords: cloud key abuser
keywords: over-privileged role abuse
keywords: public bucket attacker
keywords: cloud lateral movement
keywords: cloud data theft
uses tools: Cloud Configuration Scanning and Key Abuse Tool
uses tools: CDN and Edge Configuration Attack Tool
directly causes: Public Cloud Storage Bucket Exposure
directly causes: Cloud IAM Over-Permissioning
directly causes: Vendor Remote Access Abuse
indirectly supports: Supply Chain Risk
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

SaaS Data Thieves
type: ThreatActor
break id: TA0054
stix type: threat-actor
description: Actors who steal SaaS and collaboration data through OAuth grants, administrator accounts, or external sharing links.
keywords: SaaS Data Thieves
keywords: SaaS OAuth thief
keywords: mail data thief
keywords: drive data exfiltration
keywords: external sharing abuse
keywords: collaboration data theft
uses tools: SaaS OAuth Abuse Tool
uses tools: Data Export and DLP Bypass Tool
directly causes: SaaS Third-Party App Authorization Abuse
directly causes: Collaborative Document Link Exposure
directly causes: Customer Success and Support Ticket Data Exposure
indirectly supports: Trade Secret Leakage
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Payment Fraud Groups
type: ThreatActor
break id: TA0055
stix type: threat-actor
description: Fraud groups that profit from merchant cash-out, chargebacks, refunds, and payment-token abuse.
keywords: Payment Fraud Groups
keywords: merchant cash-out group
keywords: chargeback fraud ring
keywords: refund abuse group
keywords: payment token abuse
keywords: fake transaction ring
builds tools: Payment Fraud Automation Tool
uses tools: Payment Fraud Automation Tool
uses tools: Score-Running Platforms
directly causes: Merchant Cash-Out and Fake Transaction Fraud
directly causes: Chargeback and Refund Abuse
directly causes: Payment Tokenization Misconfiguration
indirectly supports: Money Laundering Risk
citation: PCI Data Security Standard
updated: 2026-06-17
version: 1

Ad Attribution Fraud Groups
type: ThreatActor
break id: TA0056
stix type: threat-actor
description: Groups that use install farms, click injection, and fake conversions to steal ad budgets or commissions.
keywords: Ad Attribution Fraud Groups
keywords: click injection group
keywords: install farm operator
keywords: fake conversion ring
keywords: affiliate commission fraud
keywords: traffic fraud group
builds tools: Ad Attribution Fraud Tool
uses tools: Ad Attribution Fraud Tool
uses tools: Click Simulation Tools
directly causes: Ad Click Injection
directly causes: Fake Conversion and Install Farm
directly causes: Affiliate Marketing Commission Fraud
indirectly supports: Ad Fraud
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Data Brokers and Unauthorized Data Users
type: ThreatActor
break id: TA0057
stix type: threat-actor
description: Organizations or individuals that collect, share, transform, or sell business data beyond the authorized scope.
keywords: Data Brokers and Unauthorized Data Users
keywords: data broker
keywords: unauthorized data user
keywords: purpose limitation violator
keywords: third-party data reseller
keywords: data misuse actor
uses tools: Data Export and DLP Bypass Tool
directly causes: Unauthorized Use of Shared Data
directly causes: Missing Privacy Impact Assessment
indirectly supports: User Privacy Leakage
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

AI Data Poisoners
type: ThreatActor
break id: TA0058
stix type: threat-actor
description: Attackers who influence model behavior by poisoning training data, feedback data, knowledge bases, and prompt context.
keywords: AI Data Poisoners
keywords: training data poisoner
keywords: RAG poisoning actor
keywords: feedback poisoning
keywords: prompt injection actor
keywords: model manipulation
builds tools: AI Data Poisoning and Prompt Injection Tool
uses tools: AI Data Poisoning and Prompt Injection Tool
directly causes: Training Data Copyright and Licensing Risk
directly causes: Training Data Poisoning Risk
directly causes: RAG Unauthorized Retrieval
directly causes: Sensitive Information Leakage in Model Output
indirectly supports: LLM Prompt Injection Risk
citation: NIST AI Risk Management Framework
updated: 2026-06-17
version: 1

Account Takeover Groups
type: ThreatActor
break id: TA0059
stix type: threat-actor
description: Groups that take over user or employee accounts through MFA fatigue, session-token replay, and phishing tools.
keywords: Account Takeover Groups
keywords: MFA fatigue actor
keywords: session replay group
keywords: credential phishing group
keywords: token theft operator
keywords: ATO ring
builds tools: MFA Bombing and Session Hijacking Tool
uses tools: MFA Bombing and Session Hijacking Tool
uses tools: Phishing Kits
directly causes: MFA Fatigue Attack
directly causes: Session Token Replay
indirectly supports: Account Takeover
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Mobile App Impersonation Groups
type: ThreatActor
break id: TA0060
stix type: threat-actor
description: Groups that repackage, distribute, and operate counterfeit mobile apps to steal accounts, ad revenue, or payment information.
keywords: Mobile App Impersonation Groups
keywords: fake app operator
keywords: mobile repackaging group
keywords: APK fraud group
keywords: payment-stealing app
keywords: ad fraud app
builds tools: Mobile App Repackaging Toolchain
uses tools: Mobile App Repackaging Toolchain
uses tools: Fake Apps
uses tools: Infostealers
uses tools: Phishing Kits
directly causes: Mobile App Repackaging Fraud
directly causes: Account Takeover
directly causes: Data Breach
indirectly supports: Application Reverse Engineering
indirectly supports: Promotional Activity Cheating
indirectly supports: Insufficient Employee Security Awareness
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Ransomware Gang
type: ThreatActor
break id: TA0062
stix type: threat-actor
description: Organized cybercrime groups operating under the Ransomware-as-a-Service (RaaS) model. Core developers create encryption malware and maintain dark web leak sites, while affiliates breach target networks and deploy ransomware payloads. They employ double extortion tactics: exfiltrating sensitive data before encrypting files, threatening to publish data if ransom is not paid. Notable groups include LockBit, BlackCat/ALPHV, Cl0p, and Play. From 2024-2026, ransomware attacks have trended toward supply chain targeting, automation, and critical infrastructure focus.
keywords: Ransomware
keywords: RaaS
keywords: Ransomware-as-a-Service
keywords: Data Encryption Extortion
keywords: Double Extortion
keywords: LockBit
keywords: BlackCat
keywords: Conti
builds tools: Trojan Virus
builds tools: Infostealers
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Phishing Kits
uses tools: Infostealers
uses tools: Trojan Virus
uses tools: Password Dictionaries/Rainbow Tables
uses tools: Container Escape & K8s Attack Toolkit
directly causes: Data Breach
directly causes: File or Document Theft
directly causes: Unauthorized Outbound Connection and C2 Control
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Account Takeover
indirectly supports: Automated Account Seasoning
citation: CISA StopRansomware Advisory
citation: MITRE ATT&CK: Ransomware Techniques
updated: 2026-06-26
version: 1

APT / Nation-State Actor
type: ThreatActor
break id: TA0063
stix type: threat-actor
description: State-sponsored advanced persistent threat organizations with substantial resources, time, and expertise. Their typical targets include critical infrastructure, government agencies, defense contractors, high-tech enterprises, and research institutions. Attack methods include zero-day exploitation, custom malware, supply chain compromise, long-term persistence, and lateral movement. Unlike common cybercrime, APT objectives focus on intelligence collection, intellectual property theft, or destructive operations rather than direct financial gain.
keywords: APT
keywords: Nation-State Attack
keywords: Advanced Persistent Threat
keywords: State-Sponsored Hacker
keywords: Intelligence Agency
keywords: Cyber Warfare
builds tools: System/Application Vulnerability Exploitation Tools
builds tools: Trojan Virus
builds tools: Infostealers
uses tools: System/Application Vulnerability Exploitation Tools
uses tools: Trojan Virus
uses tools: Infostealers
uses tools: Phishing Kits
uses tools: CI/CD Credential Scanning and Poisoning Tool
uses tools: Cloud Configuration Scanning and Key Abuse Tool
uses tools: Dependency Poisoning Toolkit
uses tools: Container Escape & K8s Attack Toolkit
directly causes: Data Breach
directly causes: File or Document Theft
directly causes: Automated Account Seasoning
directly causes: Unauthorized Outbound Connection and C2 Control
indirectly supports: Account Takeover
indirectly supports: Insufficient Employee Security Awareness
indirectly supports: Multi-Factor Authentication (MFA) Bypass
citation: MITRE ATT&CK Groups
citation: CISA Known Exploited Vulnerabilities Catalog
updated: 2026-06-26
version: 1

Dark Web Marketplace Operator
type: ThreatActor
break id: TA0064
stix type: threat-actor
description: Organizations or individuals operating underground dark web trading marketplaces, providing Crime-as-a-Service (CaaS) infrastructure. These platforms host and facilitate trading of illegal goods and services, including stolen data, malware and exploit tools, attack services (DDoS-for-hire, RaaS), forged documents, and banking card kits. Platforms achieve anonymous transactions through cryptocurrency payments and mixing services, using Tor or I2P networks to conceal infrastructure.
keywords: Dark Web Marketplace
keywords: Underground Market
keywords: Black Market Platform
keywords: Data Trading Platform
keywords: Crime-as-a-Service
builds tools: Dark Web
uses tools: Dark Web
uses tools: Social Engineering Database
uses tools: Cryptocurrency Mixers
directly causes: Data Breach
directly causes: Oracle Manipulation
indirectly supports: Account Takeover
indirectly supports: Application Reverse Engineering
indirectly supports: Insufficient Employee Security Awareness
citation: Europol Internet Organised Crime Threat Assessment (IOCTA)
citation: UNODC Darknet Cybercrime Threats to Southeast Asia
updated: 2026-06-26
version: 1

Order Reporting
type: Term
break id: T0001
stix type: x-break-term
definition: The act of a fraud ring member reporting completed illicit operations or transaction results to a superior for commission settlement or performance tracking.
description: In marketing fraud operations, downstream actors report completed tasks such as fake orders or fraudulent registrations to a coordinator via internal communication tools. Managers then verify the workload and disburse corresponding payments, making this a critical step for internal profit-sharing and task management within the group. This process ensures the orderly execution of illegal activities and closes the benefit chain.
aliases: Baodan
category: Marketing Fraud
keywords: Order Reporting
keywords: task reporting
keywords: order settlement
keywords: fraud ring reporting
keywords: internal declaration
keywords: ring settlement
keywords: task assignment
keywords: performance tracking
keywords: operation reporting
usage example: The ringleader of an order reporting scam group urged his downline members on Telegram to quickly submit screenshots of today's fake transactions for order reporting, so commissions could be settled before midnight.
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Device Fingerprinting
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Fraudulent Anti-Counterfeit Claims
type: Term
break id: T0002
stix type: x-break-term
definition: A fraudulent attack by black market operators exploiting loopholes in e-commerce platform rules through fabricated transactions or data manipulation against merchants or the platform itself.
description: Attackers typically organize large numbers of accounts to place malicious orders, initiate fake returns, or post batches of negative reviews targeting specific products or stores. This is done to extort merchants or fraudulently claim compensation from the platform. Such activities directly undermine market order, often leading to financial losses for merchants and store downgrades, representing a classic black market operation within the e-commerce ecosystem.
category: Marketing Fraud
keywords: Fraudulent Anti-Counterfeit Claims
keywords: fake review orchestration
keywords: disinformation campaign
keywords: reputation sabotage
keywords: fake anti-counterfeit
keywords: review manipulation
keywords: e-commerce sabotage
keywords: fake transaction orchestration
keywords: competitor sabotage
usage example: Professional claimers use fraudulent anti-counterfeit claims tactics, specifically hunting for superlative words or ingredient labeling loopholes in product titles. After placing an order, they threaten to report the merchant to extort high compensation.
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Bulk Arbitrage Flip
type: Term
break id: T0003
stix type: x-break-term
definition: A large-scale fraudulent scheme where coupon hunters exploit high-value promotions or pricing errors on e-commerce platforms to buy goods at extremely low prices for resale and profit.
description: Operators closely monitor platform promotional rule flaws and use automated scripts to instantly purchase large quantities of heavily discounted goods, hoarding them for resale at a markup through second-hand channels. This activity not only deprives legitimate consumers of benefits but can directly bankrupt merchants due to catastrophic financial losses, serving as a core profit-generating method for professional coupon hunters.
category: Marketing Fraud
keywords: Bulk Arbitrage Flip
keywords: bulk buying arbitrage
keywords: promo scalping
keywords: price gap exploitation
keywords: bulk resale
keywords: promo arbitrage
keywords: scalper bulk buy
keywords: discount scalping
keywords: arbitrage flipping
usage example: During a Double Eleven sale, a bulk arbitrage flip expert exploited a platform's stacking discount loophole to hoard hundreds of high-end robot vacuums at extremely low prices, then resold them on a second-hand platform for profit.
related risks: Unauthorized Discount Purchase
related risks: Promotional Activity Cheating
related risks: Malicious Benefit Abuse
related risks: Order-Splitting Arbitrage
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Dropshipping
type: Term
break id: T0004
stix type: x-break-term
definition: A link in the black market chain where a third-party drop-shipper provides actual logistics packages and shipping services for fake transactions or fraudulent orders.
description: In fake order or fraud scenarios, to evade platform risk controls, the person placing the order does not possess real goods but entrusts a drop-shipper to send empty packages or cheap trinkets. The drop-shipper forges logistics information, providing realistic shipping traces for the fake transaction to fraudulently obtain platform subsidies or buyer trust.
aliases: Wearing Hair
category: Marketing Fraud
keywords: Dropshipping
keywords: order fulfillment
keywords: third-party fulfillment
keywords: logistics obscuring
keywords: fulfillment service
keywords: shipping proxy
keywords: blind dropshipping
keywords: package forwarding
keywords: order masking
usage example: To bypass e-commerce logistics authenticity checks, the scam group pushes order information to a dropshipping service provider, who generates empty packages with real tracking numbers to complete the delivery confirmation.
related risks: Fake Shipment
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Device Fingerprinting
related business scenes: BS02
citation: 2022 Internet Anti-Fraud: supply-chain corruption risks across retail, technology, and gaming
updated: 2026-06-16
version: 1

Big Score
type: Term
break id: T0005
stix type: x-break-term
definition: A target or single illicit gain with an exceptionally high profit margin and value in black market activities.
description: Within coupon hunter or hacker circles, 'big meat' signifies the discovery of a severe platform vulnerability or a high-value, no-strings-attached promotion that the group can exploit for a massive, one-time profit. Such targets often involve financial payment loopholes or large-sum discount events, and a successful breach can cause catastrophic financial damage to the targeted enterprise.
category: Marketing Fraud
keywords: Big Score
keywords: high-value target
keywords: large-scale breach
keywords: big profit margin
keywords: high-value scheme
keywords: lucrative target
keywords: whale target
keywords: major score
keywords: big haul
usage example: A fraud ring obtained a batch of high-limit, unrestricted e-commerce member accounts through credential stuffing, calling them a big score, and immediately organized personnel to place orders overnight and cash out.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Reverse Arbitrage Loss
type: Term
break id: T0006
stix type: x-break-term
definition: A situation where coupon hunters, while participating in promotions or exploiting loopholes, fail to recover their costs and incur a loss due to market downturns or operational errors.
description: For example, the market price of hoarded physical goods plummets, or risk control triggers lead to frozen accounts and funds. This phenomenon of being 'fleeced by the platform instead' often occurs when black market groups miscalculate a promotion's value or encounter merchant order cancellations, serving as a self-deprecating term for a failed arbitrage attempt.
aliases: Anti-Halogen
category: Marketing Fraud
keywords: Reverse Arbitrage Loss
keywords: arbitrage loss
keywords: scalper loss
keywords: promo loss
keywords: failed flip
keywords: loss on promo
keywords: arbitrage fail
keywords: promo misjudgment
usage example: A professional scalper invested tens of thousands in capital to hoard limited-edition sneakers for premium resale, leveraging bots and multiple accounts to bypass purchase limits and dominate flash sales.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Promotional Activity Cheating
related avoidances: Account Ban
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Carding Shop
type: Term
break id: T0007
stix type: x-break-term
definition: An automated online consignment platform specifically for trading various black market virtual materials, accounts, and attack tools.
description: These carding platforms are fundamental infrastructure for the black market, where merchants list illegal goods such as social media accounts, burner mobile SIMs, and phishing kits, allowing buyers to make fully automated purchases. This drastically lowers the barrier to entry for black market transactions, enabling fraudulent resources to circulate as easily as regular commodities, making it a central hub for money laundering and material distribution.
category: Marketing Fraud
keywords: Carding Shop
keywords: carding marketplace
keywords: virtual goods shop
keywords: account shop
keywords: invite code shop
keywords: digital goods market
keywords: fraud tool shop
keywords: carding platform
keywords: underground marketplace
usage example: A novice coupon abuser used a carding platform to automatically purchase bulk first-order vouchers and virtual coupons, then resold them at a discount for quick profit.
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Card Vending Platforms
related business scenes: BS02
related business scenes: BS04
citation: Behind the Scale of Black and Gray Markets: The Resource Trading Network Formed by Carding Platforms
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Payout
type: Term
break id: T0008
stix type: x-break-term
definition: The act of an upstream taskmaster settling the advanced principal and commission to a downstream operator after a fake transaction or proxy order is completed.
description: In scalper proxy purchasing or fake order fraud, the operator first advances their own money to buy designated goods. After receiving the goods or completing the task, the taskmaster 'returns the payment' via a payment tool. This sum typically includes the original price of the goods and the agreed-upon commission, serving as the direct financial incentive that keeps part-time black market participants engaged.
aliases: Return Home
category: Marketing Fraud
keywords: Payout
keywords: commission payout
keywords: task commission
keywords: rebate payout
keywords: payout settlement
keywords: task reimbursement
keywords: commission return
keywords: payout processing
keywords: participant payout
usage example: After verifying that the part-time mom had completed the designated fake proxy payment order, the task publisher immediately issued a payout via Alipay, covering the fronted principal and commission.
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Device Fingerprinting
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Fixed Payout
type: Term
break id: T0009
stix type: x-break-term
definition: A fixed commission paid to participants upon completing marketing fraud tasks assigned by black-market operators.
description: In organized marketing fraud schemes such as coupon exploitation and proxy purchasing, operators offer a predetermined fixed return to incentivize participants. The payout amount is clearly stated in the task instructions, and participants receive the fixed return after completing required actions like placing orders, receiving goods, or filing compensation claims. This model is commonly used in proxy purchasing and claims groups to quickly settle costs and profits, enabling fraud rings to extract platform subsidies at scale.
category: Marketing Fraud
keywords: Fixed Payout
keywords: fixed commission
keywords: task payout
keywords: predetermined payout
keywords: fixed rebate
keywords: fixed reward
keywords: task reward
keywords: fixed compensation
keywords: payout listing
usage example: When a group task says 'fixed return 184,' it means that regardless of how much you actually pay upfront, you will get 184 back after completing the order according to the scheme.
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Scalpers
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Promo Abuser
type: Term
break id: T0010
stix type: x-break-term
definition: A term used within black-market circles to refer to downstream participants in marketing fraud, including homemakers, university students, and part-time workers.
description: 'Beggar friend' is a colloquial label used by fraud operators for the individuals who execute fraudulent tasks. These participants receive assignments through task groups and exploit platform loopholes or promotional rules to obtain goods, cashback, or compensation at minimal cost. Often operating multiple accounts, they collaborate with SIM card suppliers and scalpers to conduct bulk exploitation, serving as the operational layer of the fraud chain. Long-term involvement can lead to personal information leaks, account bans, and even legal liability.
category: Marketing Fraud
keywords: Promo Abuser
keywords: bonus abuser
keywords: coupon abuser
keywords: promo exploiter
keywords: cashback abuser
keywords: discount abuser
keywords: promo group
keywords: coupon stacking
keywords: offer abuser
usage example: In a social referral campaign, a large number of promo abusers used self-built groups to mutually assist each other, completing batch registrations with virtual numbers and exhausting the platform's new user rewards.
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Scalpers
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: Professional Counterfeit Claimants
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Bank Card Dealers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Scalper Proxy Ordering
type: Term
break id: T0011
stix type: x-break-term
definition: A practice where fraud rings organize real users to remotely place orders, systematically circumventing purchase limits to acquire discounted goods for resale.
description: In this model, upstream suppliers provide the purchasing scheme and funds, while downstream participants use their personal accounts to place orders to designated addresses. Once the goods arrive, the supplier collects and resells them. This method bypasses per-account purchase limits by using genuine users as ordering tools, enabling large-scale exploitation. Because the transactions are conducted by real individuals, they closely mimic legitimate consumer behavior, making detection by platforms more difficult.
category: Marketing Fraud
keywords: Scalper Proxy Ordering
keywords: proxy buyer
keywords: order proxy
keywords: scalper gang
keywords: reseller proxy
keywords: bulk purchasing agent
keywords: purchasing script
keywords: limited release proxy
keywords: drop buyer
usage example: To fraudulently claim high-value gifts exclusive to new offline users of a supermarket app, a fraud ring organized a scalper proxy ordering service, remotely controlling real users' phones to complete the purchase.
related risks: Proxy Login / Proxy Order Placement
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

SMS Code Pickup
type: Term
break id: T0012
stix type: x-break-term
definition: The practice of obtaining SMS verification codes via specialized platforms to register accounts in bulk or bypass identity verification.
description: SMS code reception is a core component of bulk account creation. SIM card suppliers use devices like modem pools to control numerous black-market SIM cards, and code-receiving platforms automatically forward verification codes to participants. These verified accounts are then used to exploit new-user promotions, participate in prize draws, or conduct fake transactions, severely undermining platform marketing rules. This activity is directly linked to the infringement of personal information and the broader cybercrime supply chain.
category: Marketing Fraud
keywords: SMS Code Pickup
keywords: SMS verification bypass
keywords: virtual number verification
keywords: PVA account creation
keywords: SMS forwarding service
keywords: burner phone verification
keywords: OTP interception
keywords: SMS relay
keywords: code-receiving platform
usage example: When attacking a social platform's user acquisition campaign, the fraud ring used an SMS code pickup platform to obtain verification codes for thousands of virtual phone numbers, instantly completing batch account registration and verification.
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Virtual Number Registration
related risks: Promotional Activity Cheating
related avoidances: SMS Verification
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related attack tools: SMS Verification Code Platform
related attack tools: Modem Pool SIM Cards
related attack tools: Modem Pool
related threat actors: SIM Card Dealers (Phone Numbers)
related business scenes: BS02
citation: 2024 H1 Overseas E-commerce Platform Risk Research Report
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Empty Package
type: Term
break id: T0013
stix type: x-break-term
definition: A package sent during a fake transaction that contains no actual goods or is filled with irrelevant items.
description: Empty packages are a common tactic in fake order brushing and false shipping. Sellers send empty packages to generate a logistics trail, creating the illusion of a completed transaction to fraudulently boost sales rankings and reputation scores. In marketing fraud, empty packages are also used to fabricate delivery records for proxy purchasing schemes, concealing the actual flow of goods. This constitutes direct transactional fraud.
category: Marketing Fraud
keywords: Empty Package
keywords: fake shipment
keywords: brushing parcel
keywords: ghost package
keywords: dummy delivery
keywords: empty box shipping
keywords: synthetic tracking
keywords: phantom order fulfillment
keywords: void shipment
usage example: To fabricate fake transaction records and defraud platform subsidies, the scam merchant colluded with logistics insiders, sending tens of thousands of empty packages filled with waste paper across the country.
related risks: Fake Shipment
related risks: Fake Transactions
related risks: Order Brushing
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Device Fingerprinting
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Coupon Farming
type: Term
break id: T0014
stix type: x-break-term
definition: The act of exploiting platform loopholes or promotional rules to obtain goods or services at zero or extremely low cost.
description: 'Wool pulling' is the execution phase in the marketing fraud chain. Participants use SMS-verified accounts, coupon stacking, and other methods to extract platform subsidies. Fraud rings organize large-scale wool-pulling activities through task groups, collecting the obtained goods for resale and profit. This behavior not only causes direct financial losses to platforms but also disrupts normal marketing order.
aliases: Lu Mao
category: Marketing Fraud
keywords: Coupon Farming
keywords: promo abuse
keywords: coupon clipping
keywords: bonus hunting
keywords: reward farming
keywords: promo code stacking
keywords: deal churning
keywords: offer harvesting
keywords: incentive abuse
usage example: A group of university students exploited a food delivery platform's loophole, using coupon farming techniques to stack multiple expired vouchers and ultimately scoring a luxury lunch for just one cent.
related risks: Unauthorized Discount Purchase
related risks: Promotional Activity Cheating
related risks: Malicious Benefit Abuse
related risks: Flash Return Arbitrage
related risks: Order-Splitting Arbitrage
related risks: Fake Registration
related risks: Bulk Account Registration
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: SIM Card Dealers (Phone Numbers)
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Direct Order
type: Term
break id: T0015
stix type: x-break-term
definition: A task execution method where orders are placed at the original price without using any coupons or discounts.
description: 'Naked ordering' is common in scenarios where sellers are brushing their own sales volume or in proxy purchasing schemes. Participants place orders at full price, and the merchant later refunds the cost and pays a commission through rebates. This method circumvents platform risk controls that monitor coupon stacking, making the transaction appear more like a genuine purchase and reducing the risk of being flagged as fake.
category: Marketing Fraud
keywords: Direct Order
keywords: no-discount order
keywords: rebate farming
keywords: cashback order
keywords: merchant kickback
keywords: direct rebate
keywords: order rebating
keywords: bare order
keywords: no-coupon purchase
usage example: Because the platform's risk control system strictly audits voucher usage, the fraud ring opted for a direct order approach to complete the task at full price without triggering any alerts.
related risks: Order Brushing
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

SIM Bank
type: Term
break id: T0016
stix type: x-break-term
definition: Physical SIM cardsheld by card suppliers and inserted into modem pool devices for bulk sending and reception of SMS verification codes.
description: Modem pool cards are the hardware foundation of the SMS code reception supply chain. Card suppliers use modem pool devices to control a large number of SIM cards simultaneously, providing verification code reception services to downstream black-market operations. These cards are often sourced from operator loopholes, illegally resold IoT cards, or identity fraud, and are widely used for bulk account registration and exploiting platform promotions. The existence of these cards allows fraud rings to bypass identity verification mechanisms at scale and low cost.
category: Marketing Fraud
keywords: SIM Bank
keywords: modem pool
keywords: SIM farm
keywords: SMS gateway
keywords: bulk SMS device
keywords: SIM box
keywords: GSM modem array
keywords: verification farm
keywords: SIM hosting
usage example: A SIM card dealer inserted hundreds of registered SIM cards into a SIM bank device, using companion software to provide real-time SMS verification codes for various app registrations to code-receiving platforms.
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Virtual Number Registration
related risks: Promotional Activity Cheating
related avoidances: SMS Verification
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Modem Pool
related attack tools: Mass Control Systems
related attack tools: SMS Verification Code Platform
related attack tools: Modem Pool SIM Cards
related threat actors: SIM Card Dealers (Phone Numbers)
related business scenes: BS02
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Flash Sale
type: Term
break id: T0017
stix type: x-break-term
definition: A form of marketing fraud in which illicit actors use automated tools to snap up promotional items at extreme speed during flash sales.
description: Fraud rings deploy custom scripts or bot programs that complete the checkout process within milliseconds of a promotion going live, targeting limited-quantity discounted goods or voucher bundles. This prevents legitimate users from accessing the offers, severely undermines the fairness of marketing campaigns, and is often linked to downstream monetization channels for large-scale arbitrage.
aliases: Kill
category: Marketing Fraud
keywords: Flash Sale
keywords: lightning deal
keywords: limited-time offer
keywords: flash discount
keywords: timed promotion
keywords: instant deal
keywords: doorbuster
keywords: time-limited sale
keywords: flash buying
usage example: During last night’s half-price liquor promotion, script operators flash-purchased hundreds of orders in seconds—we stood no chance trying to grab one manually.
related risks: Cheating Tools / Game Hacks
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Instant Sellout
type: Term
break id: T0018
stix type: x-break-term
definition: The phenomenon in which popular items are instantly cleared out by illicit actors during marketing events, leaving ordinary users unable to make a purchase.
description: Fraud rings use automated tools to place bulk orders within milliseconds of a sale opening, rapidly driving inventory to zero. This tactic is commonly employed for hoarding or resale for profit, severely disrupting platform sales operations and depriving average consumers of any buying opportunity.
aliases: Meow
category: Marketing Fraud
keywords: Instant Sellout
keywords: sold out instantly
keywords: out of stock immediately
keywords: instant depletion
keywords: zero inventory
keywords: immediate sellout
keywords: rapid sellout
keywords: instant clearance
keywords: gone in seconds
usage example: Those limited-edition sneakers were gone the moment they dropped—definitely cleaned out by a group using bots again.
related risks: Cheating Tools / Game Hacks
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Aged Blank Account
type: Term
break id: T0019
stix type: x-break-term
definition: An account that has been registered for a full month and has no transaction history, prized by fraud rings for its low-risk profile in brushing operations.
description: Because these accounts meet the required registration age and maintain a clean behavioral record, they can bypass entry-level risk controls that platforms apply to new accounts. After being acquired by fraud rings, they are commonly used for bulk order padding, fake reviews, or referral campaigns to collect platform marketing incentives at minimal cost, serving as a foundational resource for marketing fraud.
category: Marketing Fraud
keywords: Aged Blank Account
keywords: clean account
keywords: fresh account
keywords: unused profile
keywords: zero-history account
keywords: virgin account
keywords: newly registered
keywords: blank profile
keywords: untouched account
usage example: The platform’s risk controls have tightened lately and fresh accounts aren’t working well—we need to source a batch of clean month-old accounts to run tasks reliably.
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Device Fingerprinting
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Compensation Abuse
type: Term
break id: T0020
stix type: x-break-term
definition: The illicit practice of exploiting loopholes in platform after-sales policies to obtain unlawful profits through fraudulent refunds or compensation claims.
description: Fraud rings target e-commerce policies such as no-reason returns, shipping insurance, or counterfeit compensation guarantees by fabricating product defects, conducting bait-and-switch returns, or posting malicious negative reviews to coerce merchants into cash settlements. This activity has evolved into an industrial chain that causes significant financial harm to sellers and disrupts market order.
aliases: Compensation Deputy
category: Marketing Fraud
keywords: Compensation Abuse
keywords: refund fraud
keywords: malicious refunding
keywords: payout abuse
keywords: compensation scamming
keywords: refund exploit
keywords: claims abuse
keywords: refund churning
keywords: settlement abuse
usage example: Those groups specifically buy items covered by shipping insurance, then pick faults upon delivery to file compensation claims—they can pull in a fair amount of money each month.
related risks: Malicious Claims
related risks: After-Sales Rights Abuse
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Shield Bypass
type: Term
break id: T0021
stix type: x-break-term
definition: The technical methods used by fraud operators to crack or circumvent a platform’s security and risk-control systems.
description: Fraud technicians employ vulnerability scanning, protocol cracking, emulator-based device spoofing, and other techniques to defeat CAPTCHA challenges, device fingerprinting, and behavioral analysis. Successfully breaking through these defenses is a prerequisite for large-scale account registration, flash purchasing, or data scraping, making it the preparatory step for a wide range of cyberattacks and marketing fraud schemes.
category: Marketing Fraud
keywords: Shield Bypass
keywords: risk engine evasion
keywords: captcha bypass
keywords: bot detection bypass
keywords: WAF bypass
keywords: fingerprint spoofing
keywords: device spoofing
keywords: anti-fraud bypass
keywords: rule engine bypass
usage example: This campaign just added device fingerprinting checks—if we don’t break through the shield first, our scripts won’t even be able to log in.
related risks: Credential Stuffing
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Device Fingerprinting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Device Spoofing Tools
related attack tools: Credential Stuffing Tools
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Order Locking
type: Term
break id: T0022
stix type: x-break-term
definition: A tactic used by fraud rings during major e-commerce sales events in which they place bulk orders programmatically without completing payment to tie up inventory or promotional slots.
description: After identifying pricing errors or high-value coupons, fraud rings use automated tools to instantly generate a large volume of pending orders that lock up the available stock. The intent is to hoard goods for resale at a higher price or to hold them for arbitrage, preventing both the merchant from selling normally and other consumers from making purchases.
aliases: Lock Pill
category: Marketing Fraud
keywords: Order Locking
keywords: inventory hoarding
keywords: cart squatting
keywords: checkout hoarding
keywords: flash sale bot
keywords: cart locking
keywords: inventory denial
keywords: order reservation exploit
usage example: Don’t rush to pay—first lock down all the low-priced inventory with orders; once the price rebounds, we can flip the order slots for a profit.
related risks: Inventory Denial
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Fake Follower Boosting
type: Term
break id: T0023
stix type: x-break-term
definition: The black-market practice of inflating a social media account’s follower count through bulk registration or purchase of fake accounts.
description: Fraud rings leverage bot-farm control systems and SMS verification platforms to mass-produce zombie accounts that are then used to follow a designated target, creating an illusion of popularity. These fake followers typically generate no genuine engagement and are used to facilitate scam-driven traffic, exaggerate advertising performance, or defraud platform creator incentive programs, ultimately misleading real users or advertisers.
aliases: Sofen
category: Marketing Fraud
keywords: Fake Follower Boosting
keywords: follower farming
keywords: social boosting
keywords: bot followers
keywords: follower inflation
keywords: mass account creation
keywords: influence inflation
keywords: follower botnet
usage example: A new account going live gets no traffic—first find a channel to pad the follower count and make the storefront look credible, otherwise no one will trust you.
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: SMS Verification Code Platform
related threat actors: SIM Card Dealers (Phone Numbers)
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Lossless Cashout
type: Term
break id: T0024
stix type: x-break-term
definition: A scheme in which fraud rings exploit platform rule loopholes to convert vouchers or red packets into cash at near-zero cost.
description: Through fictitious transactions, self-dealing, or collusion with merchants, fraud rings turn platform-issued coupons and shopping subsidies into real money. The operation requires no actual logistics or relies solely on empty-package shipping services, directly draining platform marketing funds and causing substantial financial losses to the platform.
category: Marketing Fraud
keywords: Lossless Cashout
keywords: coupon liquidation
keywords: gift card cashout
keywords: voucher arbitrage
keywords: promo abuse cashout
keywords: coupon arbitrage
keywords: zero-cost cashout
keywords: promo code liquidation
usage example: There’s a loophole in this campaign—grab the vouchers and cash them out through a designated channel with almost no loss, turning a 100-yuan voucher into 95 in hand.
related risks: Fake Transactions
related risks: Subsidy Fraud
related risks: Unauthorized Discount Purchase
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Scalpers
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

No Shield
type: Term
break id: T0025
stix type: x-break-term
definition: A term used by fraud operators to describe a target platform that has no risk control measures in place.
description: In underground fraud circles, a platform's risk control system is referred to as a "shield." "No shield" means the platform has not deployed effective security verification or anti-fraud strategies. This allows fraudsters to bypass defenses directly and conduct bulk operations, commonly used for large-scale harvesting of physical rewards, vouchers, or cash bonuses. The nature of a "shield" varies across business scenarios—such as a bank's hardware security token or an e-commerce platform's risk engine—but the absence of one signals an extremely low cost of attack.
category: Marketing Fraud
keywords: No Shield
keywords: unprotected endpoint
keywords: risk control gap
keywords: unmonitored API
keywords: bypassable verification
keywords: missing rate limit
keywords: unshielded transaction
usage example: While scouting, the fraud ring discovered the newly launched social campaign page had absolutely no risk control strategy, a classic no shield situation, and immediately launched a massive machine-driven registration attack.
related risks: Promotional Activity Cheating
related avoidances: Virtual Land Trading Platform Review Mechanism
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related business scenes: BS02
related business scenes: BS01
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Hardware Token
type: Term
break id: T0026
stix type: x-break-term
definition: A verification mechanism deployed in e-commerce scenarios to prevent automated scripts from snapping up purchases.
description: During flash sales or the release of popular items, fraud rings often deploy automated scripts to conduct bulk purchasing, disrupting normal transaction order. Platforms implement a "small shield" as a security checkpoint, requiring users to complete specific verifications to prove they are human operators, thereby blocking automated requests from bots. This mechanism serves as a critical line of defense against marketing fraud and protects the interests of legitimate users.
category: Marketing Fraud
keywords: Hardware Token
keywords: USB token
keywords: OTP token
keywords: hardware OTP
keywords: transaction signing token
keywords: 2FA dongle
keywords: banking token
keywords: cryptographic token
usage example: To block scalper automation scripts, the platform deployed a hardware token at a critical step in the liquor flash sale, requiring users to complete a slider puzzle verification before submitting their order.
related risks: Promotional Activity Cheating
related avoidances: Human Verification Technology
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Profitable Target
type: Term
break id: T0027
stix type: x-break-term
definition: A term used in underground fraud circles to indicate that a fraudulent activity or target offers high financial returns.
description: Operators use "meat" as slang for profit. "Has meat" signifies that attacking a specific platform, participating in a marketing campaign, or executing a particular fraud technique can yield substantial illicit gains. Assessing whether a target "has meat" is the core criterion for fraud rings when deciding whether to commit resources and manpower to an attack. Campaigns involving high cashback, large no-threshold vouchers, or high-value physical gifts are typically flagged as targets that "have meat."
category: Marketing Fraud
keywords: Profitable Target
keywords: high-value target
keywords: profitable exploit
keywords: lucrative promo
keywords: high-margin scheme
keywords: juicy target
keywords: high-ROI exploit
usage example: After deeply analyzing a platform's membership system, the fraud ring leader concluded the points exchange loophole was a profitable target, as the redeemable high-value hard currency could be quickly resold for substantial returns.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Cloud Blacklist
type: Term
break id: T0028
stix type: x-break-term
definition: Accounts flagged and restricted by UnionPay QuickPass's risk control system, preventing them from participating in marketing campaigns.
description: To combat marketing fraud, UnionPay QuickPass applies risk control flags to abnormal accounts, which are internally referred to as "cloud blacklisted." Once an account is placed on this blacklist, the user is barred from participating in any promotions, red packet giveaways, or lucky draws offered by the platform. When organizing coupon-harvesting operations, fraud rings prioritize non-blacklisted accounts for bulk actions to circumvent platform restrictions and ensure they can successfully drain marketing funds.
category: Marketing Fraud
keywords: Cloud Blacklist
keywords: UnionPay blacklist
keywords: QuickPass blacklist
keywords: cloud payment ban
keywords: promo ban list
keywords: risk-flagged account
keywords: payment token block
usage example: While participating in a UnionPay promotion, a coupon abuser found their account forcibly flagged with an 'activity risk' tag after bulk-redeeming points rewards, resulting in permanent blacklisting from all promotional campaigns.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

One-Yuan Arbitrage Crew
type: Term
break id: T0029
stix type: x-break-term
definition: A general term for coupon-harvesting groups obsessed with exploiting promotional offers to acquire goods or services at extremely low cost.
description: Initially referring to users who only purchased one-yuan items, the term has evolved into a collective label for coupon harvesters, including demographics such as stay-at-home mothers, students, and part-time workers. They are highly active in various social groups, systematically collecting, sharing, and exploiting platform loopholes or promotional rules. By stacking vouchers and red packets, they achieve near-zero or zero-cost purchases. Their activities often operate in a grey area, and when scaled into organized operations, they become a link in the underground fraud supply chain.
category: Marketing Fraud
keywords: One-Yuan Arbitrage Crew
keywords: penny auction group
keywords: deal hunter crew
keywords: coupon stacking group
keywords: low-cost arbitrage
keywords: promo abuse ring
keywords: bonus hunter collective
usage example: Members of the one-yuan arbitrage crew are active in the billion-yuan subsidy sections of major e-commerce platforms, specifically lying in wait for special offers that, after stacking coupons, require payment of just one yuan or even 0.01 yuan.
related risks: Promotional Activity Cheating
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

High-Value Promo Exploit
type: Term
break id: T0030
stix type: x-break-term
definition: Underground slang for an exceptionally profitable marketing loophole or coupon-harvesting opportunity.
description: Within coupon-harvesting communities, a "lamb shank" refers to a single high-yield marketing campaign or platform vulnerability, distinct from the smaller, repeated gains known as "wool." Discovering a "lamb shank" signifies a major profit opportunity, causing information to spread rapidly through fraud networks and triggering massive, concentrated attacks that can inflict substantial financial losses on a platform within a short period.
category: Marketing Fraud
keywords: High-Value Promo Exploit
keywords: big score
keywords: whale promo
keywords: high-payout loophole
keywords: jackpot exploit
keywords: big promo hit
keywords: lucrative loophole
keywords: high-value glitch
usage example: Scored a massive lamb shank today. Using cards starting with 37 for purchases over 2500 gave a 137 discount. Found a ride organizer, all three accounts cashed out smoothly—the profit is insane. Spots are still open, brothers, get in fast!
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Automated Reselling
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related threat actors: Scalpers
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

Multi-Merchant Terminal
type: Term
break id: T0031
stix type: x-break-term
definition: The illegal practice of binding a single POS terminal to multiple merchant accounts for credit card cashing or limit maintenance.
description: This operation violates UnionPay's one-machine-one-merchant regulation and is a common tactic used by coupon harvesters for credit card maintenance. By simulating multiple merchants across different industries on a single POS machine, cardholders can fabricate diversified spending records to evade bank risk controls and exploit rate differences between merchants to maximize credit card points or cashback rewards. This constitutes a regulatory violation or outright illegal act and is a form of financial fraud.
aliases: One Chicken and Many Eggs
category: Marketing Fraud
keywords: Multi-Merchant Terminal
keywords: multi-merchant binding
keywords: POS terminal hijacking
keywords: terminal stacking
keywords: merchant hopping
keywords: one terminal multiple MID
keywords: terminal multi-tenancy
keywords: POS bonus abuse
keywords: multi-MID POS
usage example: A night market stall owner pulls a Multi-Merchant Terminal from his backpack and skillfully switches between three merchant names to swipe cards for regulars, joking it's "one device with many eggs" to quickly boost credit limits.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Reducing Returns
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
related business scenes: BS01
citation: Black Market Big Data: E-commerce Scalper Industry Chain Analysis Report
updated: 2026-06-16
version: 1

AB Loan Scam
type: Term
break id: T0032
stix type: x-break-term
definition: A fraudulent loan scheme that exploits individuals with good credit history to act as debt bearers for the actual borrower.
description: Fraud rings target person A, who is desperate for cash but has poor credit, and lure them into recruiting person B, who has a clean credit profile, to act as a guarantor or nominal borrower. Intermediaries then fabricate documentation to help B secure a loan. The funds are used by A, but the debt and legal liability fall entirely on B. Ultimately, A and the intermediaries split the loan proceeds and disappear, leaving B saddled with massive debt under unknowing or coerced circumstances, often triggering severe social and financial risks.
category: Credit Fraud
keywords: AB Loan Scam
keywords: proxy borrower scam
keywords: guarantor fraud
keywords: credit mule recruitment
keywords: loan stacking fraud
keywords: nominee loan scheme
keywords: debt mule
keywords: credit washing scheme
keywords: assisted lending fraud
usage example: Xiao Zhang was brought by a friend to a loan company under the guise of helping with a transaction flow. Only after signing the contract did he realize he had become the B-role debtor in an AB Loan Scam, while the so-called A-role friend had vanished without a trace.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Proxy Loan
type: Term
break id: T0033
stix type: x-break-term
definition: The act of applying for a loan from a financial institution on behalf of another person without genuine borrowing intent, and then transferring the funds to that person.
description: In a proxy loan scheme, the nominal borrower applies for the loan, signs the contract, and receives the disbursement, then passes the money to the actual user. A high-risk variant is AB lending, where the nominal borrower’s identity is used without their knowledge, leaving them with heavy debt. This model is often exploited by illicit intermediaries to defraud financial institutions, resulting in credit losses.
aliases: Bang Dai
category: Credit Fraud
keywords: Proxy Loan
keywords: nominee borrower
keywords: credit proxy
keywords: loan mule
keywords: fronting fraud
keywords: third-party application
keywords: borrower substitution
keywords: credit surrogate
keywords: straw borrower
usage example: My friend’s credit was trashed and he couldn’t get a loan, so an agent had me do a proxy loan for him. I transferred the money as soon as it came through, and now it’s overdue—the bank keeps calling me.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Invisible
type: Term
break id: T0034
stix type: x-break-term
definition: An individual with no credit history in the credit reporting system, making it difficult for financial institutions to assess their risk.
description: Because they have no borrowing history, credit invisibles are treated as high-value material by underground fraud rings and are openly traded on platforms like Telegram and X. Fraud syndicates use these identities to apply for loans or credit cards, bypassing risk models to commit large-scale credit fraud. Recruited as debt mules, these individuals often become part of the fraud chain unknowingly or under false promises and may ultimately face legal liability.
category: Credit Fraud
keywords: Credit Invisible
keywords: thin file
keywords: no-hit profile
keywords: credit newbie
keywords: unscored consumer
keywords: zero-record applicant
keywords: ghost profile
keywords: credit file farming
keywords: synthetic identity precursor
usage example: I’m short on cash lately and saw someone in a group recruiting credit invisibles to carry debt. They said I just need to sign a few papers and can get tens of thousands—does that sound legit?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Desperados in Financial Fraud
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Error Code Fix
type: Term
break id: T0035
stix type: x-break-term
definition: A service offered by credit intermediaries claiming to resolve loan disbursement failures caused by specific error codes.
description: When a financial institution’s system returns a risk-control error code that blocks loan disbursement, some intermediaries sell a fix service. They exploit internal loopholes, forge documents, or collude with insiders to override the restriction and force the disbursement. This practice usually involves high service fees and significantly increases the risk of subsequent loan fraud.
category: Credit Fraud
keywords: Error Code Fix
keywords: decline override
keywords: error code bypass
keywords: funding block removal
keywords: loan unlock service
keywords: system decline fix
keywords: override code service
keywords: disbursement unblock
keywords: credit decision override
usage example: My application got rejected with error code E018. I found an agent who guarantees a fix for a 20% cut—not sure if they can really clear it.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Blank
type: Term
break id: T0036
stix type: x-break-term
definition: An individual with a completely blank credit file and no credit history whatsoever.
description: A pure credit invisible has an even cleaner record than an ordinary credit invisible, making them more valuable in underground fraud circles and top-grade material for loan fraud and money laundering. Fraud rings recruit such individuals through social media, fabricate application profiles, and simultaneously apply for high-value loans from multiple institutions. Once the funds are obtained, the debt mule is often abandoned, leaving behind unrecoverable bad debt.
category: Credit Fraud
keywords: Credit Blank
keywords: zero-file applicant
keywords: no-record profile
keywords: clean slate credit
keywords: unscorable consumer
keywords: blank-file identity
keywords: credit file seeding
keywords: pristine profile
keywords: empty bureau file
usage example: The agent said a pure credit invisible can get a bigger loan. He told me to give him my ID and he’d package the application—I’d get 30% of the payout. Is this a trap?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related business scenes: BS01
related business scenes: BS04
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Processing
type: Term
break id: T0037
stix type: x-break-term
definition: The capability or channel to manage the entire credit application process within underground fraud operations.
description: In the context of credit fraud, the term refers not to a physical document but to an intermediary’s possession of the resources and methods to successfully secure a loan. Intermediaries package client profiles, clear approval hurdles, or exploit bank loopholes to complete the application. Having a direct line to the funding source or key approver means a higher success rate and steeper fees.
category: Credit Fraud
keywords: Loan Processing
keywords: full-cycle handling
keywords: loan origination service
keywords: credit packaging
keywords: application processing
keywords: credit file building
keywords: loan document prep
keywords: credit intermediary service
keywords: loan ops
usage example: I’ve got a solid direct line—blacklisted or clean file, doesn’t matter. As long as there’s no court enforcement, I can get it approved. Fee negotiable.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Premium Card For Masses
type: Term
break id: T0038
stix type: x-break-term
definition: In credit card enthusiast slang, refers to three premium credit cards—Bank of Communications White Qilin, CMB Classic Platinum, and SPDB AE Platinum—that offer rich benefits and allow annual fees to be offset with points.
description: These three cards are known for relatively accessible application thresholds and practical perks, leading ordinary cardholders to self-deprecatingly call them the 'loser's three white cards.' In underground circles, intermediaries often exploit bank easing periods or document fabrication techniques to help unqualified clients obtain these high-end cards, aiming to fraudulently secure high credit lines or resell points benefits.
category: Credit Fraud
keywords: Premium Card For Masses
keywords: White Unicorn Card
keywords: Classic Platinum CMB
keywords: AmEx Platinum SPDB
keywords: entry-level premium card
keywords: point-offset annual fee
keywords: mass affluent card
keywords: accessible premium trio
keywords: reward-point arbitrage card
usage example: SPDB AE Platinum has been easing approvals lately; the agent said among the loser's three white cards, this one offers the best value and can help me package my application to get approved.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Easing
type: Term
break id: T0039
stix type: x-break-term
definition: A period when a bank temporarily relaxes its credit approval standards, making it easier to get a loan or credit card approved.
description: A loosening window is usually triggered by business pressure, policy adjustments, or system loopholes, and manifests as lower credit requirements, higher tolerance, or simplified processes. Underground intermediaries quickly detect such signals and organize bulk applications to defraud credit funds en masse. These windows are often short-lived, prompting agents to urge clients to act fast.
category: Credit Fraud
keywords: Credit Easing
keywords: approval window
keywords: loose lending
keywords: easy credit period
keywords: underwriting easing
keywords: credit flood
keywords: approval rate spike
keywords: lending spree
keywords: relaxed underwriting
usage example: Inside info—XX Bank is loosening big time these next two days, ignoring inquiry counts. Get in quick before it closes.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Anti-Collection
type: Term
break id: T0040
stix type: x-break-term
definition: The practice by underground organizations of helping debtors evade repayment obligations through forged documents, malicious complaints, and other illegal means.
description: Operating under the guise of legal consulting, debt evasion rings incite debtors to default willfully. They forge poverty certificates and medical records or coach clients to file malicious complaints, pressuring financial institutions to grant debt relief or write off obligations. This behavior severely undermines the financial order; participants not only face debt recovery but may also be prosecuted for fraud.
category: Credit Fraud
keywords: Anti-Collection
keywords: debt evasion tactics
keywords: collection dodge
keywords: malicious avoidance
keywords: fake documentation claims
keywords: debt strike
keywords: collection resistance
keywords: repayment strike
keywords: debt discharge scheme
usage example: I hired a legal consultant for debt evasion. They told me to forward all calls to them and said they could stop interest and suspend payments, but they took my money and blocked me.
related risks: Anti-Collection Risk
related risks: Malicious Complaints
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Fake Provident Fund
type: Term
break id: T0041
stix type: x-break-term
definition: The practice of fabricating housing provident fund (HPF) contribution records—either by forging data or creating fictitious employment relationships—to fraudulently qualify for personal credit products offered by financial institutions.
description: Fraud rings use technical means to spoof HPF app data or arrange backdated contributions through shell employment, enabling applicants to pass bank eligibility checks for consumer loans and salary-based loans. This tactic specifically targets credit products that rely on HPF data for risk assessment, allowing unqualified individuals to extract large sums. Once the fraud succeeds, the lender faces a direct bad-debt loss.
aliases: Provident Fund Forgery
category: Credit Fraud
keywords: Fake Provident Fund
keywords: Housing Fund Forgery
keywords: Fake Housing Fund
keywords: Provident Fund App
keywords: Fund Data Fabrication
keywords: Fund Packaging
keywords: Fake Employment Record
keywords: Fund Loan Fraud
keywords: Fund Contribution Fraud
usage example: An agent posted a "provident fund packaging" service on social media, claiming that for just three months of service fees they could fabricate six months of high-base contribution records, helping clients defraud a bank of 300,000 yuan in credit loans through a Fake Provident Fund scheme.
related risks: Consumer Loan Fraud (Genuine Retroactive Payment)
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: Credit Fraud: Analysis of Provident Fund Forgery Loan Fraud Techniques
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Hungry
type: Term
break id: T0042
stix type: x-break-term
definition: An individual whose credit report shows a high volume of hard inquiries due to frequent applications for credit cards or loans.
description: Because they have applied for multiple credit products in a short period, financial institutions view these individuals as higher-risk—either cash-strapped or exhibiting poor credit management. In underground lending contexts, such profiles are often targeted for “debt restructuring”: a fraud ring pays off their existing debts to temporarily clean their credit report, then immediately helps them apply for a batch of higher-limit loans. The victim ends up with a far heavier debt burden while the ring collects exorbitant service fees.
category: Credit Fraud
keywords: Credit Hungry
keywords: Credit Shopping
keywords: Credit Report Inquiry
keywords: Multiple Credit Applications
keywords: Credit Seeking
keywords: Loan Stacking
keywords: Credit Application Storm
keywords: Credit Tapping
usage example: His credit report is full of inquiries—a classic over-inquired profile. No mainstream bank will approve him now.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Blacklist
type: Term
break id: T0043
stix type: x-break-term
definition: A person blacklisted by financial institutions due to severe adverse credit history, rendering them ineligible for any legitimate loan channel.
description: These individuals typically have records of delinquency or default. Because fund flows through their accounts are hard to trace, their identities and accounts are frequently purchased or rented by fraud rings as money-laundering conduits. Rings also use blacklisted individuals’ personal information to conduct credential-stuffing attacks across multiple platforms, testing whether they can fraudulently apply for loans or credit products in the victim’s name. If successful, all resulting debt and liability fall on the original identity holder.
category: Credit Fraud
keywords: Credit Blacklist
keywords: Blacklisted Borrower
keywords: Loan Default
keywords: Credit Impairment
keywords: Adverse Credit History
keywords: Blacklisted Account
keywords: Credit Denial
keywords: Credit Ban
usage example: That identity is completely blacklisted now—no legitimate path works. It can only be used for running money.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Application Submission
type: Term
break id: T0044
stix type: x-break-term
definition: The operational step of submitting a prepared loan application package to a financial institution’s approval system.
description: This is the critical juncture in the credit process where an application formally enters the review queue. In organized loan fraud, the submission stage often involves batch-uploading falsified documents, including fabricated corporate financial statements, personal bank statements, or fake housing provident fund records. Fraud rings use these packaged materials to systematically exploit specific risk-control rules and obtain high credit lines.
category: Credit Fraud
keywords: Application Submission
keywords: Loan Application
keywords: Credit Application
keywords: Application Package
keywords: Loan Origination
keywords: Application Intake
keywords: Application Processing
keywords: Document Submission
keywords: Loan Onboarding
usage example: All these profiles have been seasoned. We’re submitting the whole batch tonight—aiming for full approval.
related risks: Consumer Loan Fraud (Genuine Retroactive Payment)
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Fast Company Flip
type: Term
break id: T0045
stix type: x-break-term
definition: A scheme in which a fraud ring rapidly transfers a pre-seasoned shell company to a loan applicant through an untraceable change of ownership, circumventing rules that flag short-tenure legal representatives for business financing fraud.
description: Fraud rings cultivate empty-shell companies with substantial operating revenue and tax invoice records in advance. Through manipulation, banks are unable to detect the true change of control via commercial registries. Once the applicant takes over, they can apply for multiple large-amount corporate tax-invoice loans within 20 to 45 days under the new legal-representative identity. The tactic exploits a time gap to concentrate large-scale fund extraction before the lender detects the anomaly.
category: Credit Fraud
keywords: Fast Company Flip
keywords: Quick Company
keywords: Fast Company
keywords: Company Flip
keywords: Ownership Transfer
keywords: Traceless Transfer
keywords: Business Takeover
keywords: Shell Company
keywords: Quick Flip
usage example: Just took over a fast-transfer shell company—the data has been seasoned for six months. We’re pushing submissions hard over the next few days.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Desperados in Financial Fraud
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Exploit
type: Term
break id: T0046
stix type: x-break-term
definition: A vulnerability or weak spot in a credit approval workflow or risk-control system that can be exploited for fraudulent gain.
description: Underground operators specialize in reverse-engineering financial platforms’ review mechanisms to identify gaps, such as lax document verification or system response delays. Once a viable loophole is discovered, they mobilize teams to attack it at scale, batch-obtaining loans through forged documents and fake transactions. Information about these vulnerabilities is traded at high prices within closed fraud communities and spreads rapidly.
aliases: Button
category: Credit Fraud
keywords: Exploit
keywords: Loophole
keywords: Lending Loophole
keywords: Application Loophole
keywords: Credit Gap
keywords: Lending Gap
keywords: Approval Bypass
keywords: Instant Approval
usage example: That newly launched consumer loan product has a loose loophole—no in-person interview required. Get people on it now.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

No-Collateral Loan
type: Term
break id: T0047
stix type: x-break-term
definition: A high-risk, unsecured loan issued without collateral or guarantees, typically by unlicensed underground lenders or private individuals operating outside the formal financial system.
description: This lending model relies not on standard credit checks but on violent collection tactics to manage risk. In the context of credit fraud, such loans are often used to create debt traps through “borrow-new-to-pay-old” cycles or to provide short-term bridge funding for illicit operations. Once a borrower falls in, they face exorbitant interest rates and physical intimidation, making it extremely difficult to exit.
category: Credit Fraud
keywords: No-Collateral Loan
keywords: Unsecured Loan
keywords: Unlicensed Lending
keywords: Private Lending
keywords: Loan Shark
keywords: Street Loan
keywords: Underground Loan
keywords: Hard Money Loan
keywords: No Collateral
usage example: Those who get rejected by banks all turn to unsecured underground lenders. The interest is terrifyingly high, but you can get cash the same day.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related threat actors: Underground Money Houses
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Card Bust-Out
type: Term
break id: T0048
stix type: x-break-term
definition: A form of credit card fraud in which the cardholder deliberately maxes out the credit line through spending, cash advances, or installment plans and then intentionally defaults on all repayment obligations.
description: Operators exhaust the entire credit limit through large purchases, cash-out schemes, or installment-based consumption and then refuse to make any payments. Common methods include applying for cards with synthetic identities and draining them immediately, or using cyclic cash-out techniques to funnel the funds into illegal activities. This practice directly causes bad-debt losses for the issuing institution and is a classic modus operandi in credit card fraud.
category: Credit Fraud
keywords: Card Bust-Out
keywords: Bust-Out
keywords: Max Out
keywords: Credit Line Exhaustion
keywords: Card Maxing
keywords: Credit Dumping
keywords: Bust-Out Fraud
keywords: Sleeper Bust-Out
keywords: Credit Bust-Out
usage example: All cards obtained from that batch of identities are treated as empty-card runs—drain them and dump them. No one thinks about repayment.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Farming
type: Term
break id: T0049
stix type: x-break-term
definition: Loan harvesting refers to the fraudulent practice of applying for small online loans in bulk using fabricated credentials with no intention of repayment.
description: Fraudsters use synthetic or stolen identities, forged income proofs, and fake employment records to apply for loans across multiple platforms simultaneously. Once the funds are disbursed, they immediately sever contact and default, leaving financial institutions with bad debt. This tactic often targets small, fast-approval cash loan products with weak risk controls and is a classic form of loan fraud.
category: Credit Fraud
keywords: Loan Farming
keywords: Loan Stacking
keywords: Bulk Application
keywords: Loan Harvesting
keywords: Application Fraud
keywords: Loan Default
keywords: No Intent to Repay
keywords: Loan Abuse
usage example: Several unemployed youths specialize in studying platform risk control loopholes, using a set of fake documents to batch "loan farm." They call this their salary, with no intention of repaying a cent—once the phone is off, it's pure profit from Loan Farming.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Naked Application
type: Term
break id: T0050
stix type: x-break-term
definition: Naked application refers to the practice of applying for a credit card or loan by submitting only a basic form without any supporting documentation.
description: Applicants deliberately withhold proof of assets, income, or other supplementary materials, exploiting the lenient underwriting thresholds of certain products. Fraud rings commonly use this method to test banks' or platforms' approval loopholes at scale, screening for channels with weak risk controls to pave the way for subsequent large-scale fraud.
category: Credit Fraud
keywords: Naked Application
keywords: No-Doc Application
keywords: Stated Income Application
keywords: Low-Doc Application
keywords: Application Only
keywords: No Income Verification
keywords: No Asset Verification
keywords: Skeleton Application
usage example: Old Li saw an ad at an internet cafe and tried a Naked Application for a credit card, filling in only his name and ID number while leaving the employer field blank. Surprisingly, he was instantly approved for a 5,000 yuan limit.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Slow Company Flip
type: Term
break id: T0051
stix type: x-break-term
definition: Slow-cooked enterprise refers to a scheme where fraud rings acquire and long-term package shell companies to defraud banks of large tax-invoice loans.
description: Fraud rings formally transfer the legal representative role of a shell company to a debt mule and wait out the bank's required 3-6 month change-of-ownership period. During this time, they fabricate business transaction records, invoicing, and tax payments to portray the company as a normally operating, high-quality client. This is done to bypass risk models and secure high-limit business loans, after which they default on the debt.
category: Credit Fraud
keywords: Slow Company Flip
keywords: slow flip
keywords: slow company fraud
keywords: company incubation fraud
keywords: sleeper company
keywords: business loan fraud
keywords: legal representative tenure
keywords: fabricated tax invoices
keywords: inflated cash flows
usage example: This group spent a full two years on a Slow Company Flip, genuinely renting an office, paying social insurance and salaries on time, and dressing up a shell entity to appear as a company with tens of millions in annual revenue, all for that final 5-million-yuan tax loan.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Desperados in Financial Fraud
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Grocery Card
type: Term
break id: T0052
stix type: x-break-term
definition: Grocery card refers to a bank card used by fraud rings for daily small-amount cash-outs or money laundering activities.
description: Fraud rings use these cards to conduct low-value, high-frequency sham transactions at merchants, simulating everyday spending like grocery shopping to evade risk controls. These cards are often sourced illegally and are used to clean illicit funds from scams or gambling by breaking them into small amounts. Once the card is flagged by risk controls, any remaining funds are rapidly transferred out.
category: Credit Fraud
keywords: Grocery Card
keywords: card cashing
keywords: microtransaction laundering
keywords: convenience store cash-out
keywords: small-value card fraud
keywords: sham purchase card
keywords: card cycling
keywords: card mule
keywords: low-value transaction laundering
usage example: He uses a batch of grocery cards to make dozens of small transactions at convenience stores every day, cleaning money from telecom fraud a few dozen bucks at a time.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Reducing Returns
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Internal Kickback
type: Term
break id: T0053
stix type: x-break-term
definition: Internal kickback refers to the commission paid to internal employees or intermediaries who facilitate fraudulent loans.
description: In the loan fraud chain, internal kickbacks are the illicit payments that motivate bank insiders or loan brokers to violate procedures. To secure these high commissions, they actively help fraud rings fabricate application materials, relax review standards, or even directly use their internal access to approve high-risk applications, leading to significant bad debt.
category: Credit Fraud
keywords: Internal Kickback
keywords: commission fraud
keywords: loan agent kickback
keywords: referral fee abuse
keywords: application fraud incentive
keywords: bounty abuse
keywords: broker commission scheme
keywords: sales incentive fraud
keywords: kickback laundering
usage example: In an Internal Kickback operation, a bank account manager processed fraudulent loans for a scam ring, taking a 5% commission from each transaction as compensation.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS02
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Company Incubation
type: Term
break id: T0054
stix type: x-break-term
definition: Enterprise incubation refers to the practice of registering or acquiring shell companies in bulk and fabricating operational data to fraudulently obtain business loans.
description: Fraud rings purchase dormant companies or register new shells, then generate fake invoices, transaction flows, and tax records for them. After months of packaging, these companies appear to be stable businesses, but are actually used to apply for large tax-invoice loans from banks. Once the funds are received, they are immediately transferred through multiple accounts, and the debt is ultimately defaulted on.
category: Credit Fraud
keywords: Company Incubation
keywords: business credit building
keywords: shell incubation
keywords: synthetic business fraud
keywords: trade line seasoning
keywords: business credit piggybacking
keywords: fabricated business credit
keywords: credit profile building
keywords: incubated shell
usage example: Through Company Incubation, a black-market gang batch-registered over twenty shell companies within three months, each with forged complete corporate cash flow and tax records, specifically targeting banks' small and micro business loans.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

7-14 Payday Trap
type: Term
break id: T0055
stix type: x-break-term
definition: 7-14 high-interest loan refers to an illegal, ultra-high-interest loan with a 7- or 14-day term that charges exorbitant upfront fees and overdue penalties.
description: Illegal lending platforms operated by fraud rings lure victims with promises of unsecured, instant loans. In reality, they deduct over 30% in upfront fees at disbursement. Borrowers who default face aggressive debt collection and punitive penalty interest. This model is often accompanied by the illegal harvesting of contact lists, which is used to threaten borrowers, making it a classic trap loan scheme.
category: Credit Fraud
keywords: 7-14 Payday Trap
keywords: payday loan trap
keywords: short-term high-interest loan
keywords: predatory lending
keywords: front-loaded interest
keywords: loan shark app
keywords: payday loan abuse
keywords: short-term loan cycle
keywords: 7-day loan
usage example: Xiao Zhou, desperate for cash, clicked a 7-14 Payday Trap link. He borrowed 2,000 yuan but received only 1,400, and had to repay 3,000 in seven days. After being just one day overdue, his entire contact list was bombarded, and collection calls even reached his boss.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Car Loan Cash-Out
type: Term
break id: T0056
stix type: x-break-term
definition: Car financing fraud refers to the act of using falsified documents to fraudulently obtain an auto loan and then cashing out the vehicle.
description: Fraud rings recruit credit mules with clean records and fabricate their employment and income proofs. They use these fake profiles to secure a loan from a financial institution under the pretense of buying a car. Once the vehicle is acquired, it is not used but is immediately pawned or sold for cash. The loan is then abandoned, resulting in a bad debt for the auto loan.
category: Credit Fraud
keywords: Car Loan Cash-Out
keywords: auto loan fraud
keywords: vehicle financing fraud
keywords: auto loan stacking
keywords: title washing
keywords: straw purchase auto
keywords: auto loan mule
keywords: vehicle title fraud
usage example: An agent accompanied a client to pick up a BMW at a 4S dealership, then immediately drove it to an underground parking lot to hand over to a car buyer, using the Car Loan Cash-Out method to extract 200,000 yuan, while the monthly loan payments were never addressed again.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Sharking
type: Term
break id: T0057
stix type: x-break-term
definition: In the context of credit fraud, this refers to illegal high-interest loans specifically issued to gamblers.
description: These loans are typically provided by individuals operating near casinos or by affiliates of online gambling platforms. They carry extremely high interest rates calculated on a daily or weekly basis. Lenders target desperate gamblers who have lost heavily and are seeking to recoup their losses. When borrowers fail to repay, violent debt collection or coercion is often used. Such capital flows are frequently linked to money laundering and underground banking, easily leading to secondary crimes.
category: Credit Fraud
keywords: Loan Sharking
keywords: loan shark
keywords: vig loan
keywords: juice loan
keywords: street loan
keywords: illegal lending
keywords: predatory lending
keywords: underground lending
usage example: He lost everything at the casino last night and borrowed 100,000 in loan shark money from a lender on the floor, agreeing to repay 130,000. A week later, he still hadn't paid it back and debt collectors were at his door.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Reducing Returns
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Double Blacklist
type: Term
break id: T0058
stix type: x-break-term
definition: Refers to a personal credit report containing multiple severe negative records, such as serious delinquencies and court-enforced dishonesty judgments.
description: Fraud rings often use this term to precisely target and lock in desperate borrowers. As these individuals cannot obtain loans through legitimate channels, they become 'prime customers' for illicit brokers. These brokers assist them in defrauding loans by fabricating application materials and exploiting bank approval loopholes, charging high fees in the process, which ultimately leads to a surge in bad debt risk for financial institutions.
category: Credit Fraud
keywords: Double Blacklist
keywords: credit blacklist
keywords: debt blacklist
keywords: credit repair scam
keywords: bad credit loan
keywords: subprime fraud
keywords: credit-impaired
keywords: debt relief scam
keywords: credit mule
usage example: The broker posted an ad in the group saying, 'Specializing in loans for the double-blacklisted, credit history irrelevant, anyone welcome.' It was just a trick to get people with ruined credit to apply for loans.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Shell Company
type: Term
break id: T0059
stix type: x-break-term
definition: A fraudulent scheme where criminals use a shell company with no actual operations as a disguise to fraudulently obtain loans or credit lines.
description: Fraudsters first acquire or register a seemingly normal company, then fabricate transaction records and financial statements to make it appear as a high-quality enterprise. This 'shell' is then used to apply for loans or acceptance bills from multiple financial institutions. Once the funds are secured, the money is quickly transferred and the company is dissolved. This method is highly covert and often leaves credit institutions facing massive bad debts.
category: Credit Fraud
keywords: Shell Company
keywords: shell company fraud
keywords: shell leasing
keywords: shelf corporation
keywords: aged shell
keywords: shell company laundering
keywords: shell company credit
keywords: shell company loan
keywords: shell company mule
usage example: Their team specializes in recruiting rural elderly people to register companies using their IDs. After running fake transactions for six months, they start shell company loan fraud. By the time the bank catches on, the company is long gone.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Exploit-Based Credit Application
type: Term
break id: T0060
stix type: x-break-term
definition: The illegal practice of exploiting loopholes in bank risk control or policy differences to bypass standard approval processes and fraudulently obtain credit cards or loans.
description: Operators typically study the varying approval strictness across different banks or regions, exploiting system vulnerabilities to submit false information or apply from a different location. Upon a successful 'border crossing,' they quickly max out the credit line and abandon the card, causing direct bad debt losses for the bank. This behavior severely disrupts the financial credit order and is a primary target for anti-fraud departments.
category: Credit Fraud
keywords: Exploit-Based Credit Application
keywords: credit card loophole
keywords: application exploit
keywords: address jigging
keywords: credit card churning
keywords: application fraud
keywords: policy gap exploit
keywords: credit card stacking
keywords: bypass credit check
usage example: The risk control on that loan product has been lax lately. The group chats are full of tutorials on how to sneak through, using fake addresses for cross-regional applications, and the approval rate is pretty high.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Fee Refund Abuse
type: Term
break id: T0061
stix type: x-break-term
definition: A scheme where illicit actors use malicious complaints or forged documents to coerce financial institutions into refunding various legally charged fees.
description: Posing as 'agent advocates,' fraud rings instigate clients or directly act on their behalf to file mass complaints with regulatory bodies. They exploit the financial institution's desire to avoid trouble, demanding refunds of interest, service fees, or even principal, and then take a large commission. Such malicious complaints not only disrupt the financial order but also crowd out legitimate complaint channels for ordinary consumers.
category: Credit Fraud
keywords: Fee Refund Abuse
keywords: chargeback fraud
keywords: refund scam
keywords: fee reversal abuse
keywords: refund intermediary
keywords: malicious refund
keywords: fee clawback
keywords: refund agent
keywords: refund for profit
usage example: A broker helped him get all the interest from his online loan refunded and took a 30% cut. He was then told to refer everyone in his contact list for the same fee refund scam.
related risks: Malicious Complaints
related risks: Platform Online Loan Fraud
related risks: Anti-Collection Risk
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: Credit Fraud: Exposing the Underground Industry Behind Illegal Proxy Rights-Protection Schemes
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Online Lending
type: Term
break id: T0062
stix type: x-break-term
definition: Refers to small loans issued through internet platforms, which are frequently exploited by fraud rings for fraudulent applications.
description: Fraud rings use synthetic or stolen identities to register for and apply to various online lending products in bulk. They typically target small, cash-advance platforms with weak risk controls, maliciously cashing out through a practice known as 'loan farming' and then disappearing after the loan is disbursed. This behavior leads to massive bad debts for online lending platforms and is a contributing factor to the violent debt collection chaos.
aliases: WWD
category: Credit Fraud
keywords: Online Lending
keywords: online microloan
keywords: P2P lending
keywords: loan shark app
keywords: payday loan
keywords: loan intermediary
keywords: loan broker
keywords: loan mule
keywords: loan stacking
usage example: He created a bunch of fake profiles to specifically target online loan products that don't check credit history. Any money he got was considered a 'payday,' and he never intended to pay it back.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Profile Dilution
type: Term
break id: T0063
stix type: x-break-term
definition: Describes a personal credit profile that has become extremely chaotic and poor due to frequent applications for online loans, as reflected in big data credit checks.
description: These users typically apply for loans on multiple platforms in a short period, leaving a trail of numerous credit inquiries and debt records. Fraud brokers view these 'credit-messed' users as potential clients, selling them services like 'big data cleanup' or 'forced loan approval.' In reality, this chaotic data state is very difficult to fix, and users often fall into a vicious cycle of taking out new loans to pay old ones.
category: Credit Fraud
keywords: Credit Profile Dilution
keywords: credit inquiry overload
keywords: multi-platform borrowing
keywords: credit report dilution
keywords: credit file pollution
keywords: credit hungry
keywords: loan application spree
keywords: credit data contamination
keywords: credit profile damage
usage example: His credit is completely messed up now, so all legitimate platforms reject him. He can only go to shady brokers for a long shot, which just makes his credit worse until he's totally blacklisted.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Debt Relief Scam
type: Term
break id: T0064
stix type: x-break-term
definition: An illicit agency service that fraudulently profits under the guise of debt optimization, using methods like document forgery and malicious complaints.
description: Under the pretext of 'legal aid,' fraud rings offer agency services for debt relief, such as stopping interest accrual or negotiating installment plans. They pressure financial institutions by forging documents like poverty certificates or hospital records, and even instigate clients to default maliciously. This operation not only defrauds clients of high service fees but also exposes financial institutions to compliance risks, undermining the normal credit order.
category: Credit Fraud
keywords: Debt Relief Scam
keywords: debt consolidation scam
keywords: debt relief agent
keywords: debt negotiation fraud
keywords: debt settlement scam
keywords: debt restructuring fraud
keywords: counter-collection
keywords: debt fixer
keywords: debt adjustment scam
usage example: He paid a broker ten thousand for debt optimization, which just meant the broker forged fake hardship documents to negotiate with the bank. In the end, the bank called the police, and all his accounts were frozen.
related risks: Anti-Collection Risk
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: Credit Fraud: Exposing the Underground Industry Behind Illegal Proxy Rights-Protection Schemes
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Straw Borrower
type: Term
break id: T0065
stix type: x-break-term
definition: A professional debt mule is an individual recruited by fraud rings to take out loans under their own name in exchange for a small cut of the proceeds, while bearing full liability for the debt.
description: These individuals typically have clean credit histories but are in urgent need of money. After being coached by fraud intermediaries, they apply for auto loans, mortgages, personal credit, or business loans in their own name. Once the funds are disbursed, the bulk of the money is siphoned off by the orchestrating gang, leaving the debt mule with a small share while they shoulder the entire debt burden and credit damage. This scheme is common in organized loan fraud, ultimately resulting in bad debt for financial institutions and legal liability and credit ruin for the mule.
category: Credit Fraud
keywords: Straw Borrower
keywords: debt mule
keywords: credit mule
keywords: loan proxy
keywords: debtor for hire
keywords: debt assumption fraud
keywords: credit rental
keywords: debt dummy
keywords: loan stand-in
usage example: Lao Liu was taken by a fellow villager to another city to sign several mortgage loan contracts, becoming a professional Straw Borrower. His name was instantly saddled with 2 million yuan in housing debt, for which he only received 30,000 yuan, while the real buyer had already mortgaged the property and fled with the cash.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Exposing Malicious Loan Brokers
citation: 2024 H1 Credit Fraud Risk Landscape Report
updated: 2026-06-16
version: 1

Leaked Data
type: Term
break id: T0075
stix type: x-break-term
definition: In the context of the underground industry, broadly refers to various types of sensitive data illegally obtained and used for profit.
description: This data encompasses personal information, corporate secrets, login credentials, and more, serving as the foundational resource for online fraud, unauthorized transactions, and marketing scams. Within the underground supply chain, this data is often resold multiple times, processed from raw data into refined, high-value data, and ultimately used by downstream criminal groups for monetization.
category: Data Leakage
keywords: Leaked Data
keywords: data dump
keywords: breach data
keywords: leaked PII
keywords: stolen database
keywords: compromised records
keywords: exfiltrated data
keywords: leaked credentials
keywords: data leak
usage example: A black-market operator posted on a dark web forum selling a batch of freshly "stripped" first-hand Leaked Data containing names, phone numbers, and four-element bank card details, claiming the data was highly fresh and could be used directly for precision scams.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related threat actors: Data Brokers
related threat actors: Personal Data Traffickers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Resold Data
type: Term
break id: T0075-001
stix type: x-break-term
definition: Second-hand data refers to personal or corporate data that has been resold one or more times in illicit data trading markets.
description: Due to repeated reselling, this data often suffers from missing fields, outdated information, or tampering, significantly reducing its accuracy and validity. In the underground supply chain, second-hand data is typically used for broad-stroke scams or low-quality marketing campaigns. Its trading price is far lower than that of fresh data, and buyers are usually downstream fraudsters with limited budgets.
category: Data Leakage
keywords: Resold Data
keywords: recycled data
keywords: data reseller
keywords: aged data
keywords: secondhand data
keywords: data resharing
keywords: data repackaging
keywords: data re-brokering
keywords: data resale
usage example: A buyer tried to save money by purchasing a batch of cheap Resold Data, only to find that when they called, the numbers were either disconnected or already flagged for fraud. They realized the data had been resold multiple times and was already "washed out" by competitors.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Broad-Sweep Data
type: Term
break id: T0075-002
stix type: x-break-term
definition: Bulk data refers to a broad, unfiltered collection of personal information with low precision, traded in illicit data markets.
description: This type of data usually comes from messy sources and contains a high volume of invalid, duplicate, or erroneous records, lacking any specific targeting. After purchasing bulk data, fraudsters often need to invest additional effort in cleaning and filtering before it can be used for scams or marketing. Due to its extremely low conversion rate, bulk data is cheap on the market and is commonly used for low-level attacks such as mass phishing SMS blasts.
category: Data Leakage
keywords: Broad-Sweep Data
keywords: unfiltered data
keywords: raw data dump
keywords: unverified data
keywords: bulk data
keywords: data sweep
keywords: untargeted data
keywords: data trawling
keywords: broad data scrape
usage example: A novice scammer, seeking convenience, bought a batch of Broad-Sweep Data. Upon opening it, they found it contained only the ID numbers of all residents in a certain province, without even a phone number attached, making it completely unusable directly and requiring further processing.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Refreshed Data
type: Term
break id: T0075-003
stix type: x-break-term
definition: Refurbished data refers to old data that has been processed and disguised as new data in illicit data trading.
description: Fraudsters repackage outdated data by supplementing it with fabricated information, altering timestamps, or deduplicating records. On the surface, this data appears fresh and valid, but the core information is stale, often leading to failed scams or blocked marketing efforts when used by buyers. Refurbished data is commonly used to deceive downstream buyers by passing off inferior goods as high-quality, reaping excessive profits.
category: Data Leakage
keywords: Refreshed Data
keywords: data laundering
keywords: data refresh
keywords: data reconditioning
keywords: data repurposing
keywords: data reactivation
keywords: data rejuvenation
keywords: data revalidation
keywords: data re-aging
usage example: A seller repackaged old, unsold data from last year, mixing in some fabricated recent transaction records, and sold it as Refreshed Data on the dark web, claiming it was freshly leaked internal bank data.
related risks: Metric Manipulation / Ranking Fraud
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Subsidy Recipient Data
type: Term
break id: T0075-004
stix type: x-break-term
definition: Subsidy data refers to personal information related to recipients of government poverty alleviation programs, traded in illicit data markets.
description: This data typically contains detailed identity, address, and subsidy information of low-income individuals, illegally obtained and resold by underground actors. Downstream buyers exploit this data to carry out targeted scams against vulnerable groups with weak awareness, such as impersonating poverty alleviation offices to issue fake subsidies. Due to the high authenticity of the data, such scams have a high success rate and cause severe social harm.
category: Data Leakage
keywords: Subsidy Recipient Data
keywords: welfare data
keywords: benefits data
keywords: subsidy list
keywords: aid recipient data
keywords: low-income data
keywords: public assistance data
keywords: relief data
keywords: grant recipient data
usage example: A black-market ring specifically compiled a batch of Subsidy Recipient Data, precisely tagging the information of farmers who had just received subsidies. They then posed as poverty alleviation officials, calling to perpetrate targeted fraud under the guise of distributing follow-up benefits.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Overnight Data
type: Term
break id: T0075-005
stix type: x-break-term
definition: Aged data refers to data that attackers deliberately delay selling for a period after exfiltrating it, in illicit data trading.
description: To evade risk tracking or wait for the heat to die down, attackers hoard freshly stolen data for a while before releasing it onto the black market. This delayed transaction severely lags the discovery of and response to the data breach, causing victims to suffer ongoing losses often without their knowledge. Aged data is frequently used for highly targeted scams and is favored by underground actors for its strong stealth.
category: Data Leakage
keywords: Overnight Data
keywords: delayed data release
keywords: data embargo
keywords: data holdback
keywords: stale data
keywords: data aging
keywords: delayed breach sale
keywords: data warehousing
keywords: data time delay
usage example: After breaching an e-commerce platform, the attackers did not immediately sell the data. Instead, they deliberately stockpiled a batch of Overnight Data, slowly releasing it only after the platform patched the vulnerability, both evading detection and fetching a higher price.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Stock Investor Data
type: Term
break id: T0075-006
stix type: x-break-term
definition: Investor data refers to personal information specifically tailored for targeting stock investors, traded in illicit data markets.
description: This data precisely targets high-net-worth or active retail investors and contains sensitive information such as investment preferences and portfolio holdings. Fraud rings use this data to carry out stock recommendation scams, pump-and-dump schemes, and other illegal activities, with single fraud amounts often being substantial. Due to its high conversion rate and strong monetization potential, investor data is a high-value commodity in darknet trading.
category: Data Leakage
keywords: Stock Investor Data
keywords: investor leads
keywords: retail investor PII
keywords: high-net-worth data
keywords: active trader profiles
keywords: investor fullz
keywords: stock trader intel
keywords: wealth management targets
keywords: investor database
usage example: A brokerage sales department just leaked a batch of Stock Investor Data containing investors' holding amounts and risk preferences. Armed with this information, scammers precisely promoted fake margin financing and pig-butchering stock recommendations, achieving a high success rate.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Skimmed Card Data
type: Term
break id: T0075-007
stix type: x-break-term
definition: Track data refers to bank card magnetic stripe information obtained through skimming devices installed on compromised POS terminals, traded in illicit data markets.
description: By implanting skimming modules in POS terminals, fraudsters steal magnetic stripe data and PINs from bank cards. This data is extremely precise and can be directly used to clone cards for fraudulent transactions or sold to downstream gangs for telecom fraud. Track data is core financial information, and its leakage directly threatens the financial security of cardholders.
category: Data Leakage
keywords: Skimmed Card Data
keywords: POS skimming data
keywords: skimmed track2
keywords: dumps with PIN
keywords: compromised terminal data
keywords: skimmer logs
keywords: magstripe dump
keywords: track data
keywords: skimmed fullz
usage example: A convenience store cashier, while a customer was distracted, swiped their card an extra time on the POS terminal, skimming the track data and selling it to a counterfeit card ring. The gang then worked overnight to clone multiple cards and frantically withdrew cash from ATMs.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Fresh Data
type: Term
break id: T0075-008
stix type: x-break-term
definition: In illicit data trading, refers to personal or organizational information that is still valid and can be immediately used for fraudulent activities.
description: This type of data is typically the latest leaked or stolen first-hand information, not yet resold multiple times, and has a high verification success rate. After purchasing it, underground practitioners can directly use it for targeted scams, unauthorized transactions, or account takeovers without additional cleaning. Due to its timeliness, its price on dark web forums and Telegram groups is significantly higher than that of expired data.
category: Data Leakage
keywords: Fresh Data
keywords: live data
keywords: fresh fullz
keywords: active PII
keywords: verified leads
keywords: recent breach data
keywords: fresh dump
keywords: live account info
keywords: valid credentials
usage example: A dark web seller emphasized that the batch in their hands was Fresh Data, where every phone number could be reached and the recipients had recently applied for loans. The success rate for impersonating customer service scams was extremely high, so the price had tripled.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Precision Data
type: Term
break id: T0075-009
stix type: x-break-term
definition: In illicit data trading, refers to personal information or account credentials that have been meticulously filtered and verified, possessing extremely high authenticity.
description: This data often includes detailed contact information, asset status, or specific consumption records, cleaned and annotated by specialized groups. Fraudsters exploit its high accuracy to conduct targeted phishing or business fraud, with success rates far exceeding ordinary data. In underground market transactions, this data is often sold at a high price per record and is a core tool leading to substantial financial losses.
category: Data Leakage
keywords: Precision Data
keywords: verified fullz
keywords: high-quality leads
keywords: enriched PII
keywords: targeted data
keywords: premium intel
keywords: curated dataset
keywords: validated profiles
keywords: high-value targets
usage example: In the underground data market, brokers aggressively pitch this "Precision Data," claiming it contains the ID numbers, phone numbers, and exact purchase amounts of high-end property owners, with each record directly usable for customized fraud.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Niche Data
type: Term
break id: T0075-010
stix type: x-break-term
definition: In illicit data trading, refers to personal or corporate information with low market demand that is difficult to monetize.
description: This data may be of little interest to underground practitioners due to the target group's weak purchasing power, outdated information, or narrow application scenarios. Such data is often sold off cheaply in bulk or bundled with other high-value data, used to fill databases or for low-cost, wide-net scams.
category: Data Leakage
keywords: Niche Data
keywords: low-demand data
keywords: specialty intel
keywords: obscure datasets
keywords: limited-use profiles
keywords: niche targets
keywords: uncommon PII
keywords: specialized leads
keywords: low-volume data
usage example: On a hacker forum, someone is dumping a batch of corporate registration data at a low price, but it attracts few buyers because this "Niche Data" can't be used for direct theft or precise marketing, making it very slow to resell.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Raw Data
type: Term
break id: T0075-011
stix type: x-break-term
definition: In illicit data trading, refers to raw, leaked data that has not been cleaned, filtered, or categorized.
description: This data typically contains a large amount of redundant, duplicate, or invalid information, making direct use highly inefficient. Data brokers or technical groups in the underground economy purchase this raw data, clean and process it through methods like credential stuffing and cross-referencing, extract valid fields, and then resell it at a markup to downstream fraud or marketing teams.
category: Data Leakage
keywords: Raw Data
keywords: unprocessed data
keywords: unfiltered dump
keywords: raw intel
keywords: unsorted records
keywords: dirty data
keywords: unrefined PII
keywords: bulk raw data
keywords: uncleaned leak
usage example: The freshly dumped "Raw Data" is chaotic, filled with invalid numbers and formatting errors. It requires cleaning and filtering to become usable precision data, but its main advantage is the low price.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Maternal-and-Infant Data
type: Term
break id: T0075-012
stix type: x-break-term
definition: In illicit data trading, refers to personal information and consumption data related to pregnant women, new mothers, and infants.
description: This data includes maternal health records, infant birth registrations, and baby product purchase lists, leaked from channels such as hospitals and e-commerce platforms. After acquiring it, underground groups resell it to confinement centers and photography studios for telemarketing harassment, or directly use it for targeted scams impersonating medical staff.
category: Data Leakage
keywords: Maternal-and-Infant Data
keywords: pregnancy data
keywords: new parent leads
keywords: baby product records
keywords: maternity PII
keywords: newborn intel
keywords: mom-and-baby profiles
keywords: infant data
keywords: parenting targets
usage example: A fraud ring purchased "Maternal-and-Infant Data" and then posed as obstetricians calling new mothers, accurately providing the baby's birth date and home address to pitch expensive postpartum recovery packages.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Domestic Fullz
type: Term
break id: T0075-013
stix type: x-break-term
definition: In illicit data trading, refers to the four core pieces of information for a domestic bank card: the card number, password, cardholder's ID number, and linked mobile phone number.
description: These four pieces of data are critical for conducting unauthorized transactions, money laundering, and account takeovers, typically obtained through phishing sites, trojans, or system vulnerabilities. Underground groups use them to directly transfer funds or register fake accounts for money laundering through transaction splitting, posing a direct threat to personal financial security.
category: Data Leakage
keywords: Domestic Fullz
keywords: CVV fullz
keywords: cardholder data
keywords: bank card intel
keywords: full card details
keywords: card PII
keywords: account takeover data
keywords: carding fullz
keywords: cardholder profiles
usage example: In an underground trading group, someone is selling "Domestic Fullz," claiming it contains complete domestic bank card details. The card number, password, ID number, and linked phone number all match perfectly, usable directly for money laundering.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Identity Document Set (4-Piece)
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Real-Time Data
type: Term
break id: T0075-014
stix type: x-break-term
definition: Refers to freshly stolen, first-hand personal or organizational data that has not been resold, commanding the highest price on the black market due to its timeliness.
description: Real-time material emphasizes data freshness and immediate usability, often sourced from recent system intrusions, insider leaks, or phishing harvests. Black-market actors quickly distribute it through automated card-selling platforms or darknet groups, aiming to monetize it before it becomes obsolete. Buyers typically use it for real-time fraud, credential-stuffing attacks, or registering malicious accounts, as shorter delays yield higher success rates.
category: Data Leakage
keywords: Real-Time Data
keywords: fresh fullz
keywords: first hand fullz
keywords: live data feed
keywords: fresh logs
keywords: fresh data dump
keywords: recent breach data
keywords: new stolen data
usage example: Freshly generated "Real-Time Data" is the most sought-after on the black market because the victim hasn't had time to change passwords or report the card lost, allowing criminals to immediately log into online banking for transfers.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related attack tools: Card Vending Platforms
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Dead Data
type: Term
break id: T0075-015
stix type: x-break-term
definition: In illicit data trading, refers to personal or organizational data that has expired and can no longer be exploited, regarded as worthless inventory within the black market.
description: Dead material loses its utility due to age, information changes, or upgraded platform risk controls, such as deactivated phone numbers, frozen bank cards, or invalid login credentials. This data finds no buyers on the market and is sometimes mixed into data packs to deceive inexperienced downstream purchasers. Once identified as dead material, it is typically discarded and cannot be used in subsequent fraud or marketing operations.
category: Data Leakage
keywords: Dead Data
keywords: aged fullz
keywords: expired fullz
keywords: old logs
keywords: recycled data
keywords: dead fullz
keywords: invalid records
keywords: stale data dump
usage example: The credit cards in this "Dead Data" batch are already frozen, and the phone numbers are disconnected. Within underground circles, it's treated as garbage inventory to clear out, with no value even for bundled resale.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

International Fullz
type: Term
break id: T0075-016
stix type: x-break-term
definition: Refers to four types of overseas bank card information—card number, password, cardholder ID number, and linked phone number—known in the black market as “foreign material” or “CVV fullz.”
description: Foreign material primarily originates from data breaches involving overseas cards, including phishing sites, payment interface hijacking, or darknet database dumps. Black-market actors sell these full sets to downstream buyers for cross-border carding, fraudulent transactions, or impersonation-based telecom fraud. Due to the involvement of overseas cards, tracing is difficult, and the laundering process often integrates with underground money-transfer platforms, making the cash-out path covert. Once such information enters the market, cardholders face direct financial loss and identity theft risks.
category: Data Leakage
keywords: International Fullz
keywords: CVV fullz
keywords: overseas card fullz
keywords: non-resident fullz
keywords: foreign card dump
keywords: international card data
keywords: cross-border fullz
keywords: offshore card info
usage example: A darknet vendor displayed a batch of "International Fullz," containing overseas Visa and Mastercard numbers, expiry dates, and CVV codes, claiming they could bypass risk control systems to directly purchase from luxury goods sites abroad.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Identity Document Set (4-Piece)
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

First-Hand Data
type: Term
break id: T0075-017
stix type: x-break-term
definition: Refers to personal or organizational data obtained directly from the breach source without any intermediary resale, commanding a premium in black-market trading due to its high integrity.
description: First-hand material avoids the contamination and adulteration caused by multiple resales and typically comes directly from data sources such as insiders, system vulnerabilities, or real-time phishing results. Black-market actors prioritize using first-hand material for high-value fraud or precision marketing because its completeness and strong correlations yield much higher conversion rates than second-hand material. Sellers often advertise “first-hand supply” to attract buyers, though actual transactions may include dead or duplicate data to inflate volumes.
category: Data Leakage
keywords: First-Hand Data
keywords: unresold data
keywords: fresh dump
keywords: private data leak
keywords: exclusive leak
keywords: direct breach data
keywords: unshared fullz
keywords: zero-day data leak
usage example: An informant directly provided "First-Hand Data" leaked from a courier company's internal system. The recipient phone numbers and addresses have never been resold, offering extremely high completeness, so the asking price is several times that of ordinary waybills.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Stock Advisory Lead Data
type: Term
break id: T0075-018
stix type: x-break-term
definition: In illicit data trading, refers to sensitive customer information illegally obtained from stock investment platforms or advisory firms, known in the black market as “stock advisory material.”
description: This data covers personal identities, transaction records, portfolio preferences, and contact details, often leaked by internal employees or obtained through system intrusions. Black-market actors resell stock advisory material to investment scam rings, illegal margin-trading platforms, or precision marketing agencies, who use it for fraudulent investment inducement, fake stock recommendations, or charging exorbitant service fees. Victims are easily misled into believing the scammers are legitimate advisors due to the precise matching of their personal investment profiles, ultimately resulting in financial loss.
category: Data Leakage
keywords: Stock Advisory Lead Data
keywords: stock investor leads
keywords: investment client data
keywords: brokerage data leak
keywords: trading account data
keywords: investor PII
keywords: financial advisory leak
keywords: stock tip leads
usage example: An insider at an investment advisory firm sold the client list to underground groups. This "Stock Advisory Lead Data" details users' holding amounts and risk appetite, making it the perfect bait for recommending fake investment platforms.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

IOU App Data
type: Term
break id: T0075-019
stix type: x-break-term
definition: A data package from high-interest or private lending containing signed IOUs, personal identity information, and contact details of borrowers.
description: This data typically leaks from illegal lending platforms or private loan shark groups and contains detailed borrower privacy information. After acquisition, underground actors use it for secondary fraud, aggressive debt collection, or resale to other criminal groups. Victims are highly susceptible to scams due to the data's authenticity and the debt relationship involved.
category: Data Leakage
keywords: IOU App Data
keywords: Loan data
keywords: Debtor info
keywords: Private lending data
keywords: Borrower records
keywords: Lending app leak
keywords: Debt collection data
keywords: Loan application data
usage example: "Selling real-time IOU data, risk-control data, high volume, guaranteed first-hand source, good price"
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Risk-Control Data
type: Term
break id: T0075-020
stix type: x-break-term
definition: A collection of user data leaked from financial platform risk-control systems, containing preliminary analysis and risk tags.
description: This data often includes sensitive information such as credit ratings, spending habits, and risk labels, leaked by insiders or third-party service providers. Underground actors use these precise profiles for customized marketing fraud, loan scams, and other illegal activities. Its targeted nature leads to a much higher scam success rate compared to random attacks.
category: Data Leakage
keywords: Risk-Control Data
keywords: Credit scoring data
keywords: User profiling
keywords: Financial profiling
keywords: Creditworthiness data
keywords: Borrower risk data
keywords: Loan applicant data
keywords: Underwriting data
usage example: "Selling real-time IOU data, risk-control data, high volume, guaranteed first-hand source, good price."
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: User Profiling
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Loan-Lead Data
type: Term
break id: T0075-021
stix type: x-break-term
definition: A complete set of loan applicant documents leaked from online lending platforms, including ID cards, bank cards, and credit reports.
description: This data is leaked internally from loan facilitation platforms or financial institutions, classified by credit rating by underground brokers, and sold at a premium. Downstream fraud rings purchase it to impersonate platform customer service and conduct secondary scams under the guise of 'unfreezing fees' or 'security deposits.' The detailed loan information makes these scams highly deceptive.
category: Data Leakage
keywords: Loan-Lead Data
keywords: Loan applicant data
keywords: Loan application leak
keywords: Borrower PII
keywords: Loan origination data
keywords: Lending platform leak
keywords: Applicant records
keywords: Loan broker data
usage example: "Various loan application data, welcome to inquire"
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Real-Name Identity Verification
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Gold-Installment Data
type: Term
break id: T0075-022
stix type: x-break-term
definition: Refers to user information from small, illegal cash-out platforms that support gold purchases with installment repayments, known as 'gold material' in underground data markets.
description: These platforms use gold purchases as a front to help users obtain cash, charging high handling fees. Black-market actors compile the personal information of users involved in cash-outs and sell it as 'gold material.' This data is often used for secondary scams, where victims not only face financial loss but may also become entangled in legal disputes due to the cash-out activity.
category: Data Leakage
keywords: Gold-Installment Data
keywords: Gold installment data
keywords: Gold loan data
keywords: Gold collateral loan
keywords: Gold purchase data
keywords: Gold-backed loan
keywords: Gold pawn data
keywords: Gold financing data
usage example: Underground groups targeted user data from small-amount gold installment platforms, selling this "Gold-Installment Data" to debt collection crews because the users are mostly desperate, debt-ridden young people with extremely high collection value.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Subsidy Fraud Leads
type: Term
break id: T0075-023
stix type: x-break-term
definition: Refers to personal information related to recipients of poverty alleviation subsidies, illegally obtained by black-market actors for targeted scams or money laundering.
description: Black-market actors steal the identities, contact details, and subsidy specifics of aid recipients through insider moles or system vulnerabilities. This data is resold to fraud rings, who impersonate government officials and defraud victims under the pretense of distributing subsidies. Due to the precision of the information, victims are often highly convinced, leading to the theft of funds intended for poverty relief.
category: Data Leakage
keywords: Subsidy Fraud Leads
keywords: subsidy data leak
keywords: poverty relief data
keywords: government assistance data
keywords: welfare fraud leads
keywords: subsidy scam data
keywords: social benefit data breach
keywords: aid recipient data
keywords: subsidy phishing leads
usage example: 'Bosses needing pyramid scheme material, poverty alleviation material, or courier material, contact me! Suit-and-tie big shots, V-push, telemarketing, data, SDK real-time daily active high-quality data!'
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Air Ticket Booking Data
type: Term
break id: T0075-024
stix type: x-break-term
definition: Refers to complete flight booking data leaked from airline systems, containing sensitive information such as passenger names, ID numbers, and flight numbers.
description: This data is typically leaked by insiders within ticketing systems or stolen through hacking. After purchasing it, fraud rings impersonate airline customer service agents, tricking victims into transferring money under the pretext of flight cancellations, rebookings, or refunds. The success rate of such scams is extremely high because the scammers can accurately provide the flight details.
category: Data Leakage
keywords: Air Ticket Booking Data
keywords: flight booking data
keywords: PNR leak
keywords: airline ticket leak
keywords: travel itinerary data
keywords: flight confirmation data
keywords: passenger data breach
keywords: airline booking scam
keywords: flight data dump
usage example: 'Selling undeparted flight ticket material'
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Device-Rental Data
type: Term
break id: T0075-025
stix type: x-break-term
definition: Refers to user order data leaked from phone rental platforms, including phone models, rental periods, repayment records, and personal identity information.
description: Black-market actors obtain this data by infiltrating rental platform backends or bribing insiders. Buyers use this information for targeted marketing to rental users or to impersonate platform customer service for scams. This data can also be used for malicious debt collection or to screen users with financial needs for secondary fraud.
category: Data Leakage
keywords: Device-Rental Data
keywords: device rental leak
keywords: phone rental data
keywords: rental order data
keywords: device leasing data
keywords: rental user data
keywords: gadget rental leak
keywords: rental platform data
keywords: device financing data
usage example: 'Need phone rental material, next-day real-time device data, can test, contact me'
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Gift-Card Installment Data
type: Term
break id: T0075-026
stix type: x-break-term
definition: Refers to user information from small cash-out platforms that support purchasing E-cards or gift cards with installment repayments, illegally traded as 'card voucher material' or 'E-card material.'
description: These platforms allow users to buy virtual cards and resell them for cash, essentially functioning as illegal lending operations. Black-market actors collect the data of users involved in these cash-outs and package it for sale. This data is often used to promote other illicit lending products or to conduct targeted scams against the users.
category: Data Leakage
keywords: Gift-Card Installment Data
keywords: gift card data
keywords: E-card data
keywords: virtual card data
keywords: installment card data
keywords: card installment leak
keywords: prepaid card data
keywords: gift card dump
keywords: card installment data
usage example: Fraudsters use the user information from "Gift-Card Installment Data," posing as platform customer service and luring users with card recycling and cash-out offers to provide SMS verification codes, thereby stealing from their linked bank cards.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Waybill Data
type: Term
break id: T0079
stix type: x-break-term
definition: In illicit data trading, refers to leaked detailed records from express delivery logistics.
description: These records contain the recipient's name, phone number, address, and purchased item details, serving as a crucial information source for targeted marketing and fraud within the underground economy. This data is typically leaked by insiders at courier companies or through system vulnerabilities, sold in bulk by data brokers, and used for brushing, telecom fraud, or selling counterfeit goods.
category: Data Leakage
keywords: Waybill Data
keywords: shipping labels
keywords: courier records
keywords: package data
keywords: delivery intel
keywords: parcel details
keywords: shipping manifest
keywords: logistics leak
keywords: consignee PII
usage example: Insiders at courier stations secretly photograph "Waybill Data" and sell it in bulk. These images clearly record the recipient's name, phone number, and home address from the package, serving as the foundational data for precision scams.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Customs Data
type: Term
break id: T0081
stix type: x-break-term
definition: In illicit data trading, refers to personal or logistics data stolen during the customs clearance of overseas shipments, packaged and sold as “customs clearance material.”
description: This type of data typically leaks through cross-border logistics processes and includes sensitive information such as recipient identity, addresses, and phone numbers. Black-market actors intercept data at customs clearance nodes via insiders or system vulnerabilities, then sort and sell it based on freshness and completeness. Downstream buyers often use it for precision fraud, marketing harassment, or identity theft. Due to its high timeliness, this data can be monetized quickly in the short term.
category: Data Leakage
keywords: Customs Data
keywords: customs clearance data leak
keywords: customs record dump
keywords: shipment data breach
keywords: import export data leak
keywords: customs info sale
keywords: border clearance data
keywords: customs PII leak
usage example: After customs data leaked, underground groups packaged overseas shoppers' ID photos and detailed addresses as "Customs Data," selling it specifically to fraud rings posing as customs officials processing returns.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Redirect / Oauth Account
type: Term
break id: T0084
stix type: x-break-term
definition: Refers to Weibo, WeChat, or QQ accounts whose core functions have been restricted by the platform but can still be used to authorize logins on other platforms, sold cheaply by black-market actors for secondary exploitation.
description: These accounts have typically been flagged for bulk activity, bonus abuse, or malicious registration, resulting in restrictions on posting, payments, and other core functions. However, their authorization login interfaces remain functional, allowing black-market actors to package them as “redirect accounts” and sell them to bypass registration barriers on other platforms. Buyers use these accounts for operations such as astroturfing, traffic diversion scams, or cross-platform bonus harvesting, benefiting from low costs and delayed bans.
category: Data Leakage
keywords: Redirect / Oauth Account
keywords: OAuth account
keywords: authorized login account
keywords: social media auth account
keywords: platform auth bypass
keywords: pre-authorized account
keywords: tokenized account
keywords: bound account
usage example: Scammers bought a batch of "Redirect / Oauth Accounts," which are Weibo accounts with restricted functionality, and exploited their ability to still authorize logins on other platforms to mass-register fake accounts for astroturfing and comment manipulation.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Dating Data
type: Term
break id: T0086
stix type: x-break-term
definition: In illicit data trading, refers to user personal information packages illegally obtained from dating or matchmaking platforms, internally called “dating material.”
description: Dating material typically includes personal profiles, contact details, photos, and dating preferences, often leaked by insiders or harvested via web scraping. Black-market actors categorize and sell this data by age, location, and asset status to marketing gangs or fraud rings. Downstream buyers frequently use it to carry out “pig-butchering” scams, emotional manipulation, or targeted matchmaking service promotions, exploiting the data’s high authenticity to lower victims’ defenses.
category: Data Leakage
keywords: Dating Data
keywords: dating site leak
keywords: dating profile dump
keywords: romance scam leads
keywords: dating app data
keywords: matchmaking data leak
keywords: dating record sale
keywords: dating PII dump
usage example: "Dating Data" leaked from a well-known matchmaking site circulates on the black market, containing the real annual salaries and partner preferences of many middle-class single women, which is precisely targeted for pig-butchering scam scripts.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
related business scenes: BS01
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Record Lookup
type: Term
break id: T0089
stix type: x-break-term
definition: A service in which underground criminal groups illegally retrieve a target's complete personal dossier using a single piece of information, such as a phone number.
description: File retrieval is a core service in underground data trading. Criminals leverage insider access, system vulnerabilities, or previously breached databases to provide clients with detailed personal records. The service covers highly sensitive data, including identity information, bank card numbers, asset holdings, and hotel stay records. Typically charged per query, this service is a critical source of intelligence for downstream crimes such as fraud, extortion, and precision marketing.
category: Data Leakage
keywords: Record Lookup
keywords: data lookup service
keywords: PII search
keywords: doxing service
keywords: personal record search
keywords: background check illegal
keywords: info retrieval service
keywords: data broker lookup
usage example: By providing just a phone number, underground groups can use a "Record Lookup" service to pull a target's household registration, marital status, and even hotel stay records, a deep privacy violation service typically charged per query.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Decryption
type: Term
break id: T0090
stix type: x-break-term
definition: An operation in which criminals restore full phone numbers from partially masked information on privacy-enhanced express delivery waybills.
description: Decryption services primarily serve telecom fraud rings and underground marketing operations, forming a critical link in the express information leakage chain. Operators illegally obtain waybill numbers and their corresponding virtual or masked phone numbers, then restore the full number using internal system access or cracking tools. Once obtained, the complete phone numbers are used for precision scams, advertising, or resale, directly violating user privacy.
category: Data Leakage
keywords: Decryption
keywords: phone unmasking
keywords: shipment label decrypt
keywords: tracking number decrypt
keywords: masked number reveal
keywords: virtual number decrypt
keywords: logistics data decrypt
keywords: privacy label bypass
usage example: Using "Decryption" technology, underground groups target the last four digits of phone numbers visible on waybills. By combining the tracking number pattern with an algorithm, they can reconstruct the full 11-digit phone number in seconds.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Doxing
type: Term
break id: T0091
stix type: x-break-term
definition: The act of illegally obtaining and publicly exposing an individual's private data, carried out by underground actors.
description: Doxing is a common malicious exposure tactic in the cyber underground, typically conducted in anonymous group chats or on social platforms. Perpetrators aggregate fragmented information from social engineering databases, leaked data dumps, and other sources to assemble a complete dossier, including ID numbers, home addresses, social connections, and financial records. Often motivated by revenge, notoriety, or extortion, this practice poses a severe threat to the victim's personal safety and reputation.
category: Data Leakage
keywords: Doxing
keywords: dox
keywords: doxx
keywords: doxing attack
keywords: doxxing campaign
keywords: doxing operation
keywords: doxing group
keywords: doxing chat
keywords: doxing forum
usage example: A fandom dispute escalated into cyber violence, with someone hiring underground groups to conduct "Doxing" against an ordinary blogger, publicly posting their real name, home address, and their minor child's school information online.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Database Operator
type: Term
break id: T0092
stix type: x-break-term
definition: A key figure in underground data trading who owns and operates large-scale databases of leaked information.
description: The database owner is a top-tier role in the underground data ecosystem, responsible for illegally acquiring, organizing, and continuously updating various social engineering and credential-stuffing databases. By purchasing data from material suppliers or conducting their own attacks, they amass vast amounts of sensitive information and offer query, subscription, or bulk sale services to data buyers. They build and maintain the core infrastructure of underground data trading and are the source of leaked data circulation.
category: Data Leakage
keywords: Database Operator
keywords: db operator
keywords: db owner
keywords: data broker
keywords: leaked database operator
keywords: database admin
keywords: underground db admin
keywords: db admin
usage example: This "Database Operator" holds hundreds of millions of leaked records and never directly engages in fraud. Instead, they act like a wholesaler, splitting and renting out different categories of databases to downstream fraud and trafficking rings.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Supplier
type: Term
break id: T0093
stix type: x-break-term
definition: A primary individual or organization in the underground supply chain that controls and sells first-hand leaked data in bulk.
description: The material supplier is the direct controller of the data breach source. They obtain fresh data through insider moles, hacking attacks, or vulnerability exploitation, then categorize and organize it. As the upstream source in underground trading, they wholesale data at high prices to downstream buyers, acting as the original supplier for various crimes like fraud and identity theft. They typically only handle the data supply and avoid direct involvement in end-user crimes to minimize their own risk.
category: Data Leakage
keywords: Data Supplier
keywords: data vendor
keywords: leak supplier
keywords: data wholesaler
keywords: fullz seller
keywords: data reseller
keywords: data source
keywords: leak provider
usage example: A Data Supplier on Telegram offered 5 million fresh transaction records from a major e-commerce platform for $20,000 after a data breach, including phone numbers and delivery addresses, claiming they were "absolutely fresh" and attracting numerous downstream buyers.
related risks: Insider-Outsider Collusion
related risks: Employee Policy Violations
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Malicious Insiders
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Buyer
type: Term
break id: T0094
stix type: x-break-term
definition: An individual or organization in the underground supply chain that purchases and uses leaked data for illegal activities.
description: The data buyer is the end consumer or secondary distributor in underground data trading. They purchase various types of data from material suppliers or data shops and convert it into actual criminal profit. Common downstream activities include financial fraud, bank card theft, social engineering attacks, or reselling the data. They are the direct executors of the harm caused by leaked data, turning the risk of information misuse into reality.
category: Data Leakage
keywords: Data Buyer
keywords: data purchaser
keywords: leak buyer
keywords: fullz buyer
keywords: data reseller
keywords: downstream buyer
keywords: data trafficker
keywords: info buyer
usage example: Police raiding a telecom fraud den discovered the gang acted as Data Buyers, purchasing express delivery label data from the dark web and making thousands of calls daily impersonating customer service for refunds to execute precise scams.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Marketplace
type: Term
break id: T0095
stix type: x-break-term
definition: A platform or site on the black market specifically for trading carding information, such as CVV data.
description: A carding shop is an online marketplace in the credit card fraud industry chain. Stocked by numerous material suppliers, it primarily sells 'material' containing card numbers, expiration dates, and CVV codes. Transactions are typically settled in cryptocurrency to evade oversight, with the shop itself providing escrow and arbitration services. Such platforms significantly lower the barrier to entry for carding crimes, allowing buyers without hacking skills to easily acquire criminal tools.
category: Data Leakage
keywords: Data Marketplace
keywords: CVV shop
keywords: carding shop
keywords: CVV store
keywords: carding marketplace
keywords: fullz shop
keywords: carding site
keywords: CVV market
usage example: A security team traced a batch of stolen credit card details back to a single Data Marketplace, which offered CVV data filterable by region with "auto-delivery and replacement guarantee" as a selling point, priced at just a few dozen yuan per record.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Fuzzy Lookup
type: Term
break id: T0096
stix type: x-break-term
definition: A technique used in social engineering databases to precisely locate a target's data by filtering results with auxiliary fields when only vague information like a name is known.
description: Demon hunting is a common query technique in social engineering databases. When an attacker only knows a target's name, they cross-reference the returned results with auxiliary information like birthdate, region, and gender. This method allows them to precisely filter a specific target's complete dossier from a massive pool of homonymous data. This technique is a critical step in executing precision scams and doxing.
category: Data Leakage
keywords: Fuzzy Lookup
keywords: lm lookup
keywords: fuzzy search db
keywords: fuzzy query
keywords: social engineering db
keywords: SE db
keywords: fuzzy data lookup
keywords: fuzzy record search
usage example: Using a Fuzzy Lookup in a social engineering database, an investigator targeted an individual known only as "Zhang Qiang," rapidly locking down his full ID number and home address by cross-referencing his former phone number and household registration fields.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Database Sale
type: Term
break id: T0097
stix type: x-break-term
definition: The practice of selling stolen databases in bulk through illicit channels.
description: Fraudsters package sensitive data—such as personal information, account credentials, and passwords—obtained through various means and sell them at fixed prices on dark web forums or encrypted chat groups. Sellers often exaggerate data freshness and accuracy to inflate prices, while buyers use the data for targeted scams, brute-force attacks, or resale. This activity directly fuels downstream crime and causes large-scale privacy breaches.
category: Data Leakage
keywords: Database Sale
keywords: db dump sale
keywords: leaked db sale
keywords: database dump
keywords: db leak sale
keywords: selling db
keywords: db vendor
keywords: leak dump
usage example: A hacking group compromised a hotel chain's management system, exporting tens of millions of stay records and listing the Database Sale on the dark web for 0.5 Bitcoin, claiming it contained private data of political and business celebrities.
related risks: Data Breach
related risks: Data Exfiltration Risk
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Forced Account Login
type: Term
break id: T0098
stix type: x-break-term
definition: The act of forcibly logging into user accounts using technical means to steal internal sensitive information.
description: Attackers exploit vulnerabilities or use credential-stuffing techniques to breach platform defenses and forcibly access user account backends, stealing order details, addresses, and other private data. This high-value information is then packaged and sold to downstream fraud or marketing groups. In data-trading advertisements, the term “forced login” is often used to indicate the data’s source and freshness.
category: Data Leakage
keywords: Forced Account Login
keywords: forced login
keywords: account takeover
keywords: forced access
keywords: ATO
keywords: unauthorized login
keywords: forced session
keywords: credential hijack
usage example: A cybercriminal gang used passwords obtained from credential stuffing for a Forced Account Login into high-value corporate emails, immediately searching for keywords like "contract" and "quotation" and forwarding messages to steal commercial secrets.
related risks: Credential Stuffing
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Credential Stuffing Tools
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Account Sweeping
type: Term
break id: T0099
stix type: x-break-term
definition: The illicit use of automated tools to test batches of credentials and filter out valid accounts.
description: Using previously leaked username-password combinations, fraudsters run scripts to attempt mass logins across multiple platforms, identifying usable accounts. These validated accounts can then be used to steal virtual assets, post illicit content, or serve as raw material for subsequent targeted scams. This practice severely threatens personal account and financial security.
category: Data Leakage
keywords: Account Sweeping
keywords: credential stuffing
keywords: account checker
keywords: account validator
keywords: combolist
keywords: combo list
keywords: account testing
keywords: credential testing
usage example: Attackers scripted an Account Sweeping operation against a video platform, using simple password combinations for bulk login attempts, cracking tens of thousands of valid accounts in an hour before selling them to fake engagement farms.
related risks: Credential Stuffing
related risks: Automated Login Risk
related risks: Bulk Account Enumeration
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Credential Stuffing Tools
related business scenes: BS00
citation: API Account Enumeration Has Become a Major Threat to Account Security
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Manual Data Extraction
type: Term
break id: T0100
stix type: x-break-term
definition: A downstream fraud tactic in which operators manually dial victims to conduct direct harassment or scams.
description: After acquiring personal information through illegal data trading, downstream marketing or fraud groups contact targets one by one via manual dialing. Compared to automated calls, this “manual dialing” approach is more flexible and is often used to carry out high-return targeted scams or aggressive telemarketing. Insiders use this term to evaluate data conversion performance.
category: Data Leakage
keywords: Manual Data Extraction
keywords: manual dialing
keywords: manual calling
keywords: manual outreach
keywords: hand dial
keywords: voice phishing
keywords: vishing call
keywords: manual dial campaign
usage example: After obtaining purchase records for elderly health supplements, downstream criminals used Manual Data Extraction by calling individuals one by one, posing as health consultants to feign concern and induce them to buy thousands of dollars' worth of fake "miracle cures."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Manual Poverty-Lead Harvesting
type: Term
break id: T0101
stix type: x-break-term
definition: The manual screening and collection of personal information specifically targeting recipients of poverty alleviation benefits.
description: Fraudsters pose as officials on social media or through offline channels, luring low-income individuals into providing sensitive information such as ID numbers and bank card details under the pretense of processing subsidies. The collected data is packaged and either used to apply for fraudulent relief funds or sold to other scam rings for targeted fraud, directly harming vulnerable groups.
category: Data Leakage
keywords: Manual Poverty-Lead Harvesting
keywords: poverty relief data
keywords: welfare recipient scraping
keywords: lead harvesting manual
keywords: social media scraping leads
keywords: poverty lead gen
keywords: manual data collection
keywords: aid beneficiary scraping
usage example: A gang dispatched members to infiltrate rural communities for Manual Poverty-Lead Harvesting under the guise of a "poverty alleviation survey," registering the ID numbers and bank card details of low-income residents door-to-door and compiling the data to sell to fraud rings.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Social Engineering Database
type: Term
break id: T0102
stix type: x-break-term
definition: An illicit, consolidated information database built by aggregating data leaked from multiple sources.
description: Fraudsters compile data from public records, database breaches, and social engineering to create a comprehensive repository containing personal identities, contact details, and social connections. Attackers use this database to quickly build detailed profiles of targets, enabling highly effective targeted fraud, extortion, or account takeover.
category: Data Leakage
keywords: Social Engineering Database
keywords: SE database
keywords: doxing database
keywords: combolist
keywords: creds database
keywords: PII warehouse
keywords: breach combo list
keywords: personal info dump
usage example: A former employee sold company HR system data to cybercriminals, which was then integrated into a massive Social Engineering Database where attackers could query associated social security, travel, and call records simply by entering a phone number.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Database Dump
type: Term
break id: T0103
stix type: x-break-term
definition: A hacking technique used to exfiltrate an entire database from a target server.
description: After gaining full access to a database through vulnerability exploitation, privilege escalation, or insider collusion, attackers download the entire database file. The stolen data typically contains massive volumes of user information and serves as the source for subsequent database sales and data laundering, causing irreparable damage to businesses and users.
category: Data Leakage
keywords: Database Dump
keywords: DB exfiltration
keywords: mass data theft
keywords: SQL dump
keywords: credential harvesting
keywords: insider data theft
keywords: privilege escalation dump
keywords: bulk extraction
usage example: Hackers exploited a web application vulnerability to infiltrate a recruitment site's backend, performing a Database Dump that stole 3 million resumes containing education, work history, and salary details, leading to widespread precision headhunting scams.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Cleaning
type: Term
break id: T0104
stix type: x-break-term
definition: The process of filtering, deduplicating, and formatting raw illegally obtained data.
description: Fraudsters clean up messy raw data by removing invalid, duplicate, or erroneous entries, transforming it into well-structured, ready-to-use “premium material.” Laundered data commands higher prices on the market and is often used for targeted scams or fraudulent loan applications, significantly boosting the efficiency of downstream crimes.
category: Data Leakage
keywords: Data Cleaning
keywords: data scrubbing
keywords: lead refinement
keywords: PII sanitization
keywords: deduplication
keywords: data normalization
keywords: raw data processing
keywords: lead validation
usage example: Data brokers purchased chaotic leaked data from multiple channels, then assigned personnel for Data Cleaning to remove duplicates and invalid fields, unifying the format and repackaging it as a "premium database" for resale at a high price.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Enrichment
type: Term
break id: T0105
stix type: x-break-term
definition: The process within underground operations of cleaning, filtering, and enriching leaked upstream data to enhance its utility for downstream exploitation.
description: Operators filter illegally obtained user information by removing invalid or inactive numbers and supplementing records with attributes such as geographic location and age demographics. This refined data enables downstream fraud or marketing groups to conduct highly targeted scams, significantly increasing their success rates. Such activities directly amplify the risk of secondary harm following a privacy breach.
category: Data Leakage
keywords: Data Enrichment
keywords: lead scoring
keywords: data append
keywords: demographic enrichment
keywords: phone validation
keywords: geo enrichment
keywords: lead filtering
keywords: data enhancement
usage example: A professional data enrichment gang purchased massive bank transaction records, then performed tiered filtering by asset balance and supplemented victims' social media accounts, dramatically increasing data precision for executing investment fraud schemes.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Bird Lead
type: Term
break id: T0107
stix type: x-break-term
definition: In the context of the 'bird-killing scam,' this term refers to individuals who are homebound, have limited social circles, and are easily deceived by offers of online income.
description: This demographic primarily includes students and homemakers who are eager to earn money through online side jobs but lack sufficient life experience. Fraudsters exploit this psychology, using lures like 'cashback for reviews' to trap them. Within the gang, this specific group of vulnerable individuals is collectively referred to as 'birds.'
category: Telecom Fraud
keywords: Bird Lead
keywords: homebound target
keywords: stay-at-home victim
keywords: online job seeker lead
keywords: task scam target
keywords: commission scam lead
keywords: remote victim profile
keywords: vulnerable lead
usage example: During the early lead generation phase of a Bird-Killing Scam, fraud rings specifically target students and stay-at-home mothers who frequently post part-time job searches, as these individuals with narrow social circles and a desire for quick money are considered ideal "birds."
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Bird Hooking
type: Term
break id: T0107-001
stix type: x-break-term
definition: Underground jargon used by fraud rings to mark a potential or successfully hooked victim as a target for ongoing exploitation.
description: The gang uses this tagging system to categorize and manage victims, allowing them to assign different operators for follow-up and deeper fraud attempts. This assembly-line management enables the gang to efficiently track the progress of a scam and ensure no exploitable target is overlooked. Once marked, the victim faces a continuous and customized series of deceptive attacks.
category: Telecom Fraud
keywords: Bird Hooking
keywords: victim tagging
keywords: target marking
keywords: lead labeling
keywords: scam target tracking
keywords: victim pool management
keywords: target acquisition
keywords: marking marks
usage example: In internal communications, fraud rings use "Bird Hooking" to mark victims who have submitted registration forms and shown strong willingness to participate, signaling they are ready for the next monetization phase.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Feeding the Bird
type: Term
break id: T0107-002
stix type: x-break-term
definition: A probing tactic where a fraudster sends a small amount of money or benefit to a targeted victim to build trust and verify the validity of their financial accounts.
description: Through this 'feeding' operation, the fraudster lulls the victim into a false sense of security, making them accustomed to receiving funds from the scammer. This action lays the groundwork for later inducing the victim into making a large investment or extracting their core financial information. Once the victim becomes dependent on these 'small gains,' they are far more likely to fall into a large-scale fraud trap.
category: Telecom Fraud
keywords: Feeding the Bird
keywords: trust seeding
keywords: micro-deposit lure
keywords: bait payment
keywords: account verification bait
keywords: trust building payout
keywords: small reward grooming
keywords: seed money scam
usage example: To dispel a college student's doubts about a fake brushing job, a scammer first transferred an 8-yuan commission as a sweetener; this Feeding the Bird tactic convinced the victim the tasks were genuine, leading them to invest a large sum of principal.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Intoxicated Bird
type: Term
break id: T0107-003
stix type: x-break-term
definition: A state of mind-control achieved through long-term cultivation of an emotional or trust-based relationship, causing the victim to completely lower their guard and become dependent on the fraudster.
description: Through meticulously planned, long-term communication, the fraudster makes the victim emotionally or financially subservient. A victim in this 'drunk bird' state loses their basic judgment and follows the fraudster's instructions without question. This deep level of brainwashing means the victim not only fails to resist but may even actively assist the fraudster.
category: Telecom Fraud
keywords: Intoxicated Bird
keywords: groomed victim
keywords: emotionally dependent target
keywords: romance scam victim
keywords: trust exploitation
keywords: financial dependency victim
keywords: scam grooming
keywords: brainwashed target
usage example: After three months of online romantic grooming, the victim fell into an Intoxicated Bird state, becoming completely obedient to her "boyfriend's" recommended gambling platform, investing all her savings and borrowing heavily without any sense of vigilance.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Bird-Killing Scam
type: Term
break id: T0108
stix type: x-break-term
definition: A fraud model targeting homebound individuals, using lures such as 'cashback for reviews' or 'high-paying part-time jobs' to trick victims into advancing their own funds or paying deposits.
description: After gaining trust with a small payout, the fraudster induces the victim to invest a large sum of principal, then refuses to return the money citing reasons like 'incomplete tasks.' This model relies heavily on social media platforms for lead generation and is one of the most prevalent types of telecom fraud. Victims often realize they have been scammed only after losing their entire savings.
category: Telecom Fraud
keywords: Bird-Killing Scam
keywords: task scam
keywords: commission fraud
keywords: like-and-earn fraud
keywords: deposit scam
keywords: advance fee task
keywords: fake job scam
keywords: piggyback scam
usage example: A stay-at-home mother saw an ad for "outsourced handcrafts earning 300 yuan daily" and was pulled into a Bird-Killing Scam, where the operator induced her to pay thousands in "material deposits" before immediately disappearing.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Successful Conversion
type: Term
break id: T0112
stix type: x-break-term
definition: Internal jargon within a fraud ring signifying the critical moment when a victim has taken the bait and is about to, or is in the process of, transferring money.
description: In the fraud context, the 'fish' represents the victim and 'water' is a metaphor for money. 'Out of water' means the fish has left the water, signifying the victim is fully trapped. This marks the final stage of the scam, where the gang focuses all efforts on inducing the victim to complete the transfer. This term signals that the fraud process has entered the substantive phase of financial harvesting.
category: Telecom Fraud
keywords: Successful Conversion
keywords: victim hooked
keywords: money about to be stolen
keywords: falling into trap
keywords: funds about to be taken
keywords: bait taken
keywords: conversion point
keywords: scam payout
keywords: victim conversion
usage example: The moment scammers see a victim entering a transfer verification code on the control panel, they signal a Successful Conversion with "the water's flowing" in the group chat, as everyone waits with bated breath to begin the profit-sharing and cleanup phase.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Phishing
type: Term
break id: T0113
stix type: x-break-term
definition: In fraud operations, the process of luring a victim step by step using deceptive information.
description: Fraud rings use fabricated investment opportunities, fake prize notifications, or impersonation of acquaintances to continuously deliver bait messages, gradually building the victim's trust. Once the victim takes the bait, they are manipulated into disclosing sensitive personal information or transferring money directly. This tactic serves as the common front-end stage of various telecom and online fraud schemes, often followed by specific scams such as 'cashing out the fish.'
category: Telecom Fraud
keywords: Phishing
keywords: luring victim
keywords: deceptive bait
keywords: fake investment lure
keywords: impersonation bait
keywords: prize notification scam
keywords: taking the hook
keywords: casting net
keywords: social engineering lure
usage example: A cybercriminal gang meticulously cloned a bank's official website and conducted a Phishing campaign by mass-sending "points for cash" SMS messages; victims entered their bank card numbers and passwords on the phishing page, resulting in instant fund transfers.
related risks: Phishing Attack
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Casting Bait
type: Term
break id: T0115
stix type: x-break-term
definition: The preparatory act of mass-distributing fake advertisements or messages to screen for potential victims.
description: Fraud rings widely disseminate bait such as 'loan limit increases' or 'vaccine appointments' through bulk SMS, social media groups, or web pop-ups. This stage does not involve direct fraud but waits for interested victims to initiate contact, effectively filtering for easy targets for the subsequent 'cashing out' stage.
category: Telecom Fraud
keywords: Casting Bait
keywords: mass baiting
keywords: broadcast bait
keywords: fake loan offer
keywords: fake credit increase
keywords: HPV vaccine scam
keywords: epidemic survey scam
keywords: clickbait link
keywords: mass phishing SMS
usage example: The ringleader pressed his crew in the group chat, asking, 'Did you scatter enough bait today? Why haven't any fish bitten yet?' By 'scattering bait,' he meant checking who had clicked on the phishing SMS links they sent out.
related risks: Phishing Attack
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Fish-Killing Scam
type: Term
break id: T0116
stix type: x-break-term
definition: A scam tactic that uses fake loans or investment schemes as bait to defraud victims who proactively reach out.
description: The fraud ring's 'angler' first posts fake loan or investment information via SMS or web ads, waiting for victims desperate for money or greedy for high returns to make contact. Once a victim 'takes the bait,' the 'fish cutter' who runs the operation sets up a series of traps, demanding repeated transfers under the guise of handling fees, security deposits, or unfreezing charges. This is the standard operating procedure for loan-based scams.
category: Telecom Fraud
keywords: Fish-Killing Scam
keywords: loan scam
keywords: investment scam
keywords: angler role
keywords: gutter role
keywords: wide-net fraud
keywords: false information dissemination
keywords: click-to-lose
keywords: bait-and-hook scheme
usage example: A job seeker named Xiao Zhang saw an ad on short video claiming "internal channel, instant approval for bad credit." After downloading a fake banking app and submitting details, he was tricked into repeatedly transferring money to "boost transaction flow"—a classic Fish-Killing Scam.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related risks: Phishing Attack
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mark
type: Term
break id: T0121
stix type: x-break-term
definition: A collective term used by fraud rings to refer to potential victims—individuals with low vigilance who are easily lured into scams.
description: Fraudsters liken the process of finding victims to fishing, calling target selection “choosing the fish.” Using illegally obtained contact lists or mass messaging, they identify people who are credulous and lack defensive awareness. Once someone responds, they are marked as a “hooked fish” and moved into the next stage of the fraud pipeline.
category: Telecom Fraud
keywords: Mark
keywords: sucker list
keywords: easy mark
keywords: victim profile
keywords: lead generation
keywords: phish target
keywords: whale target
keywords: cold prospect
usage example: That group blasted 20,000 messages last night and hooked over 30 fish in a single evening.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mom Lead
type: Term
break id: T0121-001
stix type: x-break-term
definition: In a fraud context, this specifically refers to the demographic of homemakers who are willing to do part-time work, hoping to supplement their household income through manual tasks or fake review schemes.
description: Fraudsters post fake job ads on social platforms, attracting homemakers with promises of 'handcraft work from home' or 'commissions for brushing orders.' They demand an upfront deposit or franchise fee, promising a refund and payment later, and ultimately disappear after collecting a large sum in deposits. This type of scam precisely exploits the homemaker demographic's fragmented time and eagerness to earn money.
category: Telecom Fraud
keywords: Mom Lead
keywords: stay-at-home job scam
keywords: fake assembly work
keywords: manual piecework fraud
keywords: online part-time scam
keywords: deposit fraud
keywords: membership fee scam
keywords: work-from-home bait
keywords: homemaker target
usage example: Scam rings post "pen assembly, daily pay, earn while parenting" in mom groups, using high commissions and zero barriers as a perfect Mom Lead to lure mothers, then charge "membership fees" or "deposits" before blocking them.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Friend-Social Lead
type: Term
break id: T0121-002
stix type: x-break-term
definition: An internal term used by fraud rings for targets who are deceived through a fake friendship.
description: Fraudsters invest time in long-term chats to build a false friendship, breaking down the victim's psychological defenses. These victims often have strong emotional needs and are easily deceived by excuses such as fake investment opportunities or emergency loans recommended by their 'friend.' By exploiting interpersonal trust, this method is more insidious than direct financial enticement and often leads to significant financial losses.
category: Telecom Fraud
keywords: Friend-Social Lead
keywords: friendship grooming
keywords: impersonated friend
keywords: trust exploitation
keywords: social trust scam
keywords: emotional manipulation
keywords: friend impersonation
keywords: relationship scam
keywords: affinity fraud
usage example: Underground operators noted these Friend-Social Leads took half a month to cultivate; using stolen social accounts, they messaged victims "old classmate needs urgent cash," exploiting trust in acquaintances for higher success than fake customer service.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Sexual Lure Lead
type: Term
break id: T0121-003
stix type: x-break-term
definition: An internal term for men who fall into scams while seeking pornographic content.
description: Fraudsters plant trojans or fake payment links in pornographic content on adult sites or social platforms to lure users. Because victims are often too embarrassed to report the crime, they are easily coerced into paying large sums of hush money in subsequent sextortion scams after a small initial charge or contact list theft. This type of scam exploits human weakness and is extremely high-risk.
category: Telecom Fraud
keywords: Sexual Lure Lead
keywords: adult content lure
keywords: porn scam
keywords: explicit bait
keywords: sextortion lead
keywords: NSFW bait
keywords: clickbait adult
keywords: payment fraud lure
keywords: personal data theft lure
usage example: Late-night livestream "local hookup" pop-ups funnel Sexual Lure Leads into private chat apps, where hosts demand gifts to "unlock explicit shows"—by the time victims realize, thousands are lost and the account is deleted.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Money Laundering Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Money Laundering Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Student Lead
type: Term
break id: T0121-004
stix type: x-break-term
definition: An internal term used by fraud rings for groups primarily targeting school students.
description: Exploiting students' lack of social experience and desire to earn money through part-time work, fraudsters post fake job ads like 'high pay, daily settlement' or 'cashback for reviews.' Once contacted, victims are asked to pay 'training fees' or 'security deposits,' ultimately receiving no payment and losing their principal. This demographic is a prime target for task-based scams.
category: Telecom Fraud
keywords: Student Lead
keywords: student job scam
keywords: part-time scam
keywords: fake online survey
keywords: ad-clicking scam
keywords: training fee fraud
keywords: campus target
keywords: student deposit scam
keywords: fake campus job
usage example: Near finals, a fake advisor account joined class chats claiming "admin office handles loan deferrals," herding dozens of Student Leads into a sham group to collect "processing fees" via private message until someone called to verify.
related risks: Order Brushing
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Gaming Lead
type: Term
break id: T0121-005
stix type: x-break-term
definition: An internal term used by fraud rings for groups primarily targeting online gamers.
description: Fraudsters post fake offers for low-cost top-ups, power-leveling services, or equipment trades in game chats or on trading platforms. Once a player takes the bait, they are directed to a phishing site for payment or tricked into giving up their account credentials. By exploiting players' focus on in-game assets, this type of transaction fraud has a very high incidence rate among young people.
category: Telecom Fraud
keywords: Gaming Lead
keywords: in-game transaction scam
keywords: gamer target
keywords: virtual item fraud
keywords: game currency scam
keywords: in-game purchase scam
keywords: gamer phishing
keywords: game account theft
keywords: online gaming fraud
usage example: Fraud rings internally define Gaming Leads as online gamers, targeted because their habit of in-game trading and lower vigilance makes them easy prey for fake equipment transaction scams.
related risks: Unauthorized Third-Party Top-Up Services
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Phishing Attack
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Game Boosters
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pregnant-Woman Lead
type: Term
break id: T0121-006
stix type: x-break-term
definition: An internal term used by fraud rings for groups primarily targeting pregnant women.
description: Targeting pregnant women who have more free time and a desire to earn income from home, fraudsters post fake part-time jobs like 'handicraft assembly' or 'remote customer service' in mom groups or on maternity forums. Victims are typically required to pay upfront for materials or a deposit, after which the fraudsters refuse to pay wages using various excuses and eventually disappear with the money. This group tends to have weaker fraud awareness and is susceptible to repeat victimization.
category: Telecom Fraud
keywords: Pregnant-Woman Lead
keywords: pregnancy job scam
keywords: maternity leave scam
keywords: fake data entry
keywords: material fee fraud
keywords: mom-to-be target
keywords: home assembly scam
keywords: prenatal scam
keywords: mom job bait
usage example: Posing as maternal health staff, scammers call Pregnant-Woman Leads to "verify birth subsidy details"; after accurately stating exam dates and names, they coax out bank card numbers and SMS codes, draining accounts within minutes.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Romance Grooming
type: Term
break id: T0123
stix type: x-break-term
definition: A term used internally by fraud rings to describe the tactic of building trust through deep emotional conversations in order to carry out a scam.
description: This is the core operational stage of “pig-butchering” scams. Operators pose as high-value romantic partners—such as wealthy, attractive singles—and use carefully scripted dialogues to engage targets in prolonged emotional exchanges. After establishing a romantic relationship through “intensive chatting,” they lure victims into fake investment platforms, gambling sites, or overpriced goods by claiming to have inside information or system loopholes. The entire process emphasizes emotional groundwork to maximize the amount stolen.
category: Telecom Fraud
keywords: Romance Grooming
keywords: love scam
keywords: sweetheart swindle
keywords: online romance fraud
keywords: catfishing
keywords: relationship grooming
keywords: dating app scam
keywords: affinity fraud
usage example: His intensive chatting skills are impressive; he nurtured an account for a month and got that woman to mortgage her house.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig-Butchering Scam
type: Term
break id: T0124
stix type: x-break-term
definition: A fraud model in which victims are lured into fake investment or gambling platforms under the guise of online romance, and ultimately have all their funds stolen.
description: After building an online romantic relationship through “intensive chatting,” fraud rings direct victims to fraudulent investment or gambling websites they control. Initially, victims are allowed to make small profits and withdraw funds successfully to encourage larger deposits. Once a substantial amount has been invested, the platform blocks withdrawals with various excuses and eventually shuts down. The entire process is graphically described as “finding the pig, raising the pig, and butchering the pig.”
category: Telecom Fraud
keywords: Pig-Butchering Scam
keywords: sha zhu pan
keywords: investment romance scam
keywords: crypto romance fraud
keywords: butchering the pig
keywords: pig slaughter
keywords: romance investment scheme
keywords: hybrid scam
usage example: Their crew ran a pig-butchering scam last year, netting over ten million in three months using a crypto platform.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Compliance Governance
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
related business scenes: BS15
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Streetwalking Account
type: Term
break id: T0126
stix type: x-break-term
definition: Social media accounts that use fake locations and carefully crafted personas on “nearby” features to attract and funnel potential victims into downstream scams.
description: Operators typically dress these accounts with profile photos and albums depicting attractive young women. Using location-spoofing tools, they position the accounts in busy commercial areas or densely populated target zones. These accounts exploit male curiosity to draw attention; once a friend request is accepted, the target is redirected to adult services, drink hustles, or pig-butchering scams. They serve as a common front-end tool for illicit traffic generation.
category: Telecom Fraud
keywords: Streetwalking Account
keywords: bait account
keywords: honeypot profile
keywords: lure account
keywords: nearby promotion
keywords: social media bait
keywords: decoy profile
keywords: traffic account
usage example: As soon as these street-walker accounts were placed on nearby, dozens of men added them within one night.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig Target
type: Term
break id: T0127
stix type: x-break-term
definition: A derogatory term used internally by fraud rings to refer to scam targets and victims, treating them as livestock ready for slaughter.
description: Throughout the fraud chain, victims are thoroughly objectified and seen as “pigs” that can generate profit. From the moment a target is identified, fraudsters view them as animals to be fattened, showing no empathy whatsoever. This label reflects the extreme callousness and dehumanization that characterize the internal culture of these criminal operations.
category: Telecom Fraud
keywords: Pig Target
keywords: victim target
keywords: high-value target
keywords: whale
keywords: sucker
keywords: easy target
keywords: gullible target
keywords: mark
usage example: This pig has been raised for two months; it’s finally time to slaughter it—prepare to close the net.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig Conditioning
type: Term
break id: T0127-001
stix type: x-break-term
definition: The stage in a fraud operation where a target is subjected to deep brainwashing and emotional manipulation in order to break down their psychological defenses.
description: In romance-investment scams such as “pig-butchering,” operators follow scripted playbooks to build fake intimate relationships through high-frequency chatting, feigned care, and sharing fabricated lifestyle details. The core objective of this phase is to gain trust and make the victim emotionally dependent on the fraudster, paving the way for later investment or money transfer inducements. Once the target is successfully “bewitched,” they typically become fully convinced by the scam.
category: Telecom Fraud
keywords: Pig Conditioning
keywords: grooming script
keywords: social engineering cycle
keywords: trust building
keywords: victim conditioning
keywords: romance scam prep
keywords: pre-texting
keywords: confidence stage
usage example: This client is very guarded; the team lead told me to keep working on her for another two days and not bring up money yet.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Feeding the Pig
type: Term
break id: T0127-002
stix type: x-break-term
definition: A term used by fraud rings to describe the process of inducing victims to keep pouring in money in order to extract maximum value from them.
description: In pig-butchering or fake investment scams, once a victim starts making small trial investments, operators exploit their greed or emotional attachment to fabricate reasons for increasing the stakes. This process is likened to fattening a pig before slaughter, with the goal of maximizing the final payout. Victims often drain their life savings or even borrow heavily during this “fattening” phase.
category: Telecom Fraud
keywords: Feeding the Pig
keywords: drip feed
keywords: progressive extraction
keywords: milking the victim
keywords: staged investment
keywords: reload scam
keywords: re-victimization
keywords: pump and run
usage example: Don’t close the deal yet; keep fattening him up—I think he can still borrow a lot more from his relatives.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig Feed
type: Term
break id: T0127-003
stix type: x-break-term
definition: Pre-scripted dialogue templates and supporting materials carefully crafted by fraud rings to gain victims’ trust and induce them to transfer money.
description: “Pig feed” serves as standardized tooling for the fraud process, containing complete conversation templates that cover everything from initial greetings and persona building to emotional escalation and the introduction of investment topics. The content includes daily greetings, emotional stories, flaunting-wealth photos, and even fake profit screenshots. Operators simply follow the script to efficiently “feed” targets and steer them step by step into the trap.
category: Telecom Fraud
keywords: Pig Feed
keywords: scam script
keywords: chat playbook
keywords: lure script
keywords: fraud scenario
keywords: social engineering kit
keywords: scripted dialogue
keywords: pretext scenario
usage example: This set of pig feed is tailored for divorced women; the opening lines need to hook them through emotional resonance.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig Trough
type: Term
break id: T0127-004
stix type: x-break-term
definition: A pig trough refers to the chat or social tools used by fraud rings for daily communication and emotional grooming, serving as the communication pipeline in the pig-butchering process.
description: In pig-butchering telecom fraud, scammers refer to victims as “pigs” and dating or matchmaking platforms as “pigsties.” The pig trough is the messaging app or social tool they use to build intimacy. Operators use the pig trough to deliver pre-scripted “pig feed” talking points on a daily basis, presenting themselves as high-value partners and continuously dispensing fake affection to cloud the victim’s judgment. Once the victim becomes emotionally dependent on the fabricated relationship, they are steered into fake investments or gambling schemes to be fully fleeced.
category: Telecom Fraud
keywords: Pig Trough
keywords: encrypted chat app
keywords: scam communication tool
keywords: dating platform
keywords: scam infrastructure
keywords: chat platform
keywords: pigsty app
keywords: messaging app
usage example: That crew just switched to a new pig trough—they’re all on an encrypted chat app now, running three shifts a day to pump feed into the pigs, and once they’re fattened up they hand them straight to the fish-killing team.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Pig Hunting
type: Term
break id: T0127-005
stix type: x-break-term
definition: Pig hunting is the opening stage of a fraud chain, referring to the act of screening and locking in potential victims.
description: In pig-butchering scams or schemes targeting specific demographics, pig hunting is the critical front-end traffic generation step. Scammers use social media, matchmaking platforms, telemarketing, or fake job ads to batch-screen target groups who are emotionally vulnerable, have weak defenses, or are desperate for money. This stage focuses on collecting basic personal data and contact details, supplying a precise list of leads for the subsequent pig-farming stage. The efficiency of pig hunting directly determines the crew’s overall output and is typically handled by dedicated traffic or data teams.
category: Telecom Fraud
keywords: Pig Hunting
keywords: target acquisition
keywords: lead generation
keywords: victim prospecting
keywords: sourcing marks
keywords: prey selection
keywords: target identification
keywords: lead sourcing
usage example: This week the pig-hunting team cast their net across several dating apps and pulled in over thirty divorced single parents; all the contact info has already been handed over to the pig-farming crew.
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mule
type: Term
break id: T0131
stix type: x-break-term
definition: Horses specifically refer to elderly patients who frequent hospitals and are easily deceived, seen as high-quality targets by fraud rings.
description: These victims have lost confidence after repeated hospital visits and poor treatment outcomes for chronic illnesses, making them highly receptive to promises of “miracle cures” or “ancestral remedies.” Scammers exploit this psychological vulnerability with precision. Rings often obtain medical records through illicit channels, then pose as fake specialists for follow-up calls or door-to-door sales, using “horse feed” scripts to repeatedly brainwash the victims and ultimately sell overpriced fake drugs or supplements. Because elderly victims have low medical literacy and weak awareness of their rights, such scams tend to be highly covert and have high recurrence rates.
category: Telecom Fraud
keywords: Mule
keywords: money mule
keywords: mule account
keywords: mule herder
keywords: mule recruitment
keywords: mule network
keywords: elderly fraud
keywords: chronic illness scam
keywords: medical scam
usage example: Last month they pulled a batch of long-term patients from the hospital registration system—all premium horses. After two weeks on horse feed, that batch of fake meds brought in over eight hundred thousand.
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mule Leads
type: Term
break id: T0131-001
stix type: x-break-term
definition: Horse feed is the fixed script used when defrauding elderly patient groups, functionally equivalent to pig feed.
description: In scams targeting “horses,” horse feed is the core brainwashing tool, typically containing fabricated medical theories, fake recovery stories, and emotional care talking points designed specifically to break down an elderly person’s defenses. Operators follow the script and deliver it day by day, first building trust as a health consultant, then gradually planting anxiety about the “only effective treatment,” and finally closing the sale of counterfeit drugs or substandard supplements. The design of horse feed relies heavily on the victim’s medical records; the more the script aligns with their condition, the higher the conversion rate.
category: Telecom Fraud
keywords: Mule Leads
keywords: scam script
keywords: social engineering script
keywords: rapport building
keywords: trust building
keywords: victim grooming
keywords: pig butchering script
keywords: fake treatment pitch
keywords: medical fraud script
usage example: This set of horse feed is built specifically for old horses with diabetes and hypertension—first give away free glucose meters, then pitch fake insulin repair case studies, and finally apply pressure to sell those unlicensed capsules.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related threat actors: Money Laundering Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mule Recruitment Script
type: Term
break id: T0131-002
stix type: x-break-term
definition: Horse reins refer to the core contact details of defrauded elderly victims, such as phone numbers and home addresses, which are the critical information fraud rings use to make contact.
description: In scams targeting “horses,” horse reins are the sole link between the scammer and the victim. They are typically obtained illegally by data brokers or hospital insiders and then sold to fraud rings. With horse reins, calling teams can make precise calls, conduct home visits, or mail fake promotional materials, thereby launching the entire horse-training process. The quality of horse reins directly determines the success rate of the scam; the fresher and more detailed the information, the higher the probability that the victim can be controlled.
category: Telecom Fraud
keywords: Mule Recruitment Script
keywords: victim contact
keywords: patient data
keywords: leaked medical records
keywords: hospital data breach
keywords: patient lead
keywords: victim phone list
keywords: cancer patient lead
usage example: This batch of horse reins came straight from an insider at a top-tier hospital—all recently diagnosed cancer patients with full phone numbers and home addresses. The horse-training team has already started contacting them one by one.
related risks: Data Breach
related risks: Data Exfiltration Risk
related risks: Insider-Outsider Collusion
related risks: Employee Policy Violations
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Money Laundering Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Malicious Insiders
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
related threat actors: Money Laundering Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Mule Training
type: Term
break id: T0131-003
stix type: x-break-term
definition: Horse training refers to the full process of systematically brainwashing and building trust with locked-in elderly victims to ultimately complete the fraud and cash out.
description: Horse training is the core operational stage of “horse”-type scams. Once horse reins are obtained, scammers impersonate medical experts, rehabilitation consultants, or charity workers, gradually building an authoritative image through phone calls, messaging apps, or in-person contact. Throughout the process they heavily deploy horse feed scripts, first using free checkups or gifts as bait, then fabricating the “only effective treatment” to create urgency, ultimately taming the elderly victim into a compliant payer. The training cycle can last from a few days to several months, entirely depending on the victim’s financial means and level of vigilance.
category: Telecom Fraud
keywords: Mule Training
keywords: victim grooming
keywords: trust building
keywords: social engineering
keywords: victim manipulation
keywords: elderly exploitation
keywords: scam execution
keywords: pig butchering process
usage example: That crew specializes in horse training—they call posing as Beijing specialists, then mail fake meds and fabricated recovery cases, taming the old lady until she’s completely obedient and eventually drains even her retirement savings.
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Lead Vendor
type: Term
break id: T0135
stix type: x-break-term
definition: A data broker is a player in the underground supply chain who specializes in illegally obtaining and reselling citizens’ personal information, providing precise data sources for downstream fraud.
description: Data brokers use methods such as hacking and database dumps, insider leaks, phishing sites, or public scraping to collect sensitive information in bulk—including names, phone numbers, ID numbers, home addresses, and even medical records or bank statements—and then trade it through darknet markets, Telegram groups, or offline channels. This data is used by downstream fraud, illegal marketing, money-muling, or gambling operations for precise profiling and targeted attacks, directly enabling identity theft, loan fraud, and precision telecom scams. Data brokers are the data source of the entire underground chain and one of its highest-risk nodes.
category: Telecom Fraud
keywords: Lead Vendor
keywords: data broker
keywords: personal information seller
keywords: PII seller
keywords: medical record dealer
keywords: patient data vendor
keywords: lead generation
keywords: data leak marketplace
usage example: With the recent crackdown, data brokers have all moved their trading to Telegram—first-hand bank transaction records are sold per entry, second-hand medical records are sold in bulk, and the buyers are all running precision telecom fraud.
related risks: Data Breach
related risks: Data Exfiltration Risk
related risks: Insider-Outsider Collusion
related risks: Employee Policy Violations
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Phishing Attack
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Reducing Returns
related attack tools: Dark Web
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Personal Data Traffickers
related threat actors: Malicious Insiders
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related threat actors: Scam Compound Operator
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Offline App Promotion
type: Term
break id: T0136
stix type: x-break-term
definition: In the underground context, street pushing refers to using offline giveaways, QR-code scanning, and other bait to directly install scam apps or illicit services onto users’ phones as a traffic-generation method.
description: Unlike legitimate commercial street promotion, underground street pushing typically sets up in high-traffic commercial areas, residential communities, or rural markets, using free gifts such as tissues, eggs, or toys as bait to lure passersby into downloading scam applications disguised as normal apps. Once installed and granted permissions, the app can remotely read contacts, intercept SMS verification codes, or even directly control the phone to initiate transfers. This offline installation method bypasses online risk controls and specifically targets elderly or low-awareness groups, often resulting in financial losses that are nearly impossible to recover.
category: Telecom Fraud
keywords: Offline App Promotion
keywords: malicious app install
keywords: QR code scam
keywords: offline promotion scam
keywords: street marketing fraud
keywords: gift scam
keywords: remote access trojan install
keywords: phone takeover
usage example: Last month they set up a stand outside the wet market, giving away eggs to get people to scan a QR code and download that fake investment app—the backend enabled remote control straight away, and several elderly women had their bank cards completely drained.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: SMS Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Compliance Governance
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Chat Proxy
type: Term
break id: T0137
stix type: x-break-term
definition: A proxy chatter is an outsourced operative in the fraud chain who impersonates a fabricated identity to conduct text or voice conversations with targeted victims.
description: Proxy chatters are typically recruited by upstream fraud rings or distributed through task-based platforms, and are paid per assignment. They pose as attractive women, customer service agents, or investment mentors on social media, dating apps, and classified ad sites, using scripted dialogues to gradually build trust. Once a victim is sufficiently groomed, they are handed off to the next stage—operators running pig-butchering scams or online gambling schemes. The use of proxy chatters makes fraud operations more modular, harder to detect, and insulates the principal offenders from direct attribution.
category: Telecom Fraud
keywords: Chat Proxy
keywords: fake profile
keywords: catfishing
keywords: romance scammer
keywords: impersonation
keywords: chat scam
keywords: gambling lure
keywords: prostitution lure
usage example: “That account chatted with me for two days and then started pushing me to place bets. I only found out later that it wasn’t a real person—it was a proxy chatter running through a script.”
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Trust-Seeding Float
type: Term
break id: T0138
stix type: x-break-term
definition: A cushion deposit is a falsified sum of money or fabricated transaction record that fraudsters inject into a victim’s account or display interface before executing the main financial scam.
description: Cushion deposits are commonly used in task-based rebate scams and fake investment platforms. Operators manipulate backend figures or use Photoshop to forge transfer screenshots, making victims believe they have received a commission or profit. This illusion of a trustworthy, profitable platform encourages victims to commit larger sums. In reality, the money never reaches a genuine account; once the victim deposits substantial principal, the funds are immediately transferred out or become impossible to withdraw.
category: Telecom Fraud
keywords: Trust-Seeding Float
keywords: fake deposit
keywords: fake balance display
keywords: advance-fee fraud
keywords: phantom funds
keywords: bait money
keywords: trust seeding
keywords: fake payout
usage example: “He showed me the backend balance and said he’d already put a fifty-thousand cushion in there for me, telling me to follow the trades without worry. Turned out every digit was fake.”
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Malicious Payload
type: Term
break id: T0139
stix type: x-break-term
definition: A poison package is a malicious file bundle pre-loaded with a Trojan or remote access tool, used to establish a covert control channel on a victim’s device.
description: Poison packages are typically crafted by technical underground actors and distributed to downstream promoters or proxy chatters. Promoters fabricate pretexts such as ‘installing a security certificate’ or ‘claiming a promotional offer’ to trick victims into downloading and opening the file. Once executed, the attacker can remotely harvest passwords, hijack sessions, or control the device’s camera. In telecom fraud scenarios, poison packages are often used to directly steal online banking credentials or to facilitate secondary scams in coordination with fake customer service scripts, serving as a critical link for breaching endpoint security.
category: Telecom Fraud
keywords: Malicious Payload
keywords: trojan horse
keywords: remote access trojan
keywords: spyware
keywords: keylogger
keywords: malware delivery
keywords: credential theft
keywords: device compromise
usage example: “He told me to download that authentication pack, claiming it was a bank security plugin. The moment I opened it, my computer was taken over remotely.”
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Money Laundering Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related threat actors: Money Laundering Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Reverse-Scan Tool
type: Term
break id: T0140
stix type: x-break-term
definition: Reverse scanning is a money-laundering technique in which a complicit merchant’s barcode scanner or point-of-sale scanning device is used to process fraudulent funds as if they were legitimate consumer payments, enabling rapid fund transfer.
description: Money-muling rings typically recruit merchants with physical storefronts. They transmit fraudulently obtained payment codes online to the merchant, who then uses a barcode scanner to ‘reverse scan’ and complete the transaction. Once the funds enter the merchant’s account, they are cycled back to underground-controlled accounts under the guise of payment for goods or top-ups. This method exploits the instant settlement and relatively lax risk controls of offline payment scenarios, allowing dirty money to be laundered quickly. Merchants often become unwitting or incentivized conduits for money laundering.
category: Telecom Fraud
keywords: Reverse-Scan Tool
keywords: QR code scam
keywords: payment code fraud
keywords: money laundering POS
keywords: illicit QR scan
keywords: merchant collusion
keywords: payment redirection
keywords: code hijacking
usage example: “They told me to send over my payment code and said they’d just scan it with the shop’s barcode scanner to settle up. In reality, they were using my code to wash dirty money.”
related risks: Money Laundering Risk
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Compliance Governance
related attack tools: Score-Running Platforms
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Score Runner
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Instant-Scan Pack
type: Term
break id: T0141
stix type: x-break-term
definition: ‘Send and scan immediately’ is an instruction used in the money-laundering or fraudulent collection stage, demanding that a victim or money mule generate a payment code and have it scanned instantly to complete the fund transfer.
description: Because payment platforms typically keep payment codes valid for only tens of seconds to a minute, underground operators rush to complete the transfer before risk-control systems can intervene, urging the counterparty to ‘scan it the moment the code appears.’ This practice is common in money-muling groups, gambling top-up operations, and the final emergency collection stage of a scam, where speed is critical to evade transaction blocking and account freezes. Any delay that causes the payment code to expire will break the fund chain.
category: Telecom Fraud
keywords: Instant-Scan Pack
keywords: QR code rush
keywords: expiring payment code
keywords: instant scan tactic
keywords: snap scan
keywords: code flash payment
keywords: merchant scan pressure
keywords: time-sensitive QR
usage example: “The group kept shouting ‘send and scan immediately.’ My code was swept away less than ten seconds after it appeared—I didn’t even have time to react.”
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Compliance Governance
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Scam Bookmaker
type: Term
break id: T0142
stix type: x-break-term
definition: A dog banker is a gambling operator who controls an illegal betting ring or private lottery platform, systematically extracting bettors’ funds through preset odds and rigged mechanics.
description: Dog bankers typically run gambling websites or underground casinos hosted on offshore servers, holding backend privileges that allow them to alter draw results, restrict withdrawals, or adjust odds at will. They employ dog promoters to lure players into the game, initially allowing small wins to build trust before slaughtering victims once they increase their stakes. The dog banker sits at the apex of the online gambling chain, directly controlling the life and death of the capital pool, and serves as a major exit point for laundered and scammed funds.
category: Telecom Fraud
keywords: Scam Bookmaker
keywords: rigged gambling den
keywords: underground bookmaker
keywords: house fix
keywords: cheating casino software
keywords: outcome manipulation
keywords: illegal betting ring
keywords: crooked house
usage example: “After three straight losses on that platform, I knew it was the dog banker manipulating the results from the backend. There’s no way they’d ever let you walk away with a win.”
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related risks: Platform-Facilitated Gambling
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Compliance Governance
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related threat actors: Online Gambling Gangs
related business scenes: BS04
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Scam Pusher
type: Term
break id: T0143
stix type: x-break-term
definition: A dog promoter is a frontline canvasser employed by overseas online gambling or fraud rings, tasked with recruiting targets and inducing bets through social platforms and chat groups.
description: Dog promoters are typically concentrated in compounds or office blocks across Southeast Asia. They mass-register accounts using group-control systems and post ‘guaranteed profit’ or ‘insider information’ in dating apps, adult-content groups, or part-time job channels. Following scripted playbooks, they convert targets into gamblers or investment victims. Under intense performance pressure and with restricted personal freedom, they often have their passports and wages withheld. Dog promoters are both the lowest-tier executors in the underground chain and high-turnover disposable assets.
category: Telecom Fraud
keywords: Scam Pusher
keywords: gambling promoter
keywords: social media lure
keywords: deceptive betting script
keywords: Southeast Asia scam farm
keywords: lottery tout
keywords: shill account
keywords: online casino recruiter
usage example: “Those accounts that flood groups with profit screenshots every day, claiming you can earn steady money by following a mentor—they’re almost all dog promoters. Their accounts get banned in batches and they just spin up new ones.”
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Phone Operator
type: Term
break id: T0144
stix type: x-break-term
definition: A phone operator is a front-line member of a telecom fraud ring responsible for making initial contact with victims and guiding them through scripted dialogues over the phone.
description: Phone operators typically work from centralized fraud dens or through remote calling systems. Following prepared scripts, they impersonate law enforcement, customer service representatives, or loan officers, using narratives about ‘pending cases,’ ‘refunds,’ or ‘credit approvals’ to create a sense of urgency. Their task is to screen and stabilize victims before transferring them to second- or third-tier ‘fish-killing’ teams who execute the actual fund transfers. As the entry point of the fraud chain, the operator’s call quality and script fluency directly determine the scam’s success rate.
category: Telecom Fraud
keywords: Phone Operator
keywords: call center operative
keywords: scripted pitch
keywords: first-contact fraudster
keywords: victim handoff
keywords: phone phishing agent
keywords: telecom fraud frontliner
keywords: voice scammer
usage example: “First, a phone operator called saying my parcel had been lost and I needed to file a claim. They had me add a customer service QQ account, and from there they started extracting my bank card details step by step.”
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: AI Fraud Chatbots
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Scam Script
type: Term
break id: T0145
stix type: x-break-term
definition: A preset conversational script used by fraud rings to manipulate victims over the phone.
description: A script book is a standardized operational manual developed internally by fraud organizations, detailing the exact phrasing, emotional cues, and contingency strategies for each stage of a scam. Frontline operators follow it rigorously to build trust, create panic, and ultimately coerce victims into transferring money or divulging sensitive information. This assembly-line approach significantly lowers the barrier to committing fraud, enabling callers to perpetrate crimes efficiently at scale.
category: Telecom Fraud
keywords: Scam Script
keywords: conversation script
keywords: fraud playbook
keywords: objection handling guide
keywords: manipulation manual
keywords: call flow document
keywords: psychological coercion script
keywords: pretexting guide
usage example: The team leader distributed the new script book before the shift, instructing everyone to memorize the pages on impersonating customer service for refunds, and to flip to page three for the rebuttal tactics if questioned.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Boxed-Meal Scam
type: Term
break id: T0146
stix type: x-break-term
definition: A scam where fraudsters impersonate a major client, luring a business into advancing payment for a fictitious bulk order.
description: Scammers typically pose as authoritative entities like schools or military units, contacting businesses with an urgent procurement request for a specific branded product they do not normally stock. When the merchant says the item is unavailable, the scammer provides a fake supplier's contact, tricking the merchant into paying for the goods upfront. Once the merchant sends money to the bogus supplier, the scammers disappear, leaving the business with a financial loss and no goods.
category: Telecom Fraud
keywords: Boxed-Meal Scam
keywords: fake bulk order
keywords: impersonation scam
keywords: urgent order fraud
keywords: advance payment trick
keywords: supplier redirect
keywords: branded product trap
keywords: deposit theft
usage example: A restaurant owner got a bulk order from someone claiming to be with the military yesterday. He ended up wiring eighty thousand to buy the specified canned goods, and then both the client and the supplier vanished.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related business scenes: BS04
related business scenes: BS02
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Card Deduction
type: Term
break id: T0147
stix type: x-break-term
definition: An unauthorized payment method that bypasses the need for a physical card, requiring only account details and a verification code.
description: Once a cardholder's number, name, ID, phone number, and SMS verification code are compromised, fraudsters can initiate a card-not-present transaction, circumventing the physical card and its PIN. This technique is common in the fund-draining phase following information theft via phishing sites or trojans. The transfer is swift, and victims often only realize something is wrong upon receiving a debit notification.
category: Telecom Fraud
keywords: Card Deduction
keywords: card-not-present debit
keywords: SMS verification theft
keywords: account number payment
keywords: ID-based deduction
keywords: phone verification drain
keywords: non-card transaction
keywords: bank detail exploit
usage example: He clicked a link and filled in his details, and then a card-not-present fraud happened. The money was drained in three transactions; he only knew when the bank's text alerts came through.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related risks: Phishing Attack
related risks: QR Code Phishing (Quishing)
related risks: Transfer Fraud
related risks: Account Takeover
related risks: Money Laundering Risk
related avoidances: SMS Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Compliance Governance
related attack tools: AI Fraud Chatbots
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Technician
related threat actors: Money Laundering Gangs
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Quick Scam
type: Term
break id: T0148
stix type: x-break-term
definition: A short-cycle, quick-cash scam model.
description: A hit-and-run scam focuses on rapid monetization without long-term grooming. It is common in scenarios involving fake escort services, microloans, or sham online shopping. Exploiting human weaknesses, scammers use standardized scripts and fraudulent links to complete the entire process of traffic generation, entrapment, and monetization in a very short time. This high-risk, fast-paced model is a common tactic for lower-level members of telecom fraud rings.
category: Telecom Fraud
keywords: Quick Scam
keywords: hit-and-run scam
keywords: low-effort fraud
keywords: high-volume swindle
keywords: spray-and-pray tactic
keywords: instant monetization
keywords: short-con operation
keywords: smash-and-grab scheme
usage example: Their group specializes in hit-and-run scams. They can blast out tens of thousands of escort ads a day, and the moment someone takes the bait, they send a payment QR code without any extra chatter.
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Funds Intercept
type: Term
break id: T0149
stix type: x-break-term
definition: The practice by fraud ringleaders of deducting pay for fake data used to monitor or penalize affiliates.
description: To verify the authenticity of an affiliate's promotional or click-farming work, a ringleader will insert fictitious monitoring data, known as 'mines,' into the task list. During settlement, if the submitted results are found to contain these invalid entries, the ringleader will deduct the corresponding payment or impose other penalties to ensure affiliates do not fabricate their work.
category: Telecom Fraud
keywords: Funds Intercept
keywords: dummy data trap
keywords: quality-control mine
keywords: settlement deduction
keywords: planted entry check
keywords: operative verification
keywords: task list audit
keywords: ghost lead
usage example: After this batch of work, the boss said there were too many mines and is deducting our pay. We basically worked for free for three days.
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Risk Control Bypass
type: Term
break id: T0150
stix type: x-break-term
definition: A technical method used by fraudsters to breach a platform's risk-control system.
description: Bypassing security is a core part of fraud operations. Attackers use scripts, device-fingerprint spoofing tools, and proxy IPs to circumvent a platform's device fingerprinting, behavioral analysis, and other risk-control rules. A successful bypass allows fraudsters to mass-register accounts, claim promotional rewards, or conduct credential-stuffing attacks, paving the way for downstream scams and traffic manipulation.
category: Telecom Fraud
keywords: Risk Control Bypass
keywords: risk engine bypass
keywords: limit increase exploit
keywords: verification crack
keywords: control circumvention
keywords: payment barrier break
keywords: anti-fraud evasion
keywords: system override
usage example: The new system's risk control is too tight, and our old scripts are useless. The tech team is working on a new bypass solution.
related risks: Bulk Account Registration
related risks: Credential Stuffing
related risks: Platform Fraud Risk
related risks: Account Takeover
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Anomalous Access Behavior Detection
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Device Spoofing Tools
related attack tools: Bulk Account Registration Tool
related attack tools: Credential Stuffing Tools
related attack tools: Infostealers
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS02
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Face Verification Bypass
type: Term
break id: T0151
stix type: x-break-term
definition: An attack that uses technical means to circumvent or spoof a facial recognition system.
description: Fraudsters use techniques like high-resolution photo compositing, 3D masks, video replay, or AI deepfakes to attack facial recognition verification in scenarios like financial payments or account recovery. A successful facial recognition bypass allows criminals to impersonate a victim for high-risk operations such as large fund transfers or account detail changes, directly leading to asset theft.
category: Telecom Fraud
keywords: Face Verification Bypass
keywords: facial recognition bypass
keywords: liveness detection bypass
keywords: deepfake spoofing
keywords: face swap scam
keywords: biometric spoofing
keywords: video injection attack
keywords: 3D mask bypass
keywords: photo replay attack
usage example: Having the password isn't enough; we still need to find someone to do a facial recognition bypass, otherwise that large transfer won't go through.
related risks: Facial Recognition Bypass
related risks: AI Face-Swap Fraud
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Facial Recognition
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Software Kill
type: Term
break id: T0152
stix type: x-break-term
definition: A scam where fraudsters directly control a victim's phone via remote access software to transfer funds.
description: Scammers, posing as customer service or law enforcement, trick victims into downloading a remote control app disguised as a legitimate tool and granting accessibility permissions. Once access is gained, the scammer can monitor the screen in real-time, intercept SMS messages, and directly operate the victim's mobile banking app to transfer money or make unauthorized purchases without the victim's knowledge.
category: Telecom Fraud
keywords: Software Kill
keywords: remote access trojan
keywords: accessibility service abuse
keywords: screen sharing takeover
keywords: RAT scam
keywords: device hijacking
keywords: remote control fraud
keywords: banking trojan
keywords: fake support app
usage example: He downloaded a meeting app as instructed and shared his screen. Then the remote takeover happened; he watched helplessly as his phone moved on its own and his money was transferred out.
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Sexual-Lure Traffic
type: Term
break id: T0153
stix type: x-break-term
definition: Refers to a group of followers or contacts who are drawn in by sexually suggestive or borderline content and subsequently become targets for scams.
description: Underground operators flood social platforms or groups with softcore, provocative images, texts, or short videos to exploit curiosity and desire, channeling clicks and friend requests into a pool of convertible 'sex bait fans.' These accounts are later used to push links for gambling, fake investments, or sextortion schemes, or they may be packaged and sold to downstream fraud rings. While the fans themselves exist in a gray area, the moment they are funneled into paid services or scams, they shift from mere traffic to actual victims.
category: Telecom Fraud
keywords: Sexual-Lure Traffic
keywords: sextortion lead gen
keywords: adult traffic farming
keywords: NSFW baiting
keywords: honey trap funnel
keywords: porn clickbait
keywords: erotic lure
keywords: thirst trap scam
keywords: spicy content lead
usage example: Operators found a batch of suspicious female accounts using provocative web images to generate Sexual-Lure Traffic, replying "add QQ for surprises" in comments to funnel lust-driven users from public platforms into private groups for future pig-butchering scams.
related risks: Platform Fraud Risk
related risks: Pig Butchering / Investment Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Domain & Link Threat Intelligence
related avoidances: Access Source Tracking
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
related business scenes: BS04
related business scenes: BS05
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Cloud Deduction
type: Term
break id: T0154
stix type: x-break-term
definition: Refers to illicit funds that are directly deducted or transferred through mobile payment channels such as UnionPay QuickPass.
description: In the money laundering stage of telecom fraud, QuickPass is often used to rapidly consolidate funds transferred by victims due to its fast card binding and instant settlement. Fraud rings trick victims into downloading QuickPass, linking compromised bank cards, or scanning payment codes to achieve an 'instant deduction,' after which the funds are immediately split and moved. These deducted funds typically pass through multiple layers of accounts before being funneled into money-muling platforms or cryptocurrency exchange channels, making tracing extremely difficult.
category: Telecom Fraud
keywords: Cloud Deduction
keywords: QuickPass deduction
keywords: contactless payment fraud
keywords: NFC skimming
keywords: UnionPay exploit
keywords: flash payment theft
keywords: tokenized payment abuse
keywords: contactless carding
keywords: tap-to-pay fraud
usage example: Victims induced to download screen-sharing apps are guided to open their banking app and enter payment passwords, while scammers secretly capture the entire operation through the shared screen to steal funds.
related risks: Transfer Fraud
related risks: Account Takeover
related risks: QR Code Phishing (Quishing)
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related avoidances: Compliance Governance
related attack tools: Infostealers
related attack tools: Fake Apps
related attack tools: Malicious QR Code Generators
related attack tools: AI Deepfake Video
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS04
related business scenes: BS01
related business scenes: BS15
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Spark Cultivation
type: Term
break id: T0155
stix type: x-break-term
definition: A scam tactic that relies on long-term emotional grooming to build trust before defrauding the victim.
description: The scammer poses as a romantic partner or close friend, using daily chats, sharing life details, and expressing care over months or even longer to gradually make the victim emotionally dependent. Once the emotional 'spark' has been sufficiently kindled, the scammer fabricates excuses such as urgent medical bills, joint investment opportunities, or a family member's illness to solicit money. This tactic is common in pig-butchering and romance scams, and victims often refuse to believe they were deceived even after losing their money.
category: Telecom Fraud
keywords: Spark Cultivation
keywords: romance scam grooming
keywords: pig butchering
keywords: long con relationship
keywords: trust building phase
keywords: emotional manipulation
keywords: love bombing
keywords: catfishing
keywords: sweetheart swindle
usage example: "We chatted for over half a year, and he said he wanted to help me make money. Once I invested, I couldn't withdraw anything—that's a textbook 'spark grooming' scam."
related risks: Pig Butchering / Investment Fraud Risk
related risks: Platform Fraud Risk
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Real-Name Identity Verification
related avoidances: Legal Action
related attack tools: AI Fraud Chatbots
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Telecom Fraud Gangs
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Scam Compound Operator
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
updated: 2026-06-16
version: 1

Guaranteed Real, Not Guaranteed Complete
type: Term
break id: T0156
stix type: x-break-term
definition: A disclaimer in illegal data trading where the seller guarantees the authenticity of the data but not the completeness of all fields.
description: When selling personal information, underground data brokers often use 'guaranteed authentic, not guaranteed complete' as a sales pitch. This means core items like names and ID numbers are verified as real, but fields such as addresses or contact details may be missing or outdated. This clause lowers buyer expectations and reduces disputes over incomplete data, effectively serving as a liability shield for the seller's unstable supply chain or resold data.
category: Data Leakage
keywords: Guaranteed Real, Not Guaranteed Complete
keywords: as-is data sale
keywords: no-completeness guarantee
keywords: partial record dump
keywords: verified but incomplete
keywords: data authenticity waiver
keywords: black market data disclaimer
keywords: hit-or-miss lookup
keywords: selective disclosure
usage example: A middleman sent a preview of a "full household registration" query, noting Guaranteed Real, Not Guaranteed Complete—meaning ID numbers and names are absolutely real, but spouse or child fields may be missing, with no refunds, leaving buyers to gamble.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Deposit-Backed Order Request
type: Term
break id: T0157
stix type: x-break-term
definition: An ordering method in illegal data trading where the buyer pays a deposit upfront and submits a customized request.
description: In the underground data market, 'rice' is slang for money, and 'hanging rice' means paying a deposit. After a buyer submits a specific data query request, they must pay a deposit before the service provider begins work, with any balance settled upon completion. This mechanism locks in the transaction intent, prevents buyers from backing out, and allows the provider to schedule the job or outsource it to upstream data interfaces based on the prepayment.
category: Data Leakage
keywords: Deposit-Backed Order Request
keywords: upfront payment
keywords: rice deposit
keywords: prepaid lookup
keywords: escrow order
keywords: custom data request
keywords: private account receiving
keywords: blind flow order
keywords: deposit before query
usage example: "Accepting orders for private bank statements with no blind spots: 180 for 1 month, 280 for 3 months, 360 for 6 months. All statements require a deposit upfront—no haggling. Direct from the source."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Order Intake
type: Term
break id: T0158
stix type: x-break-term
definition: In illegal data trading, the act of a service provider receiving and accepting a client's data query order.
description: Within the underground data supply chain, 'accepting orders' is a signal from a service provider that they are open for business and can handle various requests such as personal background checks, transaction records, or location tracking. These order takers often act as middlemen who do not own the data sources themselves; instead, they aggregate orders and pass them to upstream interfaces or insiders, profiting from the markup.
category: Data Leakage
keywords: Order Intake
keywords: background check request
keywords: data lookup intake
keywords: private investigation order
keywords: doxing service
keywords: personal data query
keywords: black market inquiry
keywords: information retrieval service
keywords: same-day response
usage example: "Accepting orders, guaranteed same-day results."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Result Delivery
type: Term
break id: T0159
stix type: x-break-term
definition: The act of a service provider completing a query and delivering the results to the buyer in an illegal data transaction.
description: 'Returning the order' signifies that the data query has been completed and delivered, marking the closure of the illicit transaction. After receiving feedback from upstream sources, the provider sends documents or screenshots containing personal privacy information or account statements to the buyer, finalizing the deal. The turnaround time for returning orders is often used as a competitive selling point, with providers emphasizing 'fast returns' to attract buyers in urgent need of information.
category: Data Leakage
keywords: Result Delivery
keywords: query result return
keywords: data delivery
keywords: lookup fulfillment
keywords: dox drop
keywords: information handoff
keywords: report delivery
keywords: data packet
keywords: completed transaction
usage example: "Direct from the source, price: 200 RMB, results returned in about ten minutes. Affordable and fast."
related risks: Data Breach
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Escrow Broker
type: Term
break id: T0160
stix type: x-break-term
definition: An intermediary role in illegal data trading that provides trust endorsement and fund escrow services for buyers and sellers.
description: To mitigate the risks of exit scams and fraud in the underground data market, intermediaries akin to escrow agents have emerged. The guarantor verifies the seller's credentials, temporarily holds the funds, and releases payment to the seller only after the buyer confirms the data's accuracy, taking a commission from the transaction. This model makes illegal data trading more 'professional,' attracting more participants but also complicating efforts to track and crack down on these activities.
category: Data Leakage
keywords: Escrow Broker
keywords: middleman service
keywords: transaction broker
keywords: deal guarantor
keywords: black market escrow
keywords: credential verification
keywords: trusted intermediary
keywords: trade facilitator
keywords: dispute resolution
usage example: "Scam prevention tip: Be cautious in your transactions; it is recommended to use a reputable escrow agent."
related risks: Data Breach
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Mutual Guarantee Escrow
type: Term
break id: T0161
stix type: x-break-term
definition: A risk-hedging mechanism in illicit data transactions where both parties stake mutual interests to ensure the authenticity of the deal.
description: Commonly used in high-value intelligence trades on underground data markets, this practice involves both sides holding each other's sensitive information or placing deposits to create a check-and-balance, preventing either party from absconding with the money or supplying fake data. The arrangement is typically overseen by a broker; once the transaction is completed, the collateral is returned, while a defaulting party faces exposure of their information or financial loss.
category: Data Leakage
keywords: Mutual Guarantee Escrow
keywords: dual escrow
keywords: cross guarantee
keywords: collateral bond
keywords: mutual bond
keywords: two-way guarantee
keywords: reciprocal guarantee
keywords: joint liability
keywords: escrow lock
usage example: "This batch of fresh data goes through mutual collateral—you stake thirty thousand, I stake thirty thousand. Whoever tries any tricks first loses their money."
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Forced Account Takeover
type: Term
break id: T0162
stix type: x-break-term
definition: A black-hat technique of forcibly logging into a user's online account without their knowledge through credential stuffing, vulnerability exploitation, or trojans.
description: Attackers leverage compromised username-password combinations or system flaws to bypass standard authentication and take over accounts, stealing account balances, personal data, and social connections. It is frequently used to hijack social media accounts for downstream fraud or to directly transfer assets from e-commerce and financial accounts.
category: Data Leakage
keywords: Forced Account Takeover
keywords: account hijacking
keywords: credential stuffing
keywords: session hijacking
keywords: ATO
keywords: unauthorized access
keywords: account compromise
keywords: credential takeover
keywords: forced login
usage example: "Just forcefully logged a batch of accounts last night, some still have balances in them. Come pick through them quick if you want in."
related risks: Account Takeover
related risks: Credential Stuffing
related risks: Employee Account Compromise
related risks: Automated Login Risk
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Credential Stuffing Tools
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Malicious Instrumentation
type: Term
break id: T0163
stix type: x-break-term
definition: A technical method where malicious actors implant code on web pages or in apps to capture user input in real time.
description: By embedding scripts into target applications or websites, or by tampering with app packages, sensitive data such as passwords, verification codes, and bank card numbers is simultaneously transmitted to black-market servers as the user types. This technique is commonly used on phishing sites and in cracked apps, serving as a primary channel for harvesting first-hand, high-precision data.
category: Data Leakage
keywords: Malicious Instrumentation
keywords: code injection
keywords: formjacking
keywords: JS sniffing
keywords: Magecart
keywords: client-side injection
keywords: web skimming
keywords: input scraping
keywords: keystroke logging
usage example: A brushing victim placed orders on a counterfeit mall link from their "task mentor"; while entering card details, the page felt laggy, unaware that Malicious Instrumentation scripts were capturing their card number, CVV, and phone number in real time.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Social Data Pull
type: Term
break id: T0164
stix type: x-break-term
definition: An illicit operation using technical tools to exfiltrate private data such as chat logs and contact lists from mainstream social platforms.
description: Typically exploiting system vulnerabilities or permission abuse, this method extracts private information from social accounts in bulk without user awareness. The exfiltrated data includes text, images, and video conversations, which can be used for extortion, precision marketing, or downstream scams, causing severe privacy violations.
category: Data Leakage
keywords: Social Data Pull
keywords: contact scraping
keywords: chat exfiltration
keywords: social graph pull
keywords: message dump
keywords: social extraction
keywords: contact harvesting
keywords: account export
keywords: social media pull
usage example: "Latest micro-extraction tech, can pull contacts and chat logs with just the account. Bosses who need it, hit me up."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Database Deduping
type: Term
break id: T0165
stix type: x-break-term
definition: The process of cross-referencing illegally obtained personal data against existing databases to deduplicate and filter out fresh, usable records.
description: Operators maintain a massive historical database; newly acquired data must first be 'run through the database' to weed out expired, duplicate, or repeatedly resold records. Data that has been cleaned is referred to as 'fresh stock' and commands a higher price on the market, destined for use in precision scams or targeted marketing.
category: Data Leakage
keywords: Database Deduping
keywords: deduplication
keywords: freshness check
keywords: data cleansing
keywords: deduped base
keywords: cross-reference filter
keywords: duplicate removal
keywords: new data filter
keywords: fresh base
usage example: "New batch of material just in, already run through the database, all pure first-hand and unused. Anyone interested, step up."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Private Invite-Only Group
type: Term
break id: T0166
stix type: x-break-term
definition: Non-public groups used by underground actors for trading or communication, accessible only by invitation or vetting.
description: These groups serve as the core venues for illegal data trading and technical exchanges within the black market, using strict access controls to evade platform risk management and law enforcement monitoring. Members are typically repeat customers or vetted newcomers, and the traded goods include citizens' personal information, complete sets of bank card details, and other contraband.
category: Data Leakage
keywords: Private Invite-Only Group
keywords: invite-only channel
keywords: closed group
keywords: private channel
keywords: vetted group
keywords: exclusive circle
keywords: private chat
keywords: closed community
keywords: invite-only room
usage example: An informant revealed stolen e-commerce data is auctioned in a Private Invite-Only Group called "Data Supply Cooperative"; the admin only accepts referrals, charges a deposit, and uses only voice messages and self-destructing photos to evade detection.
related risks: Data Breach
related avoidances: Invitation Code Mechanism
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Insider-Verified Data
type: Term
break id: T0167
stix type: x-break-term
definition: A black-market term indicating an exceptionally high data query success rate, often implying that the data is sourced from leaks by police insiders.
description: 'No blind spots' signifies a query capability with zero failures and no dead ends, able to precisely retrieve highly sensitive data such as bank transaction records, cardholder information, and household registration files. This channel typically involves public officials abusing their positions for unauthorized queries, representing the highest tier of the black-market data supply chain and carrying extreme risk.
category: Data Leakage
keywords: Insider-Verified Data
keywords: verified insider
keywords: zero-fail query
keywords: insider data
keywords: clean query
keywords: LE-sourced
keywords: no-fail lookup
keywords: guaranteed hit
keywords: insider feed
usage example: "No-blind-spot transaction record checks, available for both corporate and personal accounts. Consolidated dispatch every Thursday, taking both bulk and single orders."
related risks: Data Breach
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Fuzzy Lookup
type: Term
break id: T0168
stix type: x-break-term
definition: A query method within social engineering databases that uses scattered clues for fuzzy matching to unearth sensitive information on a specific target.
description: Attackers leverage known fragments of a target's information to perform associative searches within underground databases, piecing together a complete profile of their identity, social connections, and finances. This type of query is often used for doxing and the intelligence-gathering phase preceding precision fraud, significantly increasing the success rate of downstream crimes.
category: Data Leakage
keywords: Fuzzy Lookup
keywords: fuzzy matching
keywords: partial match query
keywords: broad search
keywords: wildcard lookup
keywords: SE database query
keywords: fuzzy record pull
keywords: blurred search
keywords: approximate match
usage example: Using only a vague delivery name and neighborhood, an investigator ran a Fuzzy Lookup in a social engineering database with hunter mode, cross-referencing to piece together a full ID number and three months of delivery records—a chillingly complete picture from fragments.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Completion
type: Term
break id: T0169
stix type: x-break-term
definition: The act of using technical means or social engineering databases to fill in missing identity numbers, names, and addresses to complete a personal profile.
description: In the data breach supply chain, 'completing the profile' is a downstream operation within illegal lookup services, often performed by intermediaries or data traffickers. They use fragmented information already in hand, combined with social engineering databases or insider channels, to piece together a full personal identity portrait. Completed data can then be used for targeted fraud, malicious debt collection, or resale for profit, directly worsening privacy violations.
category: Data Leakage
keywords: Data Completion
keywords: gap filling
keywords: record completion
keywords: identity patch
keywords: missing field fill
keywords: profile completion
keywords: data enrichment
keywords: attribute fill
keywords: lookup service
usage example: With a target's phone number and partial address, black-market operators opened lookup tools for Data Completion; by cross-referencing courier interfaces with credential-stuffing, they filled in the missing ID and full address within half an hour, paving the way for precise fraud.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Database Owner
type: Term
break id: T0170
stix type: x-break-term
definition: A core underground figure who controls and operates social engineering databases, credential-stuffing data, or leaked databases.
description: The database owner is a key node in the underground data trading ecosystem, responsible for illegally acquiring, organizing, and distributing vast amounts of sensitive data. They provide query services through sales, subscriptions, or membership models, forming the upstream supply chain of the data black market. Often collaborating with insiders and hackers to continuously update data sources, database owners are the foundational support for various types of targeted fraud and identity theft.
category: Data Leakage
keywords: Database Owner
keywords: db admin
keywords: data broker
keywords: leak operator
keywords: combolist owner
keywords: db operator
keywords: data vault owner
keywords: leak curator
keywords: data lord
usage example: "Bank transaction records, any bank, stable, express line departing this Sunday evening, results back by Tuesday or Wednesday."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related threat actors: Data Brokers
related threat actors: Personal Data Traffickers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Residual Data
type: Term
break id: T0171
stix type: x-break-term
definition: Leftover data from a one-time illegal lookup that was not directly used and can be resold.
description: In illicit data trading, leftovers refer to surplus personal information from a single query, such as extra ID numbers or addresses. This data is not discarded but is repackaged by intermediaries and fed into social engineering databases or sold at low prices to downstream criminals. The circulation of leftovers broadens the scope of data breaches, exposing more victims to harassment and fraud risks.
category: Data Leakage
keywords: Residual Data
keywords: leftover lookups
keywords: partial PII resale
keywords: data scraps
keywords: lookup remnants
keywords: residual records
keywords: social engineering feeds
keywords: one-time query surplus
keywords: intermediary resale data
usage example: The upstream seller listed leftover query results as Residual Data on a darknet market, noting "first-hand KYC, only three hands old," meaning the info had been resold multiple times—cheaper but likely flagged by risk control, leaving buyers to assume the risk.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Counter Channel
type: Term
break id: T0172
stix type: x-break-term
definition: A code name used in underground circles for an insider within a bank, implying they can provide authentic and reliable financial data.
description: 'Counter' typically refers to a bribed or exploited bank employee who abuses their access to illegally query sensitive information such as customer accounts and transaction records. Underground actors use this term to tout the authority and timeliness of the data source to attract buyers. Such insider behavior directly undermines the credibility of financial institutions and is a critical link in financial fraud and money laundering.
category: Data Leakage
keywords: Counter Channel
keywords: bank insider lookup
keywords: insider data channel
keywords: financial insider access
keywords: teller-sourced data
keywords: internal bank leak
keywords: insider data broker
keywords: branch-level source
keywords: insider query service
usage example: "Counter, full range, results back on Sunday, prices are extremely low, hit me up for orders."
related risks: Data Breach
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Fast Track Query
type: Term
break id: T0173
stix type: x-break-term
definition: An illicit channel that provides extremely fast data queries, delivering feedback within minutes.
description: The express line is a high-efficiency data acquisition method in the upstream underground market, often relying on compromised government systems or automated interfaces to rapidly return target information. It is used for urgent lookup needs, such as real-time location tracking or instant identity verification. The existence of express lines indicates that criminal networks have penetrated high-speed information networks, greatly enhancing criminal efficiency.
category: Data Leakage
keywords: Fast Track Query
keywords: rapid data retrieval
keywords: real-time lookup
keywords: instant query service
keywords: high-speed data channel
keywords: on-demand data pull
keywords: express data lookup
keywords: quick-turnaround query
keywords: live data feed
usage example: "Bank transaction records, any bank, stable, express line departing this Sunday evening, results back by Tuesday or Wednesday."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Slow Track Query
type: Term
break id: T0174
stix type: x-break-term
definition: An illicit channel that provides slow data queries, with feedback taking from one day to several days.
description: The slow line refers to a data lookup method that relies on special relationships or manual operations, such as a corporate insider manually exporting data. Although timeliness is poor, it may access deeper information that express lines cannot cover, such as historical records or encrypted files. The slow line is often used for non-urgent bulk data reselling and serves as a covert, long-term infiltration channel for underground networks.
category: Data Leakage
keywords: Slow Track Query
keywords: delayed data retrieval
keywords: batch query service
keywords: slow-turnaround lookup
keywords: insider-sourced slow data
keywords: corporate insider channel
keywords: offline data pull
keywords: manual data retrieval
keywords: delayed record lookup
usage example: The buyer urgently needed a full household file, but the channel explicitly said only a Slow Track Query was possible; data had to be exported layer by layer from the internal network, taking at least two days with no rush fee accepted, signaling strict risk controls.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Data Euphemism
type: Term
break id: T0175
stix type: x-break-term
definition: A coded term used on public social platforms to evade censorship, where 'fruit' refers to illegally obtained personal data.
description: Underground actors use fruit as a euphemism for illicitly acquired personal information on platforms like Tieba to bypass keyword filtering. Such coded language often appears in sales posts, paired with terms like 'first-hand' and 'complete' to emphasize data quality. It obscures the transaction intent, making it imperceptible to ordinary users while precisely reaching underground buyers, thereby fueling the trade in personal information.
aliases: Fruit
category: Data Leakage
keywords: Data Euphemism
keywords: fruit slang for data
keywords: data obfuscation term
keywords: evasion keyword for data
keywords: Tieba data slang
keywords: data black market euphemism
keywords: first-hand fruit
keywords: data vendor slang
keywords: censorship evasion term
usage example: "Selling various first-hand fruit, complete customer information, full refund if a single entry doesn't match."
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Manual Welfare Data Harvesting
type: Term
break id: T0176
stix type: x-break-term
definition: The practice of manually collecting personal information from poverty alleviation aid recipients at scale through social media and other channels by fraud rings.
description: This is a targeted data harvesting method used by fraud rings against vulnerable populations. Operators pose as aid workers to trick targets into providing sensitive details such as ID numbers and home addresses. The collected data is then sold to scam syndicates for use in subsidy fraud schemes or identity theft. This activity exploits social goodwill and causes significant harm.
category: Data Leakage
keywords: Manual Welfare Data Harvesting
keywords: welfare data scraping
keywords: poverty relief data harvesting
keywords: manual data collection
keywords: social engineering data gathering
keywords: beneficiary data mining
keywords: welfare list harvesting
keywords: hand-collected PII
keywords: aid recipient data extraction
usage example: Several runners practiced Manual Welfare Data Harvesting from township public notice boards and WeChat groups, transcribing names, ID numbers, and subsidy amounts of impoverished households into spreadsheets, then packaging them for scammers who pose as poverty relief officials.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS04
related business scenes: BS01
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Ponzi-App Data Harvesting
type: Term
break id: T0177
stix type: x-break-term
definition: The practice of scraping personal data in bulk from fraudulent investment apps by black market actors.
description: Black market groups perform targeted data extraction on fake investment and financial scam apps to harvest victim identity information. These victims typically have active bank accounts, and the data, once cleaned and organized, is resold to downstream groups for money laundering activities such as fraudulent card cashing.
category: Data Leakage
keywords: Ponzi-App Data Harvesting
keywords: investment scam data harvesting
keywords: capital pool data collection
keywords: Ponzi scheme data mining
keywords: fraudulent platform data extraction
keywords: investor data harvesting
keywords: scam app data collection
keywords: money mule data sourcing
keywords: card fraud data supply
usage example: "Large batches of pyramid scheme and poverty relief leads available, scraped from investment scam apps. Serious buyers only! Scammers stay away!"
related risks: Web Scraping Risk
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Background Check Service
type: Term
break id: T0178
stix type: x-break-term
definition: An illicit service that reverse-looks up a target's full personal dossier using a single piece of information like a phone number.
description: Exploiting insider access or system vulnerabilities, black market actors can query a target's identity, address, bank card numbers, and assets using just a phone number. This service often includes querying, decryption, and forced account access, serving as a core component of illegal data trading that provides precise intelligence for downstream fraud and extortion.
category: Data Leakage
keywords: Background Check Service
keywords: personal dossier lookup
keywords: phone-to-identity lookup
keywords: full background check
keywords: identity record retrieval
keywords: asset lookup service
keywords: address lookup service
keywords: bank card lookup
keywords: data broker background check
usage example: A private investigator's ad was simple: one phone number, a full Background Check Service. By inputting a mobile number, he could reverse-lookup the owner's household registration, vehicles, marriage, and travel records, charging thousands per query, mostly for debt dispute clients.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Basic Identity File
type: Term
break id: T0179
stix type: x-break-term
definition: A basic personal profile containing an ID photo, name, ID number, and detailed residential address.
description: This is the most fundamental personal information unit in illegal data trading, typically including a citizen's ID card front photo, name and ID number, and detailed address. Due to its completeness, this information is a basic material for identity theft and targeted scams, circulating frequently in the black market.
category: Data Leakage
keywords: Basic Identity File
keywords: ID photo record
keywords: two-factor identity file
keywords: basic KYC record
keywords: personal detail file
keywords: ID front-back record
keywords: identity document file
keywords: residential address record
keywords: basic PII record
usage example: "Individual profiles, front and back of ID, instant delivery before 6 PM."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Identity Dossier
type: Term
break id: T0180
stix type: x-break-term
definition: High-resolution photos or scans of the front and back of a citizen's ID card, containing core identity information like name, address, and ID number.
description: A black market term for acquired high-resolution images of both sides of an ID card, with complete and valid information. These materials are often used to bypass real-name verification, register illegal accounts, or forge documents, making them a core commodity for identity fraud crimes.
category: Data Leakage
keywords: Full Identity Dossier
keywords: high-res ID scan
keywords: ID card front and back
keywords: identity document image
keywords: ID card copy
keywords: document forgery source
keywords: identity theft document
keywords: two-sided ID image
keywords: full ID card scan
usage example: "National 'priest' available, valid expiry dates, 6 USDT each. Online all day, send as many as you have."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Real-Name Identity Verification
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Head-of-Household File
type: Term
break id: T0181
stix type: x-break-term
definition: A type of record check that only retrieves the householder's page and ID photo from a family register.
description: A specific type of illegal record check where black market actors obtain the householder's information through illicit channels. The data is limited to the householder and does not include other family members, often used for targeted scams or asset investigations against the head of the household.
category: Data Leakage
keywords: Head-of-Household File
keywords: household head data
keywords: head-of-household lookup
keywords: family register main page
keywords: household head ID photo
keywords: single-page household record
keywords: HOH record check
keywords: household head retrieval
keywords: head-of-household PII
usage example: "This batch of single-head-full-household is 25 USDT, one batch per day."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Household File
type: Term
break id: T0182
stix type: x-break-term
definition: A type of record check that retrieves the ID photos and information of all immediate family members in a household register.
description: The most comprehensive type of illegal record check, where black market actors can obtain the ID photos and household registration information of an entire family. The damage from such a data leak is immense, as it is often used for targeted family scams, extortion, or organized identity theft.
category: Data Leakage
keywords: Full Household File
keywords: full family register
keywords: all household members
keywords: complete household PII
keywords: family member ID photos
keywords: household headshots
keywords: entire household data
keywords: full family lookup
keywords: household register dump
usage example: The creditor paid a high price for a Full Household File lookup; the delivered dossier included not just the debtor's ID front and back, but also ID photos and household records of their spouse, children, and parents, which he planned to use to pressure them one by one.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Household Text Record
type: Term
break id: T0183
stix type: x-break-term
definition: A type of record check that provides a text-only description of household members, including names, ID numbers, and relationships.
description: A text-based household registration information service provided by black market actors. It lacks photos but includes key textual data like names, ID numbers, and familial relationships. This plain text format is easy to transmit and process, often used for batch matching, credential stuffing, or as an index for querying more complete household information.
category: Data Leakage
keywords: Full Household Text Record
keywords: household text data
keywords: family member text record
keywords: household member names
keywords: ID number household list
keywords: text-based household lookup
keywords: family relationship text
keywords: household text dump
keywords: full text household
usage example: "Text-only full records with relationships, Chunjiang escrow accepted."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Spouse Lookup
type: Term
break id: T0184
stix type: x-break-term
definition: An illicit service for querying a target's spouse information through API vulnerabilities or social engineering databases.
description: Black market actors refer to spouse information as 'po' and obtain it through two main methods: real-time querying via system API vulnerabilities, or retrieval from previously leaked social engineering databases. Acquiring spouse information is commonly used to aid fraud, blackmail, or to complete a target's social relationship map.
category: Data Leakage
keywords: Spouse Lookup
keywords: spouse data query
keywords: marital status lookup
keywords: spouse name lookup
keywords: partner information retrieval
keywords: spouse ID number
keywords: marriage record lookup
keywords: spouse API exploit
keywords: spouse database query
usage example: "National text-based 'po' with marriage/divorce status, bonus: both parties' frequently used phone numbers, with dates, instant delivery."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Name-By-Phone Lookup
type: Term
break id: T0185
stix type: x-break-term
definition: An illegal data lookup service that provides the real name associated with a phone number.
description: In underground data markets, 'Dian Bai' is a type of lookup service where buyers submit a target's phone number, and sellers use internal access or leaked databases to return the corresponding real name. This service is commonly used in telecom fraud for identity verification or precision marketing scams, enabling criminals to quickly identify targets for further fraud or data resale.
category: Data Leakage
keywords: Name-By-Phone Lookup
keywords: phone-to-name lookup
keywords: reverse phone lookup
keywords: phone number name match
keywords: caller ID lookup
keywords: phone subscriber name
keywords: phone identity lookup
keywords: phone PII retrieval
keywords: phone-to-name service
usage example: A debt collector boasted in a group about using a Name-By-Phone Lookup interface; inputting a debtor's mobile number directly returned their real name. Though lacking other fields, cross-referencing with delivery addresses was enough to track down a defaulter who had disappeared for half a year.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Subscriber Lookup
type: Term
break id: T0186
stix type: x-break-term
definition: The personal identity information of the actual user or registered owner of a mobile phone number.
description: In illegal data trading, 'owner info' typically includes the name, national ID number, and linked accounts of the phone number's user. Fraudsters obtain this data through insider access or leaked databases, using it for targeted scams, account takeover, or identity theft. This information is often sold in bulk at low prices, serving as a foundational resource for downstream crimes.
category: Data Leakage
keywords: Subscriber Lookup
keywords: phone owner info
keywords: subscriber PII
keywords: phone account holder
keywords: registered phone owner
keywords: subscriber ID number
keywords: phone user identity
keywords: subscriber data lookup
keywords: phone owner details
usage example: Owner info for 4u each, orders fulfilled via insider access, any escrow accepted, priority for those with groups.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Three-Network Data
type: Term
break id: T0187
stix type: x-break-term
definition: User information data from China's three major telecom operators: China Mobile, China Telecom, and China Unicom.
description: In illegal data trading, 'Three Networks' data covers subscriber information across all three major carriers, allowing fraudsters to conduct batch queries or correlation analysis. This data is frequently used to filter targets, send scam messages, or carry out precision marketing harassment. Leaked three-network information provides a vast pool of potential victims for telecom fraud and marketing scams.
category: Data Leakage
keywords: Three-Network Data
keywords: China Mobile data
keywords: China Telecom subscriber
keywords: China Unicom records
keywords: carrier subscriber data
keywords: telecom subscriber lookup
keywords: mobile carrier data
keywords: three-carrier lookup
keywords: carrier PII data
usage example: Bulk queries for phone numbers registered under the three networks, rock-bottom prices.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Four-Factor PII
type: Term
break id: T0188
stix type: x-break-term
definition: The four core pieces of financial information: cardholder name, national ID number, bank card number, and bank-registered phone number.
description: In illegal data trading, the 'Four Elements' are critical for financial fraud and account takeover. Criminals obtain this data through insider leaks or database breaches, using it for unauthorized transactions, money laundering, or fraudulent loan applications. With all four elements, attackers can gain near-total control over a victim's financial accounts, posing an extreme risk.
category: Data Leakage
keywords: Four-Factor PII
keywords: bank card PII
keywords: cardholder identity
keywords: bank account details
keywords: financial PII set
keywords: cardholder name ID
keywords: bank verification data
keywords: four-point PII
keywords: bank card owner data
usage example: Bank four elements, legendary insider material, act fast or miss out.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Identity Document Set (4-Piece)
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Card Reverse Lookup
type: Term
break id: T0189
stix type: x-break-term
definition: An illegal lookup service that reverse-queries a bank card number to retrieve the cardholder's name, national ID number, and registered phone number.
description: In underground data markets, 'Card Reverse' is a service where buyers provide a bank card number, and sellers use internal channels or leaked data to trace the cardholder's identity. This operation is often used in telecom fraud for identity verification or to supply critical information for downstream crimes like unauthorized transactions and money laundering.
category: Data Leakage
keywords: Card Reverse Lookup
keywords: bank card lookup
keywords: cardholder reverse lookup
keywords: card-to-identity lookup
keywords: bank card owner search
keywords: cardholder name query
keywords: bank card PII lookup
keywords: card number identity
keywords: reverse card search
usage example: After obtaining a debtor's bank card number, a debt collector immediately turned to a **Card Reverse Lookup** service on the black market. Within minutes, they retrieved the debtor's real name, ID number, and registered phone number, then launched a relentless barrage of harassing phone calls.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

QR-Code Reverse Lookup
type: Term
break id: T0190
stix type: x-break-term
definition: An illegal lookup service that reverse-queries a software account's QR code to retrieve the associated phone number.
description: In illegal data trading, 'Code Reverse' is a service where fraudsters provide a target account's QR code, and sellers use technical means or internal interfaces to trace the bound phone number. This service is commonly used for identity mining after social media account takeover or to provide contact leads for precision scams.
category: Data Leakage
keywords: QR-Code Reverse Lookup
keywords: QR code lookup
keywords: QR-to-phone lookup
keywords: QR code identity
keywords: scan-to-phone lookup
keywords: QR phone number
keywords: code-to-phone lookup
keywords: QR account lookup
keywords: QR reverse search
usage example: Accepting code reverse orders, all reverse queries accepted, high efficiency and speed, no tricks.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

ID Issuance Region Lookup
type: Term
break id: T0191
stix type: x-break-term
definition: An illegal lookup service that queries the household registration location based on a national ID number.
description: In underground data markets, 'ID Location' is a service where fraudsters use the first six digits of a national ID number to determine the target's place of household registration. This information is often used to filter victims by region or conduct geographically targeted marketing scams, helping criminals narrow down their target pool.
category: Data Leakage
keywords: ID Issuance Region Lookup
keywords: ID prefix lookup
keywords: household registration query
keywords: ID card first six digits
keywords: ID origin check
keywords: national ID region code
keywords: ID number segmentation
keywords: ID geographic lookup
usage example: Can filter by region, ID location and phone location, contact for real-name verification orders.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Phone Attribution Lookup
type: Term
break id: T0192
stix type: x-break-term
definition: An illegal lookup service that queries the carrier and geographic location associated with a phone number.
description: In illegal data trading, 'Phone Location' is a service where fraudsters input a phone number to obtain its carrier and registered location. This service is commonly used to pinpoint targets, analyze their activity range, or provide geographic context for telecom fraud and marketing harassment.
category: Data Leakage
keywords: Phone Attribution Lookup
keywords: phone carrier lookup
keywords: phone geographic origin
keywords: mobile number attribution
keywords: phone prefix lookup
keywords: carrier identification
keywords: phone region code
keywords: mobile number origin check
usage example: Can filter by region, phone location, contact for real-name verification orders.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Name-Phone-Time Data
type: Term
break id: T0193
stix type: x-break-term
definition: A standardized data format in underground data trading that bundles a person's name, phone number, and a timestamp.
description: This format is a basic information package sold by data brokers, typically sourced from insider leaks, database dumps, or social engineering databases. Buyers purchase records in bulk or by batch for telecom fraud lead generation, debt collection targeting, or precision marketing campaigns. The inclusion of a real-time timestamp helps assess data freshness and the target's active window, causing prices to fluctuate based on timeliness.
category: Data Leakage
keywords: Name-Phone-Time Data
keywords: name phone time data
keywords: consumer data bundle
keywords: PII with timestamp
keywords: fresh data leads
keywords: real-time PII feed
keywords: data batch with time
keywords: timestamped identity data
usage example: "We have fresh name-phone-time records dropping daily. Bosses who need them, please order in advance."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS02
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Address Lookup
type: Term
break id: T0194
stix type: x-break-term
definition: A detailed residential address with a full house number, illegally obtained from official systems in underground data lookup services.
description: Unlike vague addresses that only specify a district or county, these precise addresses are typically pulled from household registration, social security, or courier systems by malicious insiders. This data is used for in-person debt collection, offline retaliation, precision scams, or asset investigation, making it extremely dangerous. Due to its accuracy, it commands a much higher price than vague addresses and is often sold alongside names and national ID numbers.
category: Data Leakage
keywords: Full Address Lookup
keywords: full address data
keywords: complete residential address
keywords: doorplate lookup
keywords: precise address leak
keywords: address dump
keywords: residential address lookup
keywords: exact address query
usage example: "Real addresses for individual accounts, random batch of 2 versions out today, same-day return."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Fuzzy Address Lookup
type: Term
break id: T0195
stix type: x-break-term
definition: A vague address containing only the province, city, and district levels of administrative division, used in underground data lookup scenarios.
description: This type of address cannot pinpoint a specific house or residential compound and is mainly used for initial screening, bulk profiling, or to lower transaction costs. Data brokers often attract buyers with low prices, but the delivered content only includes administrative division names with no practical locating capability. In debt collection and fraud chains, vague addresses often serve as a low-cost lead to upsell buyers on a premium service for real addresses.
category: Data Leakage
keywords: Fuzzy Address Lookup
keywords: fuzzy address data
keywords: city-level address
keywords: district-level lookup
keywords: partial address query
keywords: administrative region lookup
keywords: blurred address info
keywords: non-precise address
usage example: "Nationwide vague addresses for individual accounts, 12 yuan each, still available, inquiries welcome."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Association Lookup
type: Term
break id: T0196
stix type: x-break-term
definition: An in-depth, illicit correlation query service that reveals a target's multi-dimensional relationships, such as cohabitants, institutional affiliations, marital ties, and shared travel or border-crossing records.
description: This service reconstructs a target's full social network by correlating data from multiple sources, and is commonly used for debt recovery, background checks, or intelligence gathering. Methods include bulk data export by insiders, system credential stuffing, or cross-departmental data aggregation. The output includes related individuals' names, national ID numbers, and relationship types. This service carries extreme risk and can easily trigger cascading privacy breaches and downstream criminal escalation.
category: Data Leakage
keywords: Full Association Lookup
keywords: deep association query
keywords: full social graph
keywords: relationship mapping
keywords: co-traveler lookup
keywords: co-residence lookup
keywords: multi-dimension association
keywords: comprehensive link analysis
usage example: A fraud ring first bought cheap **Basic Vehicle File** records containing only license plates and models. Unable to contact owners directly, they forged fake parking tickets with payment QR codes and stuck them on windshields, a scam that cost almost nothing to operate.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Basic Association Lookup
type: Term
break id: T0197
stix type: x-break-term
definition: A lightweight, illicit social relationship query service that outputs only the names and national ID numbers of related individuals.
description: This is a downgraded version of a full correlation query, providing only basic identifiers without specific relationship types or address extensions. It is often used to quickly identify people around a target, for bulk matching, or as a starting point for further queries. Data brokers typically sell these records at a low price per entry, combining them with other lookup services to lower the cost barrier for buyers.
category: Data Leakage
keywords: Basic Association Lookup
keywords: basic association query
keywords: name-only association
keywords: identity-only link
keywords: lightweight social graph
keywords: basic link lookup
keywords: minimal association data
keywords: identity correlation
usage example: "Ten-year flight and border-crossing records, single hotel check-in records, co-check-in records, ghost records, and basic relationship queries."
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Cohabitation Lookup
type: Term
break id: T0198
stix type: x-break-term
definition: A targeted, illicit query service that illegally obtains information about a specific person's cohabitants.
description: This service typically relies on hotel systems, household registration, or community grid data, pulled directly by insiders or through technical infiltration. The results are often used for debt collection, infidelity investigations, or personal threats, as they can precisely locate a target's living patterns and cohabitation relationships. Due to the highly sensitive privacy involved, this is a high-value, high-risk category in the underground data market and is often sold bundled with hotel check-in records.
category: Data Leakage
keywords: Cohabitation Lookup
keywords: cohabitation check
keywords: live-in partner lookup
keywords: shared residence query
keywords: co-living data
keywords: household member lookup
keywords: residence association
keywords: cohabitant search
usage example: Suspecting infidelity, someone ordered a **Cohabitation Lookup** through illicit channels. By entering a partner's ID number, they received details of all co-guests from hotel bookings over the past six months, a revelation that directly shattered their family.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Hotel Co-Stay Lookup
type: Term
break id: T0199
stix type: x-break-term
definition: An illicit data service that provides access to hotel check-in records and co-guest information.
description: This service directly taps into hotel Property Management Systems or public security lodging data sources through insiders, API abuse, or credential stuffing. The output includes check-in dates, hotel names, and the names and national ID numbers of co-guests. It is widely used for blackmail, infidelity evidence gathering, and debt collection by gambling rings. Data brokers often recruit agents in a pyramid scheme, settling payments per query or volume, and may offer escrow services to reduce buyer risk.
category: Data Leakage
keywords: Hotel Co-Stay Lookup
keywords: hotel co-stay
keywords: hotel guest lookup
keywords: co-check-in record
keywords: hotel stay history
keywords: guest companion query
keywords: lodging co-occupant
keywords: hotel room share
usage example: "Five-year hotel co-guest records. Looking for high-volume agents. Price depends on volume, DM for quote. Bulk orders get discounts. Two to three days for results. We only do co-guest records, five years only, escrow accepted."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Reducing Returns
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Vehicle-Under-Name Lookup
type: Term
break id: T0200
stix type: x-break-term
definition: An illicit data service that queries all vehicles registered under an individual's name.
description: This data is usually sourced from insiders at the vehicle administration or through leaked system interfaces. Output fields include license plate number, vehicle model, registration date, and owner identity. The service is used for asset investigation, collateral fraud, vehicle tracking, or illegal debt collection, directly exposing a target's financial status. Underground operators often sell this data per page or per query, and bundle it with derivative services like transfer history and traffic violation handler records to create a complete vehicle information chain.
category: Data Leakage
keywords: Vehicle-Under-Name Lookup
keywords: vehicle ownership lookup
keywords: car registration query
keywords: vehicle under name
keywords: DMV data lookup
keywords: registered vehicle search
keywords: auto asset check
keywords: vehicle title lookup
usage example: "Direct-source vehicle records. One page, three pages, vehicles under a name, transfer history, traffic violation handlers. DMV-sourced vehicle records, same-day return."
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Full Vehicle File
type: Term
break id: T0201
stix type: x-break-term
definition: Vehicle registration data containing core personal identifiers such as the owner's name and national ID number, traded on the black market.
description: This data typically originates from internal leaks within vehicle administration offices. It is considered high-value information in underground data lookup services. After being obtained through insiders or system exploits, it is used for targeted fraud, identity theft, or debt collection. Due to its completeness, downstream criminal groups are willing to pay a premium for it.
category: Data Leakage
keywords: Full Vehicle File
keywords: Vehicle registration data
keywords: DMV leak
keywords: Car registration lookup
keywords: VIN data
keywords: Vehicle owner info
keywords: Plate-to-VIN lookup
keywords: DMV insider
keywords: Fullz car
usage example: To precisely target new customers, a used car dealer bought a batch of **Full Vehicle File** records from the dark web. The files contained the names and IDs of recent vehicle owners, whom he cold-called to pitch insurance and loans, achieving an exceptionally high conversion rate.
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Basic Vehicle File
type: Term
break id: T0202
stix type: x-break-term
definition: Basic vehicle registration data containing only information like license plate number and vehicle model, traded on the black market.
description: Unlike full vehicle records, this data does not include the owner's personal identity information. Leaks often originate from vehicle administration offices or insurance systems. Underground actors use it for license plate cloning, evading traffic penalties, or as a stepping stone to acquire more detailed owner information. Its lower acquisition cost leads to higher circulation volumes in the market.
category: Data Leakage
keywords: Basic Vehicle File
keywords: License plate lookup
keywords: VIN lookup
keywords: Vehicle basic info
keywords: Car plate data
keywords: Registration plate search
keywords: Vehicle details lookup
keywords: Plate search
usage example: A fraud gang purchased a batch of basic vehicle files at low cost containing only plate numbers and vehicle models. Although they couldn't directly contact owners, they used the information to forge parking violation notices stuck on windshields, tricking car owners into scanning QR codes to pay fake fines.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS11
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Travel-Trail Lookup
type: Term
break id: T0203
stix type: x-break-term
definition: An underground service that tracks an individual's movements by illegally obtaining travel records such as flight and train bookings.
description: Data is often sourced from internal leaks in ticketing systems or the abuse of third-party APIs, packaged and sold as a lookup service. This service is frequently used to track specific targets, monitor business competitors, or conduct precision fraud. Its ability to reflect real-time personal movements poses a severe threat to individual privacy and security.
category: Data Leakage
keywords: Travel-Trail Lookup
keywords: Flight records lookup
keywords: PNR data
keywords: Travel history search
keywords: Flight manifest data
keywords: Airline booking data
keywords: Passenger name record
keywords: Travel surveillance
usage example: "Flight records + entry/exit records, affordable price / fast turnaround"
related risks: Real-World Identity Theft
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS04
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Movement-Trail Lookup
type: Term
break id: T0204
stix type: x-break-term
definition: An illegal service that tracks an individual's travel patterns by aggregating data from transportation, accommodation, and other sources.
description: This service integrates data from hotel stays, traffic checkpoints, and other sources to map a target's complete activity trail. Underground actors use this intelligence to support serious crimes such as aggressive debt collection, illegal investigation, and even kidnapping. Its danger lies in piecing together fragmented information into a comprehensive portrait of a person's movements.
category: Data Leakage
keywords: Movement-Trail Lookup
keywords: Location tracking
keywords: Hotel records lookup
keywords: Surveillance data
keywords: Movement history
keywords: Geolocation data
keywords: Border crossing records
keywords: Itinerary data
usage example: A creditor paid handsomely for a **Movement-Trail Lookup** service to track a debtor who had fled. By integrating flight and high-speed rail records, the black market operators pushed a complete real-time route map of the debtor's escape from a major city back to their hometown.
related risks: Data Breach
related risks: User Privacy Leakage
related risks: Real-World Identity Theft
related risks: Privilege Escalation / Unauthorized Access
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related attack tools: Social Engineering Database
related attack tools: Infostealers
related threat actors: Data Brokers
related threat actors: Data Broker
related threat actors: Malicious Hackers
related business scenes: BS00
related business scenes: BS01
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Multi-Lender Data
type: Term
break id: T0207
stix type: x-break-term
definition: Data leaked from shared online lending databases that records a borrower's applications to multiple institutions within a short period.
description: This data originates from risk-control systems built jointly by multiple online lending companies to identify high-risk borrowers. After acquisition, underground actors can precisely target individuals in urgent need of money for scams like 'student loan cancellation' or 'loan deposit' fraud. Leaks typically occur through system interface abuse or insider trading.
category: Data Leakage
keywords: Multi-Lender Data
keywords: Loan stacking
keywords: Multiple loan applications
keywords: Borrower behavior data
keywords: Credit inquiry data
keywords: Loan application history
keywords: Debt consolidation data
keywords: Loan stacking detection
usage example: A loan platform's risk control flagged an anomaly when an applicant was hit by a **Multi-Lender Data** check. It revealed the user had submitted applications to over twenty small loan platforms within two weeks, leading to an immediate rejection for suspected group fraud.
related risks: Platform Online Loan Fraud
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related business scenes: BS00
related business scenes: BS01
citation: [Underground Big Data] 2025 H1 Internet Underground Trend Annual Summary
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Small-Loan App Data
type: Term
break id: T0209
stix type: x-break-term
definition: Refers to user data from micro-lending platforms with extremely low application thresholds and simple approval processes, illegally traded as 'Rongdan material' in underground markets.
description: These platforms typically lack strict risk controls, attracting a large number of borrowers in urgent need of cash. After obtaining user information from these platforms, black-market actors package and resell it as 'Rongdan material.' Downstream buyers use this data to conduct targeted scams or secondary marketing. Due to the high authenticity of the data, the potential harm is significant.
category: Data Leakage
keywords: Small-Loan App Data
keywords: Microloan platform
keywords: Payday loan data
keywords: Small loan app
keywords: Quick loan data
keywords: Cash loan data
keywords: Easy loan data
keywords: Microlending data
usage example: A data broker was hawking the latest **Small-Loan App Data** on Telegram. The user profiles leaked from a financing guarantee platform were full of unemployed students and housewives, which a fraud ring purchased to use as precisely targeted leads for pig-butchering scams.
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Black Five Categories
type: Term
break id: T0215
stix type: x-break-term
definition: Refers to consumer data from e-commerce platforms for five sensitive product categories: pharmaceuticals, medical devices, breast enhancement, weight loss, and height increase products.
description: Due to the clear privacy concerns and specific consumer needs of buyers for these products, this data holds high value on the black market. After obtaining it, black-market actors resell it to other fraud rings for targeted scams, such as impersonating specialists for follow-up calls or peddling fake medicines and health supplements.
category: Data Leakage
keywords: Black Five Categories
keywords: black five data
keywords: sensitive product data
keywords: health product data
keywords: weight loss data
keywords: breast enhancement data
keywords: medical product data
keywords: diet product data
keywords: cosmetic procedure data
usage example: 'Selling weight loss, freckle removal, breast enhancement, and other black-five-category data, real-time ordering users, super effective results!!'
related risks: Data Breach
related risks: User Privacy Leakage
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Legal Action
related avoidances: Digital Watermark/Text Watermark
related threat actors: Data Brokers
related threat actors: Data Broker
related business scenes: BS00
related business scenes: BS02
citation: Black Market Big Data: 2024 Data Leakage Risk Landscape Report
citation: Black Market Big Data: 2025 H1 Data Leakage Risk Landscape Report
updated: 2026-06-16
version: 1

Order Padding
type: Term
break id: T0216
stix type: x-break-term
definition: A form of marketing fraud involving the creation of fictitious orders to falsify sales volume, evade platform penalties, or fraudulently obtain subsidies.
description: Merchants or click-farm rings organize large numbers of fake accounts to place orders, creating a false impression of product popularity to boost search rankings. This activity is particularly rampant during major e-commerce promotions, used to siphon off platform-issued coupons and promotional commissions. This behavior severely undermines market fairness and harms the interests of genuine consumers.
category: Business Fraud
keywords: Order Padding
keywords: fake order padding
keywords: order inflation
keywords: sales volume padding
keywords: fake order generation
keywords: order boosting
keywords: sales padding
keywords: order fabrication
keywords: transaction padding
usage example: 'Merchants needing review and order padding, please find me, first-hand brand'
related risks: Order Brushing
related risks: Fake Transactions
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Scrape-and-Blast
type: Term
break id: T0217
stix type: x-break-term
definition: Data scraping and bulk messaging is an automated black-market tool that integrates data harvesting and mass distribution functions.
description: This tool first illegally collects personal information such as phone numbers and social media accounts through web scraping or social engineering databases. It then sends advertisements, phishing links, or fraudulent messages in bulk via SMS, private messages, or group chats. Operators often use centralized control systems to dispatch tasks with a single click, enabling large-scale harassment or traffic diversion. Such practices severely violate user privacy and are a common method for customer acquisition and dissemination in marketing fraud and telecom scams.
category: Business Fraud
keywords: Scrape-and-Blast
keywords: data scraping
keywords: bulk messaging
keywords: SMS blast
keywords: mass DM
keywords: contact scraping
keywords: auto messaging
keywords: lead scraping
keywords: scrape and spam
usage example: Use this software to scrape a batch of accounts first, then blast private messages with links—the backend runs the whole task in one go.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Refund Harvesting
type: Term
break id: T0218
stix type: x-break-term
definition: Purchase-and-return fraud is a scheme where fraudsters buy products in bulk and then return them en masse to exploit subsidies or rebates.
description: Operators typically take advantage of new-user promotions, discount subsidies, or commission policies on platforms. They place bulk orders and then trigger the return process to pocket the price difference or rebates. This activity is especially rampant during major e-commerce sales events, creating fake transactions that distort sales data and undermine platform risk control systems. The practice not only causes financial losses for merchants but may also lead to false flags against legitimate users.
category: Business Fraud
keywords: Refund Harvesting
keywords: refund abuse
keywords: return harvesting
keywords: refund fraud
keywords: rebate harvesting
keywords: subsidy refund
keywords: refund scam
keywords: return fraud
keywords: refund siphoning
usage example: We can run purchase-and-return on this promotion—place orders to get the subsidies first, then return everything later.
related risks: Malicious Returns
related risks: Bulk Refunds
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related business scenes: BS02
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

CVV
type: Term
break id: T0219
stix type: x-break-term
definition: CVV is the security code on the back of a bank card, used to verify the cardholder's identity.
description: In credit card fraud scenarios, the CVV is often illegally obtained and sold along with the card number and expiration date for online theft. Black-market actors steal complete credit card information through phishing sites, database breaches, or malware, then quickly monetize it on overseas websites or virtual goods platforms. A compromised CVV means the card faces an extremely high risk of unauthorized use.
category: Business Fraud
keywords: CVV
keywords: CVV dump
keywords: CVV shop
keywords: CVV fraud
keywords: card verification value
keywords: CVV bin
keywords: CVV fullz
keywords: CVV base
keywords: CVV checker
usage example: Fresh batch of CVVs available, global selection, escrow accepted.
related risks: Credit Card Fraud
related risks: Stolen Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS01
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Cross-Channel Arbitrage
type: Term
break id: T0220
stix type: x-break-term
definition: Cross-channel arbitrage is the unauthorized sale of goods across regions or channels to gain illicit profits.
description: In e-commerce, black-market actors exploit subsidy differences between platforms by moving goods purchased through low-cost channels to higher-priced platforms, undermining the brand's pricing system. This practice is often combined with fake transactions and brushing orders to capture platform subsidies or bypass authorization restrictions. Cross-channel arbitrage not only harms brand interests but also disrupts market order.
category: Business Fraud
keywords: Cross-Channel Arbitrage
keywords: channel arbitrage
keywords: cross-platform arbitrage
keywords: regional arbitrage
keywords: price arbitrage
keywords: unauthorized distribution
keywords: channel conflict
keywords: grey market goods
keywords: parallel import
usage example: A brand discovered a regional dealer engaging in **Cross-Channel Arbitrage**, secretly selling high-cold-resistance engine oil meant for the north into the southern market. This caused low-price disruption locally, and the violating dealer was ultimately traced via a covert code on the packaging.
related risks: Buy Low, Sell High
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Contractual Clause Restrictions
related avoidances: Legal Action
related avoidances: Customer Service Follow-Up Confirmation
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Account Babysitting
type: Term
break id: T0221
stix type: x-break-term
definition: Proxy account farming is a service provided by black-market operators to keep accounts online in bulk and automatically execute tasks.
description: Operators use scripts or centralized control systems to maintain account activity on behalf of clients, automatically completing tasks such as check-ins, browsing, and liking to earn platform rewards or nurture accounts. This service is widely used in click-farm studios, where large numbers of accounts are operated to exploit platform incentives. Long-term proxy farming distorts platform ecosystem data and encroaches on legitimate user benefits.
category: Business Fraud
keywords: Account Babysitting
keywords: Account Sitting
keywords: Account Farming
keywords: Auto Check-in Bot
keywords: Account Warming
keywords: Account Nurturing
keywords: Engagement Farming
keywords: Bot Herding
keywords: Account Management Service
usage example: Proxy farming available, stable monthly income, just sit back and cash out.
related risks: AFK / Idle Behavior
related risks: Process Automation
related risks: Third-Party Account Aggregation
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Automated Account Seasoning
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS06
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Account Registration Service
type: Term
break id: T0222
stix type: x-break-term
definition: Proxy registration is a service that creates platform accounts in bulk on behalf of others, often to bypass real-name restrictions or for mass account nurturing.
description: Black-market actors use SMS verification platforms, virtual numbers, or fake identity information to rapidly register large numbers of accounts for subsequent brushing, traffic diversion, or fraud. This service provides foundational resources for downstream black-market activities and is the starting point of the account fraud chain. Bulk-registered accounts are easily used for sending spam or conducting targeted scams.
category: Business Fraud
keywords: Account Registration Service
keywords: Bulk Account Registration
keywords: Mass Account Creation
keywords: SMS Registration Service
keywords: Virtual Number Registration
keywords: Registration as a Service
keywords: Account Factory
keywords: Reg Farm
keywords: Account Generation
usage example: Proxy registration open, the loophole is closing soon, hurry up.
related risks: Bulk Account Registration
related risks: Virtual Number Registration
related risks: Fake Registration
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Crypto Theft
type: Term
break id: T0223
stix type: x-break-term
definition: Crypto theft refers to the illegal acquisition of others' cryptocurrency (such as USDT) through fraudulent means.
description: Black-market actors often use phishing links, malicious smart contracts, or private key theft to gain access to victims' wallets and transfer assets. The stolen cryptocurrency is typically laundered through mixers or money-muling platforms before being cashed out. Due to the anonymity of blockchain transactions, recovering losses is extremely difficult, and victims often face direct financial damage.
category: Business Fraud
keywords: Crypto Theft
keywords: Crypto Drainer
keywords: Wallet Drainer
keywords: USDT Theft
keywords: Crypto Sweeper
keywords: Blockchain Theft
keywords: Seed Phrase Theft
keywords: Crypto Heist
keywords: Wallet Siphoning
usage example: A user clicked a fake airdrop link to authorize their wallet, resulting in instant **Crypto Theft**. USDT worth hundreds of thousands was automatically transferred out without triggering any secondary verification. A subsequent investigation revealed the private key had been compromised all along.
related risks: Private Key Leakage and Management Risks
related risks: Cryptocurrency Money Laundering Risk
related risks: Money Laundering Risk
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Cryptocurrency Mixers
related attack tools: Identity Document Set (4-Piece)
related attack tools: Malicious QR Code Generators
related threat actors: Money Laundering Gangs
related threat actors: Cryptocurrency Fraud Syndicate
related business scenes: BS02
related business scenes: BS15
related business scenes: BS01
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Switch Fraud
type: Term
break id: T0224
stix type: x-break-term
definition: A switch fraudster is a black-market operator who exploits platform return policies by returning counterfeit goods for genuine products to defraud merchants.
description: The operator purchases high-value genuine items, then returns counterfeit goods or empty packages, exploiting the time gap between courier acceptance and platform refunds. Switch fraudsters typically target luxury goods, electronics, and other high-value items, and may collude with couriers for fake delivery confirmations. This practice directly causes merchants to lose both goods and payment, driving up platform operating costs.
category: Business Fraud
keywords: Switch Fraud
keywords: Return Fraud
keywords: Refund Fraud
keywords: Package Switching
keywords: Return Scam
keywords: Wardrobing
keywords: Empty Box Scam
keywords: Return Theft
keywords: Switch Scam
usage example: A professional **Switch Fraud** artist ordered the latest smartphone on an e-commerce platform. Upon delivery, they swapped the real device with a high-quality dummy model and then filed for a no-questions-asked return and refund, a seamless operation that let them resell the genuine phone for profit.
related risks: Return Fraud
related risks: Fake Transactions
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Contractual Clause Restrictions
related avoidances: Legal Action
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Malicious Merchants
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Off-Platform Direct Complaint
type: Term
break id: T0225
stix type: x-break-term
definition: Bypassing a platform's internal reporting system by filing complaints directly through external official channels such as the 12315 consumer hotline or government petition offices to report marketing fraud.
description: Black and gray market actors or victimized users leverage external regulatory pressure to target marketing fraud, often escalating after exhausting internal platform remedies. This approach can trigger administrative intervention, forcing a platform or fraudster to respond quickly, but it may also be exploited maliciously to extort merchants. Operators typically gather evidence such as screenshots and transaction records to submit to authorities, though doing so risks exposing their own involvement in gray-market activities.
category: Business Fraud
keywords: Off-Platform Direct Complaint
keywords: External Complaint
keywords: 12315 Reporting
keywords: Regulatory Complaint
keywords: Off-Platform Escalation
keywords: Official Complaint Channel
keywords: Direct Report
keywords: External Escalation
keywords: Platform Bypass Complaint
usage example: A marketing firm suffered an **Off-Platform Direct Complaint** attack. Instead of using the in-app report button, a competitor organized a flood of users to file coordinated complaints via a 12315 mini-program using a scripted template, which ultimately got the victim's payment gateway frozen.
related risks: Malicious Complaints
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Number Status Check
type: Term
break id: T0226
stix type: x-break-term
definition: Using technical methods to check the status of phone numbers in bulk or in real time, filtering out invalid numbers such as disconnected, suspended, or powered-off lines.
description: In marketing fraud, telecom scams, or data trading, black and gray market actors first clean number databases with number-checking tools to eliminate invalid resources and reduce costs. Operators connect to third-party verification APIs or use custom scripts to query number statuses, selecting active numbers for registration, fake orders, or traffic driving. Active numbers can be resold at a premium, while risky ones are discarded, all aimed at improving the efficiency and hit rate of fraudulent operations.
category: Business Fraud
keywords: Number Status Check
keywords: Number Filtering
keywords: Active Number Check
keywords: Carrier Lookup
keywords: Phone Validation
keywords: Number Scrubbing
keywords: Line Status Detection
keywords: Number Hygiene
keywords: Active Line Check
usage example: Domestic number screening: active and risky number filtering, precise removal of disconnected and inactive numbers.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Phone Number Intelligence
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Real-Name Identity Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Multi-Instance Farming
type: Term
break id: T0227
stix type: x-break-term
definition: Running multiple accounts simultaneously on a single device using virtual machines or multi-instance tools for bulk fake engagement or account farming.
description: Black and gray market actors bypass 'one device, one account' controls by using device multi-opening technology to mass-manipulate accounts for fake orders, likes, or promo abuse. Operators deploy virtual environments or device-spoofing software to simulate independent device fingerprints, making multiple accounts appear to belong to different users. This behavior easily triggers platform association bans, but short-term survival is possible through IP proxies and parameter randomization, and it is commonly used in large-scale business fraud.
category: Business Fraud
keywords: Multi-Instance Farming
keywords: App Cloning
keywords: Parallel Space Farming
keywords: Virtual Machine Farming
keywords: Multi-Instance Sync
keywords: Instance Farming
keywords: Device Farming
keywords: Multi-Accounting
keywords: App Twin Farming
usage example: A click farm studio ran over a dozen emulator windows on a single computer, using **Multi-Instance Farming** techniques to simultaneously control numerous short-video accounts and inflate livestream viewer counts. The platform's risk control detected the shared device ID fingerprint and banned the entire operation in one sweep.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related attack tools: Mass Control Systems
related attack tools: Multi-Instance Tools
related attack tools: Device Spoofing Tools
related attack tools: Click Simulation Tools
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Custom Browsers
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Instant Ban
type: Term
break id: T0229
stix type: x-break-term
definition: An account or device being banned by a platform's risk-control system within an extremely short time after login.
description: When black and gray market actors log in using blacklisted devices, abnormal IPs, or cookie-cutter scripts, they trigger real-time risk controls resulting in an 'instant death.' This is common during bulk registration, credential stuffing, or early-stage account farming, where the account's lifespan is too short for subsequent fraud. Operators must constantly change IPs, device fingerprints, or login environments to counter this, but success rates are low, leading to high resource waste and increased costs.
category: Business Fraud
keywords: Instant Ban
keywords: Instant Account Lock
keywords: Immediate Suspension
keywords: Auto-Ban
keywords: Real-Time Ban
keywords: Login Ban
keywords: Zero-Day Ban
keywords: Account Termination
keywords: Instant Block
usage example: Real-name verified white accounts for all three carriers, all functions normal, guaranteed login, guaranteed instant death, now shipping.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Account Ban
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Limit Bypass
type: Term
break id: T0230
stix type: x-break-term
definition: Using technical means to bypass restrictions set by a platform or system, such as withdrawal limits, tier caps, or bans.
description: In marketing fraud, black and gray market actors exploit vulnerabilities or use custom tools to break through platform risk controls for greater profit. Examples include cracking withdrawal frequency limits, bypassing transaction caps, or lifting device bans, often combined with device spoofing and IP proxies. Operators may reverse-engineer app logic or purchase restriction-breaking services; while successful, this can sustain illicit cash flows, but once detected, the associated accounts and fund chains face retroactive crackdowns.
category: Business Fraud
keywords: Limit Bypass
keywords: Cap Bypass
keywords: Withdrawal Limit Bypass
keywords: Restriction Bypass
keywords: Ceiling Break
keywords: Cap Removal
keywords: Limit Removal
keywords: Restriction Lift
keywords: Ceiling Bypass
usage example: Overseas card restriction bypass, stable payouts, ignores risk controls.
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Fake Ordering
type: Term
break id: T0231
stix type: x-break-term
definition: Fabricating orders, reviews, and other fake transaction data to deceive platform algorithms and consumers for unfair exposure.
description: Black and gray market actors organize merchants or click-farm workers to create fake sales and positive reviews through self-buying, self-selling, and shipping empty packages. Operators recruit buyers through social groups to simulate real shopping processes, completing the full chain of ordering, payment, and receipt. This distorts fair market competition, misleads consumers, damages platform credibility, and can trigger legal risks in severe cases.
category: Business Fraud
keywords: Fake Ordering
keywords: brushing orders
keywords: fake reviews
keywords: fake sales
keywords: order padding
keywords: review padding
keywords: sales manipulation
keywords: e-commerce manipulation
usage example: E-commerce platform fake orders at 220 per order, come to me if you're a bro, stable settlements.
related risks: Order Brushing
related risks: Fake Transactions
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Harvest Intake
type: Term
break id: T0232
stix type: x-break-term
definition: The critical step in a fake order scheme where the click-farm worker physically receives the goods, confirms delivery, and posts a positive review.
description: In the e-commerce fake order chain, 'harvesting' marks the completion of a task: the worker receives an empty package or small gift, then confirms receipt and gives a five-star rating according to a script. The organizer uses this step to verify task completion before refunding the principal and paying the commission. This directly fabricates a closed transaction loop, deceiving the platform's credit system. Mass 'harvesting' can quickly build fake reputation, but it is susceptible to detection by logistics and review analysis models.
category: Business Fraud
keywords: Harvest Intake
keywords: confirm receipt
keywords: fake receipt
keywords: delivery confirmation
keywords: order completion
keywords: fake transaction
keywords: review confirmation
keywords: task completion
usage example: The task in the brushing group had reached the **Harvest Intake** stage. Shoppers were instructed to pick up packages from parcel lockers one by one, unbox them for staged photos, and then post five-star reviews with elaborate buyer showcases. Only after this step could they settle their commissions with the finance team.
related risks: Fake Reviews
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Join the Operation
type: Term
break id: T0233
stix type: x-break-term
definition: In fraud rings, the act of seizing an active window to exploit an arbitrage or compensation loophole before it is patched.
description: These opportunities are extremely short-lived, often lasting only hours to days before platform risk controls block them. “Getting on board” emphasizes racing against the closure window. Organizers post real-time status updates in chat groups, urging members to complete fraudulent orders or false claims using designated accounts and methods. Once the window closes, the same loophole may be permanently invalid, and participants must wait for the next exploit to surface.
category: Business Fraud
keywords: Join the Operation
keywords: exploit window
keywords: vulnerability window
keywords: exploit timing
keywords: window of opportunity
keywords: exploit rush
keywords: quick exploit
usage example: This shipping insurance loophole is still open for boarding. DM me now for the link if you want in.
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Contractual Clause Restrictions
related avoidances: Legal Action
related avoidances: Customer Service Follow-Up Confirmation
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Professional Counterfeit Claimants
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Cash Out
type: Term
break id: T0234
stix type: x-break-term
definition: Converting non-cash assets such as platform coupons, red packets, or loyalty points into cash through fake transactions or abuse of promotional rules.
description: Commonly seen in e-commerce subsidies and cashback campaigns, fraud rings use batches of fake accounts and sham orders to generate artificial transaction volume and drain platform subsidies. The operation chain typically involves card sellers, click workers, and money-mule networks, with profits split after liquidation. If risk controls lag, a single campaign can be drained of hundreds of thousands or even millions in funds.
category: Business Fraud
keywords: Cash Out
keywords: coupon cashout
keywords: voucher cashout
keywords: promo abuse
keywords: reward abuse
keywords: cashout scheme
keywords: subsidy abuse
keywords: promo cashout
usage example: Quick credit card cash-out guide, simple and efficient ⚡ Instant payout available.
related risks: Order Brushing
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Invalid Boost Burn
type: Term
break id: T0235
stix type: x-break-term
definition: In group-buying, bargaining, or referral campaigns, when a fraudulent assistance action performed by a fake account is invalidated by the platform’s risk engine.
description: Fraudsters promise clients a certain number of assists, but the platform’s risk controls flag the accounts as batch-registered, sharing device fingerprints, or exhibiting abnormal behavior, voiding the assist. For the buyer, money is spent but the progress bar does not move—a typical fraud loss. Service providers often guarantee “swallowed assists will be re-done” as a fallback.
category: Business Fraud
keywords: Invalid Boost Burn
keywords: boost invalidation
keywords: invalid boost
keywords: boost fail
keywords: assist fail
keywords: task invalidation
keywords: boost loss
keywords: assist loss
usage example: Anyone need xxx speed version assists? I’ll return 5 assists for your xxx; swallowed assists will be re-done.
related risks: Bulk Account Registration
related risks: Fake Transactions
related risks: Promotional Activity Cheating
related avoidances: Device Fingerprinting
related avoidances: Risk Control Strategy
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Contractual Clause Restrictions
related avoidances: Legal Action
related avoidances: Customer Service Follow-Up Confirmation
related attack tools: Bulk Account Registration Tool
related threat actors: Malicious Merchants
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Cooldown Account
type: Term
break id: T0236
stix type: x-break-term
definition: An account that was previously logged in on a device but is now logged out, often recycled by fraud rings for re-registration or volume farming.
description: Because these accounts retain login traces, they often pass initial platform risk checks more easily than brand-new accounts. Fraud rings collect logged-out accounts in bulk from internet cafés, device rental platforms, and similar sources, then use them for SMS verification, promo abuse, or fake traffic generation. Since the original user no longer controls the account, the actual operator can switch identities at will, complicating anti-fraud detection.
category: Business Fraud
keywords: Cooldown Account
keywords: used account
keywords: recycled account
keywords: second-hand account
keywords: account recycling
keywords: account reuse
keywords: pre-owned account
keywords: account repurposing
usage example: Buying all types of logged-out accounts (gaming logged-out accounts, etc.)
related risks: Unauthorized Discount Purchase
related risks: Malicious Benefit Abuse
related risks: Order-Splitting Arbitrage
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related attack tools: SMS Verification Code Platform
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS06
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Ban Evasion Guide
type: Term
break id: T0237
stix type: x-break-term
definition: A guide that teaches how to maliciously report an account with no obvious violations and get it banned by exploiting loopholes in platform policies.
description: These tutorials typically break down weaknesses in moderation systems, such as triggering automatic penalties through mass complaints or fabricating violation screenshots. Users do not need advanced technical skills; by following the steps they can get a competitor’s shop, livestream, or channel taken down. Such guides circulate in underground groups via cloud links or documents and are a common tool for malicious competition and extortion.
category: Business Fraud
keywords: Ban Evasion Guide
keywords: false report
keywords: malicious report
keywords: report abuse
keywords: ban guide
keywords: report exploit
keywords: false flagging
keywords: report manipulation
usage example: Want a free wwg tutorial for XX platform?
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related threat actors: Competitors
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

QR Code Bombing
type: Term
break id: T0238
stix type: x-break-term
definition: Overwhelming a competitor’s QR code with high-frequency requests or protocol attacks to make it inaccessible and cut off their traffic source.
description: Often seen in turf wars between fraud rings, one side uses DDoS or interface flooding tools to saturate a rival’s QR code link, causing scan failures or frozen pages. Targets are usually payment codes, group invite codes, or campaign entry codes. The goal is to paralyze the opponent’s promotion chain and seize the same user base while they are disabled.
category: Business Fraud
keywords: QR Code Bombing
keywords: code flooding
keywords: code attack
keywords: QR flood
keywords: link bombing
keywords: code DDoS
keywords: QR DDoS
keywords: code spamming
usage example: Studio offering fake followers, volume boosting, QR code bombing, and real-person chat engagement.
related risks: Distributed Denial of Service
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS04
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Direct Login Account
type: Term
break id: T0239
stix type: x-break-term
definition: An account that can be logged into directly without SMS verification or a password, usually mass-produced by fraud rings through protocol exploits or credential-stuffing.
description: These accounts bypass secondary verification, allowing fraudsters to quickly switch devices for batch operations such as fake orders, spam advertising, or money laundering. Direct-login accounts command a premium in underground markets and are sold by platform, activity level, and whether they include payment functions. Buyers can run scripts on them immediately, drastically reducing operational time costs.
category: Business Fraud
keywords: Direct Login Account
keywords: no-verification account
keywords: auto-login account
keywords: pre-verified account
keywords: credential-stuffed account
keywords: account takeover
keywords: ATO account
keywords: credential stuffing
usage example: Telegram direct-login accounts, fresh protocol accounts, large stock available.
related risks: Process Automation
related risks: Account Reselling
related risks: Credential Stuffing
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Multi-Factor Authentication
related avoidances: SMS Verification
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Credential Stuffing Tools
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Account Dealers
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Obfuscated Data Pack
type: Term
break id: T0240
stix type: x-break-term
definition: A homophonic slang term for “materials” used in fraud circles, referring to personal information, account credentials, and other assets used for registration, verification, or scams.
description: To evade platform keyword filters, fraudsters use this homophone in chats and trading posts. Materials include front-and-back ID photos, selfie-with-ID images, bank card numbers, and phone numbers—the raw ingredients for bulk account registration and nurturing. Materials are often sold in sets, with freshness and match quality directly determining the price.
category: Business Fraud
keywords: Obfuscated Data Pack
keywords: obfuscated data
keywords: data pack
keywords: identity pack
keywords: KYC pack
keywords: verification pack
keywords: registration pack
keywords: ID pack
usage example: Want to make 5000 a day? Check the group in my materials.
related risks: Automated Account Seasoning
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Self-Trading
type: Term
break id: T0241
stix type: x-break-term
definition: A fraud tactic in which a single operator simultaneously controls both buyer and seller accounts to fabricate transactions and defraud the platform of marketing subsidies or funds.
description: The operator typically registers or controls multiple accounts, acting as both the buyer placing orders and the seller fulfilling them, creating a complete fake transaction loop. This technique is commonly used in e-commerce scenarios involving new-user subsidies, promotional discounts, or referral rewards, generating fraudulent order volume. If the platform's risk controls fail to detect it, the fraudster can cash out the subsidies, resulting in direct financial losses for the platform.
category: Business Fraud
keywords: Self-Trading
keywords: wash trading
keywords: matched orders
keywords: fictitious trading
keywords: round-tripping
keywords: sham transaction
keywords: pre-arranged trade
keywords: circular trading
usage example: That workshop ran tens of thousands of fake orders using the left-right hand trick and drained all the platform's new-user subsidies.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS04
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Reverse Scam
type: Term
break id: T0242
stix type: x-break-term
definition: A deceptive scheme that uses fake rewards as bait to trick participants into losing their own money.
description: Fraudsters often post fabricated 'money-making' tutorials or promotional links in social groups and forums, enticing victims to invest their own principal or pay a commission first. Victims believe they will receive high returns, but their money is stolen by the fraudsters, a practice commonly known as 'reverse scalping.' This tactic exploits information asymmetry and greed, serving as a funnel for attracting and defrauding victims within the marketing fraud chain.
category: Business Fraud
keywords: Reverse Scam
keywords: advance-fee fraud
keywords: bait-and-switch
keywords: task scam
keywords: prepaid scam
keywords: pig butchering
keywords: rebate fraud
usage example: Someone posted a 'deposit 50, get 100 back' link in the group, but I was blocked right after sending the money—a classic dynamite fishing scam.
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related risks: Order-Splitting Arbitrage
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related threat actors: Freebie Hunters
related threat actors: Freebie Hunt Organizer
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Carding Marketplace
type: Term
break id: T0243
stix type: x-break-term
definition: An underground arbitrage ring on live-streaming platforms that specializes in buying users' virtual gifts at a low price.
description: These groups lurk in various live-streaming rooms, proactively contacting users who have won high-value gifts and offering to buy them at a discounted cash price. They exploit platform rules that prevent direct cash withdrawal of virtual items, providing a gray-market channel for users eager to cash out. The gifts are then sent to designated streamers through other accounts to complete money laundering or arbitrage, severely disrupting the platform's virtual economy.
category: Business Fraud
keywords: Carding Marketplace
keywords: gift card cashing
keywords: virtual currency laundering
keywords: gift card reseller
keywords: gift card broker
keywords: gift card dump
keywords: gift card flipping
usage example: I won a castle gift yesterday, and right after I posted it for sale, someone from a supermarket messaged me asking if I wanted to sell.
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Warehouse Livestream
type: Term
break id: T0244
stix type: x-break-term
definition: A live-streaming sales format set in a warehouse, using the backdrop of piled-up goods to create an atmosphere of direct-from-source deals.
description: The streamer stands in front of shelves stacked with products, leveraging the visual impact and a 'cutting out the middleman' pitch to attract viewers to place orders. While this setting easily gains user trust, it is also frequently exploited by fraudsters who use fake warehouse streams to sell counterfeit goods or run shipping scams.
category: Business Fraud
keywords: Warehouse Livestream
keywords: source factory scam
keywords: fake warehouse live
keywords: drop shipping fraud
keywords: warehouse staging
keywords: factory outlet scam
keywords: source goods deception
usage example: I watched that warehouse live stream last night; the streamer was standing among piles of shoe boxes shouting about the lowest prices, but everything delivered was fake.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Cashout Merchant
type: Term
break id: T0245
stix type: x-break-term
definition: An underground organization on live-streaming platforms that specializes in buying users' virtual gifts at a low price, functionally identical to a 'supermarket.'
description: This type of gray-market channel is often promoted under code names like 'cake shop' in private communities, offering cash-out services for users holding virtual gifts. They profit by buying low and reselling high to clients who need to boost their ranking, facilitating the illegal circulation of virtual assets. This behavior undermines the platform's live-streaming ecosystem and may involve money laundering risks.
category: Business Fraud
keywords: Cashout Merchant
keywords: gift card cashout
keywords: virtual currency exchanger
keywords: gift card fence
keywords: gift card launderer
keywords: gift card arbitrage
keywords: virtual gift broker
usage example: Don't randomly add those cake shop contacts on WeChat from live-streaming rooms; they offer extremely low prices for gifts.
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Gift Flipping
type: Term
break id: T0246
stix type: x-break-term
definition: A fraudulent practice of transferring virtual gifts between multiple accounts to fraudulently obtain platform task rewards or subsidies.
description: Operators exploit platform task mechanisms or event loopholes by controlling batches of accounts to send each other free or low-cost gifts. By creating fake active transactions, these accounts quickly meet the platform's gifting task thresholds, thereby cashing out monetary rewards or traffic support. This behavior severely compromises the integrity of platform data.
category: Business Fraud
keywords: Gift Flipping
keywords: gift swapping
keywords: gift cycling
keywords: gift churning
keywords: gift transfer farming
keywords: reward cycling
keywords: virtual gift arbitrage
usage example: Their workshop has dozens of phones running gift flipping operations, racking up tens of thousands in platform rewards overnight.
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Auto Lottery Farming
type: Term
break id: T0247
stix type: x-break-term
definition: The use of scripts or programs to automatically idle in live-streaming rooms and participate in lotteries to collect virtual rewards in bulk.
description: Fraud rings use emulators or multi-instance software to have hundreds or thousands of accounts enter live-streaming rooms simultaneously and idle, automatically triggering the lottery logic. This method requires no human intervention and allows for the low-cost acquisition of large quantities of gifts or platform benefits, serving as a core tactic in the matrix operation of bot accounts.
category: Business Fraud
keywords: Auto Lottery Farming
keywords: auto-farming bot
keywords: lottery bot
keywords: idle farming
keywords: botting lottery
keywords: auto-enter giveaway
keywords: lottery automation
keywords: sock puppet farming
usage example: That streamer's room looks like it has high viewership, but it's actually full of protocol accounts idling for lottery prizes, with very few real people.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Automated Account Seasoning
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
related business scenes: BS06
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Off-Platform Gift Resale
type: Term
break id: T0248
stix type: x-break-term
definition: The gray-market practice of users reselling virtual gifts obtained on live-streaming platforms to a third party for cash.
description: After winning a high-value gift in a lottery or event, a user, instead of using it directly, sells it through an off-platform transaction to a gift-recycling underground group. The group then uses these gifts for money laundering through tipping or to complete high-value tasks, forming a complete chain for cashing out virtual assets. This behavior bypasses the platform's official exchange channels, leading to capital outflow.
category: Business Fraud
keywords: Off-Platform Gift Resale
keywords: gift resale
keywords: off-platform trading
keywords: gift arbitrage
keywords: virtual gift cashout
keywords: gift flipping
keywords: gift liquidation
keywords: gray market gifts
usage example: I won a sports car gift but had no use for it, so I just backflowed it to a supermarket for 300 yuan.
related risks: Automated Account Seasoning
related risks: Promotional Activity Cheating
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Cloud Phone
related attack tools: Mass Control Systems
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Crowdsourced Workers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS06
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Gift Farming
type: Term
break id: T0249
stix type: x-break-term
definition: An arbitrage scheme that exploits platform lottery or promotional mechanisms to obtain virtual gifts in bulk and convert them into cash.
description: Fraud rings register large numbers of accounts and use scripts or automated tools to participate in live-streaming lotteries and complete platform tasks, acquiring high-value virtual gifts at low or zero cost. These gifts are then sold at a discount to streamers or agencies through gift-recycling channels. The streamers subsequently cash out the gifts at their full platform value, with the price difference serving as the arbitrage profit. This practice drains platform marketing resources and severely disrupts the balance of the in-app economy.
category: Business Fraud
keywords: Gift Farming
keywords: gift harvesting
keywords: gift botting
keywords: lottery farming
keywords: virtual gift extraction
keywords: gift reward abuse
keywords: promo gift abuse
keywords: gift point farming
usage example: Someone scripted a bot to monitor livestream giveaways, using thousands of accounts for **Gift Farming**. The virtual gifts won were transferred to a main account via a guild for centralized liquidation, draining tens of thousands in a single day and instantly exhausting the event's budget.
related risks: Promotional Activity Cheating
related risks: Malicious Benefit Abuse
related risks: Automated Account Seasoning
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Cloud Phone
related attack tools: Mass Control Systems
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS06
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Go Live
type: Term
break id: T0250
stix type: x-break-term
definition: Slang for 'going live,' used as a homophonic code to refer to starting a live stream for product promotion or traffic diversion.
description: Fraud operators use this coded term in group chats or task assignments to evade platform keyword monitoring. Once the stream is live, they deploy prepared scripts, staged scenarios, or fake personas to conduct deceptive marketing or funnel viewers to external private domains. This is the launch phase of a live-streaming fraud chain.
category: Business Fraud
keywords: Go Live
keywords: start stream
keywords: livestream launch
keywords: go live signal
keywords: streaming start
keywords: broadcast initiation
keywords: live session start
usage example: "Alright guys, we go live at 8 PM sharp tonight. Have all the materials ready, don't drop the ball."
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Farm Account Cluster
type: Term
break id: T0251
stix type: x-break-term
definition: A cluster of accounts controlled by fraud rings to participate in organized, large-scale campaigns at specific times to exploit rewards.
description: These accounts are typically managed through centralized control systems. When a platform launches a high-value reward campaign or lottery, they swarm in to capture the prizes. They have a clear division of labor: some accounts participate in the event, while others receive and transfer the illicit gains. The sudden appearance of these account clusters can instantly deplete a campaign's budget, preventing real users from receiving rewards and severely skewing platform operational data.
category: Business Fraud
keywords: Farm Account Cluster
keywords: Sybil Farm
keywords: Account Farm
keywords: Bulk Account Operation
keywords: Mass Account Cluster
keywords: Coordinated Inauthentic Behavior
keywords: Device Farm Account
keywords: Account Array
keywords: Bot Herder
usage example: As soon as an e-commerce platform's flash sale launched, a **Farm Account Cluster** targeted it. Thousands of accounts swarmed in at 3 a.m., using scripts to precisely snap up all the discounted premium liquor, leaving ordinary users with no chance to even submit an order.
related risks: Promotional Activity Cheating
related risks: Malicious Benefit Abuse
related risks: Fake Transactions
related risks: Order Brushing
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Mass Control Systems
related attack tools: Click Simulation Tools
related attack tools: Cloud Phone
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Follower Pumping
type: Term
break id: T0252
stix type: x-break-term
definition: The practice of bulk-adding fake followers to an account to fabricate influence and monetize the inflated metrics.
description: Fraud rings use automated bot registration, hijacked accounts, or recruited real people to rapidly inflate an account's follower count, making it appear influential. These fake followers are often used to create a false sense of popularity during live-stream shopping events, deceiving merchants into paying high slotting fees, or for subsequent fraud and traffic diversion. Follower farming is a primary source in the traffic fraud supply chain.
category: Business Fraud
keywords: Follower Pumping
keywords: Follower Inflation
keywords: Ghost Follower
keywords: Vanity Metrics Boost
keywords: Follower Generation
keywords: Bulk Follower Service
keywords: Audience Inflation
keywords: Follower Farming
keywords: Follower Padding
usage example: "Taking orders for WeChat follower farming. Order in the Telegram group, counted by the ten-thousand. Work order out the next day, stable diversion links."
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Comment-Thread Lead Diversion
type: Term
break id: T0253
stix type: x-break-term
definition: A covert traffic diversion tactic where two accounts stage a question-and-answer exchange in a comment section to subtly guide users toward a product or service.
description: In this operation, one account poses as an ordinary user asking a question, while another account replies as a satisfied customer, recommending the target product or service. This creates a false impression of genuine word-of-mouth endorsement. The staged dialogue effectively bypasses platform scrutiny of direct advertising and lowers user skepticism. It is commonly used for diverting traffic to 'black five' categories like medical aesthetics, health supplements, and financial scams.
category: Business Fraud
keywords: Comment-Thread Lead Diversion
keywords: Comment Baiting
keywords: Astroturfing
keywords: Fabricated Testimonial
keywords: Sock Puppet Endorsement
keywords: Comment Section Con
keywords: Stealth Endorsement
keywords: Fake Review Thread
keywords: Q&A Lead Gen
usage example: "The A-B diversion for that acne treatment is working well lately. The sock puppet asks 'How to get rid of acne scars,' and the main account replies 'Use XX Gel.' The conversion rate is very high."
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

A/B Lead Diversion
type: Term
break id: T0254
stix type: x-break-term
definition: A risk-mitigation operating model where Account A attracts traffic and Account B receives and converts it, shielding the main asset from platform enforcement.
description: Account A enters the platform's traffic pool by posting high-quality or bait content to amass a large following. To avoid a ban for direct traffic diversion, all such actions are performed by Account B (a burner account). Account B posts contact information or links in comments and direct messages. Even if Account B is banned, Account A remains safe and can continuously supply new Account Bs, enabling long-term fraudulent operations.
category: Business Fraud
keywords: A/B Lead Diversion
keywords: Sock Puppet Network
keywords: Burner Account Diversion
keywords: Decoy Account
keywords: Proxy Account Scheme
keywords: Lead Gen Array
keywords: Funnel Account
keywords: Dual-Account Funnel
keywords: Decoy and Switch
usage example: A fraud ring executed an **A/B Lead Diversion** scheme on a short-video platform. An emotional storytelling account "A" attracted divorced women, guiding them in comments to privately message a supposed counselor account "B," where the victims were ultimately groomed in private chat for a pig-butchering scam.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Lead Account
type: Term
break id: T0255
stix type: x-break-term
definition: The first account or entry point in a traffic diversion chain that initiates the flow of users.
description: A 'vehicle head' account typically has high authority and strong activity metrics, acting as the engine of the entire diversion array. It attracts initial traffic by posting viral content or occupying high-traffic spots, then progressively guides users to subsequent monetization accounts or scam groups. If a vehicle head account is banned, the entire diversion chain collapses, so fraud rings invest significant resources in maintaining them.
category: Business Fraud
keywords: Lead Account
keywords: Traffic Driver
keywords: Funnel Entry Point
keywords: Lead Gen Initiator
keywords: Traffic Source Account
keywords: Funnel Opener
keywords: Entry Account
keywords: Traffic Origin
keywords: Lure Account
usage example: The **Lead Account** at the source of a brushing scheme posed as a delivery driver, luring young women into chat groups by offering small gifts for scanning a QR code at a shopping district. For every full group of fifty, the recruiter received a headhunting fee from the fraud ring operating the backend.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Slot
type: Term
break id: T0256
stix type: x-break-term
definition: A high-visibility position on a platform used to display content and capture or redirect user traffic.
description: A 'traffic spot' can be a trending position on a short-video hotlist, a feed ad placement, or a pinned comment section. Fraud rings use bot-driven likes and views to seize these high-exposure spots, pushing fraudulent or deceptive content to a wider audience. Securing a prime traffic spot means gaining a massive influx of users, a critical step for successful traffic diversion.
category: Business Fraud
keywords: Traffic Slot
keywords: Trend Hijacking
keywords: Hashtag Takeover
keywords: Comment Section Takeover
keywords: Promoted Slot
keywords: High-Visibility Slot
keywords: Feed Position
keywords: Trending Slot
keywords: Exposure Slot
usage example: "Hurry up, we've seized the hotlist spot for tonight. Get that gambling link up there, quick."
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Diversion
type: Term
break id: T0257
stix type: x-break-term
definition: Funnel transfer refers to the practice of systematically redirecting users from one social platform to another in bulk to enable subsequent monetization.
description: Commonly seen in public traffic scenarios such as short videos and live streaming, operators use scripted pitches, direct messages, or comment sections to lure users into private domains or designated platforms. Funnel transfer is a critical step in traffic monetization, often serving e-commerce brushing, adult content redirection, or fraud schemes. This activity bypasses platform regulations, often resulting in user exploitation and damage to the platform's traffic ecosystem.
category: Business Fraud
keywords: Traffic Diversion
keywords: Platform Funneling
keywords: Cross-Platform Lead Gen
keywords: Traffic Funneling
keywords: Audience Migration
keywords: DM-to-External Funnel
keywords: Bio Link-Out
keywords: Traffic Export
keywords: Follower Export
usage example: Funnel transfer for order generation, guaranteed quality and volume, samples available for verification.
related risks: Malicious Traffic Diversion
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS04
related business scenes: BS05
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

In-App Direct Report
type: Term
break id: T0258
stix type: x-break-term
definition: In-app direct reporting refers to the malicious competitive tactic of initiating mass reports against a target account or content directly within a client to trigger platform penalties.
description: Underground industry actors exploit platform reporting mechanisms by organizing manual efforts or deploying scripts to file concentrated reports against a competitor's accounts or videos. By generating a high volume of reports in a short period, they trigger the platform's automated review or penalty system, leading to shadowbanning, demotion, or account suspension. This is commonly used to suppress rivals and eliminate competition, disrupting a fair business environment.
category: Business Fraud
keywords: In-App Direct Report
keywords: Mass Report
keywords: Report Bombing
keywords: Coordinated Flagging
keywords: Malicious Reporting
keywords: Report Brigading
keywords: False Flagging
keywords: Report Raid
keywords: Takedown Raid
usage example: In a competitive clash, a seller used **In-App Direct Report** tactics, hiring numerous accounts to maliciously click the report button in a rival's livestream. By repeatedly triggering reviews with claims like "false advertising," they managed to get the competitor's stream temporarily suspended.
related risks: Malicious Complaints
related risks: After-Sales Rights Abuse
related risks: Malicious Claims
related avoidances: Rate Limiting
related avoidances: Account Ban
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related threat actors: Professional Counterfeit Claimants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

High-Follower Account
type: Term
break id: T0259
stix type: x-break-term
definition: High-follower accounts are social media profiles with a large follower count, used as a foundational tool for promotion and traffic redirection.
description: These accounts are typically cultivated through content reposting, fake engagement farming, or bulk registration, and are designed to project a facade of influence. Account dealers or marketing teams use them to post covert advertisements, guide followers to other platforms, or operate as part of a coordinated matrix for hype. High-follower accounts are a core asset in fraudulent marketing, used to boost traffic efficiency and conversion rates.
category: Business Fraud
keywords: High-Follower Account
keywords: Influencer Account
keywords: Aged Account
keywords: Prestige Account
keywords: Vanity Account
keywords: KOL Account
keywords: Mule Account
keywords: Established Account
keywords: Asset Account
usage example: High-follower accounts for XX email available, DM for details.
related risks: Account Reselling
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Account Seller
type: Term
break id: T0260
stix type: x-break-term
definition: Account dealers are underground industry operators who specialize in the bulk registration, nurturing, and sale of social media platform accounts.
description: Account dealers manage a complete account production chain, from obtaining verification codes via SMS relay platforms to simulating genuine user behavior for account warming, and finally selling graded accounts to downstream buyers. These buyers use the accounts for engagement farming, traffic redirection, fraud, or astroturfing campaigns. Account dealers form the foundational supply chain of the underground industry, underpinning a wide range of online fraudulent activities.
category: Business Fraud
keywords: Account Seller
keywords: Account Farmer
keywords: Account Factory
keywords: Bulk Account Vendor
keywords: Account Generation
keywords: Account Stockpile
keywords: Account Marketplace
keywords: Credential Vendor
keywords: Profile Seller
usage example: Direct source, first-hand account dealer.
related risks: Account Reselling
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Account Takeover
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: SMS Verification Code Platform
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Custom Browsers
related threat actors: Account Dealers
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Conversion Backend
type: Term
break id: T0261
stix type: x-break-term
definition: The backend refers to the landing page or private domain environment where redirected traffic is ultimately monetized or where users are retained.
description: In a traffic redirection chain, the frontend is responsible for attracting attention, while the backend handles the monetization, such as through a fake shopping website, a customer service chat interface, or a private group. The design of the backend directly impacts the success rate and average transaction value of a fraud scheme. It represents the final link in the redirection fraud chain where illicit profits are realized.
category: Business Fraud
keywords: Conversion Backend
keywords: monetization page
keywords: private domain
keywords: sinkhole page
keywords: landing page scam
keywords: conversion funnel
keywords: cashout environment
keywords: victim handover
keywords: scam closure
usage example: The livestream host repeatedly insisted viewers not place orders directly, but instead guided them to join the fan club and send a code word via private message. All transactions were finalized in a **Conversion Backend** on a private WeChat channel, completely bypassing the platform's commission fees and risk controls.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Bot Traffic
type: Term
break id: T0262
stix type: x-break-term
definition: Automated engagement farming refers to the use of automated scripts or physical devices to simulate human operations for the bulk creation of fake data metrics.
description: Through device farms, cloud phones, or custom software, operators perform bulk liking, viewing, or ordering actions on a specified target. Automated engagement farming can rapidly fabricate popularity and is used for e-commerce brushing, live stream view inflation, or app store rating manipulation. This behavior severely compromises platform data integrity and misleads consumer decisions, constituting a typical form of fraudulent marketing.
category: Business Fraud
keywords: Bot Traffic
keywords: auto-clicker
keywords: emulator farm
keywords: device farm
keywords: click farm
keywords: fraudulent engagement
keywords: synthetic traffic
keywords: account farming
keywords: SMS bomber
usage example: Source: Large supply of US-region automated farming accounts with 1k followers, in stock.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS06
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Fake Followers
type: Term
break id: T0263
stix type: x-break-term
definition: Fake followers are follower accounts acquired through inauthentic growth methods that hold no real social value.
description: These accounts are typically generated through bulk registration by bots, lack genuine user behavior, and are used solely to inflate an account's follower count. In traffic redirection scenarios, fake followers are used to create a false impression of popularity and credibility to lure in real users. The extensive use of fake followers severely pollutes platform data and serves as the traffic foundation for subsequent fraudulent activities.
category: Business Fraud
keywords: Fake Followers
keywords: bot followers
keywords: sockpuppet accounts
keywords: inflated follower count
keywords: vanity metrics
keywords: follower farms
keywords: impersonator accounts
keywords: social proof manipulation
keywords: mass account creation
usage example: Selling fake followers, instant delivery, can be used for data inflation.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Zombie Reviews
type: Term
break id: T0264
stix type: x-break-term
definition: Bot comments are fake, repetitive, and content-free comments posted in bulk by programs or click farms.
description: This type of comment is often used to drown out negative feedback from real users or to create a false impression of popularity for a product or content. Operators use a large number of accounts to post pre-scripted messages, interfering with platform content ranking and user judgment. Bot comments are a common tool for engagement manipulation and review bombing, used to mislead consumers and conceal product or service quality issues.
category: Business Fraud
keywords: Zombie Reviews
keywords: astroturfing
keywords: review bombing
keywords: spam comments
keywords: paid reviews
keywords: review manipulation
keywords: crowdturfing
keywords: reputation laundering
keywords: fake testimonials
usage example: Off-platform promotion, guaranteed 20-50 orders. Influencer videos, upload included, brand change, link refreshing, bot comments.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Astroturfing Networks
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Lead Handling
type: Term
break id: T0265
stix type: x-break-term
definition: The initial round of chat-based engagement with newly added contacts, performed by a dedicated operator to quickly build trust and screen targets within a traffic funnel.
description: This stage is typically handled by professional chat teams who use scripted dialogues to interact with users. The goal is to transform strangers drawn in by the traffic generation efforts into viable victims for further exploitation. It is commonly seen in pig butchering and romance scams, where the quality of this engagement directly impacts the scam's conversion rate.
category: Business Fraud
keywords: Lead Handling
keywords: chat handler
keywords: romance scam script
keywords: pig-butchering script
keywords: first contact
keywords: social engineering opener
keywords: trust building phase
keywords: victim grooming
keywords: conversation funnel
usage example: Professional overseas traffic from all regions, high-quality leads. [Recommended to use engagement operators] Thanks 007
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Interception
type: Term
break id: T0266
stix type: x-break-term
definition: Jieliu is a malicious traffic hijacking tactic that uses technical or content-based methods to intercept a competitor's traffic and forcibly redirect users to one's own platform.
description: Fraud operators often employ keyword hijacking, malicious pop-ups, or cloned landing pages to divert users while they are trying to access legitimate channels. This technique is widely used in e-commerce brushing and gambling promotion to directly steal a competitor's customer resources and cause financial losses.
category: Business Fraud
keywords: Traffic Interception
keywords: typosquatting
keywords: click hijacking
keywords: traffic diversion
keywords: malvertising
keywords: pharming
keywords: SEO poisoning
keywords: affiliate hijacking
keywords: URL hijacking
usage example: Selling ** jieliu investor leads, with proof of traffic videos and settlement records. Looking for partners who can settle daily.
related risks: Access Link Hijacking
related risks: Man-in-the-Middle Attack
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Lead Intake
type: Term
break id: T0267
stix type: x-break-term
definition: Jinxian refers to the first step of lead generation, where potential customer contact information is acquired through ad placements, digital footprints, or other outreach methods.
description: This is the customer acquisition phase in the fraud supply chain. Operators attract interested users into communication channels by deploying fake advertisements or mass-adding friends. Once a user 'enters the line,' their information is priced and sold to downstream chat teams or fraud rings for deeper exploitation.
category: Business Fraud
keywords: Lead Intake
keywords: lead generation
keywords: lead capture
keywords: phishing bait
keywords: ad fraud funnel
keywords: victim acquisition
keywords: clickbait lure
keywords: data harvesting
keywords: contact farming
usage example: A fraud ring floods short-video platforms with "free material" ads to generate Lead Intake, collecting phone numbers via forms before distributing them downstream for targeted scams.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Comment-Enabled Account
type: Term
break id: T0268
stix type: x-break-term
definition: Kaipinghao refers to black-market account resources that possess commenting privileges and are specifically used to post fake reviews at scale.
description: These accounts typically bypass platform real-name verification or behavioral thresholds. They are used to mass-publish fake positive reviews, malicious negative reviews, or manipulative comments. In e-commerce brushing and public opinion manipulation, kaipinghao are core tools for executing astroturfing tasks, rapidly fabricating a reputation or attacking competitors.
category: Business Fraud
keywords: Comment-Enabled Account
keywords: review accounts
keywords: aged accounts
keywords: PVA accounts
keywords: bulk registered accounts
keywords: comment spam accounts
keywords: sock puppet accounts
keywords: credible sockpuppets
keywords: reputation manipulation accounts
usage example: A click-farm crew bought high-weight, aged accounts on the black market to use as Comment-Enabled Accounts, posting fake photo reviews in e-commerce sections to push a low-quality product onto the bestseller list within three days.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Broker
type: Term
break id: T0269
stix type: x-break-term
definition: A service provider that supplies batch-registered accounts, channels, or traffic packages for black and gray market operations.
description: These entities act as traffic brokers, acquiring bulk-registered accounts or traffic entry points from upstream sources and reselling them to downstream fraud or gambling rings. They control vast amounts of fake identity data and exploit platform vulnerabilities, making them a critical resource node in the illicit traffic supply chain.
category: Business Fraud
keywords: Traffic Broker
keywords: traffic reseller
keywords: lead vendor
keywords: account dealer
keywords: bulk account seller
keywords: SIM farm operator
keywords: proxy supplier
keywords: panel provider
keywords: SMM panel
usage example: A Traffic Broker sold a gambling platform a packaged batch of five thousand freshly registered social accounts, promising they could bypass risk controls to send direct messages and recruit users, charging per head.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Volume Scaling
type: Term
break id: T0270
stix type: x-break-term
definition: The practice of generating large-scale traffic through paid placements or artificial inflation to test conversion rates or fabricate popularity.
description: Black market operators use bot accounts or automated scripts to generate a high volume of clicks, views, or visits in a short period. This is used to test new scam pages for traffic generation or to create fake popularity for live streams and product listings, thereby attracting real users to participate.
category: Business Fraud
keywords: Volume Scaling
keywords: impression inflation
keywords: click flooding
keywords: traffic testing
keywords: volume burst
keywords: burst campaign
keywords: traffic pumping
keywords: click spamming
keywords: view botting
usage example: A brushing studio ran Volume Scaling overnight on a batch of fake posts to test a new script's conversion rate, but the entire set of accounts was flagged and banned by the platform's risk control system due to abnormal data.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Burner Account
type: Term
break id: T0271
stix type: x-break-term
definition: Cannon fodder account refers to a disposable account used to probe a platform's risk control rules or carry out high-risk operations.
description: These accounts serve as suicide squads for black-hat actors, performing sensitive actions like bulk following, mass messaging, or posting prohibited content. Once the account triggers a ban, the operator immediately activates a new cannon fodder account to continue the campaign, thereby protecting high-value main accounts from being implicated.
category: Business Fraud
keywords: Burner Account
keywords: disposable account
keywords: single-use profile
keywords: alt account
keywords: sock puppet
keywords: throwaway account
keywords: fake profile
keywords: bot account
keywords: spam account
usage example: Let's not leave a direct negative review. Get a cannon fodder account and use it to find some scam reviewers for him.
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Front End
type: Term
break id: T0272
stix type: x-break-term
definition: The entry point page or content designed to attract a user's initial click or visit at the very beginning of a traffic funnel.
description: This includes fabricated short videos, fake ad landing pages, or phishing links, and serves as the first point of contact between the fraud operation and the victim. The front-end is designed to be highly enticing to maximize click-through traffic and seamlessly guide users into the subsequent scam or data harvesting stage.
category: Business Fraud
keywords: Traffic Front End
keywords: clickbait
keywords: landing page
keywords: phishing page
keywords: traffic source
keywords: entry point
keywords: funnel entry
keywords: lure page
keywords: click farm front
usage example: In an adult-content traffic diversion chain, the traffic front end is typically disguised as a suggestive short clip that redirects users through multiple layers to gambling or fraud platforms.
related risks: Phishing Attack
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Forced Group Add
type: Term
break id: T0273
stix type: x-break-term
definition: The act of forcibly adding users to a designated group or channel without their knowledge or consent through technical means.
description: Using scripts or plug-ins to bypass platform friend verification or invitation mechanisms, operators add a large number of users to groups in bulk. The added users are often unrelated to the group's theme, and the group is subsequently flooded with advertisements or scam messages. This tactic is commonly used for adult content redirection, gambling promotion, or financial scams to rapidly inflate member counts and create a false sense of activity.
category: Business Fraud
keywords: Forced Group Add
keywords: forced group invite
keywords: auto-add script
keywords: group flooding
keywords: mass invite
keywords: unauthorized group add
keywords: invite spam
keywords: bulk group injection
usage example: The victim found themselves inexplicably pulled into a stock-trading group, as black-hat operators exploited a vulnerability to execute a Forced Group Add, dragging them directly into the group for brainwashing scams.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Bulk Unsolicited Dms
type: Term
break id: T0274
stix type: x-break-term
definition: The act of using automated tools to bypass platform restrictions and send bulk private messages to a large number of non-friend users.
description: Black market operators use bot farm systems or scripts to push unsolicited private messages containing ads, phishing links, or scam scripts to unauthorized users on a massive scale. This operation disregards user privacy settings and is often associated with compromised or bulk-registered virtual accounts. It is primarily used for adult content redirection, task scams, or gambling site promotion, frequently leading to financial loss for the victims.
category: Business Fraud
keywords: Bulk Unsolicited Dms
keywords: DM spam
keywords: unsolicited messages
keywords: mass DM
keywords: message blasting
keywords: inbox spam
keywords: auto DM script
keywords: cold DM
usage example: An illegal external plugin was seized that could bypass social platform friend verifications to execute Bulk Unsolicited DMs, pushing tens of thousands of gambling ads to targeted users in a single day.
related risks: Malicious Traffic Diversion
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Proxy Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Flash QR Code
type: Term
break id: T0275
stix type: x-break-term
definition: A QR code that appears for an extremely short duration within a short video or live stream, designed to redirect traffic.
description: Fraud rings embed QR codes into video frames, exploiting the fact that they are imperceptible to the human eye but can be captured in a screenshot, thereby bypassing platform content moderation. The code is invisible during normal viewing but can be obtained by recording the screen or taking a screenshot. This method is widely used to redirect public traffic to private channels for adult content, underground lotteries, or borderline live streams.
category: Business Fraud
keywords: Flash QR Code
keywords: subliminal QR
keywords: hidden QR
keywords: frame injection
keywords: screenshot code
keywords: transient QR
keywords: steganographic QR
keywords: quick flash code
usage example: That live stream flashed for a second. I took a screenshot and saw it was a flash code. Scanning it led to nothing but gambling ads.
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Threat Intelligence
related avoidances: Legal Action
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS05
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Upsell
type: Term
break id: T0276
stix type: x-break-term
definition: Upselling is a tactic used after lead generation to manipulate consumers into purchasing products or services far exceeding their initial expectations through high-pressure scripts.
description: In the beauty, cosmetic surgery, or health supplement black markets, low-cost trial offers are used to attract customers to physical locations. Once there, sales teams employ high-pressure brainwashing scripts to coerce or induce consumers into escalating their spending. Victims often enter expecting a small fee but end up locked into packages costing thousands, frequently accompanied by hidden loan traps. This represents a classic offline 'pig-butchering' monetization phase.
category: Business Fraud
keywords: Upsell
keywords: bait and switch
keywords: high-pressure sales
keywords: up-sell funnel
keywords: tripwire offer
keywords: order bump
keywords: value ladder
keywords: coercive upsell
usage example: They said it was a free trial, but once I got there, they locked me in a small room for upselling and I couldn't leave without spending tens of thousands.
related risks: Fake Transactions
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Threat Intelligence
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Malicious Merchants
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS01
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Fake Traffic Inflation
type: Term
break id: T0277
stix type: x-break-term
definition: Metric inflation refers to the act of using fake accounts or automated scripts to fabricate false data metrics in bulk.
description: Fraud rings obtain large numbers of virtual numbers through SIM card vendor platforms and use botnet control software to generate likes, views, or comments for designated videos, live streams, or products. The goal is to deceive the platform's recommendation algorithm, create a false impression of popularity, and induce real users to follow trends or make purchases. This severely damages the platform's ecosystem and is often tied to fake review scams and counterfeit goods promotion.
category: Business Fraud
keywords: Fake Traffic Inflation
keywords: click farm
keywords: view botting
keywords: engagement manipulation
keywords: like farming
keywords: artificial inflation
keywords: traffic boosting
keywords: social proof fabrication
usage example: To inflate a streamer's asking price, a live-streaming guild used scripts to control thousands of cloud phones for Fake Traffic Inflation, instantly pushing the room's popularity to millions to defraud brands of slotting fees.
related risks: Metric Manipulation / Ranking Fraud
related risks: Fake Registration
related risks: Bulk Account Registration
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Real-Name Identity Verification
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: SMS Verification Code Platform
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS05
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Troll Farm
type: Term
break id: T0278
stix type: x-break-term
definition: Sock puppet armies are organized groups of fake accounts hired by black market operators or marketing agencies to post specific content online in a coordinated manner.
description: Controlled through group management systems, these armies mass-post positive reviews, launch coordinated harassment attacks, or steer public opinion on social platforms. They are typically paid per post or task and serve as a core tool for manipulating public opinion, smearing competitors, and conducting online extortion schemes. In lead generation scenarios, they often pose as genuine users to create a bandwagon effect and lure real users into traps.
category: Business Fraud
keywords: Troll Farm
keywords: paid posters
keywords: astroturfing
keywords: opinion manipulation
keywords: comment army
keywords: shill accounts
keywords: reputation laundering
keywords: guided commentary
usage example: A newly launched game faced a malicious siege from a competitor's Troll Farm, which flooded app stores with one-star reviews and identical negative posts, causing the game's rating to plummet.
related risks: Fake Reviews
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Terminal Abnormal Environment Detection
related avoidances: Cloud Phone Detection
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related threat actors: Astroturfing Networks
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Compliant Traffic
type: Term
break id: T0279
stix type: x-break-term
definition: Above-water advertising refers to paid promotions or influencer collaborations conducted through a platform's official, compliant channels.
description: This term is used in contrast to 'underwater' operations in the black and gray markets. Above-water advertising follows formal business processes with contracts and invoices, and its content is subject to platform regulation. While more costly, the data is authentic and traceable. In lead generation circles, it distinguishes legitimate promotion from black and gray market rule-breaking lead generation.
category: Business Fraud
keywords: Compliant Traffic
keywords: paid media
keywords: white-hat marketing
keywords: organic reach
keywords: authorized promotion
keywords: brandformance
keywords: official channel
keywords: above-the-line
usage example: During a new product launch, a beauty brand opted for Compliant Traffic by collaborating with top streamers, placing official splash ads and in-stream links through the platform's channels to achieve both brand impact and sales conversion.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Underground Traffic
type: Term
break id: T0280
stix type: x-break-term
definition: Underwater advertising refers to the promotion of rule-breaking content through unofficial channels that evade a platform's review mechanisms.
description: Black market operators use techniques like content cloaking, ephemeral QR codes, and comment section traffic hijacking to generate leads for prohibited categories, such as shady online money-making schemes, 'black five' products, or adult services. Operators use fake accounts to post advertorials or videos, funneling traffic to private domains or non-compliant landing pages. This directly siphons commercial revenue from platforms and often involves fraudulent content, making it a primary target for platform risk control.
category: Business Fraud
keywords: Underground Traffic
keywords: stealth marketing
keywords: black-hat promotion
keywords: cloaking
keywords: dark funnel
keywords: unregulated traffic
keywords: shadow advertising
keywords: illicit promotion
usage example: Black-hat operators spread cryptic Underground Traffic ads across social groups, guiding users to download a gambling app not listed in official stores, thereby evading platform audits.
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related risks: Credit Card Fraud
related risks: Gift Card / Prepaid Card Fraud
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related attack tools: Malicious QR Code Generators
related attack tools: Identity Document Set (4-Piece)
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Money Laundering Gangs
related business scenes: BS02
related business scenes: BS04
related business scenes: BS15
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Traffic Pool
type: Term
break id: T0281
stix type: x-break-term
definition: A traffic funnel is a network of content channels or account matrices used by underground actors to capture and aggregate user traffic.
description: Underground operators build matrices of social media accounts, Q&A profiles, and lifestyle recommendation accounts—either batch-registered or purchased—to systematically post traffic-driving content. The goal is to channel scattered user traffic into designated private domains or fraudulent platforms. These accounts are typically maintained by teams with a clear division of labor: some members handle content publishing, while others manage engagement and guidance, ultimately converting traffic into scam targets or monetization victims. Once a traffic funnel is detected by platform risk controls, the entire matrix may be banned in bulk, resulting in a total loss of the initial investment.
category: Business Fraud
keywords: Traffic Pool
keywords: lead gen pool
keywords: drainage matrix
keywords: sock puppet farm
keywords: account matrix
keywords: content aggregation hub
keywords: funnel account cluster
keywords: astroturfing network
keywords: engagement farm
usage example: A fraud ring built a Traffic Pool consisting of dozens of public accounts and hundreds of personal accounts, first attracting followers on short-video platforms and then channeling them into the pool for sustained scam message bombardment.
related risks: Bulk Account Registration
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Bulk Account Registration Tool
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Scraping Gangs
related threat actors: Malicious Merchants
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Account Warming
type: Term
break id: T0282
stix type: x-break-term
definition: Account nurturing refers to the cultivation process where underground actors simulate normal user behavior to increase an account’s activity level and trustworthiness.
description: Underground practitioners use automated scripts or manual methods to make accounts perform routine actions such as browsing, liking, commenting, and posting, so that platform algorithms classify them as legitimate active users. The nurturing period can range from a few days to several months, during which the frequency of operations is gradually increased to avoid triggering risk controls. Once nurtured, these accounts are used for subsequent illicit activities such as traffic diversion, engagement manipulation, and fraud. If an account is banned, operators immediately activate backup accounts to continue operations.
category: Business Fraud
keywords: Account Warming
keywords: account nurturing
keywords: profile aging
keywords: reputation building
keywords: warm-up script
keywords: sleeper account activation
keywords: bot-human mimicry
keywords: credibility farming
keywords: account maturation
usage example: Using AI to auto-reply to notes and comments, auto-engage to nurture accounts and intercept traffic, boosting note popularity.
related risks: Automated Account Seasoning
related risks: Fake Transactions
related risks: Order Brushing
related risks: Promotional Activity Cheating
related risks: Malicious Traffic Diversion
related risks: Unauthorized Promotional Redirection
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Bulk Account Registration Tool
related attack tools: Click Simulation Tools
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Web Scraping Tools
related attack tools: Auto-Posting Bots
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Account Dealers
related threat actors: Scraping Gangs
related business scenes: BS02
related business scenes: BS04
citation: Black Market Big Data: 2024 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

BC Funds
type: Term
break id: T0283
stix type: x-break-term
definition: C-material refers to illicit funds originating from gambling platforms, derived from betting, wagering, and related transactions.
description: In money laundering contexts, C-material specifically denotes funds generated by offshore gambling platforms, including player deposits, betting flows, and platform profits. Underground money-running crews acquire personal bank accounts or third-party payment codes to disperse and transfer C-material, eventually cashing it out. Due to the high volume and frequent circulation of gambling platform funds, C-material is a major source for money laundering, but its clearly illegal nature makes it highly susceptible to interception by bank and payment institution risk control systems.
category: Money Laundering
keywords: BC Funds
keywords: gambling proceeds
keywords: betting site funds
keywords: casino receivables
keywords: wagering capital
keywords: gaming platform liquidity
keywords: BC material
keywords: bookmaker cash flow
keywords: sportsbook funds
usage example: Direct supply of pure BC material, zero risk. Even newcomers can handle it. Rate at 8 points, deposit required, inquire for volume.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Black / White Funds
type: Term
break id: T0284
stix type: x-break-term
definition: Black and white funds refer to the underground classification of illicit money and ostensibly legitimate money.
description: Underground actors categorize money laundering funds into black funds and white funds. Black funds originate directly from criminal activities such as fraud and gambling, while white funds are those that have been layered through multiple cleaning stages to appear legitimate on the surface. Money laundering crews arrange different processing workflows based on the source of funds, with black funds requiring more intermediate steps to be converted into white funds. This classification helps underground actors assess the difficulty and cost of laundering and determines the commission rate charged by money-running teams.
category: Money Laundering
keywords: Black / White Funds
keywords: clean vs dirty money
keywords: layering classification
keywords: funds tiering
keywords: white money
keywords: black money
keywords: proceeds segregation
keywords: tainted vs untainted
keywords: money typology
usage example: Team long-term accepts all black and white funds. Cards accepted, return in USDT, large volumes of USDT available long-term.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Tainted USDT
type: Term
break id: T0285
stix type: x-break-term
definition: Black USDT refers to USDT originating from illegal operations such as fraud and coin theft, already flagged as high-risk.
description: Black USDT is the underground term for USDT obtained through illegal activities, typically involving fraud, Ponzi schemes, hacking, and coin theft. Exchanges and on-chain analytics tools flag these addresses, and any receiving account that transacts with them risks account freezing and fund seizure. Underground actors attempt to clean black USDT through mixers, cross-chain bridges, and other methods, but the success rate is inconsistent, and participants face potential legal liability at any time.
category: Money Laundering
keywords: Tainted USDT
keywords: dirty USDT
keywords: sanctioned USDT
keywords: flagged stablecoin
keywords: illicit crypto
keywords: stolen USDT
keywords: blacklisted Tether
keywords: contaminated USDT
keywords: high-risk wallet
usage example: Black USDT for sale: can be deposited to exchanges, used for platform contracts, or converted to RMB.
related risks: Cryptocurrency Money Laundering Risk
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Cryptocurrency Mixers
related attack tools: Identity Document Set (4-Piece)
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS15
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Mixed Fraud Funds
type: Term
break id: T0286
stix type: x-break-term
definition: Mixed material refers to illicit funds obtained through composite fraud schemes such as e-commerce refund scams, fake investment platforms, and credit card cash-out operations.
description: Mixed material is the underground umbrella term for proceeds from multi-scenario hybrid fraud. These funds come from diverse sources, including e-commerce refund fraud, fake investment platforms, loan fee scams, and credit card cash-outs. Because of the complex origin of the funds, tracing and identification are more difficult, which underground actors exploit for money laundering. Mixed material typically requires coordination among multiple money-running crews, resulting in long fund transfer chains and involving a vast number of personal information records and accounts.
category: Money Laundering
keywords: Mixed Fraud Funds
keywords: blended fraud proceeds
keywords: multi-source illicit funds
keywords: composite scam money
keywords: refund fraud funds
keywords: fake investment proceeds
keywords: carding proceeds
keywords: aggregated criminal receipts
keywords: hybrid laundering material
usage example: Crews short on cards contact me, I have mixed material, can supply cards, long-term supply until you’re satisfied, let’s talk rates.
related risks: Credit Card / Loan Cash-Out
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Parachute Funds
type: Term
break id: T0287
stix type: x-break-term
definition: Air-dropped funds are illicit proceeds obtained by directly defrauding victims through methods like adult-content lead generation or fake task scams.
description: This is the black market term for money obtained from romance or sextortion scams. Fraud rings use social apps to post adult-content bait, tricking victims into transferring money under the guise of advance deposits, membership fees, or security deposits. These funds come directly from the victims' accounts, making the transaction chain relatively simple but involving numerous personal transfer records. Black market operators need a large number of personal payment codes or accounts to receive these air-dropped funds in a decentralized manner, thereby evading bank risk controls and police tracking.
category: Money Laundering
keywords: Parachute Funds
keywords: sextortion funds
keywords: romance scam proceeds
keywords: pig-butchering money
keywords: advance-fee fraud
keywords: honey trap payments
keywords: direct victim transfers
keywords: appointment scam funds
keywords: seduction fraud receipts
usage example: Air-dropped funds need to be processed through personal merchant codes; the exchange rate is very high.
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Erotic-Chat Funds
type: Term
break id: T0288
stix type: x-break-term
definition: Sextortion chat is a scam technique that uses social apps for sexual inducement to trick victims into making payments.
description: A variant of adult-content lead generation scams, operators pose as providers of sexual services on social apps, luring victims into private chats after adding them as friends. During the conversation, they demand payments under various pretexts but never provide any actual service. This low-cost, highly covert scam often goes unreported because victims feel too ashamed to file a complaint, making fund recovery extremely difficult.
category: Money Laundering
keywords: Erotic-Chat Funds
keywords: sextortion chat
keywords: erotic luring
keywords: honey trap messaging
keywords: intimate chat scam
keywords: paid chat fraud
keywords: seduction-for-payment
keywords: adult content bait
keywords: cam girl fraud
usage example: The victim met a "beauty" on a social app who lured them into downloading a specific app for an Erotic-Chat Funds scheme, resulting in the victim being secretly recorded during a nude video chat and subsequently blackmailed.
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Ponzi Funds
type: Term
break id: T0289
stix type: x-break-term
definition: A fraudulent investment scheme disguised as a legitimate financial product, where returns are paid to earlier investors using funds from new participants.
description: Black market operators set up fake investment platforms or issue bogus financial products, luring victims with promises of high returns. Early investors are paid with money from new recruits, creating an illusion of profitability. Short-term schemes collapse within days or weeks after a quick cash grab, while long-term ones pose as legitimate projects to siphon funds over time before eventually shutting down or collapsing. These scams are frequently used in telecom fraud and illegal fundraising, often leaving participants with total losses.
category: Money Laundering
keywords: Ponzi Funds
keywords: pyramid scheme
keywords: high-yield investment program
keywords: HYIP
keywords: fake investment platform
keywords: Ponzi scheme
keywords: capital pool scam
keywords: exit scam project
keywords: bogus wealth management
usage example: Looking for second-stage funds! Regular - intimate chat - adult content - Ponzi scheme
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Second-Hop Funds
type: Term
break id: T0290
stix type: x-break-term
definition: Illicit funds that have undergone an initial round of laundering and are being circulated again.
description: Criminal networks subject first-hand proceeds from fraud or gambling to initial cleansing through multiple transfers, coin mixing, or sham transactions, turning them into second-stage funds. These funds are detached from their original source accounts, making them harder to trace, and are often funneled into downstream money muling, cryptocurrency purchases, or transfers to white merchant accounts. Second-stage funds represent a critical intermediary link in the laundering chain, significantly complicating tracking efforts.
category: Money Laundering
keywords: Second-Hop Funds
keywords: second-layer funds
keywords: intermediate proceeds
keywords: washed money
keywords: relayered funds
keywords: downstream transfers
keywords: cleaned criminal proceeds
keywords: secondary laundering stage
keywords: mid-chain money
usage example: Looking for runners to cooperate on second-stage fund schemes.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS15
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Launderable Funds
type: Term
break id: T0291
stix type: x-break-term
definition: Illicit funds awaiting or undergoing the laundering process.
description: Laundering funds broadly refer to criminal proceeds being processed through money muling, sham transactions, cryptocurrency conversion, and other methods. These funds may originate from telecom fraud, online gambling, or data trafficking, and are in the process of being transformed from 'dirty money' into 'clean assets.' The flow of laundering funds involves multiple accounts and platforms, making them the core target of money laundering operations; if intercepted, the entire chain is exposed.
category: Money Laundering
keywords: Launderable Funds
keywords: dirty money
keywords: illegal proceeds
keywords: money laundering flow
keywords: cleaning funds
keywords: black money to white
keywords: proceeds of crime
keywords: criminal capital
keywords: funds in transit
usage example: Mobile SIM box, small-amount laundering funds, contact me. Paying top dollar for grey-market QQ accounts, easy money 💰
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS15
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Unauthorized Card Spend
type: Term
break id: T0292
stix type: x-break-term
definition: The illegal act of conducting unauthorized transactions or cash withdrawals using stolen payment information.
description: Criminal actors use phishing sites, fake base stations, or malware to obtain others' bank card or credit card details, then clone cards or link them to payment accounts for fraudulent purchases. Stolen funds are often used to buy virtual goods, prepaid cards, or are funneled into money muling platforms for rapid liquidation or laundering. This activity directly violates personal financial security and is a common method for acquiring illicit proceeds in telecom and financial fraud.
category: Money Laundering
keywords: Unauthorized Card Spend
keywords: carding
keywords: card fraud
keywords: payment fraud
keywords: CNP fraud
keywords: card cracking
keywords: card cloning
keywords: e-skimming
keywords: account takeover
usage example: Small-amount payment QR codes accepting stolen carding data
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Passing Funds Downstream
type: Term
break id: T0293
stix type: x-break-term
definition: The act by which fraud syndicates distribute illicit funds to downstream actors for laundering.
description: Fund distribution is the upstream stage of the laundering chain, where fraud groups hand over proceeds from telecom scams, gambling, and other illegal activities to money mule teams or laundering intermediaries. Downstream, the funds are laundered through split transfers, cryptocurrency purchases, or the use of merchant accounts. Distributors typically do not directly participate in the cleaning process but profit through commissions, shifting the risk to the operational layer.
category: Money Laundering
keywords: Passing Funds Downstream
keywords: money mule distribution
keywords: layering stage
keywords: funds dissemination
keywords: upstream dispersal
keywords: criminal proceeds handoff
keywords: downstream laundering
keywords: cash drop
keywords: smurfing prep
usage example: Long-term fund distribution: Ponzi scheme
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS15
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

No-Questions Funds
type: Term
break id: T0294
stix type: x-break-term
definition: A laundering operation that accepts all incoming funds without scrutinizing their source.
description: Laundering intermediaries or money mule teams process any upstream funds without any review, whether they originate from fraud, gambling, or adult industry black markets. This high-efficiency, high-risk approach risks attracting attention from major criminal investigations. Indiscriminate acceptance is common in short-term cash-grab scenarios, where participants often overlook legal consequences in pursuit of quick money.
category: Money Laundering
keywords: No-Questions Funds
keywords: blind mixing
keywords: no-KYC flow
keywords: all-in laundering
keywords: indiscriminate layering
keywords: bulk cleaning
keywords: unfiltered funds
keywords: dirty money mixing
keywords: open intake
usage example: Indiscriminate acceptance, any money is good.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Unwitting Merchant
type: Term
break id: T0295
stix type: x-break-term
definition: A legitimate merchant unknowingly exploited as a laundering channel by criminal networks.
description: After obtaining funds through carding or fraud, criminals purchase high-value goods or services from white merchants, then resell them to cash out. The merchant becomes an unwitting link in the laundering chain, and their accounts may be frozen due to abnormal transactions. This tactic is common on e-commerce platforms, using genuine transactions to obscure the money trail and exposing the merchant to compliance risks.
category: Money Laundering
keywords: Unwitting Merchant
keywords: mule merchant
keywords: unwitting facilitator
keywords: clean merchant abuse
keywords: merchant account takeover
keywords: transaction laundering
keywords: shell merchant
keywords: front company
keywords: unwitting accomplice
usage example: Police traced illicit funds flowing through a seemingly normal convenience store, discovering that this Unwitting Merchant had its payment QR code covertly swapped by black-hat operators, unknowingly becoming a link in the money laundering chain.
related risks: Illegal Cash-Out
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS02
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Complicit Merchant
type: Term
break id: T0296
stix type: x-break-term
definition: A merchant account whose operator knowingly and actively colludes with criminal networks for money laundering.
description: Criminal groups control merchant accounts through rental, purchase, or profit-sharing arrangements to receive proceeds from fraud or gambling. Black merchants typically provide payment interfaces or collection QR codes, disguising illicit funds as legitimate business revenue, then completing the laundering process through withdrawals or transfers. This collaboration is a critical node in the laundering chain, characterized by a high degree of organization and posing significant challenges for law enforcement.
category: Money Laundering
keywords: Complicit Merchant
keywords: criminal collusion
keywords: merchant complicity
keywords: dirty merchant
keywords: payfac abuse
keywords: merchant-based laundering
keywords: collusive merchant
keywords: merchant collusion
usage example: The investigation revealed the gold shop owner was a Complicit Merchant, fully aware of the illegal source of funds yet still providing payment services for a fee, a typical case of colluding with black-hat operators to wash money.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Operation Boss
type: Term
break id: T0297
stix type: x-break-term
definition: The actual controller of a fraud or gambling operation, responsible for overall fund flows and crew command.
description: The 'Pan Zong' sits at the top of a fraud or gambling operation, making decisions on profit distribution, money laundering routes, and personnel assignments. They build fund-clearing networks through sub-agents, runner crews, and QR code suppliers, moving illicit proceeds through multiple layers. When an operation is busted, the Pan Zong is typically the primary target of investigation, and the capital pools they control are usually substantial.
category: Money Laundering
keywords: Operation Boss
keywords: crime boss
keywords: syndicate head
keywords: fraud ring leader
keywords: scam compound boss
keywords: kingpin
keywords: criminal mastermind
keywords: operation commander
keywords: ringleader
usage example: Looking for runner crews and individuals to move money; commission is generous. Intermediaries and Pan Zongs welcome to negotiate.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Reducing Returns
related threat actors: Fraud Kingpin
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Bank Card Broker
type: Term
break id: T0298
stix type: x-break-term
definition: An underground syndicate that illegally acquires and resells bank cards and identity information kits in bulk.
description: Card dealers collect complete sets of ID cards, bank cards, USB security keys, and phone numbers from cardholders through offline recruitment or online acquisition, then resell them at a premium to money laundering or fraud rings. These cards are used to receive, split, and transfer illicit funds, serving as the foundational tools for money laundering. Once a case is exposed, card dealers quickly cut off contact, significantly complicating fund tracing.
category: Money Laundering
keywords: Bank Card Broker
keywords: card broker
keywords: account seller
keywords: mule account provider
keywords: fullz seller
keywords: bank drop seller
keywords: carding supply
keywords: account dealer
keywords: card trafficker
usage example: A Bank Card Broker ring was busted, with hundreds of ID cards and bank cards seized on site; they sold these kits at high prices to fraud rings for registering corporate accounts and transferring illicit proceeds.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Identity Document Set (4-Piece)
related attack tools: Score-Running Platforms
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Bank Card Dealers
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Global Underground Economy Upgrade Study: SMS-Code Receiving Models Become More Covert
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

QR Code Broker
type: Term
break id: T0299
stix type: x-break-term
definition: An intermediary who specializes in providing payment QR codes for underground money laundering.
description: QR code suppliers accumulate personal, merchant, and aggregated payment codes through registration, rental, or purchase, then provide them to money laundering platforms or fraud rings for receiving payments. They take a commission based on transaction volume, dispersing illicit funds into different accounts to evade risk controls. Their existence significantly lowers the technical barrier to money laundering, making fund trails more obscure.
category: Money Laundering
keywords: QR Code Broker
keywords: code broker
keywords: QR mule
keywords: payment code seller
keywords: aggregator abuse
keywords: QR laundering
keywords: code supplier
keywords: mule code provider
keywords: payment code dealer
usage example: Small-amount collection, looking for runner crews and QR code suppliers, rate 12%
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Chat Operator
type: Term
break id: T0300
stix type: x-break-term
definition: A fraud operator who uses scripted dialogues to manipulate victims into transferring money.
description: Keyboard operators typically impersonate specific identities, contacting targets through social platforms or dating apps. They follow a preset script to build trust or emotional relationships, ultimately guiding the victim to deposit funds on a fake platform or make a direct transfer. They are the link in the fraud chain that directly faces the victim, and the sophistication of their scripts directly impacts the success rate of the scam.
category: Money Laundering
keywords: Chat Operator
keywords: scam operator
keywords: social engineering agent
keywords: romance scammer
keywords: pig butchering operator
keywords: chat scammer
keywords: script operator
keywords: call center agent
keywords: confidence trickster
usage example: Long-term cooperation with keyboard operators 👍 Top commission rate ⭐
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Cash-Out Crew
type: Term
break id: T0301
stix type: x-break-term
definition: An offline crew responsible for cashing out illicit funds through ATM withdrawals or purchases.
description: Cash-out crews hold a large number of other people's bank cards. Once funds arrive, they quickly disperse to various ATMs to withdraw cash or convert it through buying virtual goods or gold. They have a clear division of labor, with members assigned to withdrawal, lookout, and cash transfer. This offline cashing-out is the final link in the money laundering chain, carrying extremely high risk and often accompanied by violent acts like holding cardholders against their will.
category: Money Laundering
keywords: Cash-Out Crew
keywords: Cash-Out Syndicate
keywords: ATM Withdrawal Gang
keywords: Cash Mule Network
keywords: Physical Cashout
keywords: Offline Cashout Team
keywords: Cash Extraction Crew
keywords: Money Mule Herder
keywords: Cash Runner
usage example: Cash-out crew, small crews can be nurtured and supported, high commission, no bank card needed, arrangement upon deposit.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Identity Provider
type: Term
break id: T0302
stix type: x-break-term
definition: An individual who rents or sells their own identity information and accounts to underground operations for profit.
description: To earn a commission, these individuals actively or passively provide their ID cards, bank cards, and payment accounts to money laundering crews for registering merchant accounts, receiving illicit funds, or acting as a figurehead. They are often unaware of the specific source and destination of the funds, but once the account is implicated in a case, they, as the account holder, will be the first to face legal sanctions.
category: Money Laundering
keywords: Identity Provider
keywords: Identity Mule
keywords: Straw Person
keywords: Nominee Identity
keywords: ID Mule
keywords: Rented Identity
keywords: Fake Identity Provider
keywords: Shell Identity
keywords: Identity Leaser
usage example: Commission for account providers: 4 USDT, come on board.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Identity Document Set (4-Piece)
related attack tools: Score-Running Platforms
related threat actors: Card Farmer
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Cardless Identity Provider
type: Term
break id: T0303
stix type: x-break-term
definition: A provider who supplies only identity information without a physical bank card.
description: A 'cardless provider' typically only offers ID photos, selfies holding an ID, and similar materials for online identity verification, helping underground operations bypass platform registration requirements. They do not provide a physical bank card, but the virtual accounts registered with their information can still be used to receive and transfer funds. This model lowers the perceived risk for the provider, making them easier to recruit.
category: Money Laundering
keywords: Cardless Identity Provider
keywords: KYC Mule
keywords: Identity Document Provider
keywords: Selfie ID Vendor
keywords: KYC Bypass Identity
keywords: Virtual Account Registrant
keywords: ID Photo Supplier
keywords: Non-Card Identity Mule
keywords: Remote Identity Provider
usage example: Who needs a cardless provider? Has a bank account with a 5,000 yuan non-counter limit.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Account Holder
type: Term
break id: T0304
stix type: x-break-term
definition: The registered owner of a bank card or payment account whose account is used for money laundering by underground operations.
description: A cardholder may have knowingly or unknowingly provided their personal account for others to use. In money laundering, the cardholder's account serves as a transit point, receiving upstream funds from fraud or gambling and then transferring them out as instructed. Regardless of whether the cardholder profited, they will face credit penalties and even criminal liability once the account is implicated in a case.
category: Money Laundering
keywords: Account Holder
keywords: Account Mule
keywords: Bank Drop
keywords: Account Owner
keywords: Drop Account Holder
keywords: Mule Account Owner
keywords: Nominee Account Holder
keywords: Financial Mule
keywords: Straw Owner
usage example: Bank card with 3,000 yuan limit, cardholder is in Jinan.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Card Farmer
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Group Conversion
type: Term
break id: T0305
stix type: x-break-term
definition: Group guidance is a manipulation tactic used by fraud rings in social media groups or Telegram, where scripted talk and shills are deployed to continuously steer victims into completing payments or transfers.
description: Fraudsters set up groups on popular social platforms or Telegram, planting shills to create a false sense of profit or urgency. Through persistent scripted guidance, they manipulate group members into making payments, investments, or completing fake tasks, linking fraud directly to money laundering. Under peer pressure and herd mentality, victims often make repeated transfers, leading to substantial financial losses.
category: Money Laundering
keywords: Group Conversion
keywords: Group Manipulation
keywords: Social Engineering Chat
keywords: Shill Bidding
keywords: FOMO Inducement
keywords: Pump-and-Dump Chat
keywords: Shill Conversion
keywords: Group Shilling
keywords: Chatroom Scam
usage example: The group is running guidance again—several shills are doing a double act to lure newcomers into putting money in.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Onboard A Card
type: Term
break id: T0306
stix type: x-break-term
definition: Card onboarding refers to the act of an individual providing their own bank card to underground money-laundering networks for receiving and moving illicit funds.
description: To evade fund tracing, criminal networks recruit card mules who supply their bank cards as collection and transfer tools. Lured by commissions, participants knowingly or recklessly hand over their cards, U-shields, and account access for receiving fraud proceeds. Once implicated, card providers face account freezes, credit blacklisting, and potential criminal liability.
category: Money Laundering
keywords: Onboard A Card
keywords: Card Submission
keywords: Card Rent
keywords: Mule Recruitment
keywords: Card Leasing
keywords: Drop Registration
keywords: Account Onboarding
keywords: Card Farming
keywords: Mule Onboarding
usage example: A new broker claims you just need to onboard a card and run a transaction to get an 88 USDT red packet—sounds completely shady.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

First-Hand Source Panel
type: Term
break id: T0307
stix type: x-break-term
definition: A first-hand direct source is an upstream operator who directly controls the origin of illicit funds and core collection channels, maintaining a stable pool of dirty money.
description: Sitting at the top of the money-laundering chain, a first-hand direct source holds the most upstream illegal funds, such as proceeds from gambling or fraud. They directly control a large number of bank accounts, payment accounts, or crypto addresses used for collection, offering a direct laundering channel. Downstream running crews or money brokers must connect with them to obtain a stable supply of material for washing.
category: Money Laundering
keywords: First-Hand Source Panel
keywords: Source Fund Controller
keywords: Direct Panel
keywords: Whale Panel
keywords: Source Money Launderer
keywords: Core Settlement Layer
keywords: Primary Fund Source
keywords: Panel Operator
keywords: Source Channel
usage example: First-hand direct source looking for partners, gambling material, regular clean mix and blended material all available, channels are stable.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Data Brokers
related threat actors: Fraud Kingpin
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS15
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Payment QR
type: Term
break id: T0317
stix type: x-break-term
definition: In the context of money laundering, a payment QR code or link used by fraud rings to collect and pool illicit funds, serving as the entry point for cash flow.
description: A payment code is itself a normal payment instrument, but within money-muling chains it is repurposed as a “cash receptacle.” Fraud rings distribute large numbers of payment codes to downstream “runners” or embed them directly into scam scripts, inducing victims to scan and pay so that funds instantly enter the controlled environment. The money is then laundered through multi-level transfers, coin mixing, or virtual asset purchases, with the entire process relying on rapid code distribution and rotation to evade platform risk tracing.
category: Money Laundering
keywords: Payment QR
keywords: receiving QR
keywords: collection code
keywords: funds intake scan
keywords: pay-in QR
keywords: drop QR
keywords: cash-in code
keywords: receive scan
usage example: After taking an order on a money-muling platform, he simply had to post his Payment QR into a designated group to automatically receive gamblers' top-up funds, earning a 1% cut per transaction with daily volumes reaching tens of thousands of yuan.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Personal QR Code
type: Term
break id: T0317-001
stix type: x-break-term
definition: A personal QR code is a collection QR code registered under an individual identity, featuring limited transaction caps but relatively loose risk controls, commonly used for micro-laundering.
description: Underground actors collect or purchase ordinary users' personal payment QR codes to receive illicit funds. These codes typically have per-transaction and daily limits, but their fragmented and concealed nature makes them less likely to trigger early risk alerts. On money-running platforms, numerous personal codes are used for fragmented collection, breaking large sums of dirty money into countless small transactions to increase tracing difficulty.
category: Money Laundering
keywords: Personal QR Code
keywords: Personal QR
keywords: P2P Code
keywords: Individual QR
keywords: Private QR
keywords: Personal Pay Code
keywords: Consumer QR
keywords: P2P Payment Code
keywords: Direct QR
usage example: Looking for a few smooth personal codes, must handle under 3000 per day, rates are negotiable.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Merchant QR Code
type: Term
break id: T0317-002
stix type: x-break-term
definition: A merchant QR code is a collection QR code opened under a business identity, offering higher transaction limits and greater stability, serving as a key channel for cleaning illicit funds.
description: Compared to personal codes, merchant codes have higher collection limits and more stable channels, capable of handling larger cash flows. Criminal rings register shell businesses or acquire existing merchants' codes to use as core collection tools. Due to high transaction volumes, these channels can trigger large-scale financial risks once used for money laundering and are a primary target for risk monitoring.
category: Money Laundering
keywords: Merchant QR Code
keywords: Business QR
keywords: Enterprise QR
keywords: Commercial QR
keywords: Business Pay Code
keywords: Merchant Payment Code
keywords: Corporate QR
keywords: POS QR
keywords: Business Account QR
usage example: Recruiting drivers, card runners, aggregated codes, merchant codes—all smooth channels come connect.
related risks: Money Laundering Risk
related risks: Platform Fraud Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related threat actors: Score Runner
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Aggregated QR Code
type: Term
break id: T0317-003
stix type: x-break-term
definition: An aggregated QR code is a collection QR code that consolidates multiple payment methods, exploited by underground actors to obscure fund flows and increase tracing difficulty.
description: An aggregated code combines WeChat Pay, Alipay, UnionPay, and other payment options into a single QR code for user convenience. Criminals exploit this feature to have victims pay through different channels after scanning, thereby confusing the source and destination of funds. In laundering scenarios, aggregated codes are often used to collect small, multi-transaction illicit funds such as group-buying material to evade single-channel risk controls.
category: Money Laundering
keywords: Aggregated QR Code
keywords: Multi-Payment QR
keywords: Unified QR
keywords: Combined QR
keywords: Multi-Channel QR
keywords: Payment Gateway QR
keywords: Omni-Channel QR
keywords: Integrated QR
keywords: Universal QR
usage example: Recruiting aggregated codes for small group-buying material, 28 points, single transaction 90–110, daily volume 1500–2000.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related threat actors: Score Runner
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Direct Aggregated Scan
type: Term
break id: T0317-004
stix type: x-break-term
definition: Aggregated direct scan is a payment-ready aggregated QR code used by underground actors to directly receive payments, featuring multi-platform compatibility and high liquidity.
description: This is a payment channel that can be used directly for transactions; victims scan it and complete payments through various payment apps. Criminal rings widely use it for money running and collection, as its multi-platform compatibility enables rapid receipt and transfer of funds. Due to its high liquidity, it often circulates among groups as a direct-source asset to connect with various fraud scenarios.
category: Money Laundering
keywords: Direct Aggregated Scan
keywords: aggregated payment QR
keywords: multi-platform scan
keywords: direct payment gateway
keywords: aggregation scan code
keywords: unified scan
keywords: direct channel
keywords: scan-to-pay aggregation
usage example: Looking for regular direct-scan channels, must be aggregated direct scan, stable channels only.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Small-Ticket QR
type: Term
break id: T0317-005
stix type: x-break-term
definition: A small-value QR code is a collection QR code specifically used for transactions under 1,000 yuan, widely adopted in money running due to its low risk-control sensitivity.
description: To evade risk controls triggered by large transactions, criminals split illicit funds into numerous small payments. Small-value codes are the tools for receiving these fragmented funds, with single amounts typically ranging from tens to hundreds of yuan. Large numbers of small-value codes are organized on money-running platforms, where ordinary users complete collection and transfer through a task-grabbing model to wash funds, offering extreme concealment.
category: Money Laundering
keywords: Small-Ticket QR
keywords: micro payment QR
keywords: small-value code
keywords: low-value scan
keywords: micro-transaction code
keywords: small-ticket scan
keywords: split payment code
keywords: small-amount QR
usage example: Small-value codes for cashing out to USDT, Fuli escrow, high volume and stable.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Large-Ticket QR
type: Term
break id: T0317-006
stix type: x-break-term
definition: A payment QR code used in money laundering operations to receive single transactions of 2,000 yuan or more, serving as a dedicated tool for handling high-value illicit funds.
description: Fraud rings treat high-value codes as core channels for volume-based laundering—the larger the single transaction, the faster illicit funds can be pooled and moved. These codes are typically supplied by recruited “code merchants” and linked to upstream crimes such as telecom fraud and gambling. By processing frequent, high-value transactions, dirty money is broken up and recirculated. Although these codes are highly prone to triggering freezes once flagged by risk controls, their laundering efficiency keeps them in high demand across money-muling chains.
category: Money Laundering
keywords: Large-Ticket QR
keywords: high-value QR
keywords: large-amount scan
keywords: bulk payment code
keywords: big-ticket scan
keywords: high-limit QR
keywords: large-sum code
keywords: whale transaction code
usage example: Long-term recruitment for vehicles, high-value code vehicles, high volume no worries.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Limit-Breaking QR
type: Term
break id: T0317-007
stix type: x-break-term
definition: A payment QR code used in money laundering that can bypass single-transaction or daily limits imposed by payment platforms, specifically designed to circumvent risk controls for high-density transfers.
description: Platforms typically set limits on payment codes; limit-breaking codes are “over-limit” codes created by fraud rings through technical manipulation or account nurturing, capable of receiving funds far exceeding normal thresholds in a short time. Money-muling crews use them to handle the splitting of large illicit sums, breaking a single large amount into multiple rapid entries to reduce the chance of interception. Long-term use accelerates account freezes or bans, but these codes are virtually indispensable in time-sensitive laundering scenarios.
category: Money Laundering
keywords: Limit-Breaking QR
keywords: limit bypass QR
keywords: threshold breaker code
keywords: limit override scan
keywords: ceiling breaker QR
keywords: limit crack code
keywords: bypass scan
keywords: limit evasion code
usage example: 5,000–50,000 limit-breaking codes continuously operating.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Smooth-Pass QR
type: Term
break id: T0317-008
stix type: x-break-term
definition: A payment QR code used in money laundering with an extremely high transaction success rate and almost no risk-control interference, regarded by fraud rings as a “stable” channel that won’t drop.
description: The core value of a smooth code lies in “no penalty stand”—meaning no risk-control pop-ups or blocks cause the transaction to fail after scanning. Fraud rings nurture accounts through simulated normal consumer behavior to keep the code “clean,” then deploy it in telecom fraud or money-muling to receive dirty money. These codes offer smooth flow and fast settlement, significantly reducing the risk of victim suspicion and platform intervention, which is why they command higher prices and the strongest demand.
category: Money Laundering
keywords: Smooth-Pass QR
keywords: no-block scan
keywords: clean QR
keywords: unflagged code
keywords: low-friction scan
keywords: stealth payment code
keywords: smooth transaction QR
keywords: bypass scan code
usage example: Recruiting vehicles, any smooth code vehicle, truck, high volume no penalty stand—no empty runs.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Anomalous Access Behavior Detection
related avoidances: Device Fingerprinting
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Fixed-Amount QR
type: Term
break id: T0317-009
stix type: x-break-term
definition: A payment link or QR code used in money laundering that can be preset with a fixed amount, enabling precise collection of specific denominations of illicit funds.
description: Preset codes are often tied to virtual goods payment scenarios, such as QQ coins or top-up vouchers. Fraud rings lock the top-up amount to a specific tier so that the payer can only pay the preset sum. This avoids reconciliation hassles from overpayment or underpayment while disguising dirty money as legitimate virtual consumption. Money-muling crews purchase these codes in bulk and pair them with automated card-issuing platforms to achieve “pay-and-ship,” completing both money laundering and asset conversion.
category: Money Laundering
keywords: Fixed-Amount QR
keywords: preset amount QR
keywords: fixed-value scan
keywords: locked-amount code
keywords: set-value payment link
keywords: fixed-sum QR
keywords: predefined amount code
keywords: static amount scan
usage example: Recruiting: preset codes, aggregated codes, personal codes, DiDi cash.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Card Vending Platforms
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Direct Scan
type: Term
break id: T0317-010
stix type: x-break-term
definition: A money-laundering method in which the payee presents a QR code and the payer scans it to pay directly, emphasizing direct fund transfer without intermediate redirects.
description: Direct scanning skips steps like entering the amount or confirming the transfer—the payer scans and pays instantly, perfectly suiting fraud rings’ “fast in, fast out” needs. Money-muling crews use direct-scan codes to receive scam proceeds or gambling funds, with money arriving in the designated account almost in real time before being quickly moved or spent. This method demands high code quality; once a code is flagged, direct scanning fails instantly, so fraud rings constantly seek “fresh” direct-scan codes to keep the channel open.
category: Money Laundering
keywords: Direct Scan
keywords: scan-to-pay
keywords: direct pay QR
keywords: instant scan
keywords: one-step scan
keywords: direct receipt scan
keywords: straight scan
keywords: payee-presented QR
usage example: Today’s logistics direct-scan amount, 10,246, send orders, send orders!!!!
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Reverse Scan
type: Term
break id: T0317-011
stix type: x-break-term
definition: A money-laundering method in which the payee uses a device to actively scan the payer’s payment code to collect funds, commonly seen in offline or POS scenarios.
description: Reverse scanning puts the initiative in the payee’s hands—the payer merely displays their payment code and the money is deducted. In fraud rings, this is often used for offline laundering or “mobile phone vehicle” operations, such as using a POS terminal to reverse-scan a victim’s payment code or sending a “runner” with a device to scan a gambler’s code. The fund flow is more covert and less likely to be noticed by the payer. This method requires hardware and scenario coordination but effectively circumvents online risk controls, making it a key offline money-muling technique.
category: Money Laundering
keywords: Reverse Scan
keywords: merchant scan
keywords: POS-style scan
keywords: active scan
keywords: scan customer code
keywords: merchant-initiated scan
keywords: retail scan mode
keywords: presented code capture
usage example: Looking for a reverse-scan vehicle, mobile phone/gold reverse-scan vehicle, major supermarket reverse-scan vehicle!!!
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Bank Direct-Scan QR
type: Term
break id: T0317-012
stix type: x-break-term
definition: A money-laundering method that uses a payment QR code generated by a banking app for direct scan-and-transfer, disguising dirty money as ordinary bank transactions.
description: Bank direct scanning uses the bank’s proprietary channel, keeping fund flow within the banking system. Fraud rings consider this more “stable” than third-party payment codes because risk controls tend to lag. Money-muling crews use bank direct-scan codes to receive large illicit sums; the payer completes the transfer by scanning the code via a banking app, and the transaction record resembles a normal person-to-person transfer. These codes are often paired with models like “code-to-code” or “code-to-USDT,” converting renminbi into cryptocurrency or foreign exchange to further sever the traceability chain.
category: Money Laundering
keywords: Bank Direct-Scan QR
keywords: bank app scan
keywords: banking QR transfer
keywords: direct bank scan
keywords: bank-channel QR
keywords: bank-to-bank scan
keywords: bank collection code
keywords: bank pay scan
usage example: Exchange rate ceiling, code-to-code, code-to-USDT, bank direct scan, UnionPay code.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related attack tools: Cryptocurrency Mixers
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS15
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Unionpay QR
type: Term
break id: T0317-013
stix type: x-break-term
definition: A UnionPay-based payment QR code used to receive or transfer illicit funds, serving as a collection entry point in money muling operations that rely on bank clearing networks.
description: UnionPay QR codes leverage the cross-bank clearing network of UnionPay, covering the vast majority of bank accounts. Criminal actors use them as a front-end tool for collecting funds in money muling schemes. During operations, money mule organizers or platform operators generate dynamic or static QR codes for victims to scan and pay. The funds are then rapidly consolidated into controlled accounts through UnionPay channels. Due to their broad bank-level coverage and instant settlement, these codes are often used to split large sums into small, multiple transactions to evade risk monitoring systems.
category: Money Laundering
keywords: Unionpay QR
keywords: Quick Response code for money laundering
keywords: UnionPay collection QR
keywords: payment code for illegal funds
keywords: UnionPay money receiving frontend
keywords: QR code for running score
keywords: bank settlement network QR
keywords: dynamic QR for illicit collection
keywords: static QR for dirty money
usage example: QR to QR, QR to USDT, UnionPay QR.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Card-and-QR Bundle
type: Term
break id: T0317-014
stix type: x-break-term
definition: A bundled resource pack combining a bank card with a corresponding payment QR code, providing a ready-to-use collection channel set for downstream members in money muling operations.
description: A card-code bundle pairs a bank card number with its associated payment QR code into a single resource unit, allowing money mules and code merchants to switch collection methods on demand. These bundles are distributed through chat groups or darknet markets. When receiving payments, operators select the appropriate card or code based on the transaction amount and payment channel requirements. This combination reduces the logistical cost of managing collection tools and fragments the entry points for funds, increasing the difficulty of tracing.
category: Money Laundering
keywords: Card-and-QR Bundle
keywords: payment card and QR combo
keywords: bundled payment resource
keywords: receiving channel bundle
keywords: card and code package
keywords: QR and bank card set
keywords: payment method combo
keywords: fragmented payment tool
keywords: card code bundle
usage example: Direct drops for fresh data, 3,000 to 100,000. Both cards and codes accepted. Operating all day, looking for long-term drivers. All bosses welcome.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Tier-1 Bank Card
type: Term
break id: T0322
stix type: x-break-term
definition: A personal savings account with the highest transaction limits and permissions in the banking system, serving as the preferred entry point for illicit funds in money muling and laundering operations.
description: Tier-1 accounts possess the highest permissions, including large daily transfer limits and full online banking functionality. Criminal networks specifically acquire these accounts to receive upstream illicit funds from fraud or gambling. Once funds enter, they are rapidly dispersed through multi-tier splitting and fast interbank transfers, exploiting the high quota to reduce the chance of triggering bank risk controls. On the black market, Tier-1 accounts are often sold in bundles with security tokens, credit cards, and corporate accounts to form a complete collection matrix.
category: Money Laundering
keywords: Tier-1 Bank Card
keywords: high-limit savings account
keywords: full-permission bank account
keywords: unrestricted transfer account
keywords: tier-1 account for money laundering
keywords: large-value receiving card
keywords: daily large transfer card
keywords: online banking full access account
keywords: black market bank account
usage example: Buying Tier-1 accounts, credit cards, token-secured accounts, corporate accounts, and unregistered account holders.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Corporate Account
type: Term
break id: T0323
stix type: x-break-term
definition: A corporate bank account opened in the name of a business, used by criminal actors to receive and circulate large volumes of illicit funds, acting as a high-capacity channel in money muling systems.
description: Compared to personal accounts, corporate accounts have higher single-transaction and daily cumulative transfer limits. A business background can also be used to fabricate trade flows to disguise the nature of the funds. Criminals acquire these accounts by purchasing shell companies or using fraudulently registered entities. After transferring large sums from fraud or gambling into the account, the money is split and moved out under the guise of payments for goods or services. Due to their large capacity and apparent compliance, they are often used as key nodes for laundering large sums, and any case involvement typically triggers a system-wide risk control upgrade for corporate accounts.
category: Money Laundering
keywords: Corporate Account
keywords: shell company account
keywords: business bank account for laundering
keywords: high-capacity fund channel
keywords: corporate account for dirty money
keywords: fake trade account
keywords: public account for illegal funds
keywords: wholesale money laundering account
keywords: enterprise account for fraud
usage example: Buying all banks' corporate accounts nationwide, even unused junk accounts, as long as the bank acceptance draft service is activated. Turn them into cash!!!
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related attack tools: Cryptocurrency Mixers
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS15
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Four-Piece Bank Kit
type: Term
break id: T0325
stix type: x-break-term
definition: A complete identity resource pack for account opening, containing an ID card, bank card, SIM card, and U-shield, serving as the basic configuration for building money laundering accounts in bulk.
description: A four-piece set provides all the core elements needed for fraudulent account opening. After purchase, criminals can register for online banking, link third-party payment services, and activate large transfer permissions. These accounts are used to receive, split, and transfer illicit funds, forming an anonymous money flow chain. Because the complete identity set can bypass in-person bank verification, it is often used to build account pools for money muling on a large scale. Once such a set enters the market, it signifies a deep abuse of the corresponding citizen's personal information.
category: Money Laundering
keywords: Four-Piece Bank Kit
keywords: identity theft kit
keywords: full account opening set
keywords: ID card bank card phone card U-shield
keywords: anonymous account bundle
keywords: complete verification package
keywords: account registration kit
keywords: four-piece identity set
keywords: black market account package
usage example: Selling four-piece bank card sets.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Identity Document Set (4-Piece)
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Third-Party Payment Platform
type: Term
break id: T0326
stix type: x-break-term
definition: A third-party payment platform used by criminals as a buffer layer between bank cards and final recipient accounts to facilitate payment jumps in money laundering.
description: Third-party payment platforms provide interfaces for wallet top-ups, transfers, and purchases. Criminals transfer illicit funds from bank cards into third-party accounts, then further obscure the money trail through inter-account transfers or purchases of virtual goods. Common tactics include using inter-account transfers, proxy payments, and red packet features to commingle funds. Because these platforms operate independently of the bank clearing system, they can form information silos, making them a critical isolation layer in the money muling chain.
category: Money Laundering
keywords: Third-Party Payment Platform
keywords: payment isolation layer
keywords: wallet transfer platform
keywords: fund obfuscation intermediary
keywords: third-party payment for laundering
keywords: payment jump platform
keywords: money laundering isolation
keywords: third-party wallet for dirty money
keywords: payment gateway for fraud
usage example: Large amounts via third-party, large amounts via secondary cards, must pass through third-party, reverse scan.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Digital Gift Card
type: Term
break id: T0327
stix type: x-break-term
definition: Virtual stored-value cards, such as online E-cards and supermarket gift cards, which criminals purchase with illicit funds and then cash out by redeeming or reselling the card details, serving as a virtual liquidation channel for money laundering.
description: E-cards exist as a card number and password without requiring physical delivery. Criminals buy them in bulk with illicit funds and then clean the money by reselling the card details or redeeming them to purchase physical goods for resale. Because the purchase and redemption actions can be separated across different accounts and IP addresses, this method inherently provides a fund isolation effect. Commonly found on e-commerce and lifestyle service platforms, these cards have small individual values but can be processed in bulk, making them suitable for high-frequency, small-sum money laundering.
category: Money Laundering
keywords: Digital Gift Card
keywords: virtual stored-value card
keywords: e-card for money laundering
keywords: gift card cash-out
keywords: digital card for illicit funds
keywords: prepaid card for fraud
keywords: online shopping card for laundering
keywords: card number and password trade
keywords: virtual card redemption
usage example: Supplying, multiple channels for e-card details.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS02
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Digital RMB Gateway
type: Term
break id: T0328
stix type: x-break-term
definition: A technical method that intercepts a user's digital yuan top-up request and redirects it to a device controlled by the criminal, allowing them to funnel fraudulent funds directly into their own wallet.
description: A digital gateway hijacks a legitimate user's digital yuan top-up process through technical means. The top-up operation, which should be executed on the user's own device, is redirected to a device held by the criminal. Consequently, the victim's funds are deposited directly into the criminal's digital wallet, bypassing the user's own wallet binding and risk verification. This technique achieves fund diversion through device switching, with single transactions typically ranging from 300 to 20,000 yuan. It can operate automatically around the clock with a high degree of stealth.
category: Money Laundering
keywords: Digital RMB Gateway
keywords: digital yuan hijacking
keywords: e-CNY redirection
keywords: wallet top-up interception
keywords: device-switching for digital RMB
keywords: digital currency gateway
keywords: e-CNY recharge hijack
keywords: digital RMB man-in-the-middle
keywords: digital yuan wallet takeover
usage example: Digital RMB gateway, single transaction 300-20,000, online 24/7 without interruption.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related threat actors: Score Runner
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Cryptocurrency
type: Term
break id: T0329
stix type: x-break-term
definition: Cryptocurrency refers to virtual assets used by cybercriminal networks to obscure fund flows, serving as a transfer medium for anonymously laundering illicit proceeds.
description: In money laundering and layering schemes, cryptocurrencies such as USDT and BTC are used as core cleansing tools. Criminals convert illegal fiat currency into cryptocurrency, leveraging its decentralized and cross-border nature to sever the connection between the funds and the original crime. This method is commonly seen in cross-border online gambling and fraud repatriation scenarios, significantly complicating efforts by law enforcement to freeze and trace assets due to its inherent anonymity.
category: Money Laundering
keywords: Cryptocurrency
keywords: virtual currency for money laundering
keywords: crypto for illicit funds
keywords: anonymous transfer asset
keywords: crypto laundering medium
keywords: USDT for running score
keywords: BTC for fraud
keywords: cryptocurrency for criminal proceeds
keywords: digital asset for obfuscation
usage example: 💰💰 High-quality clean funds, accepting cryptocurrency 💰💰 04 Operational model: common methods and profit distribution in layering schemes
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Cryptocurrency Money Laundering Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Cryptocurrency Mixers
related attack tools: Identity Document Set (4-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS15
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Score Running
type: Term
break id: T0330
stix type: x-break-term
definition: Layering is a money laundering activity where individuals or groups use their own accounts to receive and forward illicit funds on behalf of criminal enterprises, taking a commission in the process.
description: Participants in layering, often referred to as 'money mules' or 'card mules,' provide their bank cards, payment QR codes, or third-party payment accounts to upstream criminals to receive proceeds from telecom fraud, online gambling, and other crimes. They then split and transfer the funds to other designated accounts as instructed, facilitating rapid dispersal. This act directly constitutes aiding and abetting criminal activity, exposing participants to frozen accounts and criminal liability.
category: Money Laundering
keywords: Score Running
keywords: account renting for illegal funds
keywords: money mule operation
keywords: payment proxy for fraud
keywords: card running for dirty money
keywords: account splitting for laundering
keywords: illegal fund transfer agent
keywords: money receiving and forwarding
keywords: criminal proceeds handling
usage example: Lured by a high-paying side gig, a college student lent their payment QR code to a platform for Score Running, only to be placed under criminal detention by police for suspected involvement in aiding information network crimes.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Online Score Running
type: Term
break id: T0331
stix type: x-break-term
definition: Online layering is a contactless money laundering operation conducted entirely through internet platforms.
description: Unlike traditional models requiring physical meetings, online layering relies entirely on dedicated apps or web platforms. Participants accept tasks through the platform, using linked accounts to receive and transfer funds without ever meeting the upstream handler. This model has a low recruitment threshold and spreads rapidly, often disguised as 'part-time payment collection,' attracting individuals seeking quick money with extremely fast capital turnover.
category: Money Laundering
keywords: Online Score Running
keywords: online score running platform
keywords: score running app
keywords: non-contact money laundering
keywords: digital score running
keywords: remote score running
keywords: online money muling
keywords: virtual account layering
keywords: internet-based money washing
usage example: Online layering app, officially recruiting master agents, limited spots available!
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

OTC Exchange
type: Term
break id: T0332
stix type: x-break-term
definition: In the context of cybercrime, cashing out specifically refers to the operation of exchanging fiat currency for cryptocurrencies like USDT.
description: The cash-out merchant is a key link between the fiat currency pool and the cryptocurrency pool. They receive fiat funds from illegal activities such as fraud and gambling, then pay out an equivalent value in cryptocurrency to the counterparty. This process helps criminal enterprises 'clean' high-risk fiat currency into relatively anonymous virtual assets, moving funds from the regulated banking system into a gray zone, and represents the core exchange link in the money laundering chain.
category: Money Laundering
keywords: OTC Exchange
keywords: OTC desk
keywords: crypto acceptance
keywords: fiat-to-crypto exchange
keywords: USDT acceptance
keywords: crypto settlement
keywords: acceptance agent
keywords: off-ramp
keywords: stablecoin conversion
usage example: Accepting second-tier funds from Lingqiantong and Yu'ebao for cash-out back to USDT.
related risks: Cryptocurrency Money Laundering Risk
related risks: Money Laundering Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Cryptocurrency Mixers
related attack tools: Identity Document Set (4-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS15
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

QR-to-USDT Settlement
type: Term
break id: T0333
stix type: x-break-term
definition: QR-to-Crypto is a laundering technique where criminals use payment QR codes to receive fiat currency and then return the funds in the form of USDT.
description: This method combines the convenience of QR code payments with the anonymity of cryptocurrency. Criminals use a large collection of personal payment QR codes to receive illicit funds; once the money enters the account, they purchase USDT to return to the upstream handler. This model splits the fund trail into 'fiat in, crypto out,' making tracking extremely difficult once it enters the virtual currency stage, and is commonly used for rapid profit distribution in telecom fraud.
category: Money Laundering
keywords: QR-to-USDT Settlement
keywords: QR code settlement
keywords: USDT return
keywords: QR-to-crypto
keywords: scan-and-pay laundering
keywords: code-to-U
keywords: payment code recycling
keywords: digital payment washing
keywords: QR settlement cycle
usage example: Boss, can you do small amounts, 50-1000, QR-to-Crypto?
related risks: Cryptocurrency Money Laundering Risk
related risks: Money Laundering Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: SMS Verification Code Platform
related attack tools: Cryptocurrency Mixers
related attack tools: Identity Document Set (4-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS15
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Card Receiving
type: Term
break id: T0334
stix type: x-break-term
definition: Card receiving is the act of directly using a bank card to receive and process illicit funds.
description: Card receiving is the most basic and direct form of layering. The operator provides their own bank card as a primary or secondary collection account, receiving funds from fraud or gambling operations, then transfers the money out through ATM withdrawals, over-the-counter cash-outs, or online transfers. Due to increasingly strict bank risk controls, such accounts are highly susceptible to rapid freezing, forcing criminal networks to constantly recruit new 'card mules' to supply fresh bank cards and maintain the funding chain.
category: Money Laundering
keywords: Card Receiving
keywords: card receiving account
keywords: money mule account
keywords: direct card deposit
keywords: card-based laundering
keywords: card drop
keywords: account takeover receiving
keywords: bank card relay
keywords: card collection
usage example: The ring abandoned third-party payments and directly used Card Receiving to collect scam proceeds, rapidly dispersing the illicit funds into multiple second-tier accounts to evade bank risk controls.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Card Farmer
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Proxy Payout
type: Term
break id: T0335
stix type: x-break-term
definition: Proxy payment is the act of completing payments or cash-outs on behalf of criminal enterprises, serving as a transit point for illicit funds.
description: Following instructions, a proxy payer uses their own payment account to make specific payments for criminal operations, such as paying fees, distributing salaries, or settling invoices. This is commonly seen when online gambling platforms cash out winnings for gamblers or fraud rings pay their 'call operators.' Proxy payment mixes illicit funds into everyday payment flows, obscuring the final destination of the money. The proxy earns a commission but faces extremely high legal risk.
category: Money Laundering
keywords: Proxy Payout
keywords: proxy payout service
keywords: payment proxy
keywords: payout mule
keywords: disbursement agent
keywords: third-party payout
keywords: ghost payee
keywords: pay-out intermediary
keywords: payout forwarding
usage example: Hey! Boss, need a proxy payer? 'Scan, buy, book, settle headhunting fees, settle any fee.'
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related avoidances: Reducing Returns
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Small-Ticket Collection
type: Term
break id: T0336
stix type: x-break-term
definition: Micro-collection is a money laundering tactic where criminals use other people's accounts to receive multiple small-value illicit payments to evade risk controls.
description: To avoid bank and payment platform monitoring of large or frequent transactions, criminals split a large illicit sum into countless small payments, dispersing them across numerous collection accounts. The holders of these accounts receive the funds and then consolidate and transfer them to the upstream handler. This 'break it down' strategy is common in the initial task-acceptance phase of layering platforms, effectively reducing the risk of single-transaction interception and serving as a front-end dispersal measure in the laundering chain.
category: Money Laundering
keywords: Small-Ticket Collection
keywords: micro-collection
keywords: small-ticket laundering
keywords: split deposit
keywords: smurfing collection
keywords: micro-payment mule
keywords: low-value aggregation
keywords: fragmented receiving
keywords: small-amount pooling
usage example: Layering, micro-collection, large supply of QR codes needed.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Redemption Laundering
type: Term
break id: T0337
stix type: x-break-term
definition: In money laundering operations, write-off refers to the process of disguising illicit funds as legitimate transactions through purchases, redemptions, or card and voucher binding to complete the cleansing cycle.
description: Criminal actors use proceeds from fraud or gambling to bulk-purchase virtual goods such as shopping cards, membership cards, or group-buying vouchers. These are then monetized through card-and-PIN recycling, resale, or account binding. The operation is typically coordinated by specialized card brokers or write-off agents on money-muling platforms or in private chat groups, with the goal of severing the fund trail and evading risk-control tracking. Once successfully written off, the illicit funds are laundered in the form of consumer spending, making tracing extremely difficult.
category: Money Laundering
keywords: Redemption Laundering
keywords: voucher redemption
keywords: gift card washing
keywords: card redemption laundering
keywords: purchase-based cleaning
keywords: redemption mule
keywords: coupon conversion
keywords: prepaid card cycling
keywords: redemption agent
usage example: Anyone who can buy shopping cards, come through. Supermarket card-and-PIN write-off: you get 650 per recycled card.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Bank Card Dealers
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Card-and-PIN Redemption
type: Term
break id: T0338
stix type: x-break-term
definition: In money laundering operations, card-and-PIN write-off refers to the act of binding illegally obtained electronic card numbers and PINs to accounts or consuming them to realize virtual assets.
description: After purchasing electronic cards with fraudulent funds, downstream card-and-PIN write-off agents bind the card credentials to designated apps or platform accounts, converting them into usable balances or services. This process often involves e-commerce cards, gaming top-up cards, prepaid cards, and other virtual vouchers. Tasks are distributed through instant messaging groups or darknet postings seeking card-and-PIN recyclers. The practice transforms illicit proceeds into virtual assets that are difficult to trace, representing a common cleansing stage in money-muling and money-laundering schemes.
category: Money Laundering
keywords: Card-and-PIN Redemption
keywords: card-and-PIN washing
keywords: PIN redemption
keywords: gift card code redemption
keywords: e-card PIN conversion
keywords: virtual card cashing
keywords: code redemption
keywords: card secret cashing
keywords: digital voucher redemption
usage example: Anyone who can buy shopping cards, come through. Shopping card-and-PIN write-off: you get 650 per recycled card.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
related business scenes: BS02
related business scenes: BS06
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Cash-Out Disposal
type: Term
break id: T0339
stix type: x-break-term
definition: In money laundering operations, offloading refers to the final-stage cash-out act of withdrawing, converting, or spending illicit funds from accounts that have already received them.
description: After fraudulent funds have been moved through multiple account layers, the final offloading stage is responsible for extracting the money completely. This is typically carried out by cash mules who withdraw cash at ATMs, purchase precious metals, or transfer funds into other controlled accounts. The operation demands speed and stealth, often with account monitors tracking account status in real time to prevent freezes. A successful offload closes the money-laundering loop, returning the funds to the criminal syndicate, and represents a critical node for disrupting money laundering.
category: Money Laundering
keywords: Cash-Out Disposal
keywords: cash-out mule
keywords: final extraction
keywords: ATM cash-out
keywords: physical cash withdrawal
keywords: last-mile laundering
keywords: value extraction
keywords: cash-out runner
keywords: offloading
usage example: Recruiting runners: first- and second-tier card runners, dual-custody maintenance, large-scale mixing, and step-by-step maintenance all the way to offload.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: ATM Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Quick Burn
type: Term
break id: T0340
stix type: x-break-term
definition: In money laundering operations, quick-kill refers to a rapid attack method that completes fraud scripting and fund transfers within an extremely short window to evade victim detection and risk-control interception.
description: Criminal syndicates exploit real-time online loan application data or victim information to complete fraudulent calls, induce transfers, and split funds across multiple accounts within minutes. This model requires tight coordination between phone operators and money mules, and is typically executed late at night or during periods of weak platform risk controls. Once a quick-kill succeeds, the funds immediately enter the laundering pipeline. Victims often only realize something is wrong after the money has already been offloaded, making recovery extremely difficult.
category: Money Laundering
keywords: Quick Burn
keywords: rapid burn
keywords: fast cash-out
keywords: lightning laundering
keywords: instant transfer scheme
keywords: quick-hit fraud
keywords: burn operation
keywords: speed laundering
keywords: flash payout
usage example: Selling real-time online loan application data, suitable for quick-kill/money muling. Looking for first-hand betting sites. Brokers stay away.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Quick-Pay Card Charge
type: Term
break id: T0341
stix type: x-break-term
definition: In money laundering operations, express card deduction refers to a form of account theft where criminals illicitly invoke express payment interfaces to drain funds from victims' bank cards.
description: Criminal actors exploit leaked bank card information to bind express payment agreements or intercept verification codes, completing deductions without requiring a second confirmation from the cardholder. This technique is often used in conjunction with four-piece identity kits supplied by card brokers, with funds flowing directly into money-mule accounts. Due to its stealth and instant settlement, express card deduction has become a common method for high-frequency, small-value theft and money laundering, with victims often only discovering the theft upon receiving their bank statements.
category: Money Laundering
keywords: Quick-Pay Card Charge
keywords: unauthorized card charge
keywords: payment interface abuse
keywords: express payment fraud
keywords: card-not-present theft
keywords: SMS interception
keywords: payment binding attack
keywords: card binding fraud
keywords: stolen card cashout
usage example: This group provides first-tier express card deduction. The receiving party must provide a payment video within 30 minutes. If the deadline is exceeded without providing it, the default is that funds have not arrived.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related attack tools: Identity Document Set (4-Piece)
related attack tools: Score-Running Platforms
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Bank Card Dealers
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Scam Platform
type: Term
break id: T0342
stix type: x-break-term
definition: In money laundering operations, a platform refers to a fake gambling, investment, or wealth-management site or app built by fraud syndicates to induce victims to deposit funds and channel them into the money-laundering pipeline.
description: Criminal technical teams develop websites or apps that mimic legitimate platforms, manipulating win/loss outcomes or profit data through backend controls to make victims continuously increase their bets or investments. These platforms are typically promoted through adult content, dating, or SMS-based traffic generation. Once funds are deposited, they are routed into pre-configured money-mule accounts. The platform serves as the intersection point where fraud meets money laundering, with victim funds being intercepted and beginning a multi-layered cleansing process.
category: Money Laundering
keywords: Scam Platform
keywords: fake gambling site
keywords: investment scam platform
keywords: pig butchering platform
keywords: romance scam app
keywords: fake trading app
keywords: phony investment portal
keywords: scam site backend
keywords: bogus betting portal
usage example: A fraud ring built a Scam Platform named "Hongli Venture Capital," manipulating price movements on the back end to lure victims into continuous top-ups before ultimately funneling the funds behind the scenes.
related risks: Pig Butchering / Investment Fraud Risk
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform-Facilitated Gambling
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Multi-Factor Authentication
related avoidances: Phone Number Intelligence
related avoidances: Device Fingerprinting
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related avoidances: Reducing Returns
related attack tools: Fake Apps
related attack tools: Score-Running Platforms
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
related business scenes: BS01
related business scenes: BS04
related business scenes: BS06
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Transaction Limit
type: Term
break id: T0343
stix type: x-break-term
definition: In money laundering operations, limit-goose is a homophonic slang term for limit, referring to the single-transaction or daily transaction cap on payment accounts or transaction QR codes.
description: Criminal operators conducting money-mule transfers must constantly monitor account limit-geese to avoid transaction failures or triggering risk controls due to exceeding caps. Limits vary significantly across different payment channels and account types, and dedicated maintenance personnel within the syndicate are assigned to track limit changes. Once an account hits its limit, a new account must be switched in immediately or order-splitting strategies adjusted; otherwise, the fund chain will be disrupted, impacting laundering efficiency.
category: Money Laundering
keywords: Transaction Limit
keywords: single transaction cap
keywords: daily payment ceiling
keywords: per-transfer limit
keywords: account velocity limit
keywords: payment cap evasion
keywords: channel limit bypass
keywords: split transaction
keywords: limit monitoring
usage example: When laundering fraud proceeds, an underground bank noticed a payment account had hit its daily Transaction Limit. They instructed "runners" to switch to multiple small QR codes to split the collection, thereby evading risk control blocks.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Commission Rate
type: Term
break id: T0344
stix type: x-break-term
definition: In money laundering operations, points refer to the commission rate taken proportionally by each participant at various stages of the laundering process for profit distribution.
description: Within the money-mule laundering chain, every tier from the first layer to the offload stage takes a commission at an agreed point rate, typically ranging from 1% to 5% of the total flow. The rate depends on account quality, risk level, and fund volume. Criminal groups often post recruitment ads in formats like points 57+ to attract collaborators. The point-based allocation mechanism is the core profit bond that sustains the laundering network and a central focus of internal negotiation among criminal actors.
category: Money Laundering
keywords: Commission Rate
keywords: percentage cut
keywords: tiered commission
keywords: water rate
keywords: profit-sharing ratio
keywords: money mule fee
keywords: layering fee
keywords: cashing-out fee
keywords: commission tier
usage example: Recruiting first-tier large-scale mixing card-to-crypto runners: exchange rate 20+, points 57+, full maintenance through offload.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform Fraud Risk
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
related business scenes: BS01
related business scenes: BS04
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Commission Split
type: Term
break id: T0345
stix type: x-break-term
definition: A commission model in money laundering operations where account providers are paid a percentage of the laundered amount.
description: In underground money laundering, criminal groups use third-party bank or payment accounts to move illicit funds. Account holders receive a cut based on the transaction volume, incentivizing them to supply more accounts. This practice is prevalent in telecom fraud and online gambling, often ensnaring account providers who may be unaware of the full criminal context, exposing them to legal liability and account freezes.
category: Money Laundering
keywords: Commission Split
keywords: account rental fee
keywords: mule account payout
keywords: drop account commission
keywords: percentage-based payout
keywords: flow-based commission
keywords: mule recruitment incentive
keywords: account leasing reward
usage example: Run all the A and B accounts with balances over 100k through the point system, using the standard rate.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Credit Card Fraud
related avoidances: Real-Name Identity Verification
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Reducing Returns
related attack tools: Score-Running Platforms
related attack tools: Identity Document Set (4-Piece)
related attack tools: Corporate Identity Document Set (8-Piece)
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related business scenes: BS01
citation: Exposing Fraud-Laundering Models: Order-Posting Recharge Laundering and Merchant Laundering Spread Rapidly
citation: The Current Card Vendor Ecosystem Under the Card-Crackdown Campaign
updated: 2026-06-16
version: 1

Floor Runner
type: Term
break id: T0346
stix type: x-break-term
definition: A junior operator or assistant in a gambling ring responsible for maintaining order, recording accounts, and enlivening the atmosphere during games.
description: Pa Zai handle on-the-ground tasks at gambling sessions, such as tracking wins and losses, placating players, and creating a lively environment to keep games running smoothly. They operate under mid-level managers and are the grassroots workforce in underground casinos or mobile gambling dens.
category: Gambling
keywords: Floor Runner
keywords: pit boss assistant
keywords: game recorder
keywords: shill
keywords: crowd warmer
keywords: table helper
keywords: runner
keywords: casino tout
usage example: As the gambling den grew quiet in the early hours, a Floor Runner immediately posted fake "jackpot" screenshots in the group chat and led with small bets, successfully luring hesitant observers back to the table.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Table Boss
type: Term
break id: T0347
stix type: x-break-term
definition: A mid-level manager in a gambling ring who organizes games, collects house commissions, extends credit, and oversees operations.
description: Pa Tou Zi control the core of gambling operations by setting commission rates, issuing high-interest loans, and maintaining order at the table. They serve as a critical link between gang leaders and junior staff, and their activities often involve violent debt collection and illegal detention.
category: Gambling
keywords: Table Boss
keywords: pit boss
keywords: game organizer
keywords: rake collector
keywords: loan shark
keywords: debt enforcer
keywords: casino manager
keywords: house manager
usage example: The Table Boss at this venue was ruthless, not only arranging game schedules and credit funds but also personally leading enforcers to maintain order, resorting to violent debt collection against anyone who refused to pay.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Rake Rate Slang
type: Term
break id: T0348
stix type: x-break-term
definition: Various commission calculation methods in gambling that describe the percentage the house takes from bets.
description: These terms define the house edge: 'Ban Dian' refers to a 5% commission, 'Shang Yi Jiu' to 10%, and 'Ban Yi Jiu' typically around 7.5%. Operators adjust these rates flexibly based on the game type or player status, with regulars sometimes receiving lower rates. This is a core mechanism for controlling profitability and attracting bettors.
category: Gambling
keywords: Rake Rate Slang
keywords: house cut
keywords: vig
keywords: juice
keywords: commission calculation
keywords: house edge
keywords: rake structure
keywords: water money
usage example: The syndicate used a "half-point" Rake Rate Slang rule, where the banker directly skims 5% from the winner's chips each round. Though seemingly small, the high-frequency turnover generated staggering profits overnight.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Player Broker
type: Term
break id: T0349
stix type: x-break-term
definition: A middleman who drifts between gambling sessions, earning commissions by bringing in players.
description: Cang Ying Tou do not directly run games but profit by introducing gamblers to specific casinos or tables. They leverage social networks to drive traffic for gambling operators, acting as external promoters in the underground betting chain. Their earnings increase the more the referred players lose.
category: Gambling
keywords: Player Broker
keywords: junket runner
keywords: referral agent
keywords: player scout
keywords: gambling affiliate
keywords: VIP room promoter
keywords: casino tout
keywords: commission agent
usage example: Old Zhang, a Player Broker, constantly loitered around exclusive private games. The moment he spotted a wealthy boss, he would approach and guide them in, collecting a hefty commission for every successful referral.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS04
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Shill Play
type: Term
break id: T0350
stix type: x-break-term
definition: A deceptive practice where gambling organizers fabricate a bustling scene to attract real bettors.
description: When launching a new casino or game, organizers plant fake players to create an illusion of popularity, enticing onlookers to join. Online platforms may manipulate backend algorithms to let new users win initially before they start losing, trapping them in a cycle of gambling.
category: Gambling
keywords: Shill Play
keywords: fake action
keywords: house player
keywords: prop player
keywords: simulated gambling
keywords: fake volume
keywords: stage betting
keywords: dummy bettor
usage example: The investigation revealed the online casino had virtually no real players; it was all bot accounts engaging in Shill Play, automatically placing bets to create a bustling illusion designed to lure new depositors.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Rake
type: Term
break id: T0351
stix type: x-break-term
definition: The percentage-based profit the house takes from every wager.
description: The house commission is the primary revenue model for casinos. Regardless of whether a player wins or loses, the house deducts a fixed percentage from each bet. In physical venues, this is collected by managers like Pa Tou Zi, while online platforms automate the process. Over time, this edge ensures the house always wins.
category: Gambling
keywords: Rake
keywords: house commission
keywords: vig
keywords: vigorish
keywords: juice
keywords: table take
keywords: cut
keywords: croupier's edge
keywords: house advantage
usage example: While gamblers frantically placed bets, the banker quietly collected the Rake. Regardless of whether the player won or lost, a fixed percentage of the money was silently siphoned away into the banker's pocket each round.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Remote Betting
type: Term
break id: T0352
stix type: x-break-term
definition: A gambling method where bettors use mobile phones to connect to a remote casino in real time and place wagers.
description: Bettors watch a live video feed on their phones and call in their bets, commonly for simple games like odd-even. This approach bypasses geographic restrictions, allowing overseas casinos to reach domestic players. Funds are moved through underground banking channels, making transactions highly covert.
category: Gambling
keywords: Remote Betting
keywords: phone betting
keywords: proxy betting
keywords: telephone wagering
keywords: live-stream wagering
keywords: off-site betting
keywords: remote table play
keywords: agent-assisted betting
keywords: cross-border phone gambling
usage example: To avoid physical raids, the gang set up cameras in an overseas casino and offered Remote Betting services to domestic gamblers via encrypted communication apps, allowing them to place wagers remotely.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Loan Sharking
type: Term
break id: T0353
stix type: x-break-term
definition: The practice of issuing high-interest loans to gamblers.
description: Casinos or their affiliates provide on-the-spot loans to desperate gamblers, charging interest by the day or by the game, leading to massive debts. Loan sharks often work in tandem with VIP rooms; once a gambler borrows money, repayment is frequently enforced through violent collection. This mechanism keeps gamblers trapped and is a core method for casinos to extract excessive profits.
category: Gambling
keywords: Loan Sharking
keywords: juice loan
keywords: marker
keywords: casino credit
keywords: high-interest lending
keywords: debt collector
keywords: runner
keywords: enforcer
keywords: rollover debt
usage example: After losing his principal, gambler Li got desperate and sought Loan Sharking from the pit boss on the spot. He borrowed fifty thousand to recoup his losses, only to lose it all again within half an hour, saddled with high daily interest debt.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Settlement House
type: Term
break id: T0354
stix type: x-break-term
definition: A den or syndicate specializing in handling gambling fund flows and money laundering.
description: A money-handling crew takes on the task of diverting funds from casinos or online gambling platforms. They rapidly split and consolidate gambling proceeds through multiple tiers of accounts to sever the traceability of the funds. Operators use numerous other people's accounts for high-frequency transfers, ultimately returning the laundered money to the behind-the-scenes organizers. When investigated, the money-handling crew is often the first link in the financial chain to be exposed.
category: Gambling
keywords: Settlement House
keywords: money washing hub
keywords: fund layering
keywords: cash depot
keywords: underground clearinghouse
keywords: transfer node
keywords: account splitting
keywords: capital pool
keywords: financial logistics cell
usage example: The fraud syndicate funneled illicit proceeds through layers of fake accounts, ultimately pooling them at a covert Settlement House where specialists disguised the funds as normal trade payments for cross-border laundering.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Score-Running Platforms
related threat actors: Underground Money Houses
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Rake Settlement
type: Term
break id: T0355
stix type: x-break-term
definition: The process where casino staff count and settle the house's commission.
description: After each gambling session, the dealer or cashier gathers the house's cut from the tables, counts the cash or chips on the spot, verifies the accounts, and seals them for storage. Counting the house's commission is a critical internal control action that directly reflects the table's daily commission revenue and prevents staff from embezzling funds or causing discrepancies.
category: Gambling
keywords: Rake Settlement
keywords: drop count
keywords: cage reconciliation
keywords: pit settlement
keywords: table drop
keywords: chip count
keywords: cash box audit
keywords: shift settlement
keywords: soft count
usage example: After the game broke up at dawn, the croupier handling the Rake Settlement entered a private room with the supervisor. They unsealed the night's cash rake, counted it by machine, and synchronized the records with the backend financial system.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Bet Recorder
type: Term
break id: T0356
stix type: x-break-term
definition: A person at the gambling table responsible for recording each gambler's bet amounts and win/loss results.
description: The bet recorder closely monitors chip movements on the table, reporting each gambler's wager amount and outcome in real-time to ensure the house's commission is accurate. This role requires sharp eyes and quick hands to prevent gamblers from cheating, serving as the first line of defense against fraud.
category: Gambling
keywords: Bet Recorder
keywords: chip watcher
keywords: table supervisor
keywords: floor observer
keywords: pit clerk
keywords: marker tracker
keywords: ladder man
keywords: commission recorder
keywords: drop box monitor
usage example: At that table, the Bet Recorder kept a sharp eye on every chip stack's movement. He noted precisely who raised and who folded, ensuring there would be no disputes when settling the accounts afterward.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Table-Opening Fee
type: Term
break id: T0357
stix type: x-break-term
definition: A fee paid by online gambling operators to software suppliers for opening virtual rooms.
description: Online gambling platforms pay software providers based on the number of gambling rooms they open. The more rooms they purchase, the more concurrent games they can host. This fee is a fixed operational cost; software suppliers profit continuously, while platforms cover the cost and earn commission by attracting players to bet.
category: Gambling
keywords: Table-Opening Fee
keywords: room licensing fee
keywords: table rental
keywords: seat fee
keywords: virtual room purchase
keywords: platform subscription
keywords: dealer seat cost
keywords: game room activation
keywords: per-table charge
usage example: To expand their client base, an overseas gambling syndicate spent heavily on a Table-Opening Fee for the tech team, enabling domestic agents to instantly create encrypted gambling rooms with private access cards and real-time monitoring.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Referral Rebate
type: Term
break id: T0358
stix type: x-break-term
definition: A rebate or commission the casino gives to gamblers based on their wagering amount.
description: To retain high-rollers, casinos return a percentage of the total betting turnover as cash or chips. This rebate is usually settled daily; the more a gambler wagers, the higher the kickback, incentivizing them to keep betting. This mechanism creates an illusion of recovering losses, while in reality, it further amplifies the gambler's overall losses.
category: Gambling
keywords: Referral Rebate
keywords: rolling commission
keywords: turnover rebate
keywords: loss rebate
keywords: junket incentive
keywords: dead chip program
keywords: cashback scheme
keywords: whale retention
keywords: play-based kickback
usage example: To motivate agents to bring in high-quality clients, the casino offered a generous Referral Rebate policy. As long as the referred gambler met cumulative betting thresholds, the introducer received a substantial kickback.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Accompanied Gambling
type: Term
break id: T0359
stix type: x-break-term
definition: The act of bringing people to gamble and sharing in the casino's commission revenue.
description: A recruiter, posing as a regular customer, lures newcomers to the casino. They appear to be gambling companions but actually earn a commission from the house's cut based on the number of people they bring or the amount wagered. This model ensures a steady stream of customers for the casino, provides the recruiter with a share of the profits, and causes newcomers to quickly lose their principal in the accompanied gambling environment.
category: Gambling
keywords: Accompanied Gambling
keywords: junket companion
keywords: escort gambler
keywords: bring-in man
keywords: referral agent
keywords: host
keywords: greeter
keywords: commission chaser
keywords: entourage play
usage example: Qiang didn't act as the banker himself; his money-making method was Accompanied Gambling. He specifically brought wealthy acquaintances to familiar venues and later split the rake profits with the house based on their losses.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Chess-and-Card Gambling
type: Term
break id: T0360
stix type: x-break-term
definition: A covert term used in underground circles for gambling activities conducted on board game platforms.
description: While QP superficially stands for board games, within telecom fraud and online gambling circles, it specifically refers to online gambling sessions organized through a room-card model. Organizers create groups on social apps and open virtual rooms; gamblers buy room cards to enter, and the platform profits from the rake. This model is highly covert with rapid capital flows and has become a mainstream form of online gambling.
category: Gambling
keywords: Chess-and-Card Gambling
keywords: private room poker
keywords: club-based card game
keywords: in-app gambling
keywords: social casino
keywords: card room app
keywords: hidden gambling module
keywords: agent-operated table
keywords: room-card betting
usage example: On social media, groups recruiting agents under the guise of "Chess-and-Card Gambling" appear to promote legitimate games, but in reality, they are selling access to gambling platforms with deposit and withdrawal functions.
related risks: Platform-Facilitated Gambling
related risks: Money Laundering Risk
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related threat actors: Money Laundering Gangs
related business scenes: BS06
related business scenes: BS04
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Money Mule
type: Term
break id: T0361
stix type: x-break-term
definition: In the gambling black market, a 'basket carrier' is a middleman who uses their network to facilitate the transfer of illicit funds and resolve external troubles for casinos or gambling syndicates.
description: This role typically does not involve direct gambling. Instead, the carrier leverages their 'background' to provide cover for the flow of gambling funds, moving cash, layered settlement money, or cryptocurrency from the bettor's side to the house's side, thereby evading risk controls and law enforcement. They are often connected to local power structures or insiders, acting as a dual insurance for both the money channel and relationship coordination. If the chain is compromised, the basket carrier becomes the key breakthrough point for cutting off the funds.
category: Gambling
keywords: Money Mule
keywords: Money Mule Recruitment
keywords: Mule Herder
keywords: Mule Network Operator
keywords: Funds Intermediary
keywords: Cash Courier
keywords: Illicit Fund Transfer
keywords: Underground Banking Agent
keywords: Betting Fund Conduit
usage example: The company involved appeared to be a legitimate trader but was actually a Money Mule for overseas casinos. Using complex fake trade contracts, this underground bank disguised domestic gambling funds as payments for goods sent abroad.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS15
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Hole-Card Peeking
type: Term
break id: T0362
stix type: x-break-term
definition: In gambling cheating scenarios, 'hole carding' refers to the technical means used by black market operators to spy on opponents' cards in real-time using camera equipment, cheating software, or system backdoors.
description: Common methods include installing pinhole cameras or modified card sensors at physical tables or within gambling apps, or directly bribing platform operations staff to implant a backdoor, transmitting the opponent's hand to the cheater's terminal. This allows the house or card sharp to lock in a win before placing a bet, rapidly draining the gambler's funds, especially in pig-butchering or baccarat-style games. Discovery of such cheating often leads to violent confrontations or internal gang infighting.
category: Gambling
keywords: Hole-Card Peeking
keywords: Card Peeking Device
keywords: Hidden Camera Cheating
keywords: Cheating Software
keywords: Poker Sensor
keywords: Table Bugging
keywords: Live Stream Cheat
keywords: Game Backdoor Access
keywords: Marked Cards
usage example: The gambler realized his opponent could always predict his moves. He later discovered a miniature camera had been installed in the room, and combined with off-site Hole-Card Peeking analysis software, his cards were completely exposed.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related attack tools: Fake Apps
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Rebate Fee / Turnover Fee
type: Term
break id: T0363
stix type: x-break-term
definition: In gambling-related black market operations, 'washing fee' or 'turnover fee' refers to the commission returned to agents or money mule teams by the casino or platform, calculated as a percentage of the total betting turnover.
description: This fee is essentially a cut taken from the flow of gambling funds. It is typically deducted by the casino from the total turnover and distributed to intermediaries, junket operators, or money mule teams to incentivize the continuous recruitment of gamblers and the maintenance of fund channels. In scenarios combining telecom fraud and money muling, this fee is often disguised as a 'handling fee' or 'rebate,' but it actually serves as a lubricant for the money laundering chain, significantly diluting the gambler's principal after multiple layers of deductions.
category: Gambling
keywords: Rebate Fee / Turnover Fee
keywords: Turnover Commission
keywords: Rolling Fee
keywords: Agent Rebate
keywords: Referral Kickback
keywords: Running Fee
keywords: Wash Fee
keywords: Volume-Based Commission
keywords: Betting Brokerage
usage example: Recruiting for manual money mule work, base salary plus bonus and an extra three points, with a 20% deduction for the turnover fee.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Real-Name Identity Verification
related avoidances: Compliance Governance
related attack tools: Score-Running Platforms
related threat actors: Score Runner
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS01
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

House Boss
type: Term
break id: T0364
stix type: x-break-term
definition: In gambling-related black market operations, 'rocker' refers to the top-level boss who controls the entire casino operation, managing funds and personnel.
description: The 'rocker' typically does not directly participate at the tables but orchestrates operations from behind the scenes, overseeing venue rental, personnel recruitment, fund pool management, and peripheral security to ensure the gambling sessions run continuously. They form a vertical management chain with roles like the 'basket carrier' and 'table manager.' When trouble arises, they are often the first to cut off contact and move assets. In online casinos, the 'rocker' may act as the platform administrator, remotely controlling odds, suspending bets, and centralizing funds.
category: Gambling
keywords: House Boss
keywords: Gambling Den Operator
keywords: Underground Casino Manager
keywords: Criminal Ring Leader
keywords: Game Room Controller
keywords: Pit Boss
keywords: Illegal Gambling Syndicate Head
keywords: Backroom Financier
keywords: Gambling Operation Chief
usage example: In this vast underground gambling network, the House Boss, Old Hei, held absolute authority. From venue security and fund allocation to liaising with protectors, every decision was made by him alone.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Winner's Service Fee
type: Term
break id: T0365
stix type: x-break-term
definition: In gambling-related black market operations, 'kiln flower' refers to various fees forcibly taken from winners' profits, which is essentially a disguised commission for the house.
description: This money is typically collected under the guise of transportation fees, water fees, cigarette fees, or labor costs, and is deducted directly from the winner's earnings. This ensures the house profits regardless of the game's outcome. The percentage for the 'kiln flower' is often agreed upon in advance but can be increased on the spot, serving as a covert method to squeeze gamblers' profits. In mobile gambling setups, this fee also covers costs like transportation and lookouts, sustaining the entire illegal ecosystem.
category: Gambling
keywords: Winner's Service Fee
keywords: House Cut
keywords: Table Fee
keywords: Winner's Levy
keywords: Rake
keywords: Service Charge
keywords: Transport Fee
keywords: Protection Fee
keywords: House Commission
usage example: When a gambler finally won big, the cashier forcibly deducted a Winner's Service Fee and "congratulatory money" during the exchange, leaving him with significantly less than the actual amount he was owed.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Casino Shuttle
type: Term
break id: T0366
stix type: x-break-term
definition: In gambling-related black market operations, a 'kiln car' refers to a vehicle specifically used to transport gamblers to and from an underground casino, forming part of the operation's logistics.
description: These vehicles are typically dispatched by the casino and driven by individuals familiar with the routes and police checkpoints. They pick up gamblers from a meeting point, transport them to the secret venue, and return them afterward, all within a closed-loop management system. The cars often use fake or cloned license plates and may be equipped with communication jammers to prevent tracking. If compromised, the 'kiln car' can become a key lead for law enforcement to locate the casino's entrance.
category: Gambling
keywords: Casino Shuttle
keywords: Gambling Den Transport
keywords: Illegal Taxi
keywords: Runner Vehicle
keywords: Safe Passage Driver
keywords: Drop-off Driver
keywords: Lookout Vehicle
keywords: Shuttle Service
keywords: Ghost Plate Vehicle
usage example: Police raided a suburban casino, and a Casino Shuttle disguised as a moving van was winding along the riverbank, hiding six gamblers and stacks of chips inside while the driver relayed real-time police positions via radio.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related threat actors: Online Gambling Gangs
related business scenes: BS06
related business scenes: BS11
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Shill Player
type: Term
break id: T0367
stix type: x-break-term
definition: In gambling-related black market operations, a 'hair-pricker' is a shill hired by the casino to create a lively atmosphere and lure real gamblers into betting by pretending to play.
description: These shills are usually paid based on their effectiveness, blending in with real gamblers to create a false impression of winning and to drive the betting pace, energizing a slow table. They bear no real risk of loss; any money they lose is covered by the house, and they receive a cut of any winnings. In pig-butchering scams or mobile gambling stalls, 'hair-prickers' are a core tool for creating the illusion of a 'hot' table, tricking victims into believing the game is fair and winnable.
category: Gambling
keywords: Shill Player
keywords: Decoy Gambler
keywords: Fake Player
keywords: Plant
keywords: Stooge
keywords: Crowd Warmer
keywords: Atmosphere Builder
keywords: House Plant
keywords: Prop Bettor
usage example: The pai gow table suddenly buzzed with excitement as three Shill Players took turns slapping the table, cheering, and throwing down wads of cash, pulling a hesitant middle-aged man into the frenzy until he pushed in his entire savings.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Table Banker
type: Term
break id: T0368
stix type: x-break-term
definition: In gambling-related black market operations, the 'table manager' is the operator directly responsible for handling cash payments and distributing winnings based on the game's outcome at the table.
description: The 'table manager' is the terminal executor of fund flow for each round, responsible for counting cash, taking the house's cut, and paying out winnings, ensuring instant settlement between gamblers and the banker. They are usually deeply trusted by the 'rocker' and control the on-site cash pool, but they can also become a vulnerability for internal theft or a 'rip-off.' In online gambling, this role is replaced by automated system settlements, but in physical settings, they are essential for maintaining table order and the closed loop of funds.
category: Gambling
keywords: Table Banker
keywords: Cage Cashier
keywords: Dealer
keywords: Chip Handler
keywords: Payout Clerk
keywords: Table Cash Handler
keywords: House Dealer
keywords: Pit Clerk
keywords: Money Handler
usage example: Surveillance showed the Table Banker swiftly sorting three stacks of cash by wins and losses, while quietly reporting each precise commission cut in code to the recorder behind him, with no one daring to question the fairness of his hands.
related risks: Platform-Facilitated Gambling
related avoidances: Risk Control Strategy
related avoidances: Threat Intelligence
related avoidances: Legal Action
related avoidances: Reducing Returns
related avoidances: Contractual Clause Restrictions
related avoidances: Customer Service Follow-Up Confirmation
related threat actors: Online Gambling Gangs
related business scenes: BS06
citation: Black Market Big Data: 2025 H1 Internet Underground Economy Trend Review
citation: Black Market Big Data: 2025 Internet Underground Economy Trend Annual Review
updated: 2026-06-16
version: 1

Forced Loan Activation
type: Term
break id: T0369
stix type: x-break-term
definition: Forcibly activating a loan service through illicit means, often involving theft of customer data or unauthorized deductions.
description: Fraudsters use stolen or leaked personal information to activate loan products on behalf of victims without their knowledge or consent, then deduct fees or interest upfront. Operators typically bypass risk controls using technical exploits or insider access to process applications in bulk. This practice leaves victims with unexpected debt and limited recourse for recovery.
category: Credit Fraud
keywords: Forced Loan Activation
keywords: Unauthorized Loan Origination
keywords: Coerced Lending
keywords: Account Takeover Lending
keywords: Identity Theft Loan
keywords: Forced Credit Line
keywords: Involuntary Debt
keywords: Ghost Loan
keywords: Loan Activation Fraud
usage example: They got hold of a batch of personal data and forcibly opened loans on them. The victims only found out they were in debt when collection calls started coming in.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Fake Mortgage-Free Car
type: Term
break id: T0370
stix type: x-break-term
definition: Colluding with a vehicle owner to transfer a financed car to a third party before the mortgage registration is completed, thereby evading the lien.
description: Fraud rings exploit the time gap between loan disbursement and official vehicle mortgage registration. After the lender releases funds but before the lien is recorded, the intermediary helps the owner quickly transfer the vehicle to another party. This leaves the financial institution unable to enforce its security interest, resulting in a bad debt. Common in the used-car market, intermediaries charge high fees while lenders lose both the car and the money.
category: Credit Fraud
keywords: Fake Mortgage-Free Car
keywords: Title Washing
keywords: Lien Avoidance
keywords: Fake Lien Release
keywords: Unrecorded Mortgage
keywords: Auto Loan Fraud
keywords: Title Jumping
keywords: Collateral Stripping
keywords: Vehicle Title Fraud
usage example: The intermediary said they could do a fake lien release. They told me to skip the vehicle registration office and transfer the car directly to a buyer they found. Now the bank is coming after me for the debt.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Deconstructing the Auto Loan Fraud Industry Chain
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Hard Default
type: Term
break id: T0371
stix type: x-break-term
definition: A borrower unilaterally ceases all loan repayments and deliberately cuts off contact with the lending platform.
description: Borrowers who can no longer afford high interest or who develop resistance to aggressive collection tactics choose to abandon repayment entirely. They typically change their phone numbers, delete the lending app, and brace for consequences like contact-list harassment or credit blacklisting. In underground circles, this is often discussed as a last-resort measure against predatory high-interest lenders.
category: Credit Fraud
keywords: Hard Default
keywords: intentional default
keywords: strategic default
keywords: debt refusal
keywords: ghost debtor
keywords: app uninstall evasion
keywords: contact cutoff
keywords: debt abandonment
keywords: run from debt
usage example: I'm going to go no-contact on that predatory lender. The interest is insane and I can't keep up. Has anyone here done this before? Will they freeze my payment accounts?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Forced Disbursement
type: Term
break id: T0372
stix type: x-break-term
definition: An illegal lending platform unilaterally disburses a loan to a user without their explicit consent, then demands repayment with exorbitant interest.
description: Predatory lending platforms use technical means to harvest users' contact lists and other private data. Even if a user merely fills out a form without confirming a loan, the platform forcibly transfers money into their account. They then demand repayment on extremely short cycles with excessive fees, threatening to harass the user's contacts if they don't pay. This is a typical extortion tactic, and victims often pay far more than the principal out of fear.
category: Credit Fraud
keywords: Forced Disbursement
keywords: unsolicited loan
keywords: forced loan
keywords: loan bombing
keywords: ghost lending
keywords: predatory disbursement
keywords: involuntary debt
keywords: forced credit
keywords: unconsented loan
usage example: Yesterday I downloaded a shopping app and clicked on a link inside. I registered, uploaded an ID photo, then logged out and deleted the app. Could I still be forced into a loan?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Fishing
type: Term
break id: T0373
stix type: x-break-term
definition: An applicant with poor credit knowingly attempts to apply for a loan or credit card from a strict lender, hoping for a system loophole.
description: Applicants who are aware of their bad credit history, including defaults or excessive inquiries, still submit applications to banks with stringent approval processes, hoping the risk control system will fail. Fraud rings often organize mass 'probing' attempts to identify weak points in a bank's defenses. A single success can trigger a wave of fraudulent applications.
category: Credit Fraud
keywords: Loan Fishing
keywords: credit fishing
keywords: application farming
keywords: shotgun application
keywords: credit inquiry spam
keywords: speculative application
keywords: approval probing
keywords: app spamming
keywords: blind app
usage example: My credit is a bit rough. I tried my luck with two banks last month and got rejected instantly. Guess I need to clean up my credit first.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Lead Brokering
type: Term
break id: T0374
stix type: x-break-term
definition: A loan broker passes a client they cannot service to another broker in exchange for a commission split.
description: When a broker finds a client's profile doesn't match their available lending channels, they sell the client's information to another broker who can process the loan. This practice leads to repeated reselling of personal data and increases the risk of information leaks. The referring broker earns a commission without further work, while the client may face higher fees or fall into a debt trap.
category: Credit Fraud
keywords: Lead Brokering
keywords: lead flipping
keywords: deal brokering
keywords: client handoff
keywords: app resale
keywords: lead resale
keywords: referral churn
keywords: lead pass
keywords: deal forwarding
usage example: This client's profile is too weak for my channels. I'll pass them to Old Li's side; the referral fee is twenty thousand per client.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Lead Intake
type: Term
break id: T0375
stix type: x-break-term
definition: A broker with active lending channels acquires loan-seeking clients from other brokers.
description: Brokers with reliable lending channels post 'client acquisition' notices to attract other intermediaries to supply them with applicants. The acquiring broker prices the client based on their credit profile and pays a commission to the referring broker upon successful loan disbursement. This creates an illicit profit chain where client data is repeatedly traded, making it highly susceptible to secondary fraud.
category: Credit Fraud
keywords: Lead Intake
keywords: lead buying
keywords: app sourcing
keywords: client intake
keywords: lead pooling
keywords: deal sourcing
keywords: referral intake
keywords: app aggregation
keywords: lead procurement
usage example: ChengXin is acquiring clients. Twenty thousand upfront upon signing, plus a six percent internal rebate. No tricks, send your clients over.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Assisted Lead Escort
type: Term
break id: T0376
stix type: x-break-term
definition: The referring broker accompanies the client throughout the entire loan application process to supervise the operation and ensure a fair commission split.
description: In low-trust partnerships, the broker who provided the client will stay with them on-site to prevent being cut out of the deal. The supervising broker monitors the entire packaging, application, and disbursement process to guarantee they receive the agreed-upon percentage of the payout. This is common in cross-regional operations or between first-time collaborators.
category: Credit Fraud
keywords: Assisted Lead Escort
keywords: deal escort
keywords: client chaperoning
keywords: app babysitting
keywords: payout supervision
keywords: commission escort
keywords: deal monitoring
keywords: escorted application
keywords: onsite monitoring
usage example: Full escort service. Five thousand upfront when you see the client, fifty thousand if the loan fails. A one-thousand good-faith deposit is required after sending the client's documents.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Travel-Lodging Advance
type: Term
break id: T0377
stix type: x-break-term
definition: Upfront expenses for travel and accommodation that fraud rings advance to debt applicants, to be deducted from the final payout.
description: In organized loan fraud schemes, intermediaries cover the travel and operational costs of participants traveling to designated cities. This advance, known as the 'three covers,' is a tactic to attract and lock in participants. Once the loan is approved and disbursed, the intermediary deducts these costs, often with interest, from the participant's share of the fraudulent proceeds.
category: Credit Fraud
keywords: Travel-Lodging Advance
keywords: travel advance
keywords: expense float
keywords: upfront cost
keywords: front money
keywords: deal float
keywords: expense advance
keywords: client float
keywords: travel float
usage example: The broker laid out the Travel-Lodging Advance terms for the debt-laden man: everything covered—flights, hotels, and meals at no cost to you—leaving you with eighty thousand after deducting fifteen thousand for the three-package fee.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Deconstructing the Auto Loan Fraud Industry Chain
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Easing
type: Term
break id: T0378
stix type: x-break-term
definition: A temporary loosening of a financial institution's risk controls, allowing even those with poor credit to secure loan approval.
description: This is insider intelligence circulating within fraud rings, indicating that a bank or platform has relaxed its credit approval system for a short period. This weakening of risk controls may stem from system glitches, performance-driven targets, or strategic adjustments, creating a window of opportunity for those with poor credit or high debt to commit loan fraud. Fraud rings quickly mobilize to exploit this brief period for mass applications and illicit fund acquisition.
category: Credit Fraud
keywords: Credit Easing
keywords: approval flood
keywords: underwriting gap
keywords: approval spike
keywords: credit window
keywords: lending loophole
keywords: approval surge
keywords: easy approval period
keywords: underwriting ease
usage example: Bank X is secretly loosening its controls. Normally, I get no credit line, but this time I applied casually and got approved for 60,000 instantly.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Risk-Control Seasoning Period
type: Term
break id: T0379
stix type: x-break-term
definition: A period of staged, on-time repayments orchestrated by fraud rings to evade detection by financial institutions.
description: After obtaining a loan using false identities or fabricated documents, fraud rings will make the initial monthly payments on behalf of the straw borrower. This artificially created 'good repayment record' is the risk-control period, designed to lull the monitoring system into a false sense of security. The goal is to buy time to apply for larger loans or to abscond with the funds, with a longer period further delaying the exposure of the fraud.
category: Credit Fraud
keywords: Risk-Control Seasoning Period
keywords: payment seasoning
keywords: goodpayer masking
keywords: repayment honeymoon
keywords: credit grooming
keywords: repayment facade
keywords: seasoning cycle
keywords: debt seasoning
keywords: masking period
usage example: Operating in XX area, the borrower gets XXX in hand, asset package, three-year risk-control period.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Completion Window
type: Term
break id: T0380
stix type: x-break-term
definition: The time it takes to complete a full cycle of a fraudulent loan application, from fabrication to fund disbursement.
description: In the context of credit fraud, 'graduation' refers to the entire process, from packaging false documents and applying for a loan to the final successful disbursement of funds. Fraud rings often advertise their schemes with phrases like 'graduation in X days' to attract clients seeking quick cash or looking to default on debts. A shorter time indicates higher efficiency in the ring's fabrication capabilities and channel access, enabling faster fund extraction and risk transfer.
category: Credit Fraud
keywords: Completion Window
keywords: deal cycle
keywords: payout timeline
keywords: completion cycle
keywords: payout window
keywords: deal maturation
keywords: payout completion
keywords: deal graduation
keywords: cycle completion
usage example: Direct channel, highest commission settlement, graduation in 15 to 30 days, payout of 3 to 8 million, no direct clients, intermediaries only.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Black Room
type: Term
break id: T0381
stix type: x-break-term
definition: A state where a borrower's account is restricted by a financial institution's risk-control system due to suspicious behavior, preventing normal borrowing.
description: When an account is flagged as being in the 'black room,' it means the user's actions, such as overdue payments, frequent applications, or abnormal profile data, have triggered the platform's risk-control rules. This results in a frozen credit line, instant application rejections, and a loss of access to financial services. It is an automatic punitive and isolation measure taken by the platform upon detecting risk.
category: Credit Fraud
keywords: Black Room
keywords: account restriction
keywords: account lock
keywords: risk control block
keywords: account suspension
keywords: blacklist status
keywords: frozen credit line
keywords: account quarantine
usage example: I've been in the black room since last November. I forgot to pay yesterday, which was the due date. Will being one day late affect my credit report?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Bank Channel
type: Term
break id: T0382
stix type: x-break-term
definition: An internal partnership within a bank that fraud intermediaries leverage to secure irregular loan approvals or more lenient conditions.
description: A 'channel' is a core asset in the credit fraud ecosystem, referring to a gray network of relationships intermediaries cultivate with bank insiders or third-party companies. Through these connections, they can secure loan approvals for clients with extremely poor qualifications who would normally be rejected, or bypass certain risk-control steps. Intermediaries who possess such channels operate at the top of the fraud chain, using them as leverage to attract downstream partners and charge higher service fees.
category: Credit Fraud
keywords: Bank Channel
keywords: insider access
keywords: loan officer collusion
keywords: internal referral
keywords: underwriting bypass
keywords: private banking channel
keywords: backdoor approval
usage example: Direct channel, no regional restrictions, no upfront or mid-process fees, no guarantor required.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Bank Insider Connections
type: Term
break id: T0383
stix type: x-break-term
definition: A corrupt network established by infiltrating a bank's internal operations, enabling the manipulation of the credit approval process.
description: A 'bank relationship' is a deeper, more corrupt network than a standard 'channel.' It involves fraud rings bribing or colluding with key personnel inside a bank to systematically manipulate the loan approval process. This relationship guarantees irregular loan disbursement for unqualified applicants and is the core capital fraud intermediaries use to demonstrate their power and attract partners. The consequence is a sharp increase in bad debt risk for the financial institution and a fundamental undermining of the credit system's fairness.
category: Credit Fraud
keywords: Bank Insider Connections
keywords: loan officer bribery
keywords: approval manipulation
keywords: insider fraud ring
keywords: underwriter collusion
keywords: internal corruption
keywords: bank employee compromise
usage example: Solid bank relationship, can handle single-data or full-package deals.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Hot-Market Product
type: Term
break id: T0384
stix type: x-break-term
definition: A trending opportunity in fraud circles, referring to a loan product or scam that is currently easy to exploit due to lax risk controls.
description: 'Trending opportunity' is a popular term in fraud rings for short-lived arbitrage opportunities arising from market shifts, policy loopholes, or technical flaws. These opportunities are characterized by low barriers to entry, fast disbursement, and high credit limits, making them prime targets for concentrated fraud attacks. It could be a newly launched financial product or an older one with a temporarily disabled risk-control strategy, both carrying an extremely high risk of fraud.
category: Credit Fraud
keywords: Hot-Market Product
keywords: easy approval loan
keywords: loophole product
keywords: lax underwriting
keywords: trending scam
keywords: quick cash window
keywords: bypass opportunity
usage example: Latest trending opportunity, no credit or big data checks, no upfront fees, purely online operation, you can get over 40,000 in hand.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Sure-Win Deal
type: Term
break id: T0385
stix type: x-break-term
definition: In black market operations, 'steady skin-eater' is used to describe a loan service that is reliable and guaranteed to disburse funds, used to attract collaborators.
description: Originating from Sichuan-Chongqing dialect, it originally meant having an advantage or being successful. In credit fraud, black market intermediaries use 'steady skin-eater' to package their loan services, emphasizing an extremely high success rate for loan disbursement to lure downstream agents or desperate clients. Once a client is hooked, they often face high fees or the risk of having their personal data stolen.
category: Credit Fraud
keywords: Sure-Win Deal
keywords: guaranteed approval
keywords: no-fail method
keywords: foolproof deal
keywords: guaranteed payout
keywords: lock deal
keywords: sure-thing loan
usage example: Steady skin-eater business, no restrictions on household registration, limited spots, come quickly.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Underground Method
type: Term
break id: T0386
stix type: x-break-term
definition: Refers to unlicensed lending platforms or loan-sharking rings that operate outside regulatory oversight using illegal methods.
description: These platforms typically operate beyond regulatory reach, lending privately through self-built apps or social groups. They are often associated with ultra-high interest rates and violent debt collection, making them hotbeds for fraudulent loan schemes and illegal operations. Borrowers who fall victim not only face financial loss but also potential physical threats.
category: Credit Fraud
keywords: Underground Method
keywords: unlicensed lender
keywords: illegal lending app
keywords: loan shark app
keywords: rogue platform
keywords: unregulated lending
keywords: shadow lender
usage example: For the past 9 months, I've basically been relying on underground lenders to make repayments.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Full-Service Packaging
type: Term
break id: T0387
stix type: x-break-term
definition: A full-package fraudulent service provided by black market operators, covering everything from document fabrication and data creation to bank relationship management and loan application.
description: In credit fraud, 'one-stop service' means the black market intermediary handles all stages of the scam. They forge employment certificates and bank statements for unqualified clients, and may even bribe insiders at financial institutions to ensure loan approval. This all-inclusive service is extremely expensive and high-risk, often resulting in significant bad debt for financial institutions.
category: Credit Fraud
keywords: Full-Service Packaging
keywords: full package service
keywords: end-to-end fraud
keywords: application packaging
keywords: document fabrication service
keywords: turnkey fraud solution
keywords: managed fraud service
usage example: Recruiting pure white, white accounts, and real estate credit one-stop service nationwide, total graduation amount starting from 5 million.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Desperados in Financial Fraud
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

One ID, One Card
type: Term
break id: T0388
stix type: x-break-term
definition: A simplified loan application model requiring only an ID card and a bank card, commonly seen in car loan fraud.
description: Exploiting lax review processes at some financial institutions, fraud rings apply for car loans using only an ID and bank card. In practice, they often forge supporting documents like driver's licenses to pass verification. This model is easily exploited for 'buy-and-cash-out' fraud schemes.
category: Credit Fraud
keywords: One ID, One Card
keywords: ID card only loan
keywords: minimal KYC loan
keywords: no-verification loan
keywords: simplified application
keywords: bare-minimum loan
keywords: ID-only car loan
usage example: Two IDs one card, credit record, settle at 5.7; One ID one card, credit record, settle at 5.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Two IDs, One Card
type: Term
break id: T0389
stix type: x-break-term
definition: A loan application model requiring an ID card, driver's license, and bank card, adding one more layer of identity verification than the 'One ID, One Card' model.
description: This is a common requirement in car loan fraud, where brokers forge a complete set of documents, including a driver's license, to meet the criteria. By increasing the number of documents, they create a false appearance of compliance to gain the financial institution's trust and secure a higher loan amount.
category: Credit Fraud
keywords: Two IDs, One Card
keywords: dual ID loan
keywords: ID plus license loan
keywords: enhanced fake docs
keywords: license-based fraud
keywords: two-document loan
keywords: ID and license loan
usage example: Two IDs one card, credit record, settle at 5.7; One ID one card, credit record, settle at 5.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Vehicle Green Book
type: Term
break id: T0390
stix type: x-break-term
definition: In the context of auto loan fraud, refers to the official motor vehicle registration certificate, essentially the vehicle's legal identity document.
description: The motor vehicle registration certificate serves as legal proof of vehicle ownership. In auto loan fraud, it is a critical document for securing collateralized loans or illegally reselling vehicles. Fraud rings often obtain this certificate through methods such as reporting it lost and reapplying, or by deceiving clients, enabling them to illegally transfer ownership or mortgage the vehicle to cash out.
category: Credit Fraud
keywords: Vehicle Green Book
keywords: vehicle title
keywords: car ownership certificate
keywords: auto registration
keywords: pink slip
keywords: title fraud
keywords: title loan collateral
usage example: After completing a car loan scam, the ring swapped the real Vehicle Green Book with a counterfeit and then pledged the genuine one to another small lender, effectively extracting three separate loans on the same luxury car.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: Black Market Big Data: Deconstructing the Auto Loan Fraud Industry Chain
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Zero-Down Car Purchase
type: Term
break id: T0391
stix type: x-break-term
definition: A fraud scheme disguised as a 'Zero Down Payment Car Purchase', where the fraud ring covers the down payment to trick victims into taking out a car loan, then cashes out the vehicle.
description: Using 'zero down payment' as bait, fraud rings recruit clients desperate for cash or looking for a bargain. They front the down payment to help the client buy the car, then quickly mortgage or sell the new vehicle to cash out. The client ends up with no car and a full loan to repay, while the fraud ring disappears with the cashed-out money, shifting the debt risk to the victim and the financial institution.
category: Credit Fraud
keywords: Zero-Down Car Purchase
keywords: zero down car scam
keywords: car loan fraud
keywords: straw buyer auto loan
keywords: fronted down payment
keywords: buy here pay here fraud
keywords: auto loan stacking
keywords: car loan mule
keywords: debt assumption car
usage example: 0 down payment car purchase, ages 23-60, we handle the operation, must have social security or bank statements.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Straw Buyer Car
type: Term
break id: T0392
stix type: x-break-term
definition: A fraud model where a ring recruits individuals with good credit ('blank slates') to purchase a car for someone else; the actual user then defaults, shifting the debt to the straw buyer and the lender.
description: The fraud ring pays a fee to lure clients with good credit to use their identity to finance a car for someone else. The vehicle is actually used by a ride-hailing company or a subprime borrower, who makes a few monthly payments before defaulting and disposing of the vehicle for profit. Ultimately, the straw buyer is left with massive debt, and the financial institution suffers a bad loan.
category: Credit Fraud
keywords: Straw Buyer Car
keywords: credit mule auto
keywords: car loan proxy
keywords: straw purchase vehicle
keywords: auto loan nominee
keywords: fronted car buyer
keywords: ghost buyer car
keywords: car credit rental
keywords: loan stacking mule
usage example: Straw buyer car deals, 2-5 cars per person, done in 10 days.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: [Loan Fraud] Anatomy of the 'Straw Buyer' Car Loan Fraud Technique
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Mortgage-Free Car
type: Term
break id: T0393
stix type: x-break-term
definition: A car financing arrangement where the vehicle is purchased through an installment loan but is not physically mortgaged to the lender, and the full set of ownership documents, including the motor vehicle registration certificate, is handed over to the buyer.
description: In auto loan fraud schemes, intermediaries exploit a client's credit profile to secure installment financing for a car. After the loan is disbursed, they deliberately skip the vehicle mortgage registration, leaving the car in a "mortgage-free" state. Once the buyer receives the green book and invoice, the vehicle can be freely disposed of, while the intermediary collects daily commissions. This tactic bypasses the lender's risk control loop and is frequently used for obtaining multiple loans on a single vehicle or for quick resale to cash out.
category: Credit Fraud
keywords: Mortgage-Free Car
keywords: unencumbered car loan
keywords: title-in-hand financing
keywords: no lien auto
keywords: car loan without lien
keywords: clean title loan
keywords: skip title loan
keywords: auto loan bypass
keywords: lien-free car
usage example: Big credit lines or poor credit, based on client profile, mortgage or mortgage-free cars, remote system processing, settled every three days.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 【Credit Fraud】Unveiling the "Mortgage-Free Car" Fraud Tactic in the Auto Loan Fraud Chain
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Car Loan Cashout
type: Term
break id: T0394
stix type: x-break-term
definition: A fraudulent scheme where individuals in urgent need of cash actively seek out or are recruited to purchase a car with a loan and immediately resell it to pocket the cash.
description: Underground brokers specifically target "blacklisted" individuals with poor credit records but who still qualify for loans, packaging the scheme as a legitimate "car financing" service. The broker covers the down payment or fabricates the applicant's credentials. The car is registered under the individual's name, and within a week of purchase, it is sold at a discount to a car dealer, netting the seller around 150,000 yuan in cash. This model essentially defrauds financial institutions of credit funds; the car is quickly offloaded, and the loan defaults, resulting in bad debt.
category: Credit Fraud
keywords: Car Loan Cashout
keywords: auto equity stripping
keywords: car title loan cashout
keywords: vehicle liquidation scam
keywords: car loan flipping
keywords: auto loan cashout scheme
keywords: title washing car
keywords: car loan bust out
keywords: auto collateral stripping
usage example: Blacklisted car flipping, operating in Guangdong, can do 2-3 units, registered under personal name, one week to get 150k in hand, age 20-55.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Nominee-Owned Property
type: Term
break id: T0395
stix type: x-break-term
definition: A scheme where the actual property buyer is not the genuine end-user but a paid individual who holds the property title on behalf of a third party to fraudulently obtain a bank mortgage.
description: In the mortgage fraud chain, developers seeking rapid cash flow or a clean exit recruit individuals with clean credit histories, known as "nominee holders," to sign fake purchase contracts. The nominee applies for a mortgage, and once the bank disburses the funds, the money goes to the developer, while the property is nominally registered under the nominee's name. Both parties sign a private repurchase agreement, stipulating the developer will buy back the property within two to three years. If the market declines or the developer's capital chain breaks, the nominee is left solely responsible for the massive debt.
category: Credit Fraud
keywords: Nominee-Owned Property
keywords: mortgage mule
keywords: straw buyer property
keywords: air loan mortgage
keywords: property credit mule
keywords: nominee mortgage fraud
keywords: silent second mortgage
keywords: mortgage stacking scheme
keywords: fake homebuyer
usage example: Sign a repurchase nominee property deal, the property will be bought back from the client within 2 years, property value around 700-800k.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Rollover
type: Term
break id: T0396
stix type: x-break-term
definition: A short-term borrowing practice of applying for a new loan to repay an existing debt, used to maintain cash flow or conceal overdue records.
description: When insolvent clients cannot repay a maturing loan, intermediaries help fabricate their credentials to apply for a larger loan. The newly acquired funds are then used to fill the hole of the old debt. This "borrow new to repay old" tactic can temporarily protect a credit score from overdue marks, but the debt snowball grows larger. Intermediaries often boast about "no-liability debt rolling," but in reality, they shift all the risk onto the borrower and the financial institutions that eventually hold the bag, often triggering a cascade of defaults.
category: Credit Fraud
keywords: Loan Rollover
keywords: debt reshuffling
keywords: loan stacking
keywords: refinance fraud
keywords: evergreening loan
keywords: debt restructuring scam
keywords: serial refinancing
keywords: kiting loans
keywords: double-dipping loan
usage example: An older woman wants to carry debt, she can get a 1 million yuan bank loan. After doing this, how many years of rolling debt can be free of the intermediary's liability? The documents are fake. She's 54.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Direct Debt Carry
type: Term
break id: T0397
stix type: x-break-term
definition: A business model where a bank directly assumes the loan risk and bad debt losses and manages the recovery of non-performing asset portfolios; underground brokers often fabricate such a credit endorsement to deceive victims.
description: Underground brokers falsely claim to have a "direct bank backing" channel, capable of handling internal bad debt digestion or non-performing asset portfolio disposal, using this as a fabricated official endorsement to attract clients. In reality, banks rarely outsource non-performing assets directly to external individuals. The intermediary merely uses this title to gain trust, while secretly operating illegal businesses like debt loading or loan packaging. Once hooked, clients are often tricked into signing fraudulent agreements and ultimately face legal recourse.
category: Credit Fraud
keywords: Direct Debt Carry
keywords: bad debt absorption
keywords: direct loss cover
keywords: bank loss takeover
keywords: debt assumption scheme
keywords: write-off front
keywords: loss booking scam
keywords: debt parking scheme
keywords: charge-off cover
usage example: Local direct backing, get 3 million+ in hand, done in about ten days, clean credit, one or two inquiries are fine. The asset package window is closing soon, hurry up and send people, do a couple of deals and take a break.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Short-Term Bridge Loan
type: Term
break id: T0398
stix type: x-break-term
definition: A short-term funding service provided by individuals or illegal financial organizations to clients whose bank loans are due and cannot be repaid, offering bridge capital at exorbitant interest rates.
description: When a borrower's bank loan matures and they cannot raise the funds to repay it, underground "short-term bridge" intermediaries step in to provide the capital to clear the loan. Once the bank renews the loan and disburses the new funds, the intermediary recoups the principal and charges upfront interest or high service fees. This operation often targets small and medium-sized business owners, with amounts ranging from 100,000 to 5 million yuan. If the loan renewal is not approved, the borrower is saddled with both the bank loan and the high-interest private debt, making them highly vulnerable to violent debt collection.
category: Credit Fraud
keywords: Short-Term Bridge Loan
keywords: bridge loan shark
keywords: payday bridge
keywords: loan renewal scam
keywords: debt rollover trap
keywords: hard money flip
keywords: balloon payment trap
keywords: bridge-to-default
keywords: refi trap
usage example: Accepting [SME short-term bridge loans], 100k to 5 million.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Predatory Loan Scam
type: Term
break id: T0400
stix type: x-break-term
definition: A systematic scam disguised as private lending, designed to illegally seize a victim's property by fabricating debt, deliberately creating defaults, and destroying repayment evidence.
description: Operators first lure victims with low barriers and fast disbursement to sign dual contracts or blank agreements. They then artificially inflate the loan amount, deliberately manufacture defaults, and conceal repayment records to create a false creditor's right. Once the victim is unable to repay, they initiate lawsuits or use threats of violence to force the victim to settle the debt with property or other assets. The entire process is tightly orchestrated, trapping victims in a debt snare without their knowledge, ultimately causing them to lose substantial assets.
category: Credit Fraud
keywords: Predatory Loan Scam
keywords: debt trap scheme
keywords: false contract loan
keywords: phantom debt creation
keywords: loan fraud ring
keywords: asset stripping loan
keywords: forced debt assumption
keywords: debt bondage scam
keywords: fabricated default
usage example: "The officer told me today that this kind of trap loan is illegal, and I shouldn't be afraid of being sued, they can't sue over this. The officer's exact words. Basically, just ignore it."
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Payday Cannon Loan
type: Term
break id: T0400-001
stix type: x-break-term
definition: An illegal loan product with an annualized interest rate far exceeding the legal limit, an extremely short term, and compounding interest that causes the debt to balloon rapidly.
description: These loans typically calculate interest on a daily, weekly, or monthly basis, with annualized rates often exceeding 500%. Through upfront interest deductions and extension fees, the debt swells rapidly. Lenders are usually unlicensed underground banks or online cash loan platforms, specifically targeting people in urgent need of money with no other financing options. Once a borrower defaults, they face high-frequency harassment, contact list bombing, and other violent collection tactics, making the debt virtually impossible to repay.
category: Credit Fraud
keywords: Payday Cannon Loan
keywords: loan shark app
keywords: usury loan
keywords: balloon interest
keywords: debt trap loan
keywords: cycle debt loan
keywords: predatory micro loan
keywords: exorbitant interest
keywords: loan flipping
usage example: Seriously, this loan shark has been around for years, persistently harassing me every few days. It was named and shamed on the 315 Gala, why isn't it shut down yet? Over two thousand for a card, got just over a thousand in hand, and they still have the nerve to demand money.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Blacklisted Borrower Loan
type: Term
break id: T0400-002
stix type: x-break-term
definition: Illegal high-interest loans targeting individuals with severely damaged credit histories or no credit records at all.
description: These loans are operated by unregulated lenders who exploit borrowers’ inability to access formal financing, profiting through exorbitant interest rates and harsh terms. Commonly found on underground online lending platforms or among private lending rings, borrowers face violent debt collection or rapidly compounding debt once they fall behind on payments.
category: Credit Fraud
keywords: Blacklisted Borrower Loan
keywords: credit invisible loan
keywords: bad credit loan
keywords: no credit check loan
keywords: subprime loan shark
keywords: underground lending
keywords: black credit borrower
keywords: loan sharking
usage example: Black-credit loans—everyone who gets rejected elsewhere is guaranteed approval here. We don’t check liabilities, court lawsuits, court enforcement actions, or current delinquencies. All can be processed.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Account-ID Loan
type: Term
break id: T0400-003
stix type: x-break-term
definition: A short-term illegal high-interest loan secured by handing over control of a mobile device account.
description: Borrowers are required to surrender access to their Apple ID or Android account, giving the lender leverage to enforce repayment. Upon default, the lender locks the device or extracts private data. With extremely short cycles and sky-high interest, this loan targets people in urgent need of cash who lack other collateral, and is commonly circulated through social media and underground lending channels.
category: Credit Fraud
keywords: Account-ID Loan
keywords: Apple ID pawn
keywords: phone collateral loan
keywords: device-locked loan
keywords: mobile account hostage loan
keywords: ID pawn
usage example: For black-credit applicants, we require at least an iPhone 12 Pro or higher. First-time ID loan: 1,800 approved, 1,200 in hand, repayment due in one week.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS04
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Device Rental Loan
type: Term
break id: T0400-004
stix type: x-break-term
definition: A high-interest lending scheme disguised as an electronics rental arrangement.
description: Intermediaries lure students or financially strained individuals with promises of no verification and low barriers, signing them to rental contracts whose effective annual interest far exceeds legal limits. When a borrower defaults, they face not only steep penalties but also potential violent collection or litigation, blurring the line between leasing and lending.
category: Credit Fraud
keywords: Device Rental Loan
keywords: rent-to-own scam
keywords: device leasing trap
keywords: tech rental shark
keywords: lease-to-loan scheme
keywords: electronic rental fraud
usage example: Credit score 650+, device rental loan. Agencies looking to cash out, come discuss—high volume, top quality.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

55 Payday Loan
type: Term
break id: T0400-005
stix type: x-break-term
definition: An illegal online loan product with an extremely short term and exorbitant interest rate.
description: For example, borrowing 1,000 yuan and repaying 1,500 yuan after just five days, representing a 50% interest charge. Operated by unlicensed online lending platforms, these products prey on borrowers who have no other options, rapidly piling on penalty interest and collection pressure after default, which easily pushes borrowers into a debt spiral.
category: Credit Fraud
keywords: 55 Payday Loan
keywords: 5-day loan
keywords: 50 percent interest loan
keywords: payday lending
keywords: short-term shark
keywords: weekly loan shark
keywords: high-interest short loan
usage example: The borrower only needed three thousand yuan for three days, but a 55 Payday Loan slashed fifteen hundred in interest upfront; if overdue, collectors would charge interest by the hour and blast his contacts.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Harvesting
type: Term
break id: T0400-006
stix type: x-break-term
definition: A fraudulent scheme that uses a sham loan agreement to illegally seize a borrower’s real estate.
description: Criminal rings entice property owners into signing loan contracts that embed property transfer clauses. Exploiting the borrower’s urgent need for cash or lack of legal awareness, the perpetrators ultimately take possession of the property through litigation or violent enforcement. The elderly are a primary target, and the entire process is meticulously designed to make recovery extremely difficult.
category: Credit Fraud
keywords: Loan Harvesting
keywords: equity stripping
keywords: deed theft
keywords: home stealing loan
keywords: property deed scam
keywords: mortgage fraud scheme
keywords: loan-to-own fraud
usage example: The elderly man was tricked into signing a seemingly ordinary loan agreement, but months later strangers arrived demanding he vacate his home, revealing a Loan Harvesting contract where the amount had been altered to match his property's value.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Drop-In Borrower
type: Term
break id: T0406
stix type: x-break-term
definition: Out-of-town recruits with no local ties who are used as disposable fronts in credit fraud operations.
description: Underground brokers scout across the country for individuals with no stable employment or credit history, transporting them in batches to target cities to file concentrated loan applications. These individuals serve as figureheads to complete in-person verification steps, then vanish once the loan is disbursed, leaving lenders with little recourse for recovery.
category: Credit Fraud
keywords: Drop-In Borrower
keywords: loan mule
keywords: credit mule
keywords: airborne mule
keywords: interstate loan fraud
keywords: synthetic identity applicant
keywords: straw borrower
usage example: Nationwide, disposable fronts, no-identity applicants, no driver’s license required.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Legit-Channel Operator
type: Term
break id: T0407
stix type: x-break-term
definition: Loan products issued by state-licensed and regulated financial institutions.
description: These products are offered by banks or licensed consumer finance companies with relatively transparent rates and terms, though subject to stricter vetting. In underground lending contexts, the term is often used to contrast legitimate channels with illicit ones, or as a filtering criterion when identifying targets for fraud.
category: Credit Fraud
keywords: Legit-Channel Operator
keywords: licensed lender
keywords: bank loan
keywords: regulated credit
keywords: institutional loan
keywords: prime loan
usage example: Currently carrying over 300,000 in total liabilities. A regular loan has been granted a one-month extension. Right now I have no steady income stream, no business license, but I own a fully paid-off property worth 2 million with the deed in hand, unmarried.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Dummy Car Loan
type: Term
break id: T0408
stix type: x-break-term
definition: A fraudulent auto loan obtained by exploiting the identity of individuals with intellectual disabilities or those incapable of managing their own affairs.
description: Criminal organizations recruit vulnerable people lacking sound judgment, take out car loans in their names, then immediately resell the vehicles for profit, shifting all risk onto financial institutions. The barrier to entry is extremely low; with minimal packaging, the fraudsters can bypass risk controls, leading to a high incidence of bad debt.
category: Credit Fraud
keywords: Dummy Car Loan
keywords: vulnerable adult exploitation
keywords: incapacity car loan
keywords: car loan straw purchase
keywords: auto loan fraud
keywords: vehicle title scam
usage example: Disability-exploitation car loans, available for any household registration with a credit record. Three to five days to completion, guaranteed to pass three rounds of risk control, handled end-to-end by us.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Debt Mule
type: Term
break id: T0409
stix type: x-break-term
definition: In black-market fraud, a debt mule who is packaged and used to fraudulently obtain large loans.
description: Fraud rings recruit individuals with no credit history or assets, then artificially build up their credit profile by fabricating property ownership, business operations, and other assets. After a period of credit grooming, they apply for large loans from financial institutions in the mule's name. Once the loan is disbursed, the ring and the mule split the proceeds, while the mule is left with the full debt and a ruined credit record. This scheme frequently results in bank bad debt and undermines financial order.
category: Credit Fraud
keywords: Debt Mule
keywords: debt slave
keywords: credit mule
keywords: debt assumption fraud
keywords: bust-out scheme
keywords: credit washing
keywords: synthetic debt
usage example: Taking orders province-wide. Business license must be at least two years old and transferred over six months ago! Genuine operations with a physical location, zero invoices and zero tax filings are all acceptable. Debt mules can be used, with credit lines ranging from 2 to 5 million.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Security Awareness Training
related avoidances: Automated Malicious Link Detection
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Big Trouble
type: Term
break id: T0410
stix type: x-break-term
definition: In black-market fraud, a terminally ill patient exploited for financial discounting or insurance scams.
description: Fraud rings specifically seek out patients with terminal diagnoses and critical-condition notices from hospitals, then exploit their identities for financial fraud. Common schemes include recruiting patients under the guise of drug trials, or using their identities to take out high-value insurance policies or loans that are then discounted for immediate cash before the patient dies. Family members are often lured by high payouts into signing fraudulent agreements, ultimately facing legal and financial liability.
category: Credit Fraud
keywords: Big Trouble
keywords: terminal illness discounting
keywords: viatical fraud
keywords: deathbed loan
keywords: terminally ill exploitation
keywords: patient recruitment scam
keywords: clinical trial fraud
usage example: Terminally ill clients wanted. Drug trial participants under 48, receive 700,000 in hand, cash paid upon signing!
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Borrower-Sourcing Broker
type: Term
break id: T0411
stix type: x-break-term
definition: In the black-market chain, a role responsible for referring clients to loan fraud intermediaries.
description: A client broker does not directly process loans but uses their own channels to find individuals seeking loans and refers them to partner intermediaries or operators. They earn commissions or referral fees, making them a crucial link in the fraud supply chain. Many self-proclaimed brokers with large client networks are active in social media groups, though their actual conversion rates vary widely.
category: Credit Fraud
keywords: Borrower-Sourcing Broker
keywords: lead generation intermediary
keywords: traffic broker
keywords: client referral agent
keywords: loan applicant sourcing
keywords: underground lead gen
keywords: borrower recruitment
keywords: commission-based referral
keywords: black-market lead provider
usage example: Always looking for client brokers. No time-wasters, no pie-in-the-sky dreamers, no drama.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Automated Malicious Link Detection
related avoidances: Domain & Link Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Access Source Tracking
related business scenes: BS01
related business scenes: BS04
related business scenes: BS11
citation: 【Credit Fraud】Exposing the 'Repayment-Free Car' Scam in Auto Loan Fraud Rings
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Direct Source Operator
type: Term
break id: T0412
stix type: x-break-term
definition: In black-market fraud, the key operator who directly controls core funding and channel resources.
description: A primary operator typically holds ultimate control over the source of funds, insider bank connections, or core identity-packaging techniques, sitting at the top of the fraud chain. They rarely interact with clients directly, instead distributing business through layers of agents. Most intermediaries claiming to be 'direct operators' are actually middlemen. To avoid risk, true primary operators work only with specific channels and maintain a highly concealed identity.
category: Credit Fraud
keywords: Direct Source Operator
keywords: core fund controller
keywords: primary source operator
keywords: direct channel holder
keywords: top-tier orchestrator
keywords: funding source principal
keywords: insider connection handler
keywords: wholesale fraud operator
keywords: upstream capital controller
usage example: Face-to-face, flexible communication. Big data score 65 and above. Local primary operator.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Clean Credit Thin File
type: Term
break id: T0413
stix type: x-break-term
definition: Refers to an individual with a completely blank credit report, containing no credit history whatsoever.
description: These individuals have never applied for a credit card or loan, leaving their credit report entirely empty, referred to in fraud circles as a 'blank slate.' Fraud intermediaries exploit their clean records to commit first-time large-loan fraud with a higher success rate. With no repayment history, financial institutions find it difficult to assess their true credit risk, making them ideal targets for packaging and exploitation.
category: Credit Fraud
keywords: Clean Credit Thin File
keywords: no-hit credit file
keywords: zero-trade-line report
keywords: credit invisible applicant
keywords: unscored consumer
keywords: first-time borrower target
keywords: blank credit profile
keywords: thin file exploitation
keywords: pristine credit record
usage example: Accepting applications nationwide: doing pure unsecured loans, accepting blank slates, unlimited intake.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Blacklisted Borrower
type: Term
break id: T0414
stix type: x-break-term
definition: In black-market fraud, a borrower with an extremely poor credit history who has been blacklisted by financial institutions.
description: These individuals are already unable to obtain loans through legitimate channels due to severe defaults or dishonesty. Fraud intermediaries exploit loopholes in some online lending platforms' risk controls, or use forged documents and identity packaging, to apply for loans specifically for these 'blacklisted' borrowers. Such operations often involve high fees and can easily lead to derivative problems like aggressive debt collection.
category: Credit Fraud
keywords: Blacklisted Borrower
keywords: severely delinquent borrower
keywords: credit blacklist target
keywords: defaulted loan applicant
keywords: unbankable debtor
keywords: subprime fraud lead
keywords: charge-off candidate
keywords: blocklisted individual
keywords: hard-bounced credit
usage example: Exclusive for blacklisted borrowers, matrix product, available to blacklisted individuals.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Loan Bro
type: Term
break id: T0415
stix type: x-break-term
definition: In black-market fraud, a professional loan fraudster who maliciously defaults after borrowing.
description: Operating with a 'borrowing is earning' mentality, these individuals specifically target online lending platforms with lax risk controls. They are active in various communities, sharing tips on evading debt collection, delaying repayment, and identifying which platforms are easiest to borrow from. Their actions directly cause platform default rates to soar, making them a primary target for anti-fraud systems.
category: Credit Fraud
keywords: Loan Bro
keywords: professional non-payer
keywords: intentional defaulter
keywords: serial loan abuser
keywords: debt evasion community
keywords: malicious borrower
keywords: never-pay mindset
keywords: deliberate delinquency
keywords: bad-faith applicant
usage example: Guys, I applied for a collection suspension via online customer service, finally got transferred to a human to request it, but the agent ignored me and stopped replying. What's going on? Has anyone who got a suspension teach me what to say?
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Full Identity Fabrication
type: Term
break id: T0416
stix type: x-break-term
definition: A fraudulent scheme in which a borrower's entire profile is fabricated to appear creditworthy.
description: Intermediaries forge a complete set of fake documents for unqualified clients, including fake business licenses, fake bank statements, fake social security and housing fund contribution records, and even rent physical spaces to pose as a business location. This operation is costly and time-consuming but can secure high-value loans. Once successful, the client and intermediary split the loan proceeds and abscond, leaving financial institutions with massive bad debt.
category: Credit Fraud
keywords: Full Identity Fabrication
keywords: complete identity fabrication
keywords: full-document forgery
keywords: synthetic business setup
keywords: total profile counterfeiting
keywords: deep fake application
keywords: enterprise shell packaging
keywords: comprehensive credential fraud
keywords: wholesale identity manufacturing
usage example: Full packaging for nearby clients, ages 25-49, no more than 6 credit inquiries in the last six months. Disbursement in 3 days, 400,000 per household.
related risks: Consumer Loan Fraud (Genuine Retroactive Payment)
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Light Profile Enhancement
type: Term
break id: T0417
stix type: x-break-term
definition: A fraud tactic involving limited falsification of a borrower's profile to pass loan approval checks.
description: Fraudsters engage in targeted embellishment of loan application materials by inflating income statements, optimizing credit reports, or adjusting asset-liability ratios. Commonly seen in credit fraud scenarios, the goal is to increase approval rates and credit limits from financial institutions. This type of packaging typically does not alter core identity information, only surface-level data, making it relatively covert.
category: Credit Fraud
keywords: Light Profile Enhancement
keywords: income inflation
keywords: cosmetic credit repair
keywords: document touch-up
keywords: selective profile enhancement
keywords: superficial data polishing
keywords: light-touch forgery
keywords: application window dressing
keywords: minor credential adjustment
usage example: They only did Light Profile Enhancement, attaching the unemployed borrower to a shell company and fabricating three months of transaction records, just enough to barely meet the risk model's threshold at that consumer finance firm.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Seasoning
type: Term
break id: T0418
stix type: x-break-term
definition: A preparatory fraud scheme where a syndicate provides full-chain financial support to a debt mule to secure higher loans.
description: In debt mule fraud, intermediaries or syndicates provide the mule with full board and lodging and cover upfront costs such as mortgage down payments, car loan down payments, taxes, and even business license fees. Through this fully-funded model, the mule is packaged as a high-quality borrower. Once the loan is disbursed, the funds are split among the syndicate, while the mule assumes all the debt.
category: Credit Fraud
keywords: Credit Seasoning
keywords: full-subsidy grooming
keywords: debt mule preparation
keywords: pre-funded credit building
keywords: three-expense coverage
keywords: sleeper asset cultivation
keywords: front-loaded maintenance
keywords: straw borrower nurturing
keywords: long-term credit priming
usage example: Mortgage, credit, business, car loans—fully-funded model. Looking for credit invisibles, age 23 to 48, all upfront costs covered.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Existing Business License
type: Term
break id: T0419
stix type: x-break-term
definition: A pre-prepared, seasoned business license that can be immediately transferred to a debt mule.
description: In corporate debt fraud, syndicates register companies in advance and maintain them to create the illusion of good business performance. When a suitable mule is found, the company is directly transferred, eliminating the need for the mule to build a business credit profile from scratch. This significantly shortens the fraud cycle and enables rapid access to high-value business loans.
category: Credit Fraud
keywords: Existing Business License
keywords: pre-seasoned license
keywords: ready-to-transfer entity
keywords: aged shell company
keywords: immediate business transfer
keywords: pre-existing corporate vehicle
keywords: turnkey company registration
keywords: shelf corporation handover
keywords: pre-cultivated enterprise
usage example: Ready-to-go business licenses available for immediate transfer. Deposit required for entry, transfer and change of ownership done quickly. Urgent call for agents with clients.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Four-Flow Consistency
type: Term
break id: T0420
stix type: x-break-term
definition: The fabrication of contracts, logistics, capital flow, and invoices to create a false picture of a company's operational health.
description: In corporate loan fraud, to make a shell company appear operational, fraudsters fabricate upstream and downstream transaction contracts, forge logistics documents, generate fake capital flows, and issue fraudulent invoices so that all four data streams corroborate each other. This highly realistic, closed-loop data set effectively deceives financial risk control systems to secure large corporate loans.
category: Credit Fraud
keywords: Four-Flow Consistency
keywords: fabricated transaction trail
keywords: synthetic business documentation
keywords: false contract alignment
keywords: fake logistics records
keywords: counterfeit invoice matching
keywords: artificial revenue proof
keywords: staged financial flows
keywords: documentary consistency fraud
usage example: Nationwide trade volume and capital increase services, business incubation, upstream and downstream contract packages with invoices, four-flow integration, mid-year financial data beautification.
related risks: Fake Transactions
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Show-Funds Placement
type: Term
break id: T0421
stix type: x-break-term
definition: A scheme where a large sum of money is temporarily deposited into an account to create a false impression of financial strength for loan fraud.
description: When applying for large loans, fraudsters bring in external funds to temporarily deposit a large sum into the borrower's account to demonstrate financial capability to the bank. Once the loan is approved and disbursed, these funds are quickly transferred out. This causes financial institutions to issue loans based on a false credit profile, leading to significant bad debt risk.
category: Credit Fraud
keywords: Show-Funds Placement
keywords: proof of funds display
keywords: balance sheet window dressing
keywords: temporary capital injection
keywords: inflated bank balance
keywords: fake financial strength
keywords: capital verification fraud
keywords: asset falsification
keywords: loan qualification padding
usage example: Capital display and account padding services for projects, corporate capital increase and verification, pass-through transactions.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Matched Shell Company
type: Term
break id: T0422
stix type: x-break-term
definition: The practice of equipping a debt mule with a shell company to fraudulently obtain loans from financial institutions.
description: In debt mule fraud, syndicates transfer a pre-registered or purchased shell company to the mule, making them the nominal business owner. They then 'equip' the company by generating fake transaction flows and contracts, packaging the shell as an operational entity to apply for business loans. After the loan is disbursed, the mule is left with the debt while the syndicate splits the funds.
category: Credit Fraud
keywords: Matched Shell Company
keywords: shell company matching
keywords: corporate identity packaging
keywords: business entity forgery
keywords: fake business profile
keywords: straw company setup
keywords: enterprise fabrication
keywords: nominee director scheme
keywords: shell corp handover
usage example: Bank connections nationwide, guaranteed approval of 3 to 5 million, strong communication, real shell company setup, inquiries welcome.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Housing-Credit-Enterprise Combo
type: Term
break id: T0423
stix type: x-break-term
definition: A sequential fraud model combining mortgage, credit, and business loans to maximize extraction from a single debt mule.
description: This is a fixed operational process for multi-round loan fraud against a single mule. The syndicate first uses the mule to apply for a mortgage, then leverages the property for consumer credit or renovation loans, and finally packages the mule as a business owner for a corporate loan. This layered approach maximizes the mule's credit value in the shortest possible time.
category: Credit Fraud
keywords: Housing-Credit-Enterprise Combo
keywords: mortgage-credit-enterprise stacking
keywords: multi-product loan cycling
keywords: sequential loan max-out
keywords: credit exhaustion scheme
keywords: asset-backed fraud layering
keywords: loan stacking attack
keywords: full-spectrum lending fraud
usage example: Mortgage, credit, business, car loans. Looking for credit invisibles with total liabilities under 50,000. Upfront costs covered.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Credit Whitewashing
type: Term
break id: T0424
stix type: x-break-term
definition: The illegal practice of erasing or concealing an individual's negative credit history.
description: Operating under the guise of 'credit repair,' fraudsters attempt to delete or modify negative information like overdue payments and bad debts from credit reports by forging documents, maliciously complaining to financial institutions, or exploiting system vulnerabilities. This practice not only defrauds clients of high service fees but also severely disrupts the financial credit system, and the promised 'cleansing' is often unattainable.
category: Credit Fraud
keywords: Credit Whitewashing
keywords: credit repair scam
keywords: negative entry suppression
keywords: credit history manipulation
keywords: black mark removal
keywords: credit bureau dispute abuse
keywords: credit file tampering
keywords: debt record erasure
usage example: Credit repair and cleansing, pay after processing, no charge if unsuccessful.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Break Out of the Black Room
type: Term
break id: T0425
stix type: x-break-term
definition: Bypassing bank or online lending platform risk controls to restore frozen borrowing or credit limit increase functions through specific operations.
description: In credit fraud, some users are placed in a “black room” by the system after triggering risk control rules, preventing them from borrowing or increasing their credit limit. Fraud syndicates or users forcibly restore account functions by fabricating transaction records, binding specific co-branded cards, or altering device fingerprints to circumvent the platform’s risk model. Such operations often involve fake transactions and identity forgery. Once detected by the platform, they may lead to stricter account freezes or legal liability.
category: Credit Fraud
keywords: Break Out of the Black Room
keywords: black room breakout
keywords: account restriction bypass
keywords: risk control circumvention
keywords: frozen account reactivation
keywords: credit limit unblocking
keywords: device fingerprint spoofing
keywords: shadow credit line
usage example: A few days ago I successfully bypassed the blacklist using the XX co-branded card, and my limit is now 15k04.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Upfront Costs
type: Term
break id: T0426
stix type: x-break-term
definition: The total upfront costs invested in packaging a borrower’s profile during debt assumption loan fraud operations.
description: In large-scale loan fraud operations, debt assumption intermediaries need to create a false image of a high-quality borrower for the debt assumer, which involves a series of upfront investments. These costs include purchasing shell company licenses, processing fake asset transfers, fabricating business cash flows, and making back payments on social security or housing fund contributions. Intermediaries typically pass these costs onto the debt assumer or downstream intermediaries to reduce their own risk. If the loan fails or is blocked by risk controls, these investments become sunk costs, worsening the financial losses of the participants.
category: Credit Fraud
keywords: Upfront Costs
keywords: front-end loading costs
keywords: borrower packaging expense
keywords: qualification fabrication cost
keywords: synthetic identity investment
keywords: straw borrower prep
keywords: credit profile build cost
keywords: application grooming fee
usage example: Accepting applications nationwide: 3.6% annualized rate, guaranteed loan approval, low upfront costs, interest-only payments initially with principal due at maturity, drawdown and repayment at any time, no pressure.
related risks: Consumer Loan Fraud (Genuine Retroactive Payment)
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Settlement Split
type: Term
break id: T0427
stix type: x-break-term
definition: The agreed percentage split of the loan disbursement among parties in a loan fraud scheme.
description: In the chain of debt assumption or intermediary-facilitated loan fraud, after the loan is disbursed, the capital provider, operator, debt assumer, and intermediaries at various levels split the proceeds according to a pre-agreed ratio. This ratio is often expressed in “tenths,” e.g., 7 tenths means taking 70% of the total disbursed amount. The settlement tier determines the profit distribution at each stage; the higher the tier and the more core the resources controlled, the larger the share. This profit-sharing mechanism incentivizes multi-level intermediary referrals and amplifies the scale of credit fraud.
category: Credit Fraud
keywords: Settlement Split
keywords: profit-sharing ratio
keywords: proceeds split percentage
keywords: commission tier
keywords: payout allocation
keywords: fraud revenue share
keywords: kickback percentage
keywords: settlement cut
usage example: Direct capital source settles at 70% (net profit) with generous rebates, priority given to dual-clean applicants.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Commission Rate
type: Term
break id: T0428
stix type: x-break-term
definition: The service fee percentage charged by fraud syndicates to clients based on the risk level of the operation.
description: In credit fraud, money muling, and other underground activities, intermediaries or operators charge different fee percentages based on the risk level of the business. The more covert the operation channel, the larger the amount involved, and the higher the probability of being blocked by risk controls, the higher the fee percentage. For example, the fee for large-scale debt assumption using a fake business is far higher than for ordinary personal consumer loan packaging. The fee percentage is a core metric for fraud syndicates to measure risk and return; a high percentage often implies a higher fraud success rate or more severe legal consequences.
category: Credit Fraud
keywords: Commission Rate
keywords: commission percentage
keywords: service fee rate
keywords: risk-adjusted fee
keywords: brokerage point
keywords: facilitation fee rate
keywords: cut of proceeds
keywords: channel fee percentage
usage example: Inside the code-receiving ring, the Commission Rate was clearly fixed: eight points for a first-purchase verification code from an e-commerce platform, while a bank facial recognition code jumped to twenty-five points due to higher risk.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Upfront Interest Deduction
type: Term
break id: T0429
stix type: x-break-term
definition: The portion of interest deducted upfront from the principal when a predatory loan is disbursed.
description: In illegal lending or underground banking operations, the lender does not disburse the full principal amount but directly deducts a large sum as interest, so the borrower actually receives far less than the contract amount. This practice conceals the true interest rate and traps the borrower in a debt cycle from the start. Upfront interest deductions are common in short-term cash loans and trap loans, serving as a means for fraud syndicates to quickly extract funds from borrowers, and often lead to violent debt collection and serial fraud.
category: Credit Fraud
keywords: Upfront Interest Deduction
keywords: prepaid interest deduction
keywords: loan principal skimming
keywords: disbursement shorting
keywords: interest front-loading
keywords: usurious deduction
keywords: off-the-top fee
keywords: principal haircut
usage example: For this loan, a total of over 600 was deducted as upfront interest. The service fee was over a hundred. This was my last drawdown, and it’s been overdue for nearly ten years.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Ten-Grand Cash Brick
type: Term
break id: T0430
stix type: x-break-term
definition: Slang term used in underground circles for ten thousand yuan in cash.
description: In cash-intensive underground transactions, money muling, or debt assumption settlements, fraud operators often use “brick” to refer to ten thousand yuan in cash, as a bank-strapped bundle of hundred-yuan notes resembles a brick. This jargon facilitates discreet communication about sums of money without explicitly mentioning the amount. The movement of large numbers of “bricks” typically involves offline cash handovers, gambling fund transfers, or illegal fund splitting, and is a hallmark of money laundering and illegal settlement.
category: Credit Fraud
keywords: Ten-Grand Cash Brick
keywords: cash bundle
keywords: currency brick
keywords: ten-thousand note stack
keywords: banded banknotes
keywords: bulk cash unit
keywords: physical cash block
keywords: paper bundle
usage example: The contact neatly stacked five Ten-Grand Cash Bricks into a black plastic bag, slid it across the tea restaurant corner to the card seller, and whispered that this was the final payment to buy out his four-piece identity set, severing all ties to future transactions.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Bring-Your-Own Upfront Costs
type: Term
break id: T0431
stix type: x-break-term
definition: The debt assumer or intermediary provides their own funds to cover upfront costs for borrower profile packaging and daily expenses.
description: In debt assumption fraud operations, some participants must bear all upfront costs required to package the borrower’s profile, including purchasing business licenses, fabricating cash flows, making back payments on social security and housing fund contributions, and even daily expenses to maintain the appearance of business operations. This model usually means the intermediary does not advance funds, shifting the capital risk onto the debt assumer or downstream parties. Self-funded upfront operations often target larger corporate loans with stricter scrutiny; if the packaging fails, the participant faces massive financial losses.
category: Credit Fraud
keywords: Bring-Your-Own Upfront Costs
keywords: upfront capital
keywords: self-funded packaging
keywords: pre-loan qualification
keywords: business license purchase
keywords: bank flow fabrication
keywords: social security top-up
keywords: debt farming prep
keywords: front-end cost
usage example: Direct channel, judicial protection guaranteed, daily settlement, foreign exchange: recruiting many people, must have passport, 30-day cycle, guaranteed 6 to 10 million, self-funded upfront costs.
related risks: Consumer Loan Fraud (Genuine Retroactive Payment)
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Discount Lead Intake
type: Term
break id: T0432
stix type: x-break-term
definition: A customer acquisition model where loan intermediaries accept client resources from other channels at extremely low fees.
description: In loan fraud intermediary networks, when an intermediary has sufficient processing capacity or capital sources, they accept client resources in bulk from other intermediaries at fees far below market rates, a model known as “freezing-point acquisition.” It leverages resource complementarity among intermediaries to quickly match borrowing needs with fraud channels, improving client conversion rates. Freezing-point acquisition often implies relaxed client qualification requirements and is frequently accompanied by fake document packaging and risk control circumvention, concentrating risk heavily.
category: Credit Fraud
keywords: Discount Lead Intake
keywords: low-cost lead intake
keywords: bulk client acquisition
keywords: channel consolidation
keywords: lead dumping
keywords: discount lead flow
keywords: lead arbitrage
keywords: cold point intake
usage example: Instant approval of 200k with just an ID card! Approved on the spot if you have a repayment record, freezing-point acquisition.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Client Buyout
type: Term
break id: T0433
stix type: x-break-term
definition: A one-time payment made by fraud operators to intermediaries to acquire exclusive control over a customer or bank account and all subsequent proceeds.
description: In loan fraud, fraud operators pay a fixed fee to intermediaries to buy out customer profiles, after which the operators independently handle loan applications, cash-outs, and other operations without sharing profits with the intermediary. In money laundering, this refers to purchasing a bank card outright without returning it to the original holder, using it to receive and move illicit funds until the card is flagged or frozen. This model breaks the traceability chain and complicates tracking.
category: Credit Fraud
keywords: Client Buyout
keywords: one-time payout
keywords: full asset purchase
keywords: account buyout
keywords: card buyout
keywords: lifetime buy
keywords: permanent card purchase
keywords: no-recourse buy
usage example: The broker executed a Client Buyout for twenty thousand yuan, selling this debt-laden person's identity to a downstream ring, meaning all future profits from repeatedly registering companies, issuing invoices, and defrauding loans under his name would belong to them.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Real-Name Identity Verification
related avoidances: Threat Intelligence
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Interest Suspension Arrangement
type: Term
break id: T0434
stix type: x-break-term
definition: A practice where proxy agencies negotiate with banks on behalf of debtors to waive interest and penalty fees and allow repayment of the principal in installments.
description: Proxy agencies negotiate with banks in the debtor's name, claiming they can have credit card overdue interest and penalty fees waived, so that only the principal is repaid in installments. In practice, these agents often fabricate poverty certificates, medical records, and other documents, charge exorbitant service fees, and expose debtors' personal information. This often leaves the debtor with unresolved debts, additional costs, and blacklisting by the bank.
category: Credit Fraud
keywords: Interest Suspension Arrangement
keywords: interest waiver negotiation
keywords: penalty interest removal
keywords: debt restructuring scam
keywords: fake hardship proof
keywords: medical certificate forgery
keywords: debt settlement fraud
keywords: blacklist risk
usage example: For those with overdue credit cards or online loans, or about to become overdue, we can arrange a principal-only installment plan with waived interest.
related risks: Platform Online Loan Fraud
related risks: Anti-Collection Risk
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: Credit Fraud: Exposing the Black Industry Behind Illegal "Proxy Rights Protection" in the Financial Sector
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Customized Installment Plan
type: Term
break id: T0435
stix type: x-break-term
definition: A black-market debt relief service in which illicit agencies negotiate adjusted repayment plans with lenders on behalf of overdue borrowers.
description: Illicit debt-relief agencies exploit borrowers' financial distress by filing proxy complaints or conducting sham negotiations with banks and online lending platforms to restructure installment repayment plans. These operations often involve forging supporting documents and exerting pressure through malicious complaints. Borrowers risk having their personal data resold and may face legal liability due to falsified materials.
category: Credit Fraud
keywords: Customized Installment Plan
keywords: debt rescheduling
keywords: fake complaint pressure
keywords: negotiated repayment
keywords: forged poverty proof
keywords: debt optimization scam
keywords: malicious complaint
keywords: debtor exploitation
usage example: Debt optimization, credit report dispute appeals, capital services, credit card personalized installment plans up to 60 months.
related risks: Platform Online Loan Fraud
related risks: Anti-Collection Risk
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Debt Custody
type: Term
break id: T0436
stix type: x-break-term
definition: A service in which a debt-relief agency promises to handle debt collection calls and negotiate debt reduction on behalf of the debtor.
description: Under the guise of debt management, agencies take over collection calls for debtors and claim they can negotiate debt forgiveness, while in reality charging high management fees. Their operations often involve forging documents, filing malicious complaints, and other illegal tactics, leading to misuse of personal information, worsening debt problems, and missed repayment opportunities due to false promises.
category: Credit Fraud
keywords: Debt Custody
keywords: collection call takeover
keywords: debt relief scam
keywords: custody fee
keywords: harassment shielding
keywords: debt negotiation fraud
keywords: fake material submission
keywords: debt mismanagement
usage example: Debt management service, no need to check your account, just 150 a month.
related risks: Platform Online Loan Fraud
related risks: Anti-Collection Risk
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related avoidances: Data Loss Prevention
related avoidances: Data Desensitization (Masking)
related avoidances: Threat Intelligence
related avoidances: Internal Review Mechanism
related avoidances: Digital Watermark/Text Watermark
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Aggressive Collector
type: Term
break id: T0437
stix type: x-break-term
definition: A derogatory term used by debtors to refer to third-party debt collectors.
description: In the context of loan fraud and debt collection, debtors use this term for collection agencies or individuals who employ threats, intimidation, harassment, and other high-pressure tactics. These collectors disregard the debtor's actual situation, using frequent phone bombardment, verbal abuse, and contact list exposure to force repayment, often provoking intense confrontation.
category: Credit Fraud
keywords: Aggressive Collector
keywords: debt collector harassment
keywords: phone bombing
keywords: contact list explosion
keywords: abusive collection
keywords: third-party collection abuse
keywords: predatory collector
keywords: collection harassment
usage example: The caller immediately asked when I would settle my debt on xx platform. I was confused, then asked if they had the wrong number. Only later did they say they weren't a debt collector thug but a specialist handling interest, and asked if I needed help.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Get Clear of Debt
type: Term
break id: T0438
stix type: x-break-term
definition: The state in which a borrower has fully repaid all debts and escaped a debt trap.
description: In the context of financial fraud and underground lending, this term refers to a debtor who has completely settled all outstanding obligations, either through personal effort or by leveraging debt relief agencies, thereby breaking the cycle of borrowing from one lender to pay another. Once 'ashore,' the debtor is no longer subject to collection harassment and can resume a normal life, though the process may involve gray-area practices such as illegal cash-outs or negotiated debt reductions.
category: Credit Fraud
keywords: Get Clear of Debt
keywords: debt-free life
keywords: debt clearance
keywords: escape debt cycle
keywords: debt relief completion
keywords: loan payoff
keywords: end debt harassment
keywords: debt freedom
usage example: I owe less than 60k—how can I get ashore? My credit report has charge-offs, my loan records have been blacklisted twice, and my salary is too low to get out of this right now.
related risks: Platform Online Loan Fraud
related risks: Anti-Collection Risk
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related avoidances: Proxy Detection
related avoidances: Anomalous Access Source Detection
related avoidances: IP Intelligence
related avoidances: Rate Limiting
related threat actors: Anti-Collection Gangs
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Black Market Big Data: Exposing Malicious Loan Brokers
updated: 2026-06-16
version: 1

Fall Into Debt Spiral
type: Term
break id: T0439
stix type: x-break-term
definition: The process by which a borrower takes out an initial loan and gradually sinks into a cycle of borrowing to repay existing debts until the situation spirals out of control.
description: Unable to repay the initial loan, the debtor is forced to take new loans to pay old ones, causing interest and principal to snowball until the debt becomes completely unmanageable. During this process, borrowers are often lured into illegal channels such as loan sharking and fraudulent lending schemes, sinking deeper into financial distress—the opposite of getting ashore.
category: Credit Fraud
keywords: Fall Into Debt Spiral
keywords: debt spiral
keywords: borrowing to repay
keywords: loan stacking
keywords: debt trap
keywords: cycle of debt
keywords: debt accumulation
keywords: compound debt
usage example: I sent a message but haven't heard back. Not sure if it'll work out. I really can't borrow anymore! I've gotten ashore twice but sank back down both times.
related risks: Platform Online Loan Fraud
related avoidances: Risk Control Strategy
related avoidances: Credit Level Restriction
related avoidances: Adding Approval Processes
related avoidances: Compliance Governance
related avoidances: Legal Action
related business scenes: BS01
related business scenes: BS11
citation: 2024 H1 Credit Fraud Risk Landscape Report
citation: Uncovering a loan-broker scam: 150,000 yuan deducted from a 250,000 yuan loan...
updated: 2026-06-16
version: 1

Underground Economy
type: Term
break id: T0440
stix type: x-break-term
definition: Underground economy refers to industrial chains that exploit network vulnerabilities or regulatory loopholes through technical means or organized operations to carry out illegal profit-making activities.
description: The underground economy is a collective term for black and gray industries on the internet. Black industry refers to clearly illegal criminal activities such as fraud, theft, and money laundering, while gray industry operates in legal gray zones, including fake transactions, bonus abuse, and data scraping. The underground economy has formed a complete industrial chain with distinct divisions of labor and high professionalization. Upstream actors provide tools and resources such as card merchants who supply payment cards, account sellers who provide bulk registered accounts, and data brokers who trade stolen credentials. Midstream operators implement specific attacks including credential stuffing to take over accounts, traffic manipulation to game platform algorithms, and direct fraud schemes targeting users. Downstream participants handle monetization through various channels and conduct money laundering to obscure the illegal origins of funds. This sophisticated ecosystem continuously evolves its techniques to evade detection and enforcement, causing severe harm to internet companies through financial losses and reputation damage, while exposing users to fraud, identity theft, and privacy violations.
aliases: Black Industry
aliases: Gray Industry
category: Business Security
keywords: Underground Economy
keywords: Black Industry
keywords: Gray Industry
keywords: Cyber Crime Industry
usage example: This gang is a typical underground economy organization
related risks: Process Automation
related risks: Malicious Flash Sale Grabbing
related risks: Promotional Activity Cheating
related risks: Account Reselling
related risks: Fake Transactions
related risks: Unauthorized Account Sharing
related risks: Fake Registration
related risks: Sub-Account Abuse
related risks: Account Takeover
related risks: Upload Abuse
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Anomalous Access Behavior Detection
related avoidances: Anomalous Access Source Detection
related attack tools: Black SIM Cards
related attack tools: SMS Verification Code Platform
related attack tools: Cloud Phone
related attack tools: Headless Browsers
related attack tools: Automation Scripts
related attack tools: Identity Document Set (4-Piece)
related threat actors: Scalpers
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Account Dealers
related business scenes: BS02
related business scenes: BS03
related business scenes: BS04
citation: H1 2024 Internet Black-and-Gray Industry Research Report
updated: 2026-06-16
version: 1

Credential Stuffing
type: Term
break id: T0441
stix type: x-break-term
definition: Credential stuffing is an attack method where cybercriminals use leaked username-password combinations to attempt bulk logins across other websites or applications to obtain valid accounts.
description: Credential stuffing attacks exploit users' habits of reusing the same credentials across multiple platforms. Attackers obtain massive collections of username-password combinations from data breaches and use automated tools to attempt bulk logins on target platforms. When a match succeeds, they gain account control and proceed with theft, fraud, or account resale for profit. Unlike brute-force attacks which try random password combinations, credential stuffing uses real user credential pairs that have been verified to work on at least one platform, resulting in significantly higher success rates and making detection much harder with traditional defense mechanisms. The attack typically employs sophisticated techniques including distributed IP addresses to avoid rate limiting, rotating user agents to mimic legitimate browsers, and advanced evasion methods to bypass security controls such as CAPTCHAs and behavioral analysis. Successful attacks can lead to unauthorized access to financial accounts, exposure of personal data, and enable further downstream fraud activities including identity theft, financial fraud, and unauthorized purchases. The impact extends beyond individual victims to platforms that suffer reputation damage and regulatory scrutiny.
category: Business Security
keywords: Credential Stuffing
keywords: Account Takeover
keywords: Password Reuse Attack
usage example: The fraud group used credential stuffing automation to compromise tens of thousands of accounts.
related risks: Promotional Activity Cheating
related risks: Bulk Fake Account Manipulation
related risks: Account Takeover
related risks: Credential Stuffing
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Real-Name Identity Verification
related avoidances: Anomalous Access Behavior Detection
related attack tools: Headless Browsers
related attack tools: Virtual Machine
related attack tools: Credential Stuffing Tools
related threat actors: Scalpers
related threat actors: SIM Card Dealers (Phone Numbers)
related business scenes: BS02
related business scenes: BS03
related business scenes: BS04
citation: OWASP - Credential Stuffing
updated: 2026-06-16
version: 1

Store Matrix
type: Term
break id: T0442
stix type: x-break-term
definition: Store matrix refers to an e-commerce black-hat practice of creating numerous stores in bulk and listing products across them to increase exposure and sales volume.
description: The store matrix model exploits platform traffic allocation mechanisms by registering multiple store accounts in bulk and listing identical or similar products across these stores, forming a store network to increase product exposure opportunities and order acquisition probability. This practice often operates alongside dropshipping models and directly violates platform rules that typically allow one store per person, effectively monopolizing platform resources and disrupting fair market competition. Store matrix operators usually employ automated tools to manage stores at scale, handling product listing, price adjustments, order processing, and other operations in a coordinated fashion, forming a scaled black-gray industry chain. This approach artificially inflates search results by creating multiple duplicate or near-duplicate listings for the same products, misleads consumers who believe they are comparing different sellers when in reality all stores are controlled by the same operator, and undermines the platform's ranking algorithms which are designed to surface quality merchants based on genuine performance metrics. The practice also creates unfair competitive advantages for bad actors while legitimate sellers who follow the rules struggle to gain visibility.
category: Business Security
keywords: Store Matrix
keywords: Multiple Stores
keywords: Batch Store Opening
usage example: This gang operated hundreds of stores on the platform through the store matrix model
related risks: Store Cluster
related risks: Fake Transactions
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Real-Name Identity Verification
related avoidances: Access Control
related avoidances: Feature Randomization
related threat actors: Scalpers
related business scenes: BS02
citation: Strengthening IP protection to support e-commerce development: Yiwu court practices...
updated: 2026-06-16
version: 1

Dropshipping Store
type: Term
break id: T0443
stix type: x-break-term
definition: A dropshipping store is a business model that involves scraping products from other platforms to resell on one's own platform, then ordering from the original store and shipping directly to customers after receiving orders.
description: The dropshipping model is essentially a form of reselling or product scraping where operators hold no physical inventory. Instead, they collect product information from other platforms through manual copying or automated scraping tools, mark up prices to include their profit margin, and list these products in their own stores as if they were the original sellers. When buyers place orders, operators then purchase the items from the source platform using the buyer's shipping address, effectively acting as middlemen who profit from the price difference without adding value. This model carries multiple serious risks and legal issues. It frequently involves infringement of intellectual property rights by unauthorized use of others' product images, descriptions, and brand materials. Product quality cannot be guaranteed since operators never inspect the merchandise and have no control over supplier standards. After-sales service is severely compromised because operators lack direct supplier relationships and cannot efficiently handle returns, exchanges, or complaints. Logistics timing becomes unpredictable as orders pass through multiple handlers, leading to delayed deliveries and customer dissatisfaction. Some dropshipping operations also engage in false advertising and selling inferior products marketed as premium goods, seriously damaging consumer rights and platform credibility.
category: Business Security
keywords: Dropshipping
keywords: No Inventory
keywords: Cross-platform Reselling
usage example: This store uses the dropshipping model, with all products drop-shipped from other platforms
related risks: Dropshipping Store
related risks: Fake Transactions
related avoidances: Risk Control Strategy
related avoidances: Device Fingerprinting
related avoidances: Real-Name Identity Verification
related avoidances: Feature Randomization
related threat actors: Scalpers
related business scenes: BS02
citation: Warning: three illegal behaviors in no-inventory e-commerce; over 2,000 merchants sued...
updated: 2026-06-16
version: 1

Algorithmic Discrimination
type: Term
break id: T0444
stix type: x-break-term
definition: Algorithmic discrimination refers to the phenomenon where algorithmic systems produce unfair differential treatment toward different user groups, causing specific groups to suffer adverse impacts.
description: Algorithmic discrimination stems from multiple sources including biases embedded in training data that reflect historical prejudices, flaws in model design that fail to account for fairness considerations, or improper business objective settings that prioritize profit maximization over equitable treatment. This leads algorithms to produce systematic differential treatment toward different groups during decision-making processes. Common manifestations include price discrimination based on detailed user profiles where loyal customers are charged more, restrictions on credit approval or employment opportunities for specific demographic groups based on proxy variables, and biased display of search and recommendation results that favor certain products or viewpoints while suppressing others. Algorithmic discrimination not only violates fundamental fairness principles but may also solidify and amplify existing social biases by encoding them into automated systems that affect millions of users. It infringes upon users' legitimate rights to equal treatment and can perpetuate existing inequalities while creating economic harm to vulnerable groups. The Algorithmic Recommendation Regulations for Internet Information Services explicitly require that algorithm service providers must not use algorithms to implement unreasonable differential treatment, and regulatory authorities have begun penalizing platforms that engage in such practices.
aliases: Algorithm Bias
category: Business Security
keywords: Algorithmic Discrimination
keywords: Algorithm Bias
keywords: Price Discrimination
usage example: This platform was penalized by regulators for implementing price discrimination against loyal customers through algorithmic discrimination
related risks: Algorithm Compliance Risk
related risks: Malicious Benefit Abuse
related avoidances: Algorithm Audit Mechanism
related avoidances: Compliance Governance
related avoidances: Internal Review Mechanism
related business scenes: BS01
related business scenes: BS02
related business scenes: BS03
related business scenes: BS04
citation: Provisions on the Administration of Algorithmic Recommendation for Internet Information Services
citation: Legal regulation research on algorithmic discrimination in the big-data era
updated: 2026-06-16
version: 1

Filter Bubble
type: Term
break id: T0445
stix type: x-break-term
definition: Filter bubble refers to the phenomenon where overly personalized recommendation algorithms narrow users' information access, trapping them in homogeneous information environments.
description: The filter bubble concept originates from scholar Cass Sunstein's research on how algorithmic recommendation systems filter and push content based on users' historical behaviors, causing users to be exposed to similar information over extended periods while rarely encountering different viewpoints and diverse content. To improve user retention metrics and click-through rates, algorithms continuously recommend content aligned with user preferences, forming a positive feedback loop that leads to progressively narrowed user perspectives and deepened cognitive biases. This phenomenon can trigger several serious consequences for individuals and society. At the individual level, filter bubbles lead to group polarization where people become more extreme in their views due to lack of exposure to moderate or opposing perspectives, reduced information diversity that limits knowledge and understanding of complex issues, and impaired independent thinking abilities as users become accustomed to content that simply confirms their existing beliefs. The Algorithmic Recommendation Regulations for Internet Information Services specifically address this issue by requiring platforms to provide options not targeting personal characteristics, thereby safeguarding users' algorithmic transparency and choice rights. Breaking out of filter bubbles requires conscious effort from both platforms implementing diversification mechanisms and users actively seeking varied information sources.
aliases: Echo Chamber
aliases: Information Cocoon
category: Business Security
keywords: Filter Bubble
keywords: Echo Chamber
keywords: Information Cocoon
usage example: This user lacked awareness of external changes due to long-term exposure to a filter bubble
related risks: Algorithm Compliance Risk
related avoidances: Algorithm Audit Mechanism
related avoidances: Internal Review Mechanism
related business scenes: BS01
citation: Information cocoons: the Internet as a threat to the public sphere
citation: Tencent Research Institute report: breaking algorithmic cocoons, from information cocoons to information hives
updated: 2026-06-16
version: 1

Differential Pricing
type: Term
break id: T0446
stix type: x-break-term
definition: Differential pricing is a fraudulent practice where platforms use big data analysis to implement price discrimination against loyal customers, charging higher prices to existing customers for the same products or services.
description: Differential pricing is an improper practice where platforms leverage user profiles and consumption habit data to implement differentiated pricing strategies for different users. Platforms conduct sophisticated analysis of users' order history to understand purchase patterns, payment capacity to gauge willingness to pay premium prices, brand loyalty to identify customers unlikely to switch competitors, and other behavioral signals to assess overall price sensitivity. Based on these insights, they display higher prices to price-insensitive users or those with high platform stickiness who are less likely to comparison shop, while simultaneously showing discounted prices to new users to attract them or to price-sensitive customers who actively seek deals. This behavior fundamentally violates the principle of good faith that should govern commercial transactions, directly infringes upon consumers' fair transaction rights guaranteed by law, and systematically undermines market trust mechanisms that are essential for healthy commerce. The E-Commerce Law and Consumer Rights Protection Law explicitly prohibit such price fraud practices, recognizing them as deceptive and harmful to consumer welfare. Regulatory authorities have increasingly penalized multiple high-profile cases of differential pricing as awareness of this exploitative practice has grown among consumers and policymakers.
aliases: Big Data Price Gouging
category: Business Security
keywords: Differential Pricing
keywords: Price Discrimination
keywords: Big Data Price Gouging
usage example: This user discovered that the same product displayed a price 30% higher on their account compared to new users
related risks: Malicious Benefit Abuse
related risks: Big Data Price Discrimination Risk
related avoidances: Compliance Governance
related avoidances: Internal Review Mechanism
related avoidances: Contractual Clause Restrictions
related business scenes: BS02
related business scenes: BS03
related business scenes: BS04
citation: Expert interpretation: building support systems for algorithm governance implementation
citation: Notice on strengthening the protection of minors in the online culture market
updated: 2026-06-16
version: 1

Seed Phrase
type: Term
break id: T0448
stix type: x-break-term
definition: A sequence of words used to recover and backup cryptocurrency wallets, typically consisting of 12, 18, or 24 words, serving as a human-readable form of private keys.
description: A seed phrase is a word sequence generated based on the BIP39 standard, allowing users to recover wallets by memorizing or physically backing up these words. Essentially an encoded form of private keys, anyone who obtains the seed phrase gains complete control over the corresponding cryptocurrency assets. Common seed phrase lengths are 12 or 24 words, selected from a predefined list of 2048 words. The security of a seed phrase directly relates to asset security; once leaked, it leads to asset theft. Users should store seed phrases offline in secure locations, avoiding screenshots, cloud storage, or network transmission. In blockchain security incidents, seed phrase leaks are a primary cause of user asset losses, with threat actors stealing them through phishing, malware, and social engineering.
aliases: Recovery Phrase
aliases: Mnemonic Phrase
category: Business Security
keywords: seed phrase
keywords: mnemonic phrase
keywords: mnemonic
keywords: recovery phrase
keywords: 12-word phrase
keywords: 24-word phrase
keywords: wallet recovery
keywords: private key backup
keywords: BIP39
usage example: When creating a new wallet, users receive a 12-word seed phrase that must be written down in order and securely stored to recover the wallet in case of device loss or damage.
related risks: Private Key Leakage and Management Risks
related risks: EIP and Protocol Phishing Attack
related risks: Telegram Bot Phishing
related avoidances: Encrypted Storage and Password Protection of Private Keys
related avoidances: Source Code and Configuration File Secret Scanning
related attack tools: Phishing Kits
related attack tools: Infostealers
related attack tools: Wallet Phishing and Drainer Tools
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Wallet Drainer Groups
related business scenes: BS00
related business scenes: BS15
citation: BIP39: Mnemonic code for generating deterministic keys
citation: Crypto Everest project: cracking a 7,002-BTC wallet worth USD 235 million...
updated: 2026-06-16
version: 1

Cold Wallet
type: Term
break id: T0449
stix type: x-break-term
definition: A hardware device or physical medium that stores cryptocurrency private keys offline, providing the highest level of asset security protection through internet isolation.
description: A cold wallet is a form of wallet that keeps private keys completely offline, primarily including hardware wallets and paper wallets. Hardware wallets like Ledger and Trezor store private keys in secure chips, and even when connected to computers for transaction signing, private keys remain unexposed to the network. The core advantage of cold wallets is isolating the attack surface from networks, preventing hackers from stealing private keys remotely. Suitable for users holding large amounts of cryptocurrency long-term. When using cold wallets, users generate and store private keys in offline environments, physically connecting devices for signing during transactions before broadcasting to the blockchain network. Compared to hot wallets, cold wallets sacrifice convenience for higher security, making them the preferred storage solution for institutions and high-net-worth users.
aliases: Cold Storage
aliases: Offline Wallet
category: Business Security
keywords: cold wallet
keywords: cold storage
keywords: hardware wallet
keywords: offline wallet
keywords: Ledger
keywords: Trezor
keywords: air-gapped wallet
usage example: Exchanges store over 95% of user assets in cold wallets, keeping only small amounts in hot wallets for daily withdrawal needs.
related risks: Private Key Leakage and Management Risks
related risks: Blockchain Supply Chain Attack
related avoidances: Hardware Security Module (HSM) Private Key Storage
related avoidances: Encrypted Storage and Password Protection of Private Keys
related attack tools: Wallet Phishing and Drainer Tools
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Wallet Drainer Groups
related business scenes: BS00
related business scenes: BS15
citation: Hardware Wallet Setup Best Practices : r/Bitcoin - Reddit
citation: Cold wallets and hot wallets: security options for cryptocurrency storage
updated: 2026-06-16
version: 1

Hot Wallet
type: Term
break id: T0450
stix type: x-break-term
definition: An online cryptocurrency wallet that remains connected to the internet, with private keys stored on networked devices, enabling quick transaction operations.
description: A hot wallet stores private keys on internet-connected devices such as smartphones, computers, or cloud services, including mobile app wallets, browser extension wallets, and exchange custodial wallets. The advantage of hot wallets lies in their convenience, allowing users to initiate transfers and trades anytime, suitable for daily small payments and frequent trading scenarios. However, since private keys are continuously exposed to network environments, hot wallets face higher security risks, vulnerable to phishing attacks, malware, and network hijacking. Threat actors commonly steal hot wallet private keys or seed phrases through fake wallet apps, phishing websites, and clipboard hijacking. To reduce risks, users should only store small amounts for daily use in hot wallets, transferring large assets to cold wallets. Additionally, users should choose reputable wallet service providers, enable multi-factor authentication, and regularly update software versions.
aliases: Online Wallet
aliases: Software Wallet
category: Business Security
keywords: hot wallet
keywords: online wallet
keywords: software wallet
keywords: mobile wallet
keywords: web wallet
keywords: MetaMask
keywords: Trust Wallet
keywords: browser extension wallet
usage example: Users utilize the MetaMask browser extension wallet to interact with DeFi protocols, conveniently connecting to decentralized applications for staking, swapping, and other operations.
related risks: Private Key Leakage and Management Risks
related risks: EIP and Protocol Phishing Attack
related risks: DApp Frontend Hijacking
related avoidances: Encrypted Storage and Password Protection of Private Keys
related avoidances: EIP Security Verification Mechanism
related avoidances: DApp Frontend Integrity Verification
related attack tools: Phishing Kits
related attack tools: Infostealers
related attack tools: Wallet Phishing and Drainer Tools
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Wallet Drainer Groups
related business scenes: BS00
related business scenes: BS15
citation: Hot Wallet Security Usage Guide
citation: Crypto exchange BitMart compensates users for stolen funds
updated: 2026-06-16
version: 1

Multi-Signature Wallet
type: Term
break id: T0451
stix type: x-break-term
definition: A cryptocurrency wallet requiring multiple private keys to jointly sign before completing transactions, enhancing fund security through distributed control.
description: Multi-signature wallets employ an M-of-N signature mechanism, setting N authorized signers where at least M must agree to execute transactions. For example, a 2-of-3 multisig wallet requires at least 2 of 3 private key holders to sign for confirmation. This mechanism effectively prevents single points of failure and internal malfeasance, widely applied in corporate fund management, DAO governance, and exchange hot wallet protection. Multi-signature wallets are implemented through smart contracts or Bitcoin scripts, distributing fund control among multiple independent parties; even if one party's private key is lost or stolen, funds remain secure. In enterprise applications, CFO, CEO, and audit roles can jointly manage funds, requiring multi-party approval for any large transfers. The multisig mechanism also resists internal malfeasance, as single private key holders cannot independently transfer funds. Common multisig wallet solutions include Gnosis Safe and BitGo, which have become standard configurations for institutional-grade crypto asset management.
aliases: Multisig Wallet
aliases: Joint Signature Wallet
category: Business Security
keywords: multisig
keywords: multi-signature
keywords: multi-sig wallet
keywords: M-of-N signature
keywords: joint signature
keywords: Gnosis Safe
keywords: threshold signature
usage example: A DAO organization uses a 3-of-5 multisig wallet to manage community funds, requiring at least 3 of 5 core members to sign and approve any proposal expenditure before execution.
related risks: Private Key Leakage and Management Risks
related risks: Multi-Signature Wallet Social Engineering
related risks: Account Abstraction Wallet Risk
related avoidances: Hardware Security Module (HSM) Private Key Storage
related avoidances: Multi-Sig Timelock Mechanism
related avoidances: Account Abstraction Security Audit
related attack tools: Wallet Phishing and Drainer Tools
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Wallet Drainer Groups
related business scenes: BS00
related business scenes: BS15
citation: Gnosis Safe: The most trusted platform to manage digital assets
citation: The security crisis of cryptocurrency exchanges: technology, management, and collaboration
updated: 2026-06-16
version: 1

Smart Contract
type: Term
break id: T0452
stix type: x-break-term
definition: Self-executing program code deployed on blockchains that automatically triggers and executes transactions or operations based on preset conditions.
description: Smart contracts are automated programs running on blockchain networks, with their code and execution results being completely transparent and immutable. Once deployed, contracts execute automatically according to written logic without human intervention. Widely applied in DeFi, NFT, DAO, and other decentralized application scenarios, though code vulnerabilities may lead to asset losses. Smart contracts eliminate intermediaries in traditional agreements, enabling trustless automated execution. Written in languages like Solidity and Vyper, they are deployed on platforms such as Ethereum and BNB Chain. Every contract interaction is recorded on-chain, ensuring traceability and transparency. However, smart contract security is crucial; vulnerabilities like reentrancy attacks, integer overflows, and logic errors have caused billions in losses. Major protocols undergo professional security audits and formal verification before launch. Smart contracts form the foundation of the Web3 ecosystem, enabling innovations like decentralized exchanges, lending protocols, and automated market makers.
category: Business Security
keywords: smart contract
keywords: Solidity
keywords: on-chain contract
keywords: DApp
keywords: decentralized application
keywords: blockchain contract
keywords: self-executing contract
usage example: A DeFi lending protocol uses smart contracts to automatically execute collateral deposits, loan distributions, interest calculations, and liquidations without requiring centralized platform operators.
related risks: Smart Contract Vulnerabilities
related risks: Timestamp Dependence Attack
related risks: Immutable Contract Design Flaws
related avoidances: Smart Contract Security Audit
related avoidances: Smart Contract Static Analysis Tools
related avoidances: Formal Verification of Smart Contracts
related avoidances: Comprehensive Auditing and Formal Verification
related avoidances: Code Audit and Bug Bounty
related attack tools: System/Application Vulnerability Exploitation Tools
related attack tools: Smart Contract Exploitation Framework
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Tutorial: creating a custom NFT smart contract in three minutes
citation: Opening a new era: 2021 report on privacy computing applications in finance
citation: Overview of smart contracts: challenges, progress, and platforms
updated: 2026-06-16
version: 1

Flash Loan
type: Term
break id: T0453
stix type: x-break-term
definition: An instant blockchain borrowing mechanism without collateral requirements, demanding funds be borrowed and returned within the same transaction block, otherwise the transaction automatically reverts.
description: Flash loans are a specialized lending method provided by DeFi protocols, allowing users to borrow large amounts without collateral, but requiring completion of the entire borrow-use-repay process within a single transaction. This mechanism is widely used for legitimate purposes like arbitrage and liquidations, but is also frequently exploited by attackers for price manipulation, reentrancy attacks, and other malicious activities. The atomic nature of blockchain transactions ensures that if repayment conditions aren't met, the entire transaction reverts, protecting lenders. Flash loans enable capital-efficient strategies previously impossible in traditional finance, such as instant arbitrage across multiple exchanges or collateral swaps. However, attackers leverage flash loans to manipulate oracle prices, drain liquidity pools, or exploit smart contract vulnerabilities. Notable attacks have resulted in tens of millions in losses. DeFi protocols implement defenses including price oracle decentralization, transaction slippage limits, and time-weighted average prices to mitigate flash loan attack risks.
category: Business Security
keywords: flash loan
keywords: flash loan attack
keywords: uncollateralized loan
keywords: atomic transaction
keywords: DeFi exploit
keywords: Aave flash loan
usage example: An attacker borrows 100 million dollars via flash loan, manipulates a DEX price oracle through massive swaps, exploits the distorted price to drain a lending protocol, repays the loan, and profits from the difference—all within a single transaction.
related risks: Flash Loan Attacks
related risks: Smart Contract Vulnerabilities
related risks: Oracle Manipulation
related risks: Gas Fee Manipulation and Frontrunning
related avoidances: Smart Contract Static Analysis Tools
related avoidances: Flash Loan Limit Control
related avoidances: Reentrancy Attack Protection
related avoidances: Multi-Source Oracle Aggregation and Anomaly Detection
related avoidances: Time-Weighted Average Price (TWAP) Mechanism
related avoidances: Automated Detection and Circuit Breaker for Oracle Manipulation
related attack tools: DeFi Attack Scripts
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: What are flash loans and why do they repeatedly contribute to DeFi incidents?
citation: A guide to understanding flash loans
updated: 2026-06-16
version: 1

DeFi
type: Term
break id: T0454
stix type: x-break-term
definition: A blockchain-based decentralized financial service system implementing lending, trading, wealth management, and other financial functions through smart contracts.
description: DeFi eliminates intermediaries in traditional finance, enabling users to directly engage in asset trading, collateralized lending, and liquidity mining through smart contracts. All transaction records are publicly transparent and immutable, operating without centralized authorities. DeFi protocols offer services including decentralized exchanges (DEXs), lending platforms, stablecoins, derivatives, and insurance. Users maintain custody of their assets, accessing financial services permissionlessly through wallet connections. The Total Value Locked (TVL) in DeFi has reached hundreds of billions, demonstrating significant adoption. However, DeFi faces security risks including smart contract vulnerabilities, flash loan attacks, price manipulation, rug pulls, and oracle failures. The composability of DeFi protocols enables innovation but also creates systemic risks where vulnerabilities in one protocol can cascade across interconnected systems. Regulatory uncertainty and user experience challenges remain barriers to mainstream adoption.
aliases: Decentralized Finance
category: Business Security
keywords: DeFi
keywords: decentralized finance
keywords: on-chain finance
keywords: permissionless finance
keywords: yield farming
keywords: liquidity mining
usage example: A user deposits USDC into an Aave lending pool to earn interest, then uses the deposited assets as collateral to borrow ETH for leveraged trading—all executed through smart contracts without bank intermediaries.
related risks: Smart Contract Vulnerabilities
related risks: Flash Loan Attacks
related risks: Rug Pull (Exit Scam)
related risks: Oracle Manipulation
related risks: MEV Attacks (Miner Extractable Value)
related risks: Gas Fee Manipulation and Frontrunning
related avoidances: Smart Contract Security Audit
related avoidances: Oracle Price Verification Mechanism
related avoidances: Flash Loan Limit Control
related avoidances: Multi-Source Oracle Aggregation and Anomaly Detection
related avoidances: Time-Weighted Average Price (TWAP) Mechanism
related avoidances: Private Mempool and MEV Protection Services
related avoidances: Transaction Slippage Protection and Limit Orders
related attack tools: Cryptocurrency Mixers
related attack tools: DeFi Attack Scripts
related threat actors: Underground Money Houses
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Exploring design space and challenges for DeFi protocol oracle implementations
citation: Tutorial: creating a custom NFT smart contract in three minutes
updated: 2026-06-16
version: 1

NFT
type: Term
break id: T0455
stix type: x-break-term
definition: Blockchain-based non-fungible tokens where each token has a unique identifier and ownership record, used to represent digital or physical assets.
description: NFTs provide proof of uniqueness and ownership for digital assets through blockchain technology, widely applied in digital art, gaming items, virtual real estate, and more. Each NFT has unique metadata and a Token ID, making them non-interchangeable and indivisible, though they face risks including counterfeiting, theft, and copyright disputes. NFTs revolutionized digital ownership by enabling verifiable scarcity and provenance tracking. Implemented through standards like ERC-721 and ERC-1155 on Ethereum and other chains, NFTs have created new markets for creators and collectors. Major use cases include profile picture projects, generative art, metaverse assets, event tickets, and tokenized real-world assets. The NFT market experienced explosive growth with multi-million dollar sales, though also faces challenges including market volatility, wash trading, intellectual property infringement, and environmental concerns regarding energy consumption. Smart contract vulnerabilities and phishing attacks targeting NFT holders remain ongoing security concerns.
aliases: Non-Fungible Token
category: Business Security
keywords: NFT
keywords: non-fungible token
keywords: digital collectible
keywords: ERC-721
keywords: ERC-1155
keywords: digital art
keywords: tokenized asset
usage example: A digital artist mints their artwork as an NFT on Ethereum, selling it through OpenSea marketplace where blockchain records permanently verify authenticity and ownership, with royalties automatically paid to the creator on secondary sales.
related risks: NFT Fraud Risk
related risks: Virtual World Asset Theft
related risks: NFT Royalty Bypass
related avoidances: On-Chain Asset Ownership Verification and Traceability in the Metaverse
related avoidances: Virtual Land Trading Platform Review Mechanism
related avoidances: Virtual Asset Valuation and Information Disclosure
related avoidances: On-Chain Royalty Enforcement
related attack tools: Metaverse and XR Attack Tools
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Metaverse and XR Fraud Groups
related business scenes: BS00
related business scenes: BS15
related business scenes: BS17
citation: Blockchain legal research: NFT concepts, transaction models, and legal risks
citation: Technology giants enter NFT markets: is everything becoming NFT-enabled?
updated: 2026-06-16
version: 1

Data Broker
type: Term
break id: T0456
stix type: x-break-term
definition: Underground vendors who specialize in trading stolen personal information, credentials, and user databases acquired through hacking, data breaches, or insider threats.
description: Data brokers operate in the cybercrime underground economy, acting as middlemen between data thieves and fraudsters. They aggregate vast quantities of personally identifiable information (PII) including phone numbers, ID cards, bank accounts, and login credentials obtained from data breaches, phishing campaigns, or corrupt insiders. These vendors categorize data by freshness, completeness, and industry sector, selling them through private channels, dark web marketplaces, or encrypted messaging groups. Pricing varies based on data quality and verification status. Data brokers enable downstream fraud operations including account takeovers, identity theft, precision phishing, and credential stuffing attacks. Their services are foundational to the fraud ecosystem, providing the raw material that powers various illicit schemes.
aliases: Liaoshang
aliases: Data Vendor
category: Business Security
keywords: Data Broker
keywords: data dealer
keywords: PII seller
keywords: underground data trade
keywords: credential merchant
keywords: leaked data vendor
usage example: Fraudsters purchased 100,000 verified phone numbers from a data broker to conduct SMS phishing campaigns targeting online banking users.
related risks: Points Theft
related risks: Points Redemption Reselling
related risks: Device Malware Infection
related threat actors: Scalpers
citation: Locked-price 40x leverage and off-exchange futures bets: a gold-materials trader disappears...
citation: Cosmetics industry report: domestic ingredients support the upgrade of local beauty brands
citation: How fashion designers organize proprietary fabric libraries: ten years of experience
updated: 2026-06-16
version: 1

SMS Reception Platform
type: Term
break id: T0458
stix type: x-break-term
definition: Online services that provide temporary virtual phone numbers for receiving SMS verification codes, enabling fraudsters to bypass phone-based authentication and register mass accounts anonymously.
description: SMS reception platforms operate as commercial services offering temporary or disposable phone numbers that can receive SMS messages online without requiring physical SIM cards. These platforms maintain pools of real phone numbers from various countries and carriers, accessible through web interfaces or APIs. Users pay per message or through subscription models to receive verification codes for account registration, enabling mass account creation while circumventing anti-fraud phone verification systems. Advanced platforms offer dedicated numbers, number selection by region, and immediate message delivery. These services are heavily utilized in account farming operations, bonus abuse schemes, and review manipulation campaigns where operators need hundreds or thousands of verified accounts. While some legitimate uses exist for privacy protection, the overwhelming adoption by fraud actors has made these platforms a critical infrastructure for automated abuse.
aliases: Jiema Platform
aliases: Code Receiving Platform
category: Business Security
keywords: SMS Reception Platform
keywords: online SMS receiver
keywords: virtual phone service
keywords: OTP reception service
keywords: temporary number provider
keywords: verification bypass tool
usage example: A scalper group used an SMS reception platform to register 5,000 e-commerce accounts within hours to exploit a limited-time promotional offer.
related risks: Fake Registration
related risks: Account Takeover
related attack tools: Black SIM Cards
related attack tools: SMS Verification Code Platform
citation: Interpretation of provisions on clear pricing and prohibiting price fraud
citation: Uncovering cybercrime: SMS verification-code receiving platforms
updated: 2026-06-16
version: 1

Four-piece Set
type: Term
break id: T0460
stix type: x-break-term
definition: A complete identity fraud package containing four essential items: ID card, bank card, phone SIM card, and mobile device, used to create untraceable accounts for money laundering or fraud.
description: The four-piece set represents a complete criminal identity toolkit enabling fraudsters to register fully verified accounts that pass KYC checks while remaining untraceable to the actual operator. This package typically includes a real or forged ID card with matching name and photo, a bank card or account registered under that identity, a phone SIM card with a matching registered number, and often a mobile device or device fingerprint tied to that identity. These sets are assembled through identity theft, purchase from willing sellers in vulnerable populations, or document forgery operations. They enable money mule operations where fraudsters need authentic-looking accounts to receive stolen funds, launder money through multiple transfers, or conduct high-value fraud without personal exposure. The term reflects the minimum viable identity infrastructure needed to operate in regulated financial systems. Law enforcement agencies actively track four-piece set distribution networks as they represent a critical enabler for organized financial crime.
aliases: Sijiantao
aliases: Identity Kit
category: Business Security
keywords: Four-piece Set
keywords: identity package
keywords: full ID kit
keywords: KYC bypass bundle
keywords: complete identity set
keywords: bank account package
usage example: A money laundering operation purchased 20 four-piece sets to establish transfer accounts that received funds from telecom fraud victims before dispersing them internationally.
related risks: Fake Registration
related risks: Virtual Number Registration
related risks: Generative AI Risk
related attack tools: Identity Document Set (4-Piece)
citation: What does a four-piece set include? Home decoration guide
updated: 2026-06-16
version: 1

CAPTCHA Solving Service
type: Term
break id: T0461
stix type: x-break-term
definition: Commercial services that provide automated or human-powered solutions to bypass CAPTCHA challenges, enabling bots and scrapers to circumvent anti-automation protections on websites and applications.
description: CAPTCHA solving services operate as intermediary platforms connecting clients who need CAPTCHAs solved with either AI-powered OCR systems or crowdsourced human workers in low-wage regions. These services offer APIs that seamlessly integrate into automation scripts, accepting CAPTCHA images and returning solved text within seconds. Advanced platforms support multiple CAPTCHA types including text recognition, reCAPTCHA v2/v3, hCaptcha, image classification challenges, and slider puzzles. Pricing is typically per-solve with volume discounts, ranging from $0.50 to $3 per 1,000 solves. While marketed as tools for testing and accessibility, these services are predominantly used by scalpers, account farmers, credential stuffers, and web scrapers to defeat security controls. The existence of these services creates an asymmetry where defense mechanisms are systematically bypassed through economic outsourcing.
aliases: Dama Platform
aliases: CAPTCHA Farm
category: Business Security
keywords: CAPTCHA Solving Service
keywords: CAPTCHA bypass
keywords: human verification farm
keywords: OCR solving service
keywords: anti-bot circumvention
keywords: verification code breaking
usage example: A ticket scalping operation integrated a CAPTCHA solving API to automatically purchase concert tickets within seconds of release, bypassing anti-bot protections.
related risks: Process Automation
related risks: Account Takeover
related attack tools: CAPTCHA Solving Platform
related attack tools: Image CAPTCHA Recognition Tools
citation: Xishanju redefines anime-style visuals with full-screen mosaic effects
citation: This adult-video company redefined the category
citation: Detailed Python crawler tutorial using Scrapy and Selenium
updated: 2026-06-16
version: 1

Money Laundering
type: Term
break id: T0464
stix type: x-break-term
definition: The criminal process of disguising the origins of illegally obtained money by passing it through complex transfers and transactions to make it appear legitimate and difficult to trace.
description: Money laundering is a systematic process typically divided into three stages: placement (introducing illegal funds into the financial system), layering (executing complex transactions to obscure the money trail), and integration (returning laundered funds to criminals in seemingly legitimate form). Modern laundering operations utilize diverse channels including shell companies, cryptocurrency mixing services, trade-based laundering, real estate purchases, online gambling platforms, and cross-border transfers through jurisdictions with weak oversight. Digital currencies and decentralized finance platforms have introduced new laundering vectors that exploit regulatory gaps and pseudonymity. Criminals employ money mules, nested service providers, and professional laundering networks to maximize distance between illicit sources and final destinations. Financial institutions implement Anti-Money Laundering (AML) programs using transaction monitoring, Know Your Customer (KYC) procedures, and suspicious activity reporting to detect and prevent laundering operations.
aliases: Xiqian
aliases: Proceeds Laundering
category: Business Security
keywords: Money Laundering
keywords: proceeds concealment
keywords: illegal fund integration
keywords: dirty money cleaning
keywords: financial crime concealment
keywords: illicit fund legitimization
usage example: An organized crime group laundered $50 million in drug proceeds by purchasing cryptocurrency, transferring through multiple mixers, converting to stablecoins, and investing in overseas real estate through shell companies.
related risks: Money Laundering Risk
related risks: Payment Channel Abuse
related risks: Cryptocurrency Money Laundering Risk
related attack tools: Score-Running Platforms
related attack tools: Cryptocurrency Mixers
related threat actors: Money Laundering Gangs
related threat actors: Underground Money Houses
related threat actors: Score Runner
related threat actors: Cryptocurrency Fraud Syndicate
related business scenes: BS00
related business scenes: BS01
related business scenes: BS15
citation: What is money laundering?
citation: What is the crime of money laundering?
updated: 2026-06-16
version: 1

Telecom Fraud
type: Term
break id: T0465
stix type: x-break-term
definition: Criminal schemes that use telephone, SMS, or internet communication to deceive victims into transferring money or revealing sensitive information by impersonating authorities, institutions, or trusted contacts.
description: Telecom fraud encompasses a wide range of scam methodologies that exploit communication technologies to reach and manipulate victims at scale. Common schemes include impersonating law enforcement or government officials claiming legal issues, posing as banks reporting security problems, pretending to be kidnapped relatives demanding ransom, offering fake investment opportunities, and conducting tech support scams. Sophisticated operations use caller ID spoofing to display legitimate-looking numbers, employ psychological manipulation tactics to create urgency and fear, and utilize prepared scripts optimized through A/B testing. Modern telecom fraud operations are highly organized, often operating from overseas compounds with segmented teams handling lead generation, social engineering, money mule coordination, and technical infrastructure. They leverage data broker information for precision targeting, use VoIP systems to obscure locations, and employ money laundering networks to extract proceeds. Governments combat these operations through international cooperation, real-time call blocking systems, and public awareness campaigns.
aliases: Dianxin Zhapian
aliases: Phone Scam
category: Business Security
keywords: Telecom Fraud
keywords: phone scam
keywords: voice phishing
keywords: impersonation scam
keywords: SMS fraud
keywords: caller ID spoofing
usage example: A victim transferred $200,000 to fraudsters after receiving a spoofed call from someone claiming to be a prosecutor investigating the victim for money laundering, demanding immediate fund transfer to a 'safe account' for verification.
related risks: Fake Registration
related risks: Device Malware Infection
related threat actors: Telecom Fraud Gangs
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Scam Compound Operator
citation: Opinions on applying law in telecom and online fraud criminal cases
citation: Ministry of Public Security publishes the top ten high-frequency telecom fraud types
updated: 2026-06-16
version: 1

Online Gambling
type: Term
break id: T0466
stix type: x-break-term
definition: Illegal or unlicensed online gaming operations that offer betting, casino games, or lottery services, often rigged against players and serving as vehicles for money laundering and fraud.
description: Illegal online gambling operations typically operate from jurisdictions with lax enforcement while targeting users in countries where gambling is restricted or heavily regulated. These platforms offer sports betting, casino games, lottery, and increasingly cryptocurrency-based gambling without proper licensing, player protection, or fair gaming oversight. Many operations employ rigged algorithms that guarantee house advantages beyond statistical norms, manipulate odds dynamically based on player profiles, or simply refuse large withdrawals. These platforms serve multiple criminal purposes: extracting money from addicted players, laundering proceeds from other crimes through fabricated gambling transactions, and collecting user financial information for subsequent fraud. Promotion relies on affiliate networks, social media advertising, and influencer partnerships that often violate platform policies. Players face not only unfair games but also risks of identity theft, credit card fraud, and inability to recover winnings. Regulators combat these operations through domain blocking, payment processor restrictions, and international enforcement cooperation.
aliases: Bocai
aliases: Illegal Online Betting
category: Business Security
keywords: Online Gambling
keywords: illegal betting
keywords: offshore casino
keywords: unlicensed gaming
keywords: rigged gambling platform
keywords: underground lottery
usage example: An illegal gambling platform operating from offshore servers defrauded users of $30 million before authorities blocked access, with many players unable to withdraw their winnings due to fabricated verification requirements.
related risks: Upload Abuse
related risks: Domain / Brand Impersonation
citation: Private lotteries are gambling, not lottery tickets or legitimate business
citation: Memories of the gambling industry in Kaifeng during the Song dynasty
updated: 2026-06-16
version: 1

Private Server
type: Term
break id: T0467
stix type: x-break-term
definition: Unauthorized game servers that reverse-engineer and host commercial online games without permission, often with modified game mechanics, accelerated progression, or monetization schemes that compete with official servers.
description: Private servers are unauthorized implementations of online games that operate independently from official publishers by reverse-engineering server protocols, emulating game logic, and hosting modified versions of games. These operations typically emerge for popular MMORPGs, mobile games, or service-based titles. Private server operators often modify game parameters to attract players: dramatically increased experience rates, free distribution of premium currency, custom content, or pay-to-win mechanics that generate revenue through alternative monetization. While some serve preservation purposes for discontinued games or cater to players seeking different gameplay experiences, most constitute copyright infringement and trademark violations that harm developers' business models. Private servers pose security risks as they may collect user credentials potentially reused on official servers, inject malware, or harvest payment information. Publishers combat private servers through legal action, technical protection measures, and community engagement, though enforcement is challenging when operators host in jurisdictions with weak IP protection.
aliases: Sifu
category: Business Security
keywords: Private Server
keywords: unauthorized game server
keywords: pirate server
keywords: unofficial game server
keywords: emulated MMO server
keywords: copyright-infringing server
usage example: A private server for a popular MMORPG attracted 50,000 players by offering 10x experience rates and free premium items, generating revenue through pay-to-win enhancements before being shut down through legal action.
related risks: Intentional Feeding
citation: Private World of Warcraft servers: simplifying production and redefining craft value
citation: Yu Shuxin redefines the top standard for female celebrities
updated: 2026-06-16
version: 1

Social Engineering
type: Term
break id: T0468
stix type: x-break-term
definition: The practice of manipulating individuals through psychological tactics to divulge confidential information, grant unauthorized access, or perform actions that compromise security, bypassing technical controls by exploiting human psychology.
description: Social engineering represents a class of attack vectors that target human decision-making rather than technical vulnerabilities. Attackers exploit psychological principles including authority bias, urgency, fear, curiosity, reciprocity, and trust to manipulate targets into compromising security. Common techniques include phishing emails impersonating trusted entities, pretexting scenarios that establish false contexts for information requests, baiting schemes that promise rewards for risky actions, tailgating to gain physical access, and impersonation of IT support or executives to extract credentials. Advanced operations conduct reconnaissance through social media and public records to craft convincing pretexts, use multiple communication channels to reinforce legitimacy, and establish long-term rapport before making requests. Social engineering attacks succeed because they exploit universal human cognitive biases that persist regardless of technical security measures. Defense requires security awareness training, verification procedures for sensitive requests, incident reporting channels, and organizational cultures that encourage questioning suspicious interactions without fear of repercussions.
aliases: Shehui Gongcheng
category: Business Security
keywords: Social Engineering
keywords: psychological manipulation
keywords: human hacking
keywords: pretexting
keywords: trust exploitation
keywords: manipulation attack
usage example: An attacker called an employee impersonating IT support, created urgency by claiming a security incident required immediate password reset, and successfully obtained credentials that provided access to corporate systems.
related risks: Insufficient Employee Security Awareness
related risks: Social Engineering Risk
related risks: Phishing Attack
related risks: Real-World Identity Theft
related risks: AI Deepfake Risk
related risks: ClickFix Deception Risk
related risks: Multi-Signature Wallet Social Engineering
related avoidances: Security Awareness Training
related avoidances: Multi-Factor Authentication
related avoidances: Threat Intelligence
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: Fake Call Spoofing Tool
related threat actors: Telecom Fraud Gangs
related threat actors: Malicious Hackers
related threat actors: AI Fraud Gangs
related threat actors: Scam Compound Technician
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
related business scenes: BS15
citation: Translation: social engineering explained - how criminals exploit human behavior
citation: Dugin: Liberalism 2.0
citation: What is an IP address and what is it used for?
updated: 2026-06-16
version: 1

Traffic Hijacking
type: Term
break id: T0469
stix type: x-break-term
definition: The unauthorized interception and redirection of network traffic between users and legitimate destinations, enabling attackers to steal data, inject malicious content, or redirect users to fraudulent sites.
description: Traffic hijacking encompasses multiple attack vectors that intercept communications between clients and servers. Network-level hijacking exploits vulnerabilities in routing protocols like BGP to redirect traffic at the ISP or backbone level, while local attacks compromise routers, DNS servers, or wireless networks to intercept traffic within specific networks. Proxy-based hijacking installs malicious software that forces all network traffic through attacker-controlled servers. HTTP hijacking injects advertisements, malware, or phishing content into unencrypted web traffic, commonly executed by compromised ISPs or public Wi-Fi operators. Session hijacking steals authentication cookies or tokens to impersonate legitimate users. These attacks enable credential theft, financial fraud, malware distribution, surveillance, and censorship. HTTPS encryption protects against many hijacking vectors but remains vulnerable to certificate authority compromise, downgrade attacks, or user acceptance of invalid certificates. Defense measures include HTTPS enforcement, DNSSEC implementation, VPN usage, certificate pinning, and network monitoring for anomalous routing.
category: Business Security
keywords: Traffic Hijacking
keywords: network interception
keywords: man-in-the-middle
keywords: session hijacking
keywords: BGP hijacking
keywords: HTTP redirection
usage example: Attackers hijacked BGP routes for a cryptocurrency exchange, redirecting traffic to a phishing clone for two hours and stealing login credentials from over 300 users attempting to access their accounts.
related risks: Application Reverse Engineering
related risks: Application Traffic Interception
related risks: Man-in-the-Middle Attack
citation: Sentencing for traffic hijacking, DNS hijacking, redirects, and pop-up ad crimes
citation: Former DeepSeek core member Luo Fuli joins Xiaomi; iPhone tops Singles Day phone sales...
citation: Model applications in advertising traffic anti-fraud risk control
updated: 2026-06-16
version: 1

DNS Hijacking
type: Term
break id: T0470
stix type: x-break-term
definition: An attack that manipulates DNS resolution processes to redirect users from legitimate domains to attacker-controlled IP addresses, enabling phishing, malware distribution, or surveillance without user awareness.
description: DNS hijacking operates by corrupting the domain name resolution mechanism that translates human-readable domains into IP addresses. Attackers employ various techniques: compromising routers or DNS servers to modify resolution tables, poisoning DNS caches with false records that persist and spread to other servers, exploiting vulnerabilities in DNS protocols to inject malicious responses, or conducting man-in-the-middle attacks that intercept and alter DNS queries. Router-level hijacking through compromised home or enterprise routers affects all devices on the network, while ISP-level hijacking can impact thousands of users simultaneously. Malware-based hijacking modifies local host files or DNS settings on individual devices. Once DNS is hijacked, users typing legitimate URLs are transparently redirected to attacker-controlled sites that may harvest credentials, distribute malware, or serve fraudulent content while appearing authentic. DNSSEC (Domain Name System Security Extensions) provides cryptographic verification of DNS responses, preventing many hijacking techniques. Defense strategies include DNSSEC adoption, monitoring DNS infrastructure for tampering, using trusted DNS resolvers, and browser security features that detect domain mismatches.
aliases: DNS Jiechi
category: Business Security
keywords: DNS Hijacking
keywords: DNS poisoning
keywords: DNS cache poisoning
keywords: DNS redirection
keywords: pharming
keywords: DNS spoofing
usage example: A DNS hijacking attack compromised residential routers, redirecting banking domain queries to phishing sites that collected login credentials from thousands of users who believed they were accessing legitimate bank websites.
related risks: Man-in-the-Middle Attack
related risks: Application Reverse Engineering
citation: DNS hijacking encyclopedia entry
citation: What is DNS hijacking? A detailed beginner-friendly cybersecurity guide
citation: Can HTTPS be affected by DNS hijacking and how can websites prevent it?
updated: 2026-06-16
version: 1

Man-in-the-Middle Attack
type: Term
break id: T0472
stix type: x-break-term
definition: A cyberattack where an adversary secretly intercepts and potentially alters communications between two parties who believe they are directly communicating, enabling data theft, credential capture, or message manipulation.
description: Man-in-the-middle (MITM) attacks position an attacker between a client and server, intercepting all traffic that passes between them. Common implementation methods include ARP spoofing on local networks to redirect traffic through the attacker's device, rogue Wi-Fi access points that impersonate legitimate networks, SSL stripping that downgrades HTTPS connections to unencrypted HTTP, and DNS hijacking that redirects connections to attacker-controlled proxies. Advanced attacks exploit vulnerabilities in TLS/SSL implementations, compromise certificate authorities to issue fraudulent certificates, or use social engineering to install proxy certificates on victim devices. MITM attacks enable real-time credential theft, session hijacking, injection of malicious content into legitimate communications, surveillance of sensitive data, and manipulation of transactions. Public Wi-Fi networks present high MITM risk due to lack of encryption between clients and access points. Defense strategies include mandatory HTTPS with certificate pinning, VPN usage on untrusted networks, certificate transparency monitoring, mutual authentication protocols, and network monitoring for suspicious proxy or routing behavior.
aliases: Zhongjianren Gongji
category: Business Security
keywords: Man-in-the-Middle Attack
keywords: MITM
keywords: session interception
keywords: eavesdropping attack
keywords: proxy attack
keywords: network interception
usage example: An attacker operated a rogue Wi-Fi hotspot named 'Airport_Free_WiFi' that performed MITM attacks on connected users, capturing passwords and credit card numbers from unencrypted connections and HTTP traffic.
related risks: Application Reverse Engineering
related risks: HTTP Request Analysis
related risks: Man-in-the-Middle Attack
citation: Cybersecurity: man-in-the-middle attacks
updated: 2026-06-16
version: 1

Deepfake
type: Term
break id: T0473
stix type: x-break-term
definition: AI-generated synthetic media that convincingly replaces or manipulates a person's appearance, voice, or actions in videos, images, or audio, enabling sophisticated impersonation and misinformation.
description: Deepfake technology leverages deep learning models, particularly generative adversarial networks (GANs) and diffusion models, to create highly realistic but fabricated media. Face-swapping deepfakes replace one person's face with another in video footage, voice cloning replicates speech patterns and timbre from small audio samples, and full-body synthesis generates entirely artificial personas. Initially requiring significant technical expertise, deepfake creation has become accessible through user-friendly applications and online services. Malicious applications include financial fraud through impersonating executives in video calls to authorize fraudulent transfers, creating non-consensual pornography, spreading political disinformation, manipulating evidence, and conducting sophisticated social engineering attacks. Detection techniques analyze inconsistencies in facial movements, lighting, audio-visual synchronization, and artifacts introduced by generation algorithms, but the arms race between creation and detection continues to escalate. Watermarking, blockchain provenance tracking, and multi-factor authentication for high-stakes communications serve as mitigation strategies.
aliases: Shendu Weizao
category: Business Security
keywords: Deepfake
keywords: synthetic media
keywords: AI-generated impersonation
keywords: face swap
keywords: voice cloning
keywords: neural network manipulation
usage example: Fraudsters used deepfake video technology to impersonate a company CEO in a video conference call, convincing a finance manager to transfer $35 million to an attacker-controlled account.
related risks: Phishing Attack
related risks: Shadow AI Risk
related attack tools: AI Deepfake Tools
related attack tools: AI Voice Cloning Tools
related attack tools: AI Deepfake Video
citation: Criminal-law regulation of deepfakes in the AI era
citation: Improving students' critical-thinking literacy amid generative AI and deepfake content
updated: 2026-06-16
version: 1

Web Scraper
type: Term
break id: T0474
stix type: x-break-term
definition: Automated software programs that systematically extract data from websites by parsing HTML, executing JavaScript, and navigating pages to collect content, prices, or user information at scale.
description: Web scrapers range from simple scripts parsing static HTML to sophisticated browser automation frameworks that execute JavaScript, solve CAPTCHAs, and mimic human behavior to evade detection. Legitimate use cases include search engine indexing, price comparison services, academic research, and business intelligence. However, malicious scrapers harvest personal data for spam lists, steal copyrighted content, enable competitive price undercutting, extract proprietary business data, and overwhelm servers with excessive requests. Advanced scrapers employ residential proxy networks to distribute requests across genuine IP addresses, implement randomized delays and request patterns to avoid rate limiting, use headless browsers for JavaScript-heavy sites, and integrate CAPTCHA solving services. Website operators defend through rate limiting, IP blocking, CAPTCHA challenges, honeypot traps, fingerprinting, and legal enforcement under terms of service or computer fraud statutes. The ethical and legal boundaries of scraping remain contested, particularly regarding publicly accessible but copyrighted content.
aliases: Pachong
category: Business Security
keywords: Web Scraper
keywords: data extraction bot
keywords: web crawler
keywords: content harvesting
keywords: automated data collection
keywords: spider bot
usage example: An e-commerce competitor deployed scrapers to extract real-time pricing data from thousands of product pages daily, enabling them to systematically undercut prices by minimal margins.
related risks: Web Scraping Risk
related attack tools: Click Simulation Tools
related attack tools: Web Scraping Tools
citation: Data compliance perspective on the compliance boundaries of crawler technology
citation: What is a Python crawler? A comprehensive introduction
citation: Reflections on a programmer's career path after reading Zhihu discussions
updated: 2026-06-16
version: 1

SQL Injection
type: Term
break id: T0475
stix type: x-break-term
definition: A code injection technique that exploits vulnerabilities in database queries by inserting malicious SQL statements through user inputs, enabling unauthorized data access, modification, or deletion.
description: SQL injection attacks occur when applications fail to properly sanitize user inputs that are incorporated into SQL queries, allowing attackers to manipulate query logic. Classic injection techniques insert SQL syntax through input fields, URL parameters, or HTTP headers that break out of intended query structure. Union-based injection uses UNION operators to retrieve data from additional tables, error-based injection triggers database errors that reveal structure information, blind injection infers data through boolean logic or timing delays, and stacked queries execute multiple commands in succession. Successful exploitation enables complete database compromise: extracting sensitive user data, credentials, and business information; modifying or deleting records; bypassing authentication; executing administrative operations; and in some cases achieving remote code execution on the database server. Modern web frameworks provide protection through parameterized queries and prepared statements that separate code from data, input validation, least privilege database accounts, and web application firewalls that detect injection patterns.
aliases: SQL Zhuru
category: Business Security
keywords: SQL Injection
keywords: SQLi
keywords: database injection
keywords: query manipulation
keywords: blind SQL injection
keywords: union-based injection
usage example: An attacker exploited SQL injection in a login form by entering `admin' OR '1'='1` as username, bypassing authentication and gaining administrative access to extract the entire user database containing 500,000 records.
related risks: API Abuse Risk
related risks: Supply Chain Poisoning Risk
citation: What is SQL injection? Detailed prevention measures from beginner to advanced level
citation: SQL injection explained in detail, from beginner to advanced level
updated: 2026-06-16
version: 1

Cross-Site Scripting
type: Term
break id: T0476
stix type: x-break-term
definition: A web security vulnerability where attackers inject malicious JavaScript code into websites that executes in victims' browsers, enabling session hijacking, phishing, or defacement.
description: Cross-site scripting exploits insufficient input sanitization and output encoding in web applications, allowing injection of client-side scripts that execute in other users' contexts. Stored (persistent) XSS saves malicious scripts in databases that execute for every user viewing the compromised content, reflected XSS delivers payloads through URLs that trick victims into clicking malicious links, and DOM-based XSS manipulates client-side JavaScript to execute attacks without server involvement. Successful XSS enables stealing authentication cookies and session tokens, capturing keystrokes and form inputs, redirecting users to phishing sites, modifying page content to spread misinformation, and executing actions on behalf of victims. Modern attack techniques bypass basic filters using encoding obfuscation, polyglot payloads that work across contexts, and mutation-based XSS that exploits browser quirks. Defense requires input validation and sanitization, context-aware output encoding, Content Security Policy headers that restrict script sources, HTTPOnly cookies to prevent JavaScript access, and security libraries that automatically handle escaping.
aliases: XSS Gongji
category: Business Security
keywords: Cross-Site Scripting
keywords: XSS
keywords: script injection
keywords: DOM-based XSS
keywords: reflected XSS
keywords: stored XSS
usage example: An attacker injected XSS payload into a forum post that stole session cookies from 2,000 logged-in users who viewed the thread, enabling account takeover across the platform.
related risks: API Abuse Risk
related risks: Supply Chain Poisoning Risk
citation: Cross Site Scripting (XSS) | OWASP Foundation
citation: Cross-site scripting (XSS) explained: core concepts in one article
updated: 2026-06-16
version: 1

Exclusive Dealing
type: Term
break id: T0477
stix type: x-break-term
definition: An anti-competitive practice where dominant platforms force merchants or service providers to exclusively cooperate with them and prohibit participation on competing platforms, restricting market competition.
description: Exclusive dealing, commonly known in China as 'choosing one of two', occurs when platforms with significant market power leverage their position to force business partners into exclusivity arrangements. Dominant e-commerce platforms may require merchants to delist from competing marketplaces, delivery platforms may prohibit restaurants from partnering with rivals, or app stores may demand exclusive content distribution rights. These practices harm market competition by preventing smaller platforms from accessing supply, reduce consumer choice by fragmenting available products across platforms, increase costs for merchants who lose multi-channel distribution, and entrench dominant positions by blocking competitive challenges. Enforcement mechanisms include algorithmic demotion of non-exclusive partners, withholding promotional resources, terminating partnerships, or imposing financial penalties. Antitrust regulators increasingly scrutinize these practices under abuse of dominance provisions, particularly in digital markets where network effects amplify the harm from foreclosure. Legal boundaries depend on market share, competitive alternatives, and business justifications.
aliases: Erxuanyi
category: Business Security
keywords: Exclusive Dealing
keywords: forced exclusivity
keywords: choose-one-of-two
keywords: platform exclusivity requirement
keywords: anti-competitive practice
keywords: vendor lock-in
usage example: A dominant e-commerce platform forced thousands of merchants to choose exclusivity, threatening to remove search visibility for those maintaining presence on competing marketplaces, resulting in antitrust penalties exceeding $2.7 billion.
related risks: Platform Monopoly Abuse Risk
citation: Simple usage of Spring Cache
citation: Consumer rights protection in dominant e-commerce platform exclusivity practices
citation: C language learning notes: position of .c files in object code
updated: 2026-06-16
version: 1

Self-Preferencing
type: Term
break id: T0478
stix type: x-break-term
definition: The practice where platform operators give preferential treatment to their own products or services over third-party competitors in search rankings, recommendations, or access to platform features.
description: Self-preferencing occurs when vertically integrated platforms that both operate marketplaces and sell products exploit their gatekeeper position to favor their own offerings. Common manifestations include prominently displaying first-party products in search results regardless of relevance or quality, providing internal products with better algorithmic treatment in recommendation systems, granting exclusive access to valuable user data or platform features, applying stricter policies to competitors, or bundling platform services with proprietary offerings. This conduct harms competition by making it impossible for superior third-party alternatives to compete fairly, stifles innovation as potential competitors face structural disadvantages, misleads consumers who assume neutral rankings, and enables platforms to extend dominance from one market into adjacent markets. Regulatory responses include mandatory disclosure of self-preferencing, algorithmic auditing requirements, structural separation of platform and merchant operations, and equal access obligations for platform infrastructure. The practice has become central to antitrust debates regarding digital platforms.
category: Business Security
keywords: Self-Preferencing
keywords: preferential treatment
keywords: first-party advantage
keywords: platform favoritism
keywords: discriminatory ranking
keywords: vertical foreclosure
usage example: A platform operator's shopping service consistently appeared at the top of search results for product queries despite offering higher prices than third-party merchants, leveraging algorithmic preferencing to capture sales.
related risks: Platform Monopoly Abuse Risk
citation: Everyone needs self-care
citation: Compilation of legal studies articles from university journals and social-science periodicals, 2022 Issue 6
updated: 2026-06-16
version: 1

Algorithm Recommendation
type: Term
break id: T0479
stix type: x-break-term
definition: Automated systems that use machine learning algorithms to personalize content, product, or service recommendations for users based on behavioral data, preferences, and predictive modeling.
description: Algorithmic recommendation systems analyze vast quantities of user interaction data including browsing history, purchase patterns, engagement metrics, and demographic information to predict and surface content likely to maximize specific objectives such as engagement, conversion, or time-on-platform. These systems power content feeds on social media, product suggestions in e-commerce, video recommendations, news curation, and advertisement targeting. While offering personalization benefits, these algorithms raise significant concerns: creation of filter bubbles that limit exposure to diverse viewpoints, amplification of misinformation and extreme content that generates engagement, manipulation of user behavior through addiction-optimizing designs, discriminatory outcomes when training data reflects societal biases, and lack of transparency regarding ranking criteria. Regulatory frameworks increasingly require disclosure of algorithmic ranking factors, user controls to disable personalization, human review of high-impact decisions, and regular auditing to detect discriminatory patterns or harmful content amplification.
aliases: Suanfa Tuijian
category: Business Security
keywords: Algorithm Recommendation
keywords: personalized recommendation
keywords: algorithmic curation
keywords: content ranking
keywords: recommendation engine
keywords: filter bubble
usage example: A social media platform's recommendation algorithm progressively showed users more extreme political content to maximize engagement, contributing to polarization and amplification of misinformation during election periods.
related risks: Algorithm Compliance Risk
related risks: Malicious Benefit Abuse
citation: Solving lifelong learning and transfer learning: a 30-year ILP introduction
citation: Latest 2022 review on reinforcement-learning interpretability
updated: 2026-06-16
version: 1

Data Compliance
type: Term
break id: T0480
stix type: x-break-term
definition: The organizational practices and legal obligations to collect, process, store, and transfer data in accordance with applicable privacy laws, security standards, and regulatory requirements.
description: Data compliance encompasses adherence to diverse regulatory frameworks governing how organizations handle personal and sensitive information. Key regulations include GDPR in Europe requiring consent mechanisms and data subject rights, China's Personal Information Protection Law (PIPL) and Data Security Law establishing strict data localization and security requirements, and sector-specific standards like HIPAA for healthcare and PCI DSS for payment data. Compliance obligations include obtaining valid consent for data collection, implementing appropriate technical and organizational security measures, maintaining data processing records, conducting privacy impact assessments for high-risk processing, establishing data breach notification procedures, appointing data protection officers, and implementing cross-border transfer mechanisms like Standard Contractual Clauses or Binding Corporate Rules. Non-compliance results in substantial fines (up to 4% of global revenue under GDPR), operational restrictions, reputational damage, and civil liability. Organizations require comprehensive data governance programs mapping data flows, classifying information sensitivity, implementing privacy-by-design principles, and maintaining ongoing compliance monitoring.
category: Business Security
keywords: Data Compliance
keywords: data protection regulation
keywords: data governance
keywords: regulatory compliance
keywords: data localization
keywords: cross-border data transfer
usage example: A multinational corporation faced €50 million in GDPR fines for inadequate consent mechanisms, unlawful cross-border data transfers, and failure to honor data deletion requests from European users.
related risks: AI Voice Cloning Fraud
related risks: NFT Fraud Risk
related risks: Buy Now Pay Later (BNPL) Fraud
citation: What is data compliance? Introduction, benefits, and application scenarios
citation: What is data security compliance? Introduction, benefits, and use cases
updated: 2026-06-16
version: 1

Privacy Compliance
type: Term
break id: T0481
stix type: x-break-term
definition: The legal and ethical obligations to protect individuals' personal information privacy through transparent practices, user consent, data minimization, and respect for privacy rights.
description: Privacy compliance focuses specifically on protecting individual privacy rights within broader data protection frameworks. Core principles include transparency through clear privacy notices explaining collection and use purposes, lawful basis for processing such as explicit consent or legitimate interest, data minimization collecting only necessary information, purpose limitation using data only for stated purposes, accuracy maintaining correct information, storage limitation retaining data only as long as needed, and security protecting against unauthorized access. Individuals possess rights including access to their data, correction of inaccuracies, deletion (right to be forgotten), data portability, objection to processing, and restriction of automated decision-making. Organizations must implement privacy-by-design principles integrating privacy considerations into system architecture, conduct privacy impact assessments for high-risk processing, establish consent management platforms, provide accessible privacy controls, and maintain audit trails of processing activities. Emerging privacy regulations emphasize proportionality, accountability, and user agency over data.
category: Business Security
keywords: Privacy Compliance
keywords: privacy regulation
keywords: user consent
keywords: privacy rights
keywords: data subject rights
keywords: privacy-by-design
usage example: An app company received regulatory sanctions for collecting precise location data without explicit user consent, failing to provide clear privacy notices, and sharing user data with third parties beyond stated purposes.
related risks: AI Voice Cloning Fraud
related risks: NFT Fraud Risk
related risks: Buy Now Pay Later (BNPL) Fraud
citation: The nature and legal regulation of privacy policies
citation: Compliance practices for app privacy policies, part 1
updated: 2026-06-16
version: 1

Antitrust
type: Term
break id: T0482
stix type: x-break-term
definition: Laws and regulations that prevent monopolistic practices, promote market competition, prohibit abuse of dominant positions, and regulate mergers to protect consumer welfare and competitive markets.
description: Antitrust law addresses three primary concerns: monopolization and abuse of dominant market positions through exclusionary conduct, anticompetitive agreements between competitors such as price-fixing cartels or market allocation schemes, and anticompetitive mergers that substantially reduce competition. Digital platforms face heightened antitrust scrutiny due to network effects that naturally concentrate markets, control over essential infrastructure and data, vertical integration creating conflicts of interest, and acquisition strategies that eliminate potential competitors. Enforcement actions target conduct including predatory pricing to eliminate rivals, exclusive dealing arrangements, tying and bundling products, refusal to deal or provide access to essential facilities, discriminatory treatment of business partners, and killer acquisitions of emerging competitors. Remedies range from behavioral constraints and ongoing monitoring to structural remedies requiring divestitures or operational separation. Modern antitrust debates center on whether traditional consumer welfare standards adequately address digital market dynamics and whether preemptive intervention is justified given winner-take-all dynamics.
category: Business Security
keywords: Antitrust
keywords: competition law
keywords: anti-monopoly
keywords: market dominance
keywords: anticompetitive practices
keywords: merger control
usage example: Regulators blocked a dominant platform's proposed acquisition of an emerging competitor, finding the transaction would eliminate future competitive constraint and entrench market power in violation of antitrust law.
related risks: Platform Monopoly Abuse Risk
citation: What is government regulation? Definition and explanation
citation: Market definition issues in antitrust analysis of the Internet platform economy
updated: 2026-06-16
version: 1

Script
type: Term
break id: T0483
stix type: x-break-term
definition: Automated programs or code sequences that perform repetitive tasks, often used by fraudsters to execute mass operations like account registration, credential testing, or transaction automation.
description: Scripts in the fraud context range from simple browser automation using tools like Selenium or Puppeteer to sophisticated programs that integrate CAPTCHA solving, proxy rotation, and anti-detection measures. Attackers deploy scripts for credential stuffing attacks testing stolen password databases against multiple sites, inventory snatching for limited-release products, vote manipulation, review posting, social media engagement fraud, and mass account creation. Modern scripts employ headless browsers to execute JavaScript, randomize timing and interaction patterns to mimic human behavior, rotate IP addresses through proxy pools, solve or bypass CAPTCHA challenges through third-party services, and handle complex multi-step workflows. Detection relies on behavioral analysis identifying superhuman speed or consistency, device fingerprinting detecting reused browser profiles, CAPTCHA challenges that scripts struggle to solve, and honeypot techniques that trap automated interactions. While scripting technology itself is neutral, enabling legitimate automation and testing, the accessibility of fraud-focused scripting frameworks has lowered barriers for abuse operations.
category: Business Security
keywords: Script
keywords: automation script
keywords: bot script
keywords: scripting attack
keywords: automated action
keywords: macro program
usage example: Scalpers used custom scripts to purchase 10,000 concert tickets within 30 seconds of release by automatically solving CAPTCHAs and submitting orders faster than human purchasers could complete checkout.
related risks: Process Automation
related risks: Malicious Flash Sale Grabbing
related risks: Web Scraping Risk
related attack tools: Headless Browsers
related attack tools: Automation Scripts
citation: Linker script analysis
citation: Introduction to scripts
updated: 2026-06-16
version: 1

Bot
type: Term
break id: T0484
stix type: x-break-term
definition: Automated software agents that perform tasks on the internet, ranging from legitimate applications like search engine crawlers to malicious bots conducting fraud, spam, or cyberattacks.
description: Bots represent automated programs that interact with online services, executing tasks with speed and scale impossible for human operators. Legitimate bots include search engine crawlers indexing web content, monitoring bots checking site availability, chatbots providing customer service, and trading bots executing algorithmic strategies. Malicious bots constitute a significant threat: credential stuffing bots testing stolen passwords, scraper bots harvesting content and data, spam bots posting unwanted content, click fraud bots generating fake advertising engagement, DDoS bots overwhelming servers, and social media bots spreading misinformation. Advanced bots employ residential proxies to appear as genuine users, solve CAPTCHAs through automation services, execute JavaScript to bypass basic bot detection, and coordinate in botnets controlled by command-and-control infrastructure. Bot detection technologies analyze behavioral patterns, device fingerprints, network characteristics, and challenge-response tests to distinguish automated traffic. Industry estimates suggest 30-50% of internet traffic originates from bots, with malicious bots representing substantial portions.
aliases: Jiqiren
category: Business Security
keywords: Bot
keywords: automated agent
keywords: software robot
keywords: internet bot
keywords: web bot
keywords: malicious bot
usage example: A botnet comprising 50,000 compromised devices launched coordinated attacks on e-commerce platforms during sales events, creating fake traffic to slow site performance while automated purchasing bots grabbed limited inventory.
related risks: Process Automation
related risks: Malicious Flash Sale Grabbing
related risks: Automated Reselling
related attack tools: Headless Browsers
citation: How robots work: a detailed popular-science explanation
updated: 2026-06-16
version: 1

Emulator
type: Term
break id: T0485
stix type: x-break-term
definition: Software that replicates the functionality of mobile devices or other systems on computers, enabling fraudsters to run mobile apps in controlled environments for automated abuse or testing.
description: Emulators in fraud operations serve as scalable platforms for running mobile applications without physical devices. Attackers use Android emulators like BlueStacks, Nox, or custom builds to operate multiple virtual devices simultaneously from a single computer, each appearing as distinct mobile devices to target applications. This enables mass account registration, automated gameplay for virtual currency farming, bonus abuse across device-based promotions, testing of fraud techniques without device costs, and circumventing device-based rate limits. Advanced fraud operations combine emulators with device spoofing to randomize device fingerprints, GPS spoofing for location-based restrictions, automation frameworks for scripted interactions, and cloud infrastructure for massive parallel operations. Apps attempt to detect emulators by checking for emulator-specific files and properties, analyzing hardware characteristics, detecting virtualization artifacts, and examining sensor data patterns. The cat-and-mouse game continues as emulator technologies improve realism while detection techniques become more sophisticated.
category: Business Security
keywords: Emulator
keywords: device emulation
keywords: virtual device
keywords: Android emulator
keywords: mobile emulator
keywords: environment simulation
usage example: A fraud operation ran 500 emulator instances on cloud servers to farm virtual currency in a mobile game, creating automated accounts that completed tasks 24/7 before selling the currency to legitimate players.
related risks: Account Reselling
related risks: Fake Registration
related attack tools: Mass Control Systems
related attack tools: Mobile Phone Emulator
citation: Fudan releases SimuLine, a news recommendation ecosystem simulator
citation: ZOMI: from art student to large-model training expert
citation: Custom keyboards on iOS
updated: 2026-06-16
version: 1

Device Farm
type: Term
break id: T0486
stix type: x-break-term
definition: Systems that enable centralized control of dozens to hundreds of physical mobile devices simultaneously, allowing operators to execute coordinated actions across multiple accounts for fraud or manipulation.
description: Device farms consist of physical mobile devices, typically mounted on racks with USB hubs for charging and data connectivity, controlled through specialized software that broadcasts commands to all devices simultaneously or executes scripted workflows. These setups enable one operator to control 50-200+ devices, each running separate accounts with unique identities. Applications include coordinating engagement manipulation (likes, follows, reviews), executing synchronized purchasing for limited inventory, farming virtual currency or game rewards, conducting A/B testing of fraud techniques, and maintaining large-scale account networks. Each device appears as a genuine mobile user to platforms since they possess authentic hardware identifiers, sensors, and network characteristics that emulators struggle to replicate perfectly. Advanced farms implement automation frameworks like Appium for scripted interactions, custom ROM modifications to enhance control, proxy or VPN integration for IP diversity, and physical robots for precise touchscreen interactions. The capital investment in devices makes farms primarily economically viable for high-value fraud operations.
aliases: Qunkong
category: Business Security
keywords: Device Farm
keywords: mass control
keywords: phone farm
keywords: multi-device control
keywords: device cluster
keywords: synchronized control
usage example: Authorities raided a device farm containing 300 smartphones running coordinated social media engagement fraud, generating fake followers and engagement worth over $2 million annually for clients seeking artificial popularity.
related risks: Account Reselling
related risks: Fake Registration
related attack tools: Mass Control Systems
citation: How to build voting systems and prevent vote manipulation in WeChat campaigns
citation: How Xiaohongshu combats fake recommendation content
citation: Embedded knowledge-graph wiki: embedded development beginner guide and roadmap
updated: 2026-06-16
version: 1

Device Spoofing Tool
type: Term
break id: T0487
stix type: x-break-term
definition: Software tools that modify or randomize device identifiers and hardware fingerprints, enabling fraudsters to evade device-based detection and create unlimited 'new' device identities on the same hardware.
description: Device spoofing tools manipulate the identification parameters that platforms use to track and rate-limit devices. On rooted Android devices, these tools can modify IMEI numbers, Android ID, MAC addresses, device serial numbers, build properties, sensor fingerprints, and other hardware identifiers. They may also spoof GPS locations, modify screen resolution and DPI, randomize font lists and installed app signatures, and alter network parameters. Combined with account rotation, these tools enable a single physical device to appear as unlimited unique devices, defeating device bans and rate limits. Advanced tools offer profile management for saving and switching between consistent device identities, randomization algorithms that generate realistic fingerprint combinations, and anti-detection features that hide root access or tool presence. Platforms defend through multi-factor device fingerprinting combining dozens of parameters that are difficult to spoof consistently, behavioral analysis detecting unnatural patterns, and server-side validation of claimed device characteristics.
category: Business Security
keywords: Device Spoofing Tool
keywords: device fingerprint changer
keywords: IMEI spoofer
keywords: hardware ID modification
keywords: device identity faker
keywords: fingerprint masking
usage example: Scalpers used device spoofing tools to reset device fingerprints after each purchase attempt, allowing a single phone to appear as hundreds of different devices to circumvent per-device purchase limits on a flash sale.
related risks: Fake Registration
related risks: Account Reselling
related attack tools: Mass Control Systems
related attack tools: Device Spoofing Tools
citation: IMEI tool explained: principles and legitimate applications of IMEI modification
citation: Programmer survival guide: advanced defensive patterns for recurring bugs
updated: 2026-06-16
version: 1

Automation Framework
type: Term
break id: T0488
stix type: x-break-term
definition: Software frameworks designed for automated testing and interaction with applications, repurposed by fraudsters to programmatically control browsers or mobile apps for scaled abuse operations.
description: Automation frameworks like Selenium for web browsers, Appium for mobile apps, and Puppeteer for headless Chrome provide APIs for programmatic control of user interfaces, enabling scripts to navigate pages, fill forms, click buttons, and extract data. While created for legitimate software testing, these powerful tools are widely adopted in fraud operations due to their ability to mimic human interactions convincingly. Attackers leverage these frameworks for credential stuffing campaigns, account registration automation, web scraping, form submission spam, and complex multi-step fraud workflows. Advanced usage includes headless mode operation for efficiency, proxy integration for IP rotation, CAPTCHA solving service integration, user agent randomization, and sophisticated wait strategies to handle dynamic content. Detection focuses on identifying framework artifacts like WebDriver properties, timing patterns inconsistent with human behavior, and execution environments characteristic of automation. Platforms must balance blocking malicious automation while allowing legitimate testing and accessibility tools.
category: Business Security
keywords: Automation Framework
keywords: test automation
keywords: Selenium
keywords: Appium
keywords: browser automation
keywords: UI automation
usage example: Fraudsters deployed Selenium-based scripts across thousands of proxies to automate credential stuffing attacks, testing 10 million stolen username-password combinations against banking sites and achieving 50,000 successful account compromises.
related risks: Process Automation
related attack tools: Headless Browsers
related attack tools: Automation Scripts
citation: RPA financial data analysis robots: theoretical framework and R&D strategy
citation: How to summarize an automation testing framework so everyone can learn it
citation: Automation testing framework: building a simple test framework from scratch
updated: 2026-06-16
version: 1

DAO
type: Term
break id: T0492
stix type: x-break-term
definition: A decentralized organizational structure where rules are transparently encoded in smart contracts and governance is democratically executed through token-based voting.
description: A DAO encodes organizational rules into smart contracts, enabling all decisions to be made through token holder voting while automating fund management and execution. This structure eliminates traditional hierarchical layers, creating a trustless environment where governance is transparent and verifiable on-chain. However, DAOs face significant security challenges including governance attacks, proposal manipulation, and social engineering risks targeting multi-signature wallet signers.
aliases: Decentralized autonomous organization
aliases: On-chain governance
category: Business Security
keywords: DAO
keywords: Decentralized Autonomous Organization
usage example: A DeFi protocol's DAO community votes on whether to launch a new feature; once the proposal passes, the smart contract automatically executes the upgrade.
related risks: DAO Governance Attacks
related risks: Multi-Signature Wallet Social Engineering
related avoidances: Time-Weighted Voting and Timelock Mechanism
related avoidances: Governance Scope Limitation and Multi-Signature Protection
related avoidances: DAO Governance Proposal Monitoring and Emergency Response
related avoidances: Multi-Sig Timelock Mechanism
related attack tools: DeFi Attack Scripts
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Introduction to DAOs - Ethereum
citation: The DAO Canon - a16z crypto
updated: 2026-06-16
version: 1

Layer2
type: Term
break id: T0493
stix type: x-break-term
definition: A scaling solution built on top of a blockchain mainnet (Layer1) that enhances transaction processing capacity while maintaining security.
description: Layer2 solutions significantly boost transaction throughput and reduce gas fees by moving the bulk of transaction computation off-chain, submitting only the final state to the main chain. Common implementations include Optimistic Rollups, ZK-Rollups, and state channels, which process transactions off-chain and periodically anchor proofs or state commitments to the Layer1 for settlement and security. However, these solutions introduce new security challenges, including cross-chain bridge vulnerabilities, data availability concerns, and sequencer centralization risks.
aliases: Layer 2 network
aliases: Layer 2
aliases: Rollup
category: Business Security
keywords: Layer2
usage example: A user executes token swaps on Arbitrum, a Layer2 network, benefiting from low gas fees and fast confirmations, while the final state is batched and submitted to the Ethereum mainnet for settlement.
related risks: Layer 2 Bridging Risk
related avoidances: Layer2 Bridge Security Audit
related avoidances: Formal Verification of Smart Contracts
related attack tools: Smart Contract Exploitation Framework
related attack tools: Blockchain Node and Consensus Attack Tools
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related threat actors: Malicious Blockchain Node Operators
related business scenes: BS00
related business scenes: BS15
citation: Layer 2 Scaling - Ethereum
citation: L2BEAT - Layer 2 Analytics
updated: 2026-06-16
version: 1

Cross-Chain Bridge
type: Term
break id: T0494
stix type: x-break-term
definition: A protocol that connects different blockchain networks, enabling users to transfer assets and data across chains.
description: Cross-chain bridges facilitate the movement of assets between different blockchains through lock-and-mint or burn-and-release mechanisms. These protocols typically lock assets on the source chain and mint equivalent wrapped tokens on the destination chain, or vice versa, ensuring the total supply remains constant across networks. The underlying architecture often involves smart contracts deployed on multiple chains, validators or relayers responsible for verifying cross-chain messages, and consensus mechanisms to prevent double-spending attacks. Cross-chain bridges are critical infrastructure for the multi-chain ecosystem, enabling interoperability between otherwise isolated blockchain networks. However, due to their complex asset custody and validation logic, they have become prime targets for threat actors, with multiple high-profile bridge exploits resulting in hundreds of millions of dollars in losses throughout blockchain history.
aliases: Cross-chain transfer
aliases: Bridge
aliases: Cross-chain asset transfer
category: Business Security
keywords: Cross-Chain Bridge
usage example: A user transfers USDC from Ethereum to the Polygon network via the Polygon Bridge to benefit from lower transaction fees.
related risks: Cross-Chain Bridge Attacks
related risks: Layer 2 Bridging Risk
related avoidances: Decentralized Cross-Chain Verification Network
related avoidances: Cross-Chain Bridge Smart Contract Auditing and Monitoring
related avoidances: Chain-Agnostic Design and Redundant Architecture
related avoidances: Layer2 Bridge Security Audit
related attack tools: Smart Contract Exploitation Framework
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Introduction to Bridges - Ethereum
citation: Crypto Bridge Protocols - TVL, Volume, & Fees - DefiLlama
updated: 2026-06-16
version: 1

Oracle
type: Term
break id: T0496
stix type: x-break-term
definition: A third-party service that provides external real-world data to blockchain smart contracts.
description: Since blockchains cannot actively fetch off-chain data, oracles serve as bridges that feed information such as prices, weather data, and sports results to smart contracts. Oracles are critical infrastructure for DeFi protocols, but centralized oracles pose a single point of failure risk, while decentralized oracles may also be subject to manipulation or delay attacks.
aliases: Blockchain oracle
aliases: Price feed
category: Business Security
keywords: Oracle
keywords: Chainlink
usage example: A lending protocol uses Chainlink oracles to obtain real-time ETH prices, based on which it calculates users' collateral ratios and liquidation thresholds.
related risks: Oracle Manipulation
related avoidances: Oracle Price Verification Mechanism
related avoidances: Multi-Source Oracle Aggregation and Anomaly Detection
related avoidances: Time-Weighted Average Price (TWAP) Mechanism
related avoidances: Automated Detection and Circuit Breaker for Oracle Manipulation
related attack tools: DeFi Attack Scripts
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: What Is a Blockchain Oracle? - Chainlink
citation: Introduction to Oracles - Ethereum
updated: 2026-06-16
version: 1

Gas Fee
type: Term
break id: T0497
stix type: x-break-term
definition: A fee paid to miners/validators for the computational resources consumed when executing transactions or smart contracts on a blockchain.
description: Gas fees are determined by gas consumption and gas price, fluctuating dynamically based on network congestion levels. Each operation in a transaction consumes a specific amount of gas units, and users set a gas price (typically denominated in gwei on Ethereum) to bid for block inclusion priority. Validators prioritize transactions with higher gas prices, creating a fee market that balances network demand with available block space. Properly setting gas fees directly impacts transaction confirmation speed, while excessively high gas fees degrade user experience and can make certain applications economically unviable during periods of high network activity. Gas fee manipulation may be exploited in front-running attacks (MEV attacks) where adversaries submit transactions with higher gas prices to preempt target transactions, or in denial-of-service attacks where malicious actors deliberately congest the network by submitting numerous high-fee transactions to delay legitimate operations.
aliases: Transaction fee
aliases: Miner fee
aliases: Gwei
category: Business Security
keywords: Gas Fee
keywords: Gwei
usage example: A user transferring tokens on Ethereum typically pays approximately $5-50 in gas fees, while complex DeFi interactions such as multi-hop swaps, yield farming operations, or flash loan executions may incur gas fees exceeding $100 during periods of network congestion.
related risks: Gas Fee Manipulation
related risks: Gas Fee Manipulation and Frontrunning
related avoidances: Private Mempool and MEV Protection Services
related avoidances: MEV Protection Mechanism
related attack tools: DeFi Attack Scripts
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Gas and Fees - Ethereum
citation: Ethereum Gas Tracker - Etherscan
updated: 2026-06-16
version: 1

Private Key
type: Term
break id: T0498
stix type: x-break-term
definition: A cryptographic string that serves as the core secret of a blockchain wallet, used to sign transactions and prove ownership of digital assets.
description: A private key is a randomly generated 64-character hexadecimal string. Anyone who possesses the private key effectively controls the assets associated with the corresponding blockchain address. The private key is mathematically linked to a public key and address through elliptic curve cryptography, enabling secure digital signatures without revealing the key itself. The security of all cryptocurrency holdings fundamentally depends on the confidentiality of the private key.
aliases: Private Key
aliases: Wallet key
category: Business Security
keywords: Private Key
usage example: A user signs a transfer transaction using their private key to send 10 ETH to another address. Once broadcast to the network and confirmed, the transaction is irreversible and cannot be undone.
related risks: Private Key Leakage and Management Risks
related risks: Quantum Computing Threat
related risks: Multi-Signature Wallet Social Engineering
related risks: Account Abstraction Wallet Risk
related avoidances: Hardware Security Module (HSM) Private Key Storage
related avoidances: Encrypted Storage and Password Protection of Private Keys
related avoidances: Source Code and Configuration File Secret Scanning
related attack tools: Phishing Kits
related attack tools: Infostealers
related attack tools: Wallet Phishing and Drainer Tools
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Wallet Drainer Groups
related business scenes: BS00
related business scenes: BS15
citation: Private Key : r/Coinbase - Reddit
citation: Ethereum Accounts - Ethereum
updated: 2026-06-16
version: 1

Rug Pull
type: Term
break id: T0502
stix type: x-break-term
definition: A fraudulent scheme in which cryptocurrency project developers abruptly withdraw liquidity or shut down the project and abscond with investor funds, resulting in total financial loss.
description: A rug pull is one of the most prevalent scams in the DeFi ecosystem. Malicious project creators attract capital through deceptive marketing and hype, then exploit smart contract backdoors to drain liquidity pool funds or abruptly abandon the project entirely. Common tactics include removing liquidity from decentralized exchanges, minting and dumping massive quantities of tokens to crash the price, and implementing sell restrictions that prevent investors from exiting their positions. These schemes are particularly damaging because they exploit the trustless nature of smart contracts while violating the implicit trust investors place in project teams.
aliases: Exit scam
aliases: Liquidity withdrawal
category: Business Security
keywords: Rug Pull
usage example: A DeFi project launched and, within one week, the project team suddenly withdrew $2 million in liquidity, causing the token price to instantly plummet to zero.
related risks: Rug Pull (Exit Scam)
related risks: Virtual Land/Asset Fraud
related avoidances: Smart Contract Code Auditing and Public Verification
related avoidances: Liquidity Locking and Token Vesting Schedule
related avoidances: Real-Time Rug Pull Detection and Insurance Mechanisms
related attack tools: Cryptocurrency Mixers
related attack tools: DeFi Attack Scripts
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
related business scenes: BS17
citation: The Chainalysis 2021 Crypto Crime Report
citation: Former 'bitcoin mayor' Eric Adams faces $3 million rugpull allegation ...
updated: 2026-06-16
version: 1

Maximal Extractable Value
type: Term
break id: T0503
stix type: x-break-term
definition: Additional profit extracted by miners or validators from blockchain users by reordering, inserting, or censoring transactions.
description: MEV arises from block producers' control over transaction ordering within a block. Common forms include frontrunning, sandwich attacks (inserting transactions before and after a target transaction), and arbitrage opportunity capture. While MEV can improve market efficiency by incentivizing arbitrageurs to correct price discrepancies across decentralized exchanges, it also introduces significant risks to blockchain consensus security and fairness.
aliases: Maximum extractable value
aliases: Sandwich Attack
category: Business Security
keywords: MEV
keywords: Maximal Extractable Value
keywords: Sandwich Attack
usage example: A bot detects a user's large buy order, frontruns it by purchasing the asset at a lower price, and then sells immediately after the user's transaction drives up the price, profiting from the price impact.
related risks: MEV Attacks (Miner Extractable Value)
related risks: Gas Fee Manipulation and Frontrunning
related avoidances: Private Mempool and MEV Protection Services
related avoidances: Commit-Reveal Mechanism
related avoidances: Transaction Slippage Protection and Limit Orders
related avoidances: MEV Protection Mechanism
related attack tools: DeFi Attack Scripts
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: DeFi Protocol Attackers
related business scenes: BS00
related business scenes: BS15
citation: Maximal Extractable Value (MEV) - Ethereum
citation: Ethereum is a Dark Forest - Paradigm
updated: 2026-06-16
version: 1

Phishing
type: Term
break id: T0505
stix type: x-break-term
definition: An attack method that sends fraudulent messages disguised as a trusted entity to trick victims into revealing sensitive information or installing malware.
description: Phishing is the most common form of social engineering attack, in which attackers impersonate well-known organizations such as banks, e-commerce platforms, or social media services by forging emails, SMS messages, instant messages, or websites. These deceptive communications are designed to lure users into clicking malicious links, downloading malicious attachments, or entering their account credentials and other sensitive data. Due to its low cost and high success rate, phishing remains a primary root cause of data breaches and account compromise.
aliases: Phishing
aliases: Phishing attack
category: Business Security
keywords: Phishing
usage example: A user receives an email disguised as a communication from their bank, claiming that their account requires verification due to an anomaly. Upon clicking the link, the user is directed to a spoofed website and enters their banking card details.
related risks: Phishing Attack
related risks: AI-Enhanced Phishing Attack
related risks: Account Takeover
related risks: Domain / Brand Impersonation
related risks: EIP and Protocol Phishing Attack
related avoidances: Threat Intelligence
related avoidances: Domain & Link Threat Intelligence
related avoidances: Certificate Pinning (SSL Pinning)
related avoidances: Passkeys / Phishing-Resistant Authentication
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related threat actors: Telecom Fraud Gangs
related threat actors: Malicious Hackers
related threat actors: Cryptocurrency Fraud Syndicate
related threat actors: Scam Compound Technician
related business scenes: BS00
related business scenes: BS01
related business scenes: BS02
related business scenes: BS04
related business scenes: BS15
citation: What is Phishing? - Anti-Phishing Working Group
citation: Recognize and Report Phishing - CISA
updated: 2026-06-16
version: 1

Spear Phishing
type: Term
break id: T0505-001
stix type: x-break-term
definition: A highly personalized phishing attack tailored to specific individuals or organizations, with a significantly higher success rate than generic phishing.
description: Spear phishing attackers conduct in-depth research on their targets through social media, public information, and other channels, carefully crafting email content relevant to the target's work and interests to enhance credibility. This type of attack is commonly used in APT (Advanced Persistent Threat) operations, targeting high-value individuals such as corporate executives, government officials, and research and development personnel. Due to its high degree of customization, traditional email filtering is often ineffective in defending against such attacks.
aliases: Spear Phishing
aliases: Targeted phishing
category: Business Security
keywords: Spear Phishing
usage example: After researching a company CFO's social media profiles, hackers forged a supplier email requesting a change in payment account details, successfully defrauding the company of millions of dollars in wire transfers.
related risks: Phishing Attack
related risks: AI-Enhanced Phishing Attack
related risks: Social Engineering Risk
related risks: Trade Secret Leakage
related avoidances: Security Awareness Training
related avoidances: Multi-Factor Authentication
related avoidances: Threat Intelligence
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related threat actors: Malicious Hackers
related threat actors: Scam Compound Technician
related business scenes: BS00
citation: What Is Spear Phishing? | Microsoft Security
citation: Spear Phishing - Proofpoint
updated: 2026-06-16
version: 1

Whaling Attack
type: Term
break id: T0505-002
stix type: x-break-term
definition: A highly targeted spear-phishing attack aimed specifically at senior executives (e.g., CEO, CFO) to steal sensitive information or authorize fraudulent high-value financial transactions.
description: Whaling attacks represent an extreme form of spear phishing where threat actors impersonate board members, business partners, or regulatory authorities to exploit the decision-making authority of C-suite executives. These attacks leverage time pressure and the executive's privileged access to induce unauthorized large-sum wire transfers or the disclosure of trade secrets and other confidential business intelligence. The average financial loss from whaling significantly exceeds that of conventional phishing campaigns, and the FBI classifies this attack vector as a primary form of Business Email Compromise (BEC) fraud.
aliases: Whaling Attack
aliases: Executive phishing
aliases: BEC
category: Business Security
keywords: Whaling Attack
keywords: BEC
usage example: An attacker spoofed the CEO's email address and sent an urgent payment request to the finance director, instructing an immediate wire transfer to complete a confidential acquisition. The finance employee, without verifying the request through an out-of-band channel, authorized the transfer, resulting in a loss of $5 million.
related risks: Phishing Attack
related risks: Insufficient Employee Security Awareness
related risks: Platform Fraud Risk
related risks: Trade Secret Leakage
related avoidances: Security Awareness Training
related avoidances: Multi-Factor Authentication
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: Fake Call Spoofing Tool
related threat actors: Telecom Fraud Gangs
related threat actors: Malicious Hackers
related threat actors: Scam Compound Technician
related business scenes: BS00
related business scenes: BS01
citation: Business Email Compromise - FBI
citation: What is a Whaling Attack? - Fortinet
updated: 2026-06-16
version: 1

Watering Hole Attack
type: Term
break id: T0508
stix type: x-break-term
definition: A watering hole attack is an indirect attack strategy where adversaries compromise legitimate websites frequently visited by target groups to infect visitors with malicious code.
description: The watering hole attack derives its name from the predatory strategy of waiting near a water source for prey. Attackers analyze the browsing habits of employees within targeted organizations, then compromise industry forums, news websites, or professional communities they frequently visit, implanting browser exploit code. Since the websites themselves are legitimate, traditional security measures often fail to detect or block such attacks. This technique is commonly employed in Advanced Persistent Threat (APT) campaigns targeting high-value sectors such as government, finance, and energy.
aliases: Watering Hole Attack
aliases: Strategic web compromise
category: Business Security
keywords: Watering Hole Attack
usage example: A hacker group compromised an energy industry association website, implanting a zero-day exploit code that successfully infected the computers of employees from multiple power companies.
related risks: Supply Chain Risk
related risks: Insufficient Employee Security Awareness
related risks: Phishing Attack
related risks: Office Environment Risk
related avoidances: Threat Intelligence
related avoidances: Identity Security Audit
related avoidances: Vulnerability Identification
related avoidances: Endpoint Detection and Response
related attack tools: System/Application Vulnerability Exploitation Tools
related attack tools: Infostealers
related threat actors: Malicious Hackers
related threat actors: Malware Developers
related business scenes: BS00
citation: Watering Hole Attacks - CISA
citation: Drive-by Compromise - MITRE ATT&CK
updated: 2026-06-16
version: 1

Malware
type: Term
break id: T0509
stix type: x-break-term
definition: A general term for software programs designed to disrupt operations, steal data, gain unauthorized access, or perform other malicious activities.
description: Malware serves as a core tool in the cybersecurity threat landscape, encompassing various types including viruses, trojans, worms, ransomware, spyware, adware, and rootkits. It propagates through attack vectors such as vulnerability exploitation, phishing emails, and drive-by downloads to execute malicious activities including data exfiltration, system destruction, remote control, cryptojacking, and DDoS attacks. Modern malware possesses advanced capabilities such as anti-detection, persistence, and lateral movement.
aliases: Malware
aliases: Malicious code
category: Business Security
keywords: Malware
usage example: A user downloads cracked software and gets infected with a trojan, which the attacker uses to remotely control the computer and steal banking credentials and passwords.
related risks: Device Malware Infection
related risks: Data Breach
related risks: Ransomware Attack
related risks: Server Cryptomining
related risks: Privilege Escalation / Unauthorized Access
related risks: Unauthorized Outbound Connection and C2 Control
related avoidances: Threat Intelligence
related avoidances: Security Awareness Training
related avoidances: Vulnerability Identification
related avoidances: Endpoint Detection and Response
related attack tools: Trojan Virus
related attack tools: Infostealers
related attack tools: Keyloggers
related threat actors: Malware Developers
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Handling Destructive Malware | CISA
citation: What is Malware? - Microsoft Security
updated: 2026-06-16
version: 1

Ransomware
type: Term
break id: T0510
stix type: x-break-term
definition: Malware that encrypts victim data or locks systems, demanding ransom payment to restore access.
description: Ransomware is one of the most destructive cyber threats, where attackers encrypt files, databases, or entire systems to extort ransom payments, typically demanding cryptocurrency. Modern ransomware employs a double extortion model combining encryption with data exfiltration threats. Attack targets have expanded from individuals to enterprises, hospitals, and government agencies, causing severe consequences including business disruption, data loss, and reputational damage.
aliases: Ransomware
aliases: Crypto-extortion malware
category: Business Security
keywords: Ransomware
usage example: A hospital's systems were encrypted by ransomware, rendering all medical records inaccessible, with hackers demanding a ransom of 50 Bitcoins.
related risks: Ransomware Attack
related risks: Ransomware as a Service (RaaS)
related risks: Double / Triple Extortion
related risks: Employee Error Risk
related risks: Data Breach
related avoidances: Data Loss Prevention
related avoidances: Disaster Recovery
related avoidances: Threat Intelligence
related avoidances: Endpoint Detection and Response
related attack tools: Trojan Virus
related attack tools: Infostealers
related threat actors: Malware Developers
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Stop Ransomware - CISA
citation: No More Ransom Project
updated: 2026-06-16
version: 1

Botnet
type: Term
break id: T0511
stix type: x-break-term
definition: A network of internet-connected devices infected with malware and controlled remotely by an attacker to perform coordinated malicious activities.
description: Botnets serve as versatile platforms for a wide range of cybercriminal operations, including distributed denial-of-service (DDoS) attacks, spam campaigns, credential stuffing and password brute-forcing, cryptocurrency mining, click fraud, data exfiltration, and malware distribution. Modern botnets can scale to millions of nodes, leveraging sophisticated evasion techniques such as encrypted C&C communications, multi-layered proxy chains, and modular malware architectures that allow dynamic payload updates. The sheer scale and distributed nature of these networks pose a critical threat to internet infrastructure, making takedown operations complex and requiring coordinated efforts between law enforcement agencies, security researchers, and network operators.
aliases: Botnet
aliases: Compromised host network
aliases: C2 network
category: Business Security
keywords: Botnet
keywords: Bot
usage example: The Mirai botnet infected hundreds of thousands of IoT cameras and launched DDoS attacks exceeding 1 Tbps, disrupting internet services across the U.S. East Coast.
related risks: Distributed Denial of Service
related risks: Server Cryptomining
related risks: IoT Botnets
related risks: Unauthorized Outbound Connection and C2 Control
related risks: Edge Computing Node Attack
related avoidances: DDoS Protection
related avoidances: Threat Intelligence
related avoidances: Endpoint Detection and Response
related avoidances: IoT Traffic Anomaly Detection and C&C Communication Blocking
related avoidances: IoT Device Security Configuration Enforcement
related avoidances: IoT Botnet Traffic Filtering and Rate Limiting
related attack tools: Trojan Virus
related attack tools: IoT Botnet and C2 Tools
related threat actors: Malware Developers
related threat actors: Malicious Hackers
related threat actors: IoT Botnet Operators
related business scenes: BS00
related business scenes: BS16
citation: Botnet - The Cloudflare Blog
citation: Understanding Denial-of-Service Attacks - CISA
updated: 2026-06-16
version: 1

Advanced Persistent Threat
type: Term
break id: T0512
stix type: x-break-term
definition: A prolonged and targeted cyber intrusion campaign conducted by highly skilled threat actors, often with nation-state backing, aimed at compromising specific targets for strategic advantage.
description: Advanced Persistent Threat (APT) attacks are characterized by three core attributes: 'Advanced' (leveraging zero-day exploits and custom malware), 'Persistent' (maintaining long-term access for months or even years), and 'Threat' (driven by clear objectives with destructive impact). Attackers typically establish an initial foothold through spear-phishing, watering hole attacks, or supply chain compromise, then proceed with lateral movement, privilege escalation, and data exfiltration while actively evading detection. Common targets include government agencies, defense industrial bases, energy infrastructure, and research institutions.
aliases: APT
aliases: Advanced persistent threat
category: Business Security
keywords: APT
keywords: Advanced Persistent Threat
usage example: An APT group infiltrated a defense contractor's network via a spear-phishing campaign, maintaining persistence for 18 months to exfiltrate weapon system design blueprints.
related risks: Supply Chain Risk
related risks: Employee Account Compromise
related risks: Phishing Attack
related risks: Trade Secret Leakage
related risks: Data Breach
related risks: Office Environment Risk
related avoidances: Threat Intelligence
related avoidances: Identity Security Audit
related avoidances: Security Awareness Training
related avoidances: Vulnerability Identification
related avoidances: Zero Trust Architecture
related avoidances: Endpoint Detection and Response
related attack tools: System/Application Vulnerability Exploitation Tools
related attack tools: Phishing Kits
related attack tools: Infostealers
related threat actors: Malicious Hackers
related threat actors: Malware Developers
related business scenes: BS00
citation: Nation-State Threats | Cybersecurity and Infrastructure ... - CISA
citation: Groups - MITRE ATT&CK
updated: 2026-06-16
version: 1

Vulnerability
type: Term
break id: T0513
stix type: x-break-term
definition: A flaw or weakness in a system, software, or hardware that can be exploited by an attacker to compromise security.
description: Vulnerabilities are the root source of cybersecurity threats, which may arise from design flaws, coding errors, misconfigurations, or logic gaps. Common vulnerability types include buffer overflows, injection attacks, privilege escalation, and information disclosure. The window between vulnerability discovery and remediation represents an opportunity for attackers, with zero-day vulnerabilities (undisclosed flaws) being particularly dangerous. Vulnerability management is a core component of security defense.
aliases: Vulnerability
aliases: Security flaw
aliases: Weakness
category: Business Security
keywords: Vulnerability
usage example: A security researcher discovered an SQL injection vulnerability in a web framework that could lead to complete compromise of the database.
related risks: Privilege Escalation / Unauthorized Access
related risks: Office Environment Risk
related risks: Supply Chain Risk
related risks: API Business Logic Abuse
related avoidances: Vulnerability Identification
related avoidances: Vulnerability Remediation
related avoidances: Bug Bounty Program
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Malicious Hackers
related threat actors: Malware Developers
related business scenes: BS00
citation: Common Vulnerabilities and Exposures (CVE)
citation: Known Exploited Vulnerabilities Catalog - CISA
updated: 2026-06-16
version: 1

Zero-day Vulnerability
type: Term
break id: T0514
stix type: x-break-term
definition: A security vulnerability that is unknown to the software vendor or the public, for which no patch is available, allowing attackers to exploit it without any existing defense.
description: The term '0-day' originates from the fact that zero days have elapsed since the vulnerability was discovered and exploited before a patch is released. These vulnerabilities are extremely dangerous because there is no known defense, enabling attackers to infiltrate systems silently and without detection. Zero-day exploits are highly sought after in underground markets and are widely used by nation-state hackers, APT groups, and cyber weapon developers. Once a zero-day vulnerability is publicly disclosed, it becomes an N-day vulnerability.
aliases: Zero-day
aliases: Zero-day vulnerability
aliases: Undisclosed vulnerability
category: Business Security
keywords: Zero-day Vulnerability
usage example: An APT group exploited a Windows zero-day vulnerability to infiltrate a government network, remaining undetected until Microsoft released a patch.
related risks: Supply Chain Risk
related risks: Privilege Escalation / Unauthorized Access
related risks: Office Environment Risk
related risks: Supply Chain Poisoning Risk
related avoidances: Threat Intelligence
related avoidances: Vulnerability Identification
related avoidances: Vulnerability Remediation
related avoidances: Endpoint Detection and Response
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Malicious Hackers
related threat actors: Malware Developers
related business scenes: BS00
citation: Known Exploited Vulnerabilities Catalog - CISA
citation: Microsoft Security Response Center Blog
updated: 2026-06-16
version: 1

Firewall
type: Term
break id: T0515
stix type: x-break-term
definition: A security device or software that monitors and controls network traffic, permitting or blocking data packets based on predetermined security rules.
description: A firewall serves as the first line of defense in network security, deployed at network perimeters or on individual hosts. Based on their operational methodology, firewalls are categorized into several types, including packet-filtering firewalls, stateful inspection firewalls, application-layer firewalls (such as Web Application Firewalls, or WAFs), and next-generation firewalls (NGFWs). These systems filter traffic by examining attributes such as IP addresses, ports, protocols, and application signatures to enforce security policies and block unauthorized access and malicious attacks. Modern firewalls often integrate advanced capabilities including Intrusion Prevention Systems (IPS), Deep Packet Inspection (DPI), and threat intelligence feeds to provide comprehensive protection against evolving threats.
aliases: Firewall
aliases: WAF
aliases: Access control
category: Business Security
keywords: Firewall
keywords: WAF
usage example: An enterprise deploys a firewall at the network perimeter to allow only web traffic on ports 80 and 443 into the DMZ zone.
related risks: Denial of Service Risk
related risks: Server Cryptomining
related risks: Privilege Escalation / Unauthorized Access
related risks: Unauthorized Outbound Connection and C2 Control
related avoidances: DDoS Protection
related avoidances: Resource Access Restriction
related avoidances: API Security Gateway
related avoidances: Zero Trust Architecture
related business scenes: BS00
citation: SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy | CSRC
citation: What is a Firewall? - Cloudflare
updated: 2026-06-16
version: 1

Intrusion Detection System
type: Term
break id: T0516
stix type: x-break-term
definition: A security system that monitors network or system activities to detect suspicious behavior and attack signatures, and generates alerts.
description: An Intrusion Detection System (IDS) identifies intrusion activities through techniques such as signature matching, anomaly detection, and behavioral analysis. Based on deployment location, it is categorized into Network-based IDS (NIDS) and Host-based IDS (HIDS). An IDS is only responsible for detection and alerting, and does not actively block attacks (which distinguishes it from an Intrusion Prevention System).
aliases: IDS
aliases: Intrusion Detection System
aliases: Anomaly detection
category: Business Security
keywords: IDS
keywords: Intrusion Detection System
usage example: A NIDS detects that an internal host is sending an abnormally high volume of DNS query requests, generating an alert for potential data exfiltration.
related risks: Supply Chain Risk
related risks: Server Cryptomining
related risks: Unauthorized Outbound Connection and C2 Control
related avoidances: Threat Intelligence
related avoidances: Identity Security Audit
related avoidances: Endpoint Detection and Response
related avoidances: IoT Traffic Monitoring and Anomaly Detection
related business scenes: BS00
citation: Guide to Intrusion Detection and Prevention Systems (IDPS) - NIST SP 800-94
citation: Introduction to Intrusion Detection Systems - SANS
updated: 2026-06-16
version: 1

Encryption
type: Term
break id: T0517
stix type: x-break-term
definition: The process of transforming plaintext data into ciphertext using cryptographic algorithms to prevent unauthorized access.
description: Encryption is a core technology for ensuring data confidentiality. It is primarily categorized into symmetric encryption (e.g., AES, DES) and asymmetric encryption (e.g., RSA, ECC). Symmetric encryption offers high-speed performance but faces challenges in secure key distribution, while asymmetric encryption resolves key distribution issues at the cost of higher computational overhead. Encryption is widely applied in scenarios such as data storage, secure transmission, identity authentication, and digital signatures. The advent of quantum computing poses significant threats to traditional cryptographic algorithms, making post-quantum cryptography an emerging research focus.
aliases: Encryption
aliases: Cryptography
aliases: Encryption algorithm
category: Business Security
keywords: Encryption
usage example: Banks utilize TLS encryption protocols to secure online banking communications, ensuring that account credentials are not intercepted by eavesdroppers.
related risks: Data Breach
related risks: Post-Quantum Cryptography Risk
related risks: Private Key Leakage and Management Risks
related avoidances: Traffic Encryption
related avoidances: Data Loss Prevention
related avoidances: Quantum-Safe Cryptography Migration
related avoidances: Encrypted Storage and Password Protection of Private Keys
related business scenes: BS00
citation: Cryptography - NIST
citation: Post-Quantum Cryptography - NIST
updated: 2026-06-16
version: 1

Digital Certificate
type: Term
break id: T0518
stix type: x-break-term
definition: An electronic document issued by a trusted third party (Certificate Authority, CA) to verify the identity of a public key holder.
description: A digital certificate is a core component of the Public Key Infrastructure (PKI), formatted according to the X.509 standard. It contains the public key, holder information, issuer details, validity period, and a digital signature. SSL/TLS certificates are used for identity authentication and encrypted communication on HTTPS websites, while code signing certificates are used to verify the identity of software publishers.
aliases: Digital Certificate
aliases: SSL certificate
aliases: PKI
category: Business Security
keywords: Digital Certificate
keywords: PKI
usage example: After deploying an SSL certificate on a website, a lock icon appears in the browser's address bar, allowing users to confirm the website's identity and communicate securely.
related risks: Phishing Attack
related risks: Domain / Brand Impersonation
related risks: OAuth / SSO Authorization Abuse
related avoidances: Digital Certificate
related avoidances: Certificate Pinning (SSL Pinning)
related avoidances: Passkeys / Phishing-Resistant Authentication
related avoidances: V2X PKI Authentication System
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related threat actors: Malicious Hackers
related business scenes: BS00
citation: RFC 5280: Internet X.509 Public Key Infrastructure Certificate
citation: What is SSL? | Learning Center - Cloudflare
updated: 2026-06-16
version: 1

Virtual Private Network
type: Term
break id: T0519
stix type: x-break-term
definition: A technology that establishes an encrypted tunnel over a public network, enabling users to securely access internal network resources remotely.
description: A VPN creates a virtual, private connection over the internet through encryption and tunneling techniques, ensuring the confidentiality and integrity of data transmission. It is categorized by use case into remote access VPNs (for employees accessing corporate networks) and site-to-site VPNs (for interconnecting branch offices). Common protocols include IPSec, SSL/TLS, and WireGuard. VPNs are also used by individual users to hide their IP addresses and bypass geo-restrictions, though they may be misused for illegal activities.
aliases: Virtual Private Network
aliases: Encrypted tunnel
category: Business Security
keywords: VPN
keywords: Virtual Private Network
usage example: An employee working from home connects to the corporate intranet via VPN to securely access file servers and office systems.
related risks: Wireless Network Risk
related risks: Privilege Escalation / Unauthorized Access
related risks: Unauthorized Outbound Connection and C2 Control
related avoidances: Traffic Encryption
related avoidances: Zero Trust Architecture
related avoidances: Multi-Factor Authentication
related attack tools: Evil Twin WiFi
related threat actors: Malicious Hackers
related business scenes: BS00
citation: Guide to IPsec VPNs - NIST SP 800-77
citation: Enterprise VPN Security - CISA
updated: 2026-06-16
version: 1

Sandbox
type: Term
break id: T0520
stix type: x-break-term
definition: An isolated security environment for executing and observing suspicious program behavior, preventing it from affecting real systems.
description: Sandbox technology creates a restricted execution environment through virtualization or container isolation, where malicious code cannot access real system resources. Sandboxes are widely used in scenarios such as malware analysis, browser security, and mobile application isolation. Defenders use sandboxes to analyze the behavioral characteristics of unknown files, while attackers research anti-sandbox techniques (such as detecting virtual environments, delayed execution, etc.) to evade detection.
aliases: Sandbox
aliases: Isolated environment
category: Business Security
keywords: Sandbox
usage example: The security team ran the suspicious email attachment in a sandbox to observe whether it exhibited malicious behaviors such as encrypting files or connecting to a C2 server.
related risks: Device Malware Infection
related risks: Office Environment Risk
related risks: AI Agent Tool Misuse / Excessive Autonomy Risk
related avoidances: Endpoint Detection and Response
related avoidances: Agent Behavior Sandbox
related attack tools: Trojan Virus
related attack tools: LLM Automated Attack Tools
related attack tools: AI Agent Hijacking Tools
related threat actors: Malware Developers
related threat actors: Malicious Hackers
related threat actors: AI Tool Abusers
related business scenes: BS00
related business scenes: BS14
citation: Cloudflare Sandbox SDK
citation: Virtualization/Sandbox Evasion - MITRE ATT&CK
updated: 2026-06-16
version: 1

Honeypot
type: Term
break id: T0521
stix type: x-break-term
definition: A deception technology that uses intentionally vulnerable systems or resources to attract, detect, and study attacker behavior.
description: A honeypot simulates the vulnerabilities and services of real systems, enticing attackers to invest time and resources in attacking it while recording their methods, tools, and targets. Based on the level of interaction, honeypots are categorized into low-interaction honeypots (which emulate limited services) and high-interaction honeypots (which involve a full operating system). Honeypots can be utilized for threat intelligence collection, intrusion detection, and attack attribution, but they require careful deployment to avoid becoming a launchpad for further attacks.
aliases: Honeypot
aliases: Decoy system
aliases: Honeynet
category: Business Security
keywords: Honeypot
usage example: An enterprise deploys a honeypot on its internal network to simulate a file server. As soon as someone accesses it, an alert is triggered, helping to detect lateral movement within the network.
related risks: Supply Chain Risk
related risks: Server Cryptomining
related risks: Unauthorized Outbound Connection and C2 Control
related avoidances: Business-Level Honeypot
related avoidances: Threat Intelligence
related avoidances: Identity Security Audit
related business scenes: BS00
citation: Introduction To Honeypots.md - GitHub
citation: Honeypots: A Sweet Solution? - SANS
updated: 2026-06-16
version: 1

Shadow API
type: Term
break id: T0522
stix type: x-break-term
definition: An undocumented, unmanaged, or deprecated API that remains reachable outside the official API inventory.
description: Shadow API is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Shadow API
keywords: undocumented API
keywords: unmanaged endpoint
keywords: deprecated API
keywords: API inventory
keywords: API discovery
usage example: Assess Shadow API related exposure and define the corresponding controls.
related risks: Shadow API Exposure Risk
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Object-Level Authorization
type: Term
break id: T0523
stix type: x-break-term
definition: A server-side authorization check that verifies whether the caller is allowed to access a specific object or resource instance.
description: Object-Level Authorization is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Object-Level Authorization
keywords: BOLA
keywords: IDOR
keywords: resource ownership check
keywords: object permission
keywords: API authorization
usage example: Assess Object-Level Authorization related exposure and define the corresponding controls.
related risks: API Object-Level Authorization Risk
related risks: Public Cloud Storage Bucket Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Webhook
type: Term
break id: T0524
stix type: x-break-term
definition: An event callback delivered over HTTP from one system to another when a business event occurs.
description: Webhook is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Webhook
keywords: event callback
keywords: HTTP callback
keywords: webhook signature
keywords: event delivery
keywords: third-party integration
usage example: Assess Webhook related exposure and define the corresponding controls.
related risks: Webhook Forgery and Event Replay
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Idempotency
type: Term
break id: T0525
stix type: x-break-term
definition: A property that allows repeated requests with the same intent to produce the same business result without duplicate side effects.
description: Idempotency is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Idempotency
keywords: idempotency key
keywords: duplicate request protection
keywords: safe retry
keywords: event deduplication
keywords: transaction consistency
usage example: Assess Idempotency related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Replay Attack
type: Term
break id: T0526
stix type: x-break-term
definition: An attack that reuses a valid request, event, token, or signature to trigger an operation again.
description: Replay Attack is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Replay Attack
keywords: request replay
keywords: event replay
keywords: token replay
keywords: signature replay
keywords: timestamp window
usage example: Assess Replay Attack related exposure and define the corresponding controls.
related risks: Webhook Forgery and Event Replay
related risks: Session Token Replay
related risks: Automotive OTA Update Hijacking
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

OpenAPI
type: Term
break id: T0527
stix type: x-break-term
definition: A specification format used to describe HTTP APIs, endpoints, parameters, schemas, and authentication methods.
description: OpenAPI is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: OpenAPI
keywords: API specification
keywords: API contract
keywords: schema definition
keywords: endpoint documentation
keywords: contract testing
usage example: Assess OpenAPI related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

API Gateway
type: Term
break id: T0528
stix type: x-break-term
definition: An entry layer that centralizes API routing, authentication, rate limiting, logging, and policy enforcement.
description: API Gateway is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: API Gateway
keywords: API routing
keywords: gateway authentication
keywords: rate limiting
keywords: API policy enforcement
keywords: traffic control
usage example: Assess API Gateway related exposure and define the corresponding controls.
related risks: Shadow API Exposure Risk
related risks: API Object-Level Authorization Risk
related risks: API Bulk Call Resource Exhaustion
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Rate Limiting
type: Term
break id: T0529
stix type: x-break-term
definition: A control that restricts request frequency by identity, device, IP, tenant, endpoint, or business action.
description: Rate Limiting is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Rate Limiting
keywords: request throttling
keywords: traffic shaping
keywords: quota enforcement
keywords: abuse prevention
keywords: API protection
usage example: Assess Rate Limiting related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Quota Control
type: Term
break id: T0530
stix type: x-break-term
definition: A policy that limits total resource consumption such as calls, transactions, inventory, credits, or compute usage.
description: Quota Control is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Quota Control
keywords: usage quota
keywords: resource quota
keywords: consumption limit
keywords: tenant quota
keywords: billing protection
usage example: Assess Quota Control related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

CI/CD
type: Term
break id: T0531
stix type: x-break-term
definition: Continuous integration and continuous delivery pipelines used to build, test, package, and release software.
description: CI/CD is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: CI/CD
keywords: continuous integration
keywords: continuous delivery
keywords: pipeline security
keywords: build automation
keywords: deployment pipeline
usage example: Assess CI/CD related exposure and define the corresponding controls.
related risks: CI/CD Pipeline Credential Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Runner
type: Term
break id: T0532
stix type: x-break-term
definition: An execution environment that runs CI/CD jobs, build scripts, tests, and deployment tasks.
description: Runner is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Runner
keywords: CI runner
keywords: build runner
keywords: pipeline executor
keywords: job execution environment
keywords: runner isolation
usage example: Assess Runner related exposure and define the corresponding controls.
related risks: CI/CD Pipeline Credential Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Artifact Repository
type: Term
break id: T0533
stix type: x-break-term
definition: A repository that stores build outputs, packages, container images, and release artifacts.
description: Artifact Repository is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Artifact Repository
keywords: package repository
keywords: container registry
keywords: build artifact
keywords: release repository
keywords: artifact storage
usage example: Assess Artifact Repository related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Build Signing
type: Term
break id: T0534
stix type: x-break-term
definition: A mechanism that cryptographically signs build artifacts so consumers can verify origin and integrity.
description: Build Signing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Build Signing
keywords: artifact signature
keywords: release signing
keywords: code signing
keywords: build integrity
keywords: provenance verification
usage example: Assess Build Signing related exposure and define the corresponding controls.
related risks: CI/CD Pipeline Credential Exposure
related risks: Build Artifact Poisoning Risk
related risks: Dependency Confusion and Malicious Package Poisoning
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

SLSA
type: Term
break id: T0535
stix type: x-break-term
definition: Supply-chain Levels for Software Artifacts, a framework for improving build provenance and supply-chain integrity.
description: SLSA is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: SLSA
keywords: software supply-chain levels
keywords: build provenance
keywords: supply-chain integrity
keywords: attestation
keywords: trusted build
usage example: Assess SLSA related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

SBOM
type: Term
break id: T0536
stix type: x-break-term
definition: A software bill of materials that lists the components, dependencies, and versions included in software.
description: SBOM is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: SBOM
keywords: software bill of materials
keywords: component inventory
keywords: dependency inventory
keywords: vulnerability impact
keywords: supply-chain visibility
usage example: Assess SBOM related exposure and define the corresponding controls.
related risks: SBOM Absence Hiding Vulnerability Impact
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Dependency Confusion
type: Term
break id: T0537
stix type: x-break-term
definition: A supply-chain attack in which a malicious public package with a matching name is chosen instead of the intended internal dependency.
description: Dependency Confusion is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Dependency Confusion
keywords: package namespace confusion
keywords: malicious dependency
keywords: internal package hijack
keywords: supply-chain attack
keywords: package resolution
usage example: Assess Dependency Confusion related exposure and define the corresponding controls.
related risks: Dependency Confusion and Malicious Package Poisoning
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Malicious Package
type: Term
break id: T0538
stix type: x-break-term
definition: A software package that contains hidden code for credential theft, backdoors, data exfiltration, or other abuse.
description: Malicious Package is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Malicious Package
keywords: package malware
keywords: dependency backdoor
keywords: credential stealing package
keywords: typosquatting package
keywords: supply-chain malware
usage example: Assess Malicious Package related exposure and define the corresponding controls.
related risks: Dependency Confusion and Malicious Package Poisoning
related risks: Automotive OTA Update Hijacking
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Lock File
type: Term
break id: T0539
stix type: x-break-term
definition: A file that records exact dependency versions and integrity metadata to make builds repeatable.
description: Lock File is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Lock File
keywords: dependency lock
keywords: version pinning
keywords: package integrity
keywords: repeatable build
keywords: dependency resolution
usage example: Assess Lock File related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Software Supply Chain
type: Term
break id: T0540
stix type: x-break-term
definition: The ecosystem of source code, dependencies, build systems, tools, artifacts, and release processes used to deliver software.
description: Software Supply Chain is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Software Supply Chain
keywords: build pipeline
keywords: dependency ecosystem
keywords: artifact provenance
keywords: release process
keywords: supplier risk
usage example: Assess Software Supply Chain related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Cloud IAM
type: Term
break id: T0541
stix type: x-break-term
definition: Cloud identity and access management controls for users, roles, service accounts, policies, and permissions.
description: Cloud IAM is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Cloud IAM
keywords: cloud identity
keywords: access policy
keywords: service account
keywords: role permission
keywords: least privilege
usage example: Assess Cloud IAM related exposure and define the corresponding controls.
related risks: Cloud IAM Over-Permissioning
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Temporary Credential
type: Term
break id: T0542
stix type: x-break-term
definition: A short-lived credential issued for bounded access, reducing exposure compared with long-lived secrets.
description: Temporary Credential is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Temporary Credential
keywords: short-lived credential
keywords: STS token
keywords: temporary access key
keywords: session credential
keywords: credential rotation
usage example: Assess Temporary Credential related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Object Storage Bucket
type: Term
break id: T0543
stix type: x-break-term
definition: A logical container in cloud object storage used to hold files, snapshots, logs, and other unstructured data.
description: Object Storage Bucket is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Object Storage Bucket
keywords: cloud bucket
keywords: object storage
keywords: public bucket
keywords: storage policy
keywords: bucket exposure
usage example: Assess Object Storage Bucket related exposure and define the corresponding controls.
related risks: API Object-Level Authorization Risk
related risks: Public Cloud Storage Bucket Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Configuration Drift
type: Term
break id: T0544
stix type: x-break-term
definition: A deviation between the actual runtime configuration and the approved security or operations baseline.
description: Configuration Drift is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Configuration Drift
keywords: baseline drift
keywords: cloud misconfiguration
keywords: configuration monitoring
keywords: posture drift
keywords: change detection
usage example: Assess Configuration Drift related exposure and define the corresponding controls.
related risks: Public Cloud Storage Bucket Exposure
related risks: Payment Tokenization Misconfiguration
related risks: Edge Function Configuration Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

SaaS
type: Term
break id: T0545
stix type: x-break-term
definition: Software as a service delivered through a provider-operated application and managed through tenant-level configuration.
description: SaaS is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: SaaS
keywords: software as a service
keywords: tenant configuration
keywords: cloud application
keywords: SaaS security
keywords: application permission
usage example: Assess SaaS related exposure and define the corresponding controls.
related risks: SaaS Third-Party App Authorization Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

OAuth Grant
type: Term
break id: T0546
stix type: x-break-term
definition: An authorization grant that lets an application access resources on behalf of a user or tenant.
description: OAuth Grant is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: OAuth Grant
keywords: authorization grant
keywords: OAuth consent
keywords: delegated access
keywords: access token
keywords: scope permission
usage example: Assess OAuth Grant related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Third-Party App Authorization
type: Term
break id: T0547
stix type: x-break-term
definition: Permission granted to an external application to access enterprise SaaS data, APIs, or account capabilities.
description: Third-Party App Authorization is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Third-Party App Authorization
keywords: third-party app grant
keywords: SaaS integration
keywords: OAuth app
keywords: external application access
keywords: consent review
usage example: Assess Third-Party App Authorization related exposure and define the corresponding controls.
related risks: API Bulk Call Resource Exhaustion
related risks: SaaS Third-Party App Authorization Abuse
related risks: Vehicle Data Interface Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Collaboration Document Shared Link
type: Term
break id: T0548
stix type: x-break-term
definition: A shareable URL that grants access to cloud documents, drive files, knowledge-base pages, or collaboration assets.
description: Collaboration Document Shared Link is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Collaboration Document Shared Link
keywords: shared document link
keywords: external sharing
keywords: cloud drive link
keywords: knowledge base share
keywords: public link
usage example: Assess Collaboration Document Shared Link related exposure and define the corresponding controls.
related risks: Collaborative Document Link Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

DLP
type: Term
break id: T0549
stix type: x-break-term
definition: Data loss prevention controls that detect, classify, restrict, and audit sensitive data movement.
description: DLP is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: DLP
keywords: data loss prevention
keywords: sensitive data control
keywords: outbound data monitoring
keywords: data exfiltration prevention
keywords: content inspection
usage example: Assess DLP related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Data Classification and Grading
type: Term
break id: T0550
stix type: x-break-term
definition: A governance practice that categorizes data by sensitivity, business value, and required protection level.
description: Data Classification and Grading is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Data Classification and Grading
keywords: data sensitivity
keywords: classification label
keywords: data protection level
keywords: information grading
keywords: data governance
usage example: Assess Data Classification and Grading related exposure and define the corresponding controls.
related risks: Public Cloud Storage Bucket Exposure
related risks: SaaS Third-Party App Authorization Abuse
related risks: Payment Tokenization Misconfiguration
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

PIA
type: Term
break id: T0551
stix type: x-break-term
definition: A privacy impact assessment used to identify privacy risks in a product, service, or data-processing activity.
description: PIA is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: PIA
keywords: privacy impact assessment
keywords: privacy risk review
keywords: personal data assessment
keywords: processing assessment
keywords: privacy compliance
usage example: Assess PIA related exposure and define the corresponding controls.
related risks: Shadow API Exposure Risk
related risks: API Object-Level Authorization Risk
related risks: API Bulk Call Resource Exhaustion
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

DPIA
type: Term
break id: T0552
stix type: x-break-term
definition: A data protection impact assessment used to evaluate high-risk personal-data processing and mitigation measures.
description: DPIA is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: DPIA
keywords: data protection impact assessment
keywords: high-risk processing
keywords: privacy risk mitigation
keywords: GDPR assessment
keywords: processing controls
usage example: Assess DPIA related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Purpose Limitation
type: Term
break id: T0553
stix type: x-break-term
definition: A privacy principle requiring data to be used only for specified, explicit, and legitimate purposes.
description: Purpose Limitation is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Purpose Limitation
keywords: data use limitation
keywords: privacy principle
keywords: authorized purpose
keywords: data minimization
keywords: processing purpose
usage example: Assess Purpose Limitation related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Data Broker
type: Term
break id: T0554
stix type: x-break-term
definition: An organization or individual that collects, aggregates, processes, shares, or sells data from multiple sources.
description: Data Broker is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Data Broker
keywords: data reseller
keywords: data aggregator
keywords: third-party data market
keywords: data enrichment
keywords: data trading
usage example: Assess Data Broker related exposure and define the corresponding controls.
related risks: Public Cloud Storage Bucket Exposure
related risks: SaaS Third-Party App Authorization Abuse
related risks: Payment Tokenization Misconfiguration
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Payment Tokenization
type: Term
break id: T0555
stix type: x-break-term
definition: A payment protection technique that replaces sensitive card or account data with a tokenized substitute.
description: Payment Tokenization is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Payment Tokenization
keywords: payment token
keywords: card token
keywords: token vault
keywords: PAN replacement
keywords: payment security
usage example: Assess Payment Tokenization related exposure and define the corresponding controls.
related risks: Webhook Forgery and Event Replay
related risks: Payment Tokenization Misconfiguration
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Chargeback
type: Term
break id: T0556
stix type: x-break-term
definition: A payment reversal initiated through a card issuer or payment network after a dispute.
description: Chargeback is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Chargeback
keywords: payment dispute
keywords: transaction reversal
keywords: card dispute
keywords: issuer dispute
keywords: chargeback fraud
usage example: Assess Chargeback related exposure and define the corresponding controls.
related risks: Chargeback and Refund Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Refund Fraud
type: Term
break id: T0557
stix type: x-break-term
definition: Abuse of refund, return, after-sales, or claim processes to obtain improper compensation.
description: Refund Fraud is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Refund Fraud
keywords: refund abuse
keywords: return fraud
keywords: after-sales fraud
keywords: claims fraud
keywords: improper refund
usage example: Assess Refund Fraud related exposure and define the corresponding controls.
related risks: Merchant Cash-Out and Fake Transaction Fraud
related risks: Chargeback and Refund Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Merchant Cash-Out
type: Term
break id: T0558
stix type: x-break-term
definition: A fraud pattern in which merchants use fake or circular transactions to convert payment channels into cash.
description: Merchant Cash-Out is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Merchant Cash-Out
keywords: fake merchant transaction
keywords: circular transaction
keywords: payment cash-out
keywords: merchant collusion
keywords: cash-out fraud
usage example: Assess Merchant Cash-Out related exposure and define the corresponding controls.
related risks: Merchant Cash-Out and Fake Transaction Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Fake Transaction
type: Term
break id: T0559
stix type: x-break-term
definition: A fabricated or collusive transaction used to inflate activity, move funds, earn rewards, or bypass controls.
description: Fake Transaction is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Fake Transaction
keywords: synthetic transaction
keywords: collusive order
keywords: transaction inflation
keywords: fake order
keywords: payment fraud
usage example: Assess Fake Transaction related exposure and define the corresponding controls.
related risks: Webhook Forgery and Event Replay
related risks: Merchant Cash-Out and Fake Transaction Fraud
related risks: Chargeback and Refund Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Ad Attribution
type: Term
break id: T0560
stix type: x-break-term
definition: The process of assigning credit for installs, purchases, registrations, or conversions to marketing touchpoints.
description: Ad Attribution is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Ad Attribution
keywords: conversion attribution
keywords: install attribution
keywords: marketing touchpoint
keywords: attribution model
keywords: ad measurement
usage example: Assess Ad Attribution related exposure and define the corresponding controls.
related risks: Ad Click Injection
related risks: Mobile App Repackaging Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Click Injection
type: Term
break id: T0561
stix type: x-break-term
definition: A mobile attribution fraud technique that inserts fake clicks shortly before conversion to steal credit.
description: Click Injection is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Click Injection
keywords: mobile attribution fraud
keywords: fake click
keywords: last-click hijacking
keywords: install hijack
keywords: ad fraud
usage example: Assess Click Injection related exposure and define the corresponding controls.
related risks: Ad Click Injection
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Install Farm
type: Term
break id: T0562
stix type: x-break-term
definition: A group of devices, emulators, or scripted environments used to generate fake installs and engagement.
description: Install Farm is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Install Farm
keywords: device farm
keywords: fake install
keywords: emulator farm
keywords: synthetic engagement
keywords: mobile ad fraud
usage example: Assess Install Farm related exposure and define the corresponding controls.
related risks: Ad Click Injection
related risks: Fake Conversion and Install Farm
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Affiliate Marketing
type: Term
break id: T0563
stix type: x-break-term
definition: A channel model in which partners are paid for referred traffic, leads, conversions, or sales.
description: Affiliate Marketing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Affiliate Marketing
keywords: affiliate channel
keywords: referral commission
keywords: partner traffic
keywords: conversion payout
keywords: performance marketing
usage example: Assess Affiliate Marketing related exposure and define the corresponding controls.
related risks: Affiliate Marketing Commission Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Commission Fraud
type: Term
break id: T0564
stix type: x-break-term
definition: Abuse of commission rules through fake traffic, self-dealing, hijacking, or manipulated conversions.
description: Commission Fraud is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Commission Fraud
keywords: affiliate fraud
keywords: fake conversion
keywords: commission abuse
keywords: self-dealing
keywords: traffic fraud
usage example: Assess Commission Fraud related exposure and define the corresponding controls.
related risks: Affiliate Marketing Commission Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Cookie Stuffing
type: Term
break id: T0565
stix type: x-break-term
definition: A fraud technique that places tracking cookies without genuine user intent to steal affiliate attribution.
description: Cookie Stuffing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Cookie Stuffing
keywords: affiliate cookie abuse
keywords: forced tracking cookie
keywords: attribution theft
keywords: commission hijacking
keywords: browser stuffing
usage example: Assess Cookie Stuffing related exposure and define the corresponding controls.
related risks: Affiliate Marketing Commission Fraud
related risks: Session Token Replay
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Landing Page Hijacking
type: Term
break id: T0566
stix type: x-break-term
definition: A tactic that diverts or manipulates landing pages to capture traffic, credentials, conversions, or commissions.
description: Landing Page Hijacking is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Landing Page Hijacking
keywords: traffic diversion
keywords: landing page tampering
keywords: conversion hijack
keywords: phishing landing page
keywords: affiliate hijack
usage example: Assess Landing Page Hijacking related exposure and define the corresponding controls.
related risks: Affiliate Marketing Commission Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

RAG
type: Term
break id: T0567
stix type: x-break-term
definition: Retrieval-augmented generation, where a model retrieves external knowledge and uses it as context for generation.
description: RAG is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: RAG
keywords: retrieval augmented generation
keywords: knowledge retrieval
keywords: LLM context
keywords: vector search
keywords: grounded generation
usage example: Assess RAG related exposure and define the corresponding controls.
related risks: RAG Unauthorized Retrieval
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Vector Database
type: Term
break id: T0568
stix type: x-break-term
definition: A database optimized for storing embeddings and performing similarity search over unstructured content.
description: Vector Database is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Vector Database
keywords: embedding database
keywords: similarity search
keywords: vector index
keywords: nearest neighbor search
keywords: semantic retrieval
usage example: Assess Vector Database related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Knowledge-Base Permission
type: Term
break id: T0569
stix type: x-break-term
definition: Access rules that determine which users, roles, or tenants can retrieve specific knowledge-base content.
description: Knowledge-Base Permission is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Knowledge-Base Permission
keywords: document permission
keywords: RAG access control
keywords: tenant isolation
keywords: knowledge authorization
keywords: content ACL
usage example: Assess Knowledge-Base Permission related exposure and define the corresponding controls.
related risks: Collaborative Document Link Exposure
related risks: RAG Unauthorized Retrieval
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Prompt Injection
type: Term
break id: T0570
stix type: x-break-term
definition: An attack that places instructions in user input or external content to override intended model behavior.
description: Prompt Injection is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Prompt Injection
keywords: instruction override
keywords: LLM jailbreak
keywords: external content injection
keywords: tool-call manipulation
keywords: prompt attack
usage example: Assess Prompt Injection related exposure and define the corresponding controls.
related risks: Sensitive Information Leakage in Model Output
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Training Data Poisoning
type: Term
break id: T0571
stix type: x-break-term
definition: Manipulation of training, feedback, or labeling data to influence model behavior.
description: Training Data Poisoning is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Training Data Poisoning
keywords: data poisoning
keywords: poisoned dataset
keywords: label poisoning
keywords: feedback poisoning
keywords: model manipulation
usage example: Assess Training Data Poisoning related exposure and define the corresponding controls.
related risks: Training Data Copyright and Licensing Risk
related risks: Training Data Poisoning Risk
related risks: Sensitive Information Leakage in Model Output
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Model Output Audit
type: Term
break id: T0572
stix type: x-break-term
definition: Review and monitoring of model outputs for safety, privacy, compliance, accuracy, and policy violations.
description: Model Output Audit is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Model Output Audit
keywords: AI output review
keywords: model monitoring
keywords: safety evaluation
keywords: privacy leakage test
keywords: hallucination review
usage example: Assess Model Output Audit related exposure and define the corresponding controls.
related risks: Missing Privacy Impact Assessment
related risks: Training Data Poisoning Risk
related risks: Sensitive Information Leakage in Model Output
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Model Hallucination
type: Term
break id: T0573
stix type: x-break-term
definition: A model output that appears plausible but is unsupported, incorrect, fabricated, or misleading.
description: Model Hallucination is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Model Hallucination
keywords: fabricated output
keywords: unsupported answer
keywords: LLM hallucination
keywords: false generation
keywords: model reliability
usage example: Assess Model Hallucination related exposure and define the corresponding controls.
related risks: Missing Privacy Impact Assessment
related risks: Training Data Poisoning Risk
related risks: Sensitive Information Leakage in Model Output
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

MFA Fatigue
type: Term
break id: T0574
stix type: x-break-term
definition: A social-engineering tactic that repeatedly triggers MFA prompts until a user approves one by mistake.
description: MFA Fatigue is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: MFA Fatigue
keywords: push fatigue
keywords: MFA bombing
keywords: approval fatigue
keywords: number matching
keywords: account takeover
usage example: Assess MFA Fatigue related exposure and define the corresponding controls.
related risks: MFA Fatigue Attack
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Push Bombing
type: Term
break id: T0575
stix type: x-break-term
definition: Repeated delivery of authentication or approval prompts intended to pressure users into consent.
description: Push Bombing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Push Bombing
keywords: authentication prompt spam
keywords: MFA push attack
keywords: approval bombing
keywords: push fatigue
keywords: social engineering
usage example: Assess Push Bombing related exposure and define the corresponding controls.
related risks: MFA Fatigue Attack
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Session Token
type: Term
break id: T0576
stix type: x-break-term
definition: A credential representing an authenticated session, often stored in a cookie or bearer token.
description: Session Token is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Session Token
keywords: session credential
keywords: bearer token
keywords: cookie token
keywords: authentication token
keywords: login session
usage example: Assess Session Token related exposure and define the corresponding controls.
related risks: Session Token Replay
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Cookie Replay
type: Term
break id: T0577
stix type: x-break-term
definition: Reuse of a stolen session cookie to impersonate a user from another client or device.
description: Cookie Replay is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Cookie Replay
keywords: session cookie replay
keywords: stolen cookie
keywords: session hijacking
keywords: browser token replay
keywords: cookie theft
usage example: Assess Cookie Replay related exposure and define the corresponding controls.
related risks: Affiliate Marketing Commission Fraud
related risks: Session Token Replay
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Token Binding
type: Term
break id: T0578
stix type: x-break-term
definition: A control that binds a token to a device, client, network, or cryptographic proof to limit replay.
description: Token Binding is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Token Binding
keywords: bound token
keywords: device-bound credential
keywords: proof-of-possession token
keywords: replay prevention
keywords: session binding
usage example: Assess Token Binding related exposure and define the corresponding controls.
related risks: Session Token Replay
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Mobile App Repackaging
type: Term
break id: T0579
stix type: x-break-term
definition: Modification and redistribution of a mobile app package after decompilation, patching, and resigning.
description: Mobile App Repackaging is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Mobile App Repackaging
keywords: APK repackaging
keywords: app tampering
keywords: fake app
keywords: resigned app
keywords: mobile malware
usage example: Assess Mobile App Repackaging related exposure and define the corresponding controls.
related risks: Mobile App Repackaging Fraud
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

APK Signing
type: Term
break id: T0580
stix type: x-break-term
definition: The signing process that lets Android verify the publisher and integrity of an application package.
description: APK Signing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: APK Signing
keywords: Android signing
keywords: app signature
keywords: package integrity
keywords: signing certificate
keywords: APK verification
usage example: Assess APK Signing related exposure and define the corresponding controls.
related risks: Shadow API Exposure Risk
related risks: API Object-Level Authorization Risk
related risks: API Bulk Call Resource Exhaustion
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Runtime Protection
type: Term
break id: T0581
stix type: x-break-term
definition: Controls that detect or resist tampering, hooking, debugging, emulation, and runtime manipulation.
description: Runtime Protection is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Runtime Protection
keywords: anti-tampering
keywords: hook detection
keywords: debugger detection
keywords: emulator detection
keywords: mobile runtime security
usage example: Assess Runtime Protection related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

CDN Cache Key
type: Term
break id: T0582
stix type: x-break-term
definition: The request attributes used by a CDN to decide whether two requests map to the same cached object.
description: CDN Cache Key is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: CDN Cache Key
keywords: cache key
keywords: CDN caching
keywords: vary header
keywords: cache partitioning
keywords: web cache security
usage example: Assess CDN Cache Key related exposure and define the corresponding controls.
related risks: CI/CD Pipeline Credential Exposure
related risks: CDN Cache Poisoning
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Cache Poisoning
type: Term
break id: T0583
stix type: x-break-term
definition: An attack that causes a cache to store and serve attacker-controlled or incorrect content.
description: Cache Poisoning is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Cache Poisoning
keywords: web cache poisoning
keywords: CDN cache poisoning
keywords: header pollution
keywords: cache key confusion
keywords: cached content tampering
usage example: Assess Cache Poisoning related exposure and define the corresponding controls.
related risks: CDN Cache Poisoning
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Edge Function
type: Term
break id: T0584
stix type: x-break-term
definition: Code executed at CDN or edge locations to transform requests, responses, authentication, or routing.
description: Edge Function is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Edge Function
keywords: serverless edge
keywords: CDN function
keywords: edge compute
keywords: request transformation
keywords: edge routing
usage example: Assess Edge Function related exposure and define the corresponding controls.
related risks: CDN Cache Poisoning
related risks: Edge Function Configuration Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

WAF Rule
type: Term
break id: T0585
stix type: x-break-term
definition: A web application firewall rule used to detect, block, challenge, or log suspicious HTTP traffic.
description: WAF Rule is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: WAF Rule
keywords: web application firewall
keywords: HTTP filtering rule
keywords: attack signature
keywords: traffic challenge
keywords: request blocking
usage example: Assess WAF Rule related exposure and define the corresponding controls.
related risks: Edge Function Configuration Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

OTA Update
type: Term
break id: T0586
stix type: x-break-term
definition: An over-the-air software or firmware update delivered remotely to devices or vehicles.
description: OTA Update is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: OTA Update
keywords: over-the-air update
keywords: remote firmware update
keywords: vehicle OTA
keywords: device update
keywords: software rollout
usage example: Assess OTA Update related exposure and define the corresponding controls.
related risks: Automotive OTA Update Hijacking
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Firmware Signing
type: Term
break id: T0587
stix type: x-break-term
definition: A cryptographic control that verifies firmware origin and integrity before installation or execution.
description: Firmware Signing is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Firmware Signing
keywords: firmware signature
keywords: secure boot
keywords: code signing
keywords: firmware integrity
keywords: trusted update
usage example: Assess Firmware Signing related exposure and define the corresponding controls.
related risks: Automotive OTA Update Hijacking
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Diagnostic Interface
type: Term
break id: T0588
stix type: x-break-term
definition: A maintenance interface used to inspect, configure, test, or update devices and vehicle systems.
description: Diagnostic Interface is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Diagnostic Interface
keywords: maintenance interface
keywords: vehicle diagnostics
keywords: device diagnostics
keywords: service port
keywords: UDS diagnostics
usage example: Assess Diagnostic Interface related exposure and define the corresponding controls.
related risks: Vehicle Data Interface Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Connected-Vehicle API
type: Term
break id: T0589
stix type: x-break-term
definition: An API that exposes vehicle status, location, remote-control, diagnostics, or service capabilities.
description: Connected-Vehicle API is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Connected-Vehicle API
keywords: vehicle API
keywords: remote vehicle control
keywords: vehicle status API
keywords: telematics API
keywords: car data access
usage example: Assess Connected-Vehicle API related exposure and define the corresponding controls.
related risks: Vehicle Data Interface Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

V2X Certificate
type: Term
break id: T0590
stix type: x-break-term
definition: A certificate used to authenticate vehicle-to-everything communications and related trust relationships.
description: V2X Certificate is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: V2X Certificate
keywords: vehicle certificate
keywords: V2X trust
keywords: connected-vehicle PKI
keywords: message authentication
keywords: transport security
usage example: Assess V2X Certificate related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

DID
type: Term
break id: T0591
stix type: x-break-term
definition: A decentralized identifier that enables verifiable, self-managed digital identity without a central registry dependency.
description: DID is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: DID
keywords: decentralized identifier
keywords: self-sovereign identity
keywords: DID document
keywords: identifier resolution
keywords: identity proof
usage example: Assess DID related exposure and define the corresponding controls.
related risks: Decentralized Identity Credential Forgery
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Verifiable Credential
type: Term
break id: T0592
stix type: x-break-term
definition: A tamper-evident credential whose issuer, subject, claims, and status can be cryptographically verified.
description: Verifiable Credential is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Verifiable Credential
keywords: VC
keywords: digital credential
keywords: credential proof
keywords: issuer signature
keywords: verifiable claim
usage example: Assess Verifiable Credential related exposure and define the corresponding controls.
related risks: Decentralized Identity Credential Forgery
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

VC Revocation
type: Term
break id: T0593
stix type: x-break-term
definition: A mechanism for invalidating or checking the current validity status of a verifiable credential.
description: VC Revocation is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: VC Revocation
keywords: credential revocation
keywords: revocation registry
keywords: credential status
keywords: VC validity
keywords: issuer revocation
usage example: Assess VC Revocation related exposure and define the corresponding controls.
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Decentralized Identity
type: Term
break id: T0594
stix type: x-break-term
definition: An identity model based on decentralized identifiers, verifiable credentials, and user-controlled proof presentation.
description: Decentralized Identity is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Decentralized Identity
keywords: DID identity
keywords: verifiable credentials
keywords: self-managed identity
keywords: identity wallet
keywords: trust registry
usage example: Assess Decentralized Identity related exposure and define the corresponding controls.
related risks: Decentralized Identity Credential Forgery
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Supplier Remote Access
type: Term
break id: T0595
stix type: x-break-term
definition: Remote access granted to third-party suppliers for maintenance, support, integration, or operations work.
description: Supplier Remote Access is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Supplier Remote Access
keywords: vendor remote access
keywords: third-party VPN
keywords: remote maintenance
keywords: supplier account
keywords: privileged access
usage example: Assess Supplier Remote Access related exposure and define the corresponding controls.
related risks: SBOM Absence Hiding Vulnerability Impact
related risks: Unauthorized Use of Shared Data
related risks: Vendor Remote Access Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Third-Party Operations
type: Term
break id: T0596
stix type: x-break-term
definition: Operational activities performed by external service providers, integrators, or maintenance teams.
description: Third-Party Operations is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Third-Party Operations
keywords: external operations
keywords: managed service provider
keywords: outsourced maintenance
keywords: third-party support
keywords: vendor operations
usage example: Assess Third-Party Operations related exposure and define the corresponding controls.
related risks: API Bulk Call Resource Exhaustion
related risks: SaaS Third-Party App Authorization Abuse
related risks: Vehicle Data Interface Abuse
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Customer Success System
type: Term
break id: T0597
stix type: x-break-term
definition: A system used to manage customer adoption, support signals, health scores, and engagement workflows.
description: Customer Success System is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Customer Success System
keywords: customer success platform
keywords: customer health score
keywords: customer engagement
keywords: support workflow
keywords: account management
usage example: Assess Customer Success System related exposure and define the corresponding controls.
related risks: SaaS Third-Party App Authorization Abuse
related risks: Customer Success and Support Ticket Data Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

CRM Data
type: Term
break id: T0598
stix type: x-break-term
definition: Customer relationship management data such as contacts, account records, opportunities, notes, and interaction history.
description: CRM Data is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: CRM Data
keywords: customer relationship data
keywords: contact records
keywords: account history
keywords: sales notes
keywords: customer profile
usage example: Assess CRM Data related exposure and define the corresponding controls.
related risks: Customer Success and Support Ticket Data Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Ticketing System
type: Term
break id: T0599
stix type: x-break-term
definition: A system for recording, assigning, tracking, and resolving support or operations cases.
description: Ticketing System is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Ticketing System
keywords: support ticket
keywords: case management
keywords: helpdesk system
keywords: incident ticket
keywords: service request
usage example: Assess Ticketing System related exposure and define the corresponding controls.
related risks: Customer Success and Support Ticket Data Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

Customer Support Data Leakage
type: Term
break id: T0600
stix type: x-break-term
definition: Exposure or unauthorized export of customer information contained in support, ticket, or service workflows.
description: Customer Support Data Leakage is used to identify related risks, abuse patterns, control requirements, and operational signals in BREAK business-security analysis.
category: Business Security
keywords: Customer Support Data Leakage
keywords: support data leak
keywords: ticket data exposure
keywords: customer privacy leak
keywords: support screenshot leakage
keywords: CRM data exposure
usage example: Assess Customer Support Data Leakage related exposure and define the corresponding controls.
related risks: Customer Success and Support Ticket Data Exposure
related business scenes: BS00
citation: NIST Cybersecurity Framework 2.0
updated: 2026-06-17
version: 1

When Handshakes Tell the Truth: Detecting Web Bad Bots via TLS Fingerprinting
type: Case
break id: C0001
stix type: report
summary: An academic paper proposes using TLS fingerprinting, specifically the JA4 method, to detect malicious automation programs (bad bots) at the protocol level. By analyzing protocol characteristics during the TLS handshake, the approach distinguishes automated scripts from real users, serving as a protocol-level detection technique for automated behavior.
case category: academic_research
keywords: TLS fingerprinting
keywords: JA4
keywords: bad bot detection
keywords: automated scripts
keywords: protocol characteristics
keywords: TLS handshake
keywords: network traffic analysis
keywords: bot mitigation
related risks: Protocol-Level Automation
related attack tools: Automation Scripts
related threat actors: Scraping Gangs
citation: When Handshakes Tell the Truth: Detecting Web Bad Bots via TLS
updated: 2026-06-18
version: 1

Login Replay Attack Example: Eavesdropper Impersonates User Without Decryption
type: Case
break id: C0002
stix type: report
summary: In a typical web login flow, user passwords are submitted after MD5 hashing. An attacker intercepts the login URL containing the MD5-hashed password and account, then replays the captured request directly to the server without decrypting the plaintext. This successfully impersonates the user and gains system access, exposing the risk of protocol-level automated replay.
case category: security_incident
incident time: 2022-11
keywords: login replay attack
keywords: MD5 hashing
keywords: request replay
keywords: replay vulnerability
keywords: man-in-the-middle
keywords: session hijacking
keywords: credential replay
keywords: web authentication flaw
keywords: automated replay attack
related risks: Protocol-Level Automation
related attack tools: Packet Capture Tools
related attack tools: Packet Sending/Modification Tools
citation: What Is a Replay Attack? - Amazon Web Services
updated: 2026-06-18
version: 1

Foot Bath Shop Replay Attack Analogy: Repeating Valid Requests to Deceive Systems
type: Case
break id: C0003
stix type: report
summary: Using a foot bath shop membership scenario, a customer states their card number to request service. The conversation is overheard, and a bystander repeats the same request with the card number and signature to receive service. This illustrates the essence of a replay attack: an attacker does not need to understand or modify the message content, but simply retransmits intercepted valid data as-is t
case category: academic_research
incident time: 2021-05
keywords: replay attack
keywords: request replay
keywords: protocol security
keywords: authentication bypass
keywords: message interception
keywords: signature verification
keywords: foot bath shop analogy
keywords: blog garden
related risks: Protocol-Level Automation
citation: Interviewer: What Is Request Replay? - why technology - Blog Park
updated: 2026-06-18
version: 1

Cloudflare Finds 31% of APIs Are Shadow APIs
type: Case
break id: C0004
stix type: report
summary: Cloudflare's machine learning models discovered that organizations have 31% more API endpoints than they self-report. These undocumented and unmanaged shadow APIs create a large invisible attack surface, often introduced unintentionally through frequent code changes, and if exploited could lead to data leaks and unpatched vulnerabilities.
case category: news_report
incident time: 2024-02
keywords: shadow APIs
keywords: Cloudflare
keywords: API endpoint discovery
keywords: attack surface management
keywords: machine learning
keywords: unmanaged APIs
keywords: data leaks
keywords: API sprawl
related risks: Protocol-Level Automation
citation: theNET | Three Ways to Stay Ahead of New API Threats | Cloudflare
updated: 2026-06-18
version: 1

China's First 'AI Game Cheat' Case: Simulating Player Actions to Cheat
type: Case
break id: C0005
stix type: report
summary: This case involves a new type of game cheat that does not directly modify game data. Instead, it uses a trained AI model to perceive humanoid outlines on the screen and automatically controls the mouse to smoothly move to the target outline, simulating real player actions. This automated simulation was used for cheating in games, sparking widespread discussion on whether it constitutes a criminal
case category: news_report
incident time: 2025-07
keywords: AI game cheat
keywords: automated simulator
keywords: screen perception
keywords: humanoid outline detection
keywords: game cheating
keywords: criminal offense
keywords: AI model
keywords: mouse control
related risks: Automated Simulator
related attack tools: Game Cheats
related attack tools: Malicious AI Applications
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related threat actors: Malicious Players
related threat actors: AI Tool Abusers
citation: How the Nation's First 'AI Cheat' Case Was Cracked? Still Want to Buy Cheats? Check This Out - Xinhua News Client
updated: 2026-06-18
version: 1

SEO Rank Manipulation Black Market: Exploiting Emulators for Fake Clicks to Deceive Search Engines
type: Case
break id: C0006
stix type: report
summary: The report exposes the technical methods used in SEO rank manipulation crimes. Black market groups employ traffic generation tools to simulate user clicks, but these tools fail to replicate personalized search behavior under logged-in states, with all clicks originating from anonymous, non-authenticated environments. Furthermore, one group was automatically blocked by a search engine's anti-fraud
case category: news_report
keywords: SEO manipulation
keywords: fake clicks
keywords: search engine anti-fraud
keywords: emulators
keywords: click fraud
keywords: anonymous environment
keywords: device fingerprinting
keywords: traffic generation
related risks: Automated Simulator
related attack tools: Mobile Phone Emulator
related attack tools: Click Simulation Tools
related threat actors: Criminal Organizations
citation: SEO Ranking Fraud Criminal Black Industry Chain: Fake Clicks Deceive Users, Website Ranking Trading Black Market
updated: 2026-06-18
version: 1

Criminalization of Game Cheats: Legal Disputes over Simulated Manual Operation Scripts
type: Case
break id: C0007
stix type: report
summary: This material examines the conviction and sentencing standards for game cheats, highlighting a specific category of 'simulated manual operation scripts.' These scripts automate gameplay by recording a fixed sequence of keystrokes and replaying them. The article notes that controversy exists over whether such scripts, which merely mimic human input without tampering with game data or logic, should
case category: academic_research
incident time: 2024-05
keywords: game cheat
keywords: simulated manual operation
keywords: script
keywords: conviction and sentencing
keywords: legal characterization
keywords: automation simulator
keywords: keystroke sequence
keywords: cheat criminalization
related risks: Automated Simulator
related attack tools: Game Cheats
related attack tools: Automation Scripts
citation: Criminal Law Regulation of the Online Game Cheat Industry Chain
updated: 2026-06-18
version: 1

Selling Game Bots for Over 5 Million Yuan Leads to Criminal Sentence
type: Case
break id: C0008
stix type: report
summary: Defendant Huang, seeking to increase in-game gold farming profits, self-taught programming and independently wrote a game bot script in 2019 to automate gold farming. The court convicted Huang of providing programs for the illegal control of computer information systems, sentencing him to 3 years in prison suspended for 5 years, a fine of 300,000 yuan, and confiscation of 5.56 million yuan in ille
case category: criminal_verdict
incident time: 2023-08
keywords: game bot script
keywords: automated gold farming
keywords: illegal control of computer systems
keywords: providing intrusion programs
keywords: suspended sentence
keywords: confiscation of illegal gains
keywords: Huang
related risks: Process Automation
related attack tools: Game Cheats
related threat actors: Gold Farming Studios
citation: Explaining Law Through Cases: Writing and Selling 'Game Cheats' Illegally Profited Over 5 Million Yuan, Sentenced!
updated: 2026-06-18
version: 1

Game Cheat Developer Wen Sentenced for Automating Unfair Gameplay
type: Case
break id: C0009
stix type: report
summary: Law enforcement investigation found that suspect Wen developed a custom auxiliary script for a specific game and embedded it into the game environment. The script interfered with normal game processes through automation, undermining game fairness. Wen was subsequently convicted and sentenced for related criminal offenses.
case category: criminal_verdict
incident time: 2024-09
keywords: game cheat
keywords: auxiliary script
keywords: disrupting computer information system
keywords: game fairness
keywords: automated script
keywords: criminal sentencing
keywords: game security
keywords: conviction
related risks: Process Automation
related attack tools: Automation Scripts
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: 2024 Cybersecurity Awareness Week: Illegal Acquisition of Computer Information System Data
citation: Wen So-and-So Sentenced for This Matter
updated: 2026-06-18
version: 1

Automated Crawler Attack on Government Server Causes System Paralysis
type: Case
break id: C0010
stix type: report
summary: On May 2, 2018, a software launched high-frequency automated queries against the Shenzhen residence permit system within two hours, reaching 183 requests per second and totaling over 1.51 million queries. The scraped data was saved to cloud storage. The automated attack caused the Shenzhen Public Security Bureau's residence permit service platform server to become overloaded and unable to operate
case category: criminal_verdict
incident time: 2018-05
keywords: web scraping attack
keywords: government server overload
keywords: Shenzhen residence permit system
keywords: 183 requests per second
keywords: high-frequency automated queries
keywords: server paralysis
keywords: cloud storage data exfiltration
keywords: illegal data acquisition
keywords: programmer conviction
keywords: residence permit platform DDoS
related risks: Process Automation
related attack tools: Web Scraping Tools
related attack tools: Automation Scripts
related threat actors: Scraping Gangs
citation: Yang and Zhang Computer Information System Sabotage Case
citation: ...3 Years, a Programmer Sentenced to 18 Months: Crawler Software Automated Attacks on Government Servers
citation: Crawler software automated attacks on government servers caused server blockage and system paralysis
updated: 2026-06-18
version: 1

Research on Coupon Code Enumeration Vulnerabilities in E-Commerce Platforms
type: Case
break id: C0011
stix type: report
summary: A study on e-commerce platform security weaknesses reveals that attackers can enumerate all valid coupon codes by brute-forcing coupon IDs.
case category: academic_research
keywords: coupon enumeration
keywords: brute-force attack
keywords: ID enumeration
keywords: e-commerce security
keywords: coupon code
keywords: attack vector
keywords: web security
related risks: Coupon Enumeration
related attack tools: Automation Scripts
related attack tools: Credential Stuffing Tools
citation: All Your Shops Are Belong to Us: Security Weaknesses in E-Commerce Platforms
updated: 2026-06-18
version: 1

Shanghai Crackdown on Consumer Voucher Fraud Leads to 18 Arrests
type: Case
break id: C0012
stix type: report
summary: On January 18, 2025, Shanghai police, in coordination with relevant authorities, dismantled two criminal cases involving consumer voucher fraud and arrested 18 suspects. The schemes involved posting online offers to buy vouchers, instructing others to alter IP addresses for cross-location voucher grabbing, bulk purchasing dining vouchers, and fabricating transactions to fraudulently obtain governm
case category: criminal_verdict
incident time: 2024-11
keywords: consumer voucher fraud
keywords: fabricated transactions
keywords: IP address manipulation
keywords: cross-location voucher grabbing
keywords: Shanghai police
keywords: targeted strike
keywords: dining vouchers
keywords: subsidy fraud
keywords: voucher scalping
related risks: Coupon Enumeration
related risks: Coupon Restriction Bypass
related attack tools: GPS Spoofing Tools
related attack tools: Risk IP Addresses
related threat actors: Freebie Hunters
citation: Shanghai police crack down on crimes involving consumer vouchers
citation: Shanghai police cracked two consumer voucher crime cases; 18 people suspected of illegally grabbing vouchers
citation: Shanghai police cracked two consumer voucher crime cases and arrested 18 suspects
updated: 2026-06-18
version: 1

Shanghai Putuo Dismantles Criminal Gang Exploiting Fake Orders to Defraud Platform Subsidies
type: Case
break id: C0013
stix type: report
summary: In June 2025, Shanghai Putuo police cracked a case involving malicious fake orders to defraud subsidies. The criminal gang infiltrated the backend system of an enterprise internet platform, purchased large quantities of delisted coupons, and obtained platform subsidies through fictitious transactions. The scheme involved exploiting system vulnerabilities to acquire coupon codes in bulk and conduct
case category: criminal_verdict
incident time: 2025-06
keywords: malicious fake orders
keywords: subsidy fraud
keywords: coupon arbitrage
keywords: system vulnerability
keywords: internet platform backend
keywords: fictitious transactions
keywords: Shanghai Putuo police
keywords: coupon codes
keywords: bulk acquisition
related risks: Coupon Enumeration
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Freebie Hunters
citation: Procuratorate Daily: a gray chain of order brushing for subsidies
citation: Shanghai Putuo police dismantle criminal gang exploiting fake orders to defraud subsidies
updated: 2026-06-18
version: 1

Merchant Sentenced for Defrauding Government-Issued Consumer Vouchers
type: Case
break id: C0014
stix type: report
summary: In early 2023, a district in Shenzhen launched a promotional campaign issuing consumer vouchers. Xu, the legal representative of Company A, operated a swimming pool that participated in the campaign and fraudulently obtained voucher subsidies through fictitious transactions. This involved using voucher codes to fabricate transactions to steal government subsidies.
case category: criminal_verdict
incident time: 2023-01
keywords: consumer voucher fraud
keywords: fictitious transactions
keywords: government subsidy fraud
keywords: swimming pool
keywords: Xu
keywords: voucher code abuse
keywords: subsidy theft
keywords: criminal verdict
related risks: Coupon Enumeration
related threat actors: Malicious Merchants
citation: Defrauding Consumer Voucher Subsidies? Merchant Sentenced! - China Court Network
citation: Defrauding consumer voucher subsidies? Merchant sentenced!
updated: 2026-06-18
version: 1

GitHub Project: Online Auction Fraudulent Bid Bot Detection
type: Case
break id: C0015
stix type: report
summary: This project implements an end-to-end MLOps pipeline for detecting fraudulent (bot) bidding behavior in online auctions. It uses the 'Facebook Recruiting IV: Human or Robot?' dataset from Kaggle to identify automated bot-submitted bids, addressing the threat of automated sniping bids faced by online auction platforms.
case category: academic_research
keywords: online auction
keywords: bid bot detection
keywords: MLOps pipeline
keywords: fraudulent bidding
keywords: Facebook Recruiting IV
keywords: Kaggle dataset
keywords: automated bidding
keywords: sniping bid
keywords: GitHub open source
related risks: Instant Bid Sniping
citation: GitHub - fakhrulfaiz/bid-bot-detection: An End-to-End MLOps Pipeline to ...
updated: 2026-06-18
version: 1

Sniping Attack in Auction Process Allows Attackers to Manipulate Bids
type: Case
break id: C0016
stix type: report
summary: An attacker exploits a sniping attack during the auction process by calling cancelBid() after each bid to cancel the previous bid, enabling them to acquire any token at an extremely low cost. This vulnerability allows attackers to front-run bids and manipulate auction outcomes through unfair automated means.
case category: vulnerability_advisory
keywords: sniping attack
keywords: auction vulnerability
keywords: cancelBid
keywords: front-running
keywords: NextGen
keywords: smart contract
keywords: bid manipulation
keywords: automated attack
keywords: Code4rena
related risks: Instant Bid Sniping
related attack tools: Automation Scripts
related attack tools: DeFi Attack Scripts
related threat actors: DeFi Protocol Attackers
citation: Sniping Attack During the Auction Process Allows Attackers to ... - GitHub
updated: 2026-06-18
version: 1

FH6 Auction House Sniper
type: Case
break id: C0017
stix type: report
summary: An automated auction house sniping tool designed for Forza Horizon 6. It monitors user-specified vehicles in the auction house, instantly executes buyouts when a listing appears, collects the acquired cars, and repeats the cycle. The tool claims to successfully snipe a car within 5 minutes with an approximate 10% success rate.
case category: security_incident
keywords: Forza Horizon 6
keywords: auction house sniper
keywords: instant buyout
keywords: automated script
keywords: game cheat
keywords: GitHub
keywords: FrostyIsBored
keywords: buyout automation
keywords: bid sniping
related risks: Instant Bid Sniping
related attack tools: Automation Scripts
related attack tools: Game Cheats
related threat actors: Gold Farming Studios
related threat actors: Malicious Players
citation: GitHub - FrostyIsBored/FH6-Auction-House-Sniper: Automatic Auction ...
updated: 2026-06-18
version: 1

Forza Horizon 5 Community Flags Auction Sniper Automation Software Issues
type: Case
break id: C0018
stix type: report
summary: Players in the Forza Horizon 5 community report that highly sought-after vehicles in the in-game auction house are often bought out instantly. They suspect some users are employing automation software to perform auction sniping, placing last-second bids that prevent regular players from winning cars through normal gameplay.
case category: news_report
incident time: 2025-05
keywords: Forza Horizon 5
keywords: auction house
keywords: auction sniper
keywords: automation software
keywords: scripting
keywords: bid sniping
keywords: game community
keywords: Facebook
related risks: Auction Sniping
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related attack tools: Game Cheats
related threat actors: Malicious Players
citation: Forza Horizon 5 Auction Sniping and Automated Software Concerns
updated: 2026-06-18
version: 1

GEETEST Reveals Strategies and Detection Methods for Auction Sniping Bots
type: Case
break id: C0019
stix type: report
summary: Security provider GEETEST published a detailed analysis on its official website explaining how auction sniping bots work. The article notes that these bots use automated programs to place last-second bids, exploiting the time gap to prevent real users from reacting, thereby winning items or services at low prices while negatively impacting platforms and other users.
case category: news_report
incident time: 2023-06
keywords: auction sniping
keywords: sniping bot
keywords: automated bidding
keywords: GEETEST
keywords: bot detection
keywords: auction fraud
keywords: malicious bot
related risks: Auction Sniping
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Unveiling the Tactics of Sniper Bots - GEETEST
updated: 2026-06-18
version: 1

Just So Everyone Knows What Auction Sniping Is
type: Case
break id: C0020
stix type: report
summary: A Facebook post explains auction sniping as a tactic where players win auctions by precisely timing their bids to outpace others when search refreshes.
case category: news_report
keywords: auction sniping
keywords: bid timing
keywords: sniping strategy
keywords: game auctions
keywords: bidding behavior
keywords: auction mechanics
keywords: timed bidding
related risks: Auction Sniping
citation: Just So Everyone Knows What Auction Sniping Is - Facebook
updated: 2026-06-18
version: 1

OAT-013 Sniping
type: Case
break id: C0021
stix type: report
summary: OWASP Automated Threat Project defines "Sniping" as placing bids or offers on goods or services at the last moment, leaving other users insufficient time to react. It is a typical automated threat.
case category: academic_research
keywords: OAT-013
keywords: Sniping
keywords: auction sniping
keywords: last-second bidding
keywords: bid sniping
keywords: automated threats
keywords: OWASP
keywords: web application security
related risks: Auction Sniping
citation: OAT-013 Sniping - OWASP Foundation
updated: 2026-06-18
version: 1

Auction Fraud Detection: Human or Robot?
type: Case
break id: C0022
stix type: report
summary: This project aims to detect automated bidding in online auctions using machine learning. Human bidders are driven away when they cannot compete against software-controlled opponents, and platforms need to eliminate automated bidding to restore fairness.
case category: academic_research
keywords: auction fraud detection
keywords: machine learning
keywords: bot bidding
keywords: online auctions
keywords: automated bidding software
keywords: auction sniping
keywords: anomaly detection
keywords: bidding fairness
related risks: Auction Sniping
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Freebie Hunters
related threat actors: Scalpers
citation: GitHub - gabriellewald/auction-fraud-detection: Predicting Fraud ...
updated: 2026-06-18
version: 1

Nearly 4,000 People Involved and 70 Million Yuan at Stake: Zibo Police Bust Fake Review Ring
type: Case
break id: C0023
stix type: report
summary: The Linzi Branch of the Zibo Public Security Bureau in Shandong dismantled a suspected illegal business operation ring that provided fake orders and fake reviews for e-commerce merchants. Since July 2022, the group had developed nearly 4,000 click farmers and merchants, generated more than 200,000 fake orders without genuine online-shopping services, and handled about 70 million yuan in transactions. Three principal suspects have been subjected to criminal coercive measures.
case category: criminal_verdict
incident time: 2024-11
keywords: click farming
keywords: fake transactions
keywords: e-commerce review manipulation
keywords: traffic fraud
keywords: Zibo police
keywords: online water army
keywords: nearly 4,000 click farmers and merchants
keywords: click farmers
keywords: platform reputation manipulation
keywords: illegal business operation
keywords: 70 million yuan
related risks: Bot Scalping Risk
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related attack tools: Task Completion Tools
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Astroturfing Networks
citation: Nearly 4,000 People Involved and 70 Million Yuan at Stake: Zibo Police Bust Fake Review Ring
citation: 3000 'Swipers' Post 200,000 Fake Reviews! Zibo Police Cut Off Rampant 'Traffic Swipers'
citation: 3,000 click farmers generated 200,000 fake reviews: Zibo police cut off rampant traffic fraud
updated: 2026-06-18
version: 1

Shanghai Police Dismantle Criminal Gang Using Automated Software to Scalp and Resell Medical Appointments
type: Case
break id: C0024
stix type: report
summary: The Minhang branch of the Shanghai Public Security Bureau dismantled a criminal gang involved in automated appointment scalping, hoarding, reselling, and patient referral services, arresting 10 suspects. The core member, Li, controlled 17 accounts and made over 5,000 appointments across multiple hospitals in half a year, illegally profiting over 2.4 million yuan. He recruited technicians to develo
case category: criminal_verdict
incident time: 2026-06
keywords: automated appointment grabbing
keywords: appointment scalping bot
keywords: specialist appointment reselling
keywords: medical appointment hoarding
keywords: hospital appointment scalper
keywords: appointment booking script
keywords: patient referral scheme
keywords: Shanghai PSB
related risks: Unfair Resource Seizure
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Shanghai Minhang Police Crack Down on Hospital Appointment Scalping Crimes
citation: Scalpers Resell Expert Appointments Earning Millions Annually, Can Hospitals Really Not Prevent It? - Tencent News
citation: Expert appointment slots sold out instantly but attendance stayed low; police dismantled a hospital appointment scalping ring
updated: 2026-06-18
version: 1

Chengdu Police Crack Down on "Online Scalpers" Illegally Hoarding Hospital Appointments
type: Case
break id: C0025
stix type: report
summary: Chengdu police uncovered two cases involving the use of unauthorized software to maliciously seize appointment slots at well-known hospitals. A total of 54 suspects were arrested, five specialized "plug-in" programs were seized, and the total amount involved was found to exceed 13 million yuan. Criminals used these tools to instantly snap up available slots the moment they were released, forcing p
case category: criminal_verdict
incident time: 2025-03
keywords: Chengdu police
keywords: online scalper
keywords: appointment scalping
keywords: plug-in software
keywords: hospital appointment hoarding
keywords: specialist appointment
keywords: appointment system abuse
keywords: illegal profit
keywords: organized crime
keywords: queue-jumping tool
related risks: Unfair Resource Seizure
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: 'Online Scalpers' Target Popular Hospitals, Seizing Appointment Slots for Profit! Police Reveal Behind-the-Scenes Tricks - Tencent News
citation: Xinhua investigation: exposing the black market chain of hospital appointment scalping bots
citation: Chengdu police release typical cases from the Liangjian special campaign
updated: 2026-06-18
version: 1

Hangzhou Police Seize 3 Tons of Counterfeit West Lake Longjing Tea Worth 120 Million Yuan
type: Case
break id: C0026
stix type: report
summary: Hangzhou police cracked a case involving counterfeit West Lake Longjing tea, seizing 3 tons of fake tea with a total value of 120 million yuan. The perpetrators produced and sold counterfeit products to unfairly seize market share from genuine sellers, seriously infringing on the legitimate rights and interests of businesses and consumers and disrupting fair market competition.
case category: administrative_enforcement
incident time: 2023-04
keywords: counterfeit West Lake Longjing tea
keywords: tea counterfeiting
keywords: trademark infringement
keywords: unfair competition
keywords: Hangzhou police seizure
keywords: fake tea production
keywords: market disruption
related risks: Unfair Resource Seizure
related threat actors: Piracy/Infringement Gangs
citation: Focus on Zhejiang: China News Service Zhejiang Weekly News Report - Tencent News
citation: Police notice: 3 tons of counterfeit West Lake Longjing seized and more than 50 people arrested
updated: 2026-06-18
version: 1

Tianjin Miandoudou Fined RMB 1 Million for One-Click Product Data Migration Software
type: Case
break id: C0027
stix type: report
summary: A typical 'Iron Fist' enforcement case published on the Tianjin municipal government portal showed that Tianjin Miandoudou Network Technology Co., Ltd. developed software that provided a one-click product information migration service. Without consent from the source shopping platforms or merchants on those platforms, the software scraped product information data and uploaded it to competing shopping platforms. By the time of the case, the software had scraped more than 9.42 million product information records. The Tianjin Market Supervision Commission imposed an administrative fine of RMB 1 million.
case category: administrative_enforcement
incident time: 2023-04
keywords: Tianjin Miandoudou
keywords: Anti-Unfair Competition Law
keywords: Tianjin Market Supervision Commission
keywords: one-click migration
keywords: product data scraping
keywords: online unfair competition
keywords: administrative penalty
keywords: 1 million yuan fine
related risks: Unfair Resource Seizure
related threat actors: Competitors
citation: Tianjin Announces This Year's First Batch of 'Iron Fist' Enforcement Typical Cases
updated: 2026-06-18
version: 1

A Study of the Ticket Scalping App Ecosystem in China
type: Case
break id: C0028
stix type: report
summary: A study examining the ticket scalping app ecosystem in China reveals that scalpers leverage ticket-snatching bots to directly acquire large volumes of ticket inventory. Using China as a case study, the research investigates the unfair preemption practices in ticket purchasing.
case category: academic_research
keywords: ticket scalping apps
keywords: scalper bots
keywords: ticket-snatching bots
keywords: unfair preemption
keywords: ticket ecosystem
keywords: China ticket market
keywords: USENIX Security
keywords: ticket inventory hoarding
related risks: Unfair Resource Seizure
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Tickets or Privacy? Understand the Ecosystem of Chinese Ticket Grabbing Apps
updated: 2026-06-18
version: 1

Scalper Detection in Geriatric Medical Services in China
type: Case
break id: C0029
stix type: report
summary: A study on geriatric medical services in China finds that scalping severely drains hospital resources and disrupts healthcare order. Some patients are forced to pay inflated prices to scalpers for urgent treatment, reflecting the illicit hoarding of medical appointment slots.
case category: academic_research
keywords: geriatric medical services
keywords: scalper detection
keywords: medical appointment hoarding
keywords: user profiling
keywords: healthcare resource drain
keywords: IEEE
keywords: illicit slot occupation
keywords: hospital queue manipulation
related risks: Unfair Resource Seizure
related threat actors: Scalpers
citation: User Profiling in Elderly Healthcare Services in China: Scalper Detection
updated: 2026-06-18
version: 1

A Scalping Anomaly Detection Method Based on Mobile Internet Traffic Data
type: Case
break id: C0030
stix type: report
summary: This study proposes a scalping anomaly detection method named SADM for identifying scalper behaviors in online retail. It highlights that scalping is a critical issue for online retailers, as it unfairly monopolizes product resources through illegitimate means.
case category: academic_research
keywords: scalping behavior
keywords: anomaly detection
keywords: SADM
keywords: mobile internet traffic data
keywords: online retail
keywords: traffic analysis
keywords: scalping anomaly detection
related risks: Unfair Resource Seizure
related threat actors: Scalpers
citation: Scalping Anomaly Detection Based on Mobile Internet Traffic Data
updated: 2026-06-18
version: 1

Zhejiang Shaoxing AI Face-Swap Moutai Scalping Case
type: Case
break id: C0031
stix type: report
summary: Starting in 2023, Xie Yun purchased over 3,400 pieces of personal information and used an AI face-swapping service provided by Zhang Zhi to bypass facial recognition, scalping more than 60 bottles of Moutai on WeChat mini-programs for resale profit. The three individuals were sentenced for illegal control of computer information systems and infringement of citizens' personal information, and were
case category: criminal_verdict
incident time: 2025-08
keywords: AI face-swap
keywords: facial recognition bypass
keywords: WeChat mini-program
keywords: Moutai scalping
keywords: illegal control of computer information systems
keywords: infringement of citizens' personal information
keywords: Xie Yun
keywords: Zhang Zhi
keywords: scalper
keywords: public interest damages
related risks: Malicious Flash Sale Grabbing
related attack tools: AI Deepfake Tools
related threat actors: Scalpers
related threat actors: AI Tool Abusers
citation: Scalper buys over 3,400 pieces of personal data, uses AI face-swapping to snatch 60+ bottles of Moutai—is this illegal?
citation: Selling citizens' personal information and illegally bypassing a facial recognition system
updated: 2026-06-18
version: 1

Ningbo, Zhejiang: Illegal Flash Sale Software Used to Snatch Limited Goods for Profit
type: Case
break id: C0032
stix type: report
summary: In June 2024, Ningbo police cracked an illegal purchasing case, arresting Sheng and Zheng, seizing order-snatching software and source code, and recovering over 200 bottles of premium liquor on site. The suspects exploited algorithm cracking and AI programming to execute millisecond-level purchases, targeting limited items in e-commerce livestream rooms, with the total amount involved exceeding 10
case category: criminal_verdict
incident time: 2024-06
keywords: flash sale bot
keywords: order-snatching software
keywords: AI programming
keywords: algorithm cracking
keywords: e-commerce livestream
keywords: premium liquor
keywords: Ningbo police
keywords: limited purchase
keywords: sniping tool
keywords: source code seizure
related risks: Malicious Flash Sale Grabbing
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Police crack an illegal flash-sale snatching case involving e-commerce platform plug-ins
citation: Premium phones and famous liquor obtained instantly with plug-ins: why the apparent business opportunity became a sentence
citation: Zhejiang Ningbo police crack an illegal flash-sale goods snatching case
updated: 2026-06-18
version: 1

Jiangsu Nantong Sentencing for Sniping and Rush-Purchase Software Development
type: Case
break id: C0033
stix type: report
summary: Between 2016 and October 2018, Wang developed the 'HiRoot' software capable of sniping items on Taobao and sold it via QQ for profit. The Nantong Intermediate People's Court upheld the original verdict on appeal, convicting Wang and five other defendants for providing programs or tools to intrude into and illegally control computer information systems, with illicit gains totaling approximately 570
case category: criminal_verdict
incident time: 2021-11
keywords: sniping software
keywords: rush-purchase tool
keywords: HiRoot
keywords: Taobao
keywords: intrusion into computer system
keywords: illegal control
keywords: providing tools crime
keywords: Nantong Intermediate People's Court
keywords: malicious purchasing
keywords: sniper bot
related risks: Malicious Flash Sale Grabbing
related attack tools: Flash Sale Tools
related threat actors: Malware Developers
citation: Judicial Determination of Producing and Selling Flash-Sale Sniping Software
citation: Coding 'flash sale' scalping software yields illegal profit of 570,000 yuan; multiple suspects convicted
updated: 2026-06-18
version: 1

Scalper Buys Personal Information and Uses AI Face Swapping to Buy Moutai
type: Case
break id: C0034
stix type: report
summary: In December 2025, China Court reported a case in which a scalper bought more than 3,400 pieces of personal information and used AI face-swapping techniques to bypass facial recognition and real-name reservation controls, purchasing more than 60 bottles of Moutai for resale. The court found that the conduct involved selling citizens' personal information and illegally bypassing facial recognition systems, and imposed criminal liability.
case category: criminal_verdict
incident time: 2025-12
keywords: Moutai scalping
keywords: personal information trafficking
keywords: AI face swapping
keywords: facial recognition bypass
keywords: real-name reservation abuse
keywords: resale profit
keywords: personal information infringement
keywords: batch purchasing
related risks: Malicious Flash Sale Grabbing
related attack tools: Bulk Account Registration Tool
related threat actors: Scalpers
citation: Selling Citizens' Personal Information and Illegally Bypassing Facial Recognition Systems
updated: 2026-06-18
version: 1

Sichuan Deyang Police Crack Down on Ticket Scalping Bots for Scenic Spot Admissions
type: Case
break id: C0035
stix type: report
summary: In September 2024, police in Deyang, Sichuan, dismantled three criminal groups using bot programs to hoard tickets for multiple scenic spots nationwide and one group developing scalping bots, arresting 34 suspects. They used ticket-snatching software to buy tickets for attractions like the Sanxingdui Museum, reselling tickets originally priced at 72 yuan for 150 to 200 yuan.
case category: criminal_verdict
incident time: 2024-09
keywords: ticket scalping bot
keywords: Sanxingdui Museum tickets
keywords: scenic spot ticket hoarding
keywords: malicious ticket purchasing
keywords: Deyang Sichuan
keywords: ticket reselling
keywords: bot development group
related risks: Malicious Flash Sale Grabbing
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Provincial public security department releases 4 typical cases of tackling online disorder—Sichuan Chang'an Net
updated: 2026-06-18
version: 1

Jiangxi Xiajiang Police Crack Down on Script Scalper Supply Chain
type: Case
break id: C0036
stix type: report
summary: In December 2025, police in Xiajiang, Jiangxi Province, uncovered and disrupted a supply chain selling powerful script software used to snatch scarce resources such as specialist medical appointments, scenic spot tickets, concert tickets, popular sports venue bookings, and limited-time merchandise purchases, giving users an unfair speed advantage.
case category: administrative_enforcement
incident time: 2025-12
keywords: script scalper
keywords: sniping software
keywords: ticket scalping bot
keywords: Xiajiang police
keywords: appointment grabbing
keywords: limited-time purchase script
keywords: venue booking automation
keywords: scalper supply chain
related risks: Malicious Flash Sale Grabbing
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Cyber police sever 'script scalper' chain, crack down on illegal ticket-snatching software_Southern Net
citation: Central, provincial and municipal media focus on Ji'an police cracking an illegal ticket-snatching software sales case
updated: 2026-06-18
version: 1

Jiangxi Man Sentenced to 11 Months for Scalping Train Tickets Using Ticket-Snatching Software
type: Case
break id: C0037
stix type: report
summary: In January 2020, the Nanchang Railway Transport Intermediate Court delivered its second-instance verdict against Liu Jinfu for ticket scalping. Since 2017, Liu had purchased and used ticket-snatching software to professionally grab train tickets and resell them at marked-up prices, illegally profiting over 340,000 yuan. He was ultimately sentenced to 11 months in prison and fined 1.24 million yuan
case category: criminal_verdict
incident time: 2020-01
keywords: ticket-snatching software
keywords: train ticket scalping
keywords: Liu Jinfu
keywords: Nanchang Railway Transport Intermediate Court
keywords: malicious ticket grabbing
keywords: illegal profit
keywords: fixed-term imprisonment
keywords: criminal fine
related risks: Malicious Flash Sale Grabbing
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Jiangxi man sentenced to 11 months for reselling train tickets using ticket-snatching software—Court—Jiangxi Political and Legal Net
updated: 2026-06-18
version: 1

Trackable Logistics but Vanished Package: 'Phantom Parcel' Scheme Unravels a Billion-Yuan Fraud Ring
type: Case
break id: C0038
stix type: report
summary: In March 2019, a Mr. Lin in Wuxi purchased a mobile phone online. The courier tracking showed the package had been signed for by a security guard, but he never received it. Investigation revealed the seller had used a fake tracking number generated by an empty-package website. The case exposed a network operated by Wang Mouliang in Guangdong and Zhang Mouhua in Guangxi, who built over 1,000 such s
case category: criminal_verdict
incident time: 2019-03
keywords: empty package website
keywords: fake waybill number
keywords: phantom parcel
keywords: fake shipment
keywords: online shopping fraud
keywords: cross-border gambling top-up
keywords: guard receipt scam
keywords: Wuxi
related risks: Fake Shipment
related threat actors: Telecom Fraud Gangs
related threat actors: Online Gambling Gangs
citation: Empty-package courier tracking numbers became a criminal tool
citation: Logistics info traceable, allegedly 'signed by security guard,' yet online-purchased phone vanishes?! 'Ghost...
updated: 2026-06-18
version: 1

Code-word ordering and empty parcel shipping: exploiting consumer vouchers for 400,000 yuan, 12 charged with fraudulent redemption
type: Case
break id: C0039
stix type: report
summary: In early 2024, Li ran a health supplement store on an e-commerce platform and conspired with Yang to organize click-farm workers to place orders using platform-issued consumer vouchers. Li's store shipped empty parcels or purchased fake logistics tracking numbers to fabricate transactions and defraud the platform of subsidies. By the time of discovery, the scheme had extracted over 400,000 yuan. I
case category: criminal_verdict
incident time: 2024-11
keywords: consumer vouchers
keywords: fake redemption
keywords: empty parcel shipping
keywords: click-farm workers
keywords: fake logistics tracking numbers
keywords: e-commerce platform
keywords: subsidy fraud
keywords: Shanghai Putuo District Procuratorate
keywords: coupon scalping
related risks: Fake Shipment
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: Coded orders, empty parcel shipments, 'wool-pulling' nets 400,000 yuan; 12 people exploit consumer vouchers through fake verification...
citation: A gray-market chain of order brushing to defraud platform subsidies
updated: 2026-06-18
version: 1

Minor Sentenced for Online Store Fraud via Fake Shipments
type: Case
break id: C0040
stix type: report
summary: On May 15, 2025, the People's Court of Yongxin County, Jiangxi, tried a case involving a minor surnamed Wang who defrauded victims by issuing fake shipments through an online store. Wang obtained property from victims in substantial amounts, constituting the crime of fraud. Considering the criminal circumstances, expression of remorse, and age at the time of the offense, the court sentenced Wang t
case category: criminal_verdict
incident time: 2025-05
keywords: fake shipment
keywords: online store fraud
keywords: minor offender
keywords: fraud conviction
keywords: Yongxin County People's Court
keywords: suspended sentence
keywords: e-commerce scam
keywords: criminal judgment
related risks: Fake Shipment
citation: Minor convicted for opening online store and making fake shipments!—Court—Jiangxi Political and Legal Net
updated: 2026-06-18
version: 1

Live-Stream Fake Traffic, Bait-and-Switch, and Empty Parcel Brushing: SAMR Flags Click Farming Schemes
type: Case
break id: C0041
stix type: report
summary: The State Administration for Market Regulation (SAMR) reported ten cases of online false advertising, involving hiring bots to inflate live-stream viewer counts, bait-and-switch transactions, and mailing empty parcels to fabricate sales. In one case, an individual in Changshu was fined 23,000 yuan for using bots to boost live-stream popularity; companies like Suzhou Gushanke were found to have fab
case category: administrative_enforcement
incident time: 2021-07
keywords: live-streaming click farming
keywords: fake traffic botting
keywords: bait-and-switch ecommerce
keywords: empty parcel brushing
keywords: SAMR enforcement
keywords: unfair competition China
keywords: fabricated sales transactions
keywords: Changshu click farm penalty
related risks: Fake Shipment
related risks: Ad Fraud
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Malicious Merchants
related threat actors: Astroturfing Networks
citation: Fake livestream traffic, shipping A instead of B, sending empty parcels… these click-farming and review-boosting practices exposed
citation: SAMR releases 2021 typical enforcement cases in key anti-unfair-competition areas
updated: 2026-06-18
version: 1

Online Stores Mail Empty Packages to Inflate Sales; Couriers Stuff Waste Paper for Trackable Shipments
type: Case
break id: C0042
stix type: report
summary: Reported on March 28, 2016, online sellers used two fake shipping methods to boost sales: mailing empty packages stuffed with waste paper or small gifts, and providing tracking numbers with normal logistics records but no actual goods dispatched. Sellers fabricated transaction records through these fake deliveries to deceive platforms and consumers.
case category: news_report
incident time: 2016-03
keywords: fake shipping
keywords: empty packages
keywords: brushing sales
keywords: tracking number fraud
keywords: e-commerce platforms
keywords: online store
keywords: logistics information
keywords: inflate sales
keywords: courier companies
related risks: Fake Shipment
related threat actors: Malicious Merchants
related threat actors: Astroturfing Networks
citation: Online store mails empty parcels to inflate sales; courier company stuffs waste paper, logistics traceable
updated: 2026-06-18
version: 1

Coded Orders and Empty Packages: 12 Indicted for ¥400,000 Coupon Fraud Scheme
type: Case
break id: C0043
stix type: report
summary: In early 2024, Li and others opened stores on an e-commerce platform and collaborated with click-farm workers to fabricate transactions using coded orders, empty package shipments, or fake tracking numbers, fraudulently claiming platform consumer voucher subsidies. The group completed the transaction loop through fake deliveries, defrauding over ¥400,000 in subsidies. In November 2025, 12 individu
case category: criminal_verdict
incident time: 2025-11
keywords: consumer voucher fraud
keywords: fake order fulfillment
keywords: empty package shipping
keywords: click farm
keywords: fake tracking numbers
keywords: e-commerce subsidy fraud
keywords: coded order scheme
keywords: Putuo District People's Procuratorate
related risks: Fake Shipment
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
citation: Coded orders, empty parcel shipments, 'wool-pulling' nets 400,000 yuan; 12 people exploit consumer vouchers through fake verification...
citation: 1,460 accounts used for order brushing; 12 people conspired to defraud a major e-commerce platform subsidy
updated: 2026-06-18
version: 1

Douyin Cracks Down on "Main–Alt Account" Matrix Cheating
type: Case
break id: C0044
stix type: report
summary: Douyin officially released the "Douyin Matrix Account Misconduct Governance Rules," explicitly targeting the use of group-control tools, illegal scripts, and other technical means to operate multiple accounts for posting violative low-quality content, inflating followers/likes/comments, and fabricating engagement data. The platform has already penalized numerous accounts or matrix accounts with ov
case category: administrative_enforcement
incident time: 2023-12
keywords: Douyin
keywords: matrix accounts
keywords: group-control tools
keywords: follower inflation
keywords: like farming
keywords: comment manipulation
keywords: MCN agencies
keywords: low-quality content
keywords: fake engagement
keywords: bulk alt accounts
related risks: Bulk Fake Account Manipulation
related attack tools: Mass Control Systems
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related threat actors: Freebie Hunters
related threat actors: Astroturfing Networks
citation: Official Clarification: All Violating Matrix Accounts Will Be Removed
citation: 157 arrested! Douyin cracks down on 'main and alt accounts'_Violations_Accounts_Platform
updated: 2026-06-18
version: 1

Shandong Zaozhuang Police Crack Major "Online Water Army" Case
type: Case
break id: C0045
stix type: report
summary: In the first half of 2023, public security authorities in Tengzhou, Zaozhuang, Shandong, uncovered a major "online water army" case. Investigations revealed that local netizens had created multiple WeChat groups to organize numerous accounts for fake orders, fake positive reviews, and other fraudulent interactions, fabricating sales volumes and reputations for stores to mislead and deceive consume
case category: administrative_enforcement
incident time: 2023-08
keywords: Zaozhuang Shandong
keywords: Tengzhou
keywords: online water army
keywords: fake orders
keywords: fake reviews
keywords: fabricated sales
keywords: WeChat groups
keywords: batch sock puppet accounts
keywords: click farming
related risks: Bulk Fake Account Manipulation
related attack tools: Mass Control Systems
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Weekly Alert: Fabricated Traffic, Malicious Reviews, Fake Likes... Time for 'Online Water Armies' to Stop
citation: Ministry of Public Security Cyber Bureau: Why Are There So Many Positive Follow-Up Reviews, Yet My Product Has Problems?
updated: 2026-06-18
version: 1

Paid Posting and Fake Reviews: Two 'Online Water Army' Operatives Sentenced
type: Case
break id: C0046
stix type: report
summary: The People's Court of Cangxi County, Sichuan Province, tried an 'online water army' case. Defendants Li and Ge were convicted of illegal business operations for providing paid posting, fake reviews, and other metric-manipulation services. They were sentenced to fixed-term imprisonment of one year and ten months, and one year with a two-year suspended sentence, respectively, along with criminal fin
case category: criminal_verdict
incident time: 2025-10
keywords: online water army
keywords: paid posting
keywords: fake reviews
keywords: metric manipulation
keywords: illegal business operation
keywords: Cangxi County Court
keywords: bulk fake accounts
keywords: sock puppet accounts
keywords: comment farming
related risks: Bulk Fake Account Manipulation
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Paid posting, publishing fake reviews—two 'online water army' members sentenced
citation: Li and Ge illegal business operation case: characterization of paid false information publishing online
updated: 2026-06-18
version: 1

Police Uncover the Gray Industry Chain Behind Bot-Driven Trending Topics
type: Case
break id: C0047
stix type: report
summary: Police cracked a case in which suspects had long provided paid services for fake reposts, likes, and comments to manipulate public opinion. Using large numbers of accounts and automated bot methods, they artificially inflated the popularity of trending topics, forming a complete gray industry chain.
case category: criminal_verdict
incident time: 2025-01
keywords: bot manipulation
keywords: trending topics
keywords: fake traffic
keywords: paid engagement manipulation
keywords: gray industry chain
keywords: bulk fake accounts
keywords: paid content removal
keywords: online water army
keywords: police investigation
keywords: Tencent News
related risks: Bulk Fake Account Manipulation
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Multi-Instance Tools
related attack tools: Automation Scripts
related attack tools: Device Wipe Tools
related attack tools: Click Simulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: How much of the trending searches you see is 'machine-brushed'? Police uncover the gray industry chain behind it_Tencent News
citation: MPS releases 10 typical cases of cracking down on online water army crimes
updated: 2026-06-18
version: 1

Inside the Internet Water Army Industry: Selling Followers and Tiered Comment Packages
type: Case
break id: C0048
stix type: report
summary: An investigation reveals that the internet water army industry not only sells fake followers but also provides likes and view counts to maintain an illusion of popularity. After public accounts display view counts, they must also inflate these metrics to match the purchased followers and likes, forming a complete chain of fake engagement designed to deceive advertisers into placing ads.
case category: news_report
incident time: 2018-01
keywords: internet water army
keywords: fake traffic
keywords: buying followers
keywords: fake likes
keywords: inflated view counts
keywords: public accounts
keywords: advertiser deception
keywords: click fraud
keywords: social media manipulation
related risks: Bulk Fake Account Manipulation
related attack tools: Ranking Manipulation Tools
related attack tools: Ad Attribution Fraud Tool
related threat actors: Astroturfing Networks
citation: Revealing the inner workings of the online water army industry chain: selling followers, comments also come in tiers
updated: 2026-06-18
version: 1

Douyin Enforces New Rules to Crack Down on "Main and Sub-Account" Traffic Manipulation, Banning Multiple Million-Follower Accounts
type: Case
break id: C0049
stix type: report
summary: Douyin's platform discovered that black and gray market organizations were using multiple sub-accounts for repetitive low-quality posts, fake engagement, and high-frequency interactions to funnel traffic to main accounts for illicit profit. After the new rules took effect, the platform uniformly penalized these matrix accounts involved in improper profiteering, banning several million-follower acc
case category: security_incident
incident time: 2023-12
keywords: Douyin
keywords: main and sub-accounts
keywords: improper traffic diversion
keywords: batch sub-account cheating
keywords: MCN agency
keywords: fake followers and likes
keywords: black and gray market
keywords: account ban
keywords: platform rules
related risks: Bulk Fake Account Manipulation
related attack tools: Mass Control Systems
related attack tools: Multi-Instance Tools
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Freebie Hunters
related threat actors: Account Dealers
related threat actors: Criminal Organizations
related threat actors: Astroturfing Networks
citation: Effective Today! Douyin's New Rules Crack Down on Improper Traffic Diversion via 'Main and Alt Accounts,' Multiple Million-Follower Accounts Banned
citation: Douyin Announcement on Governance Rules for Improper Matrix Account Behavior
updated: 2026-06-18
version: 1

Inside the 'Online Water Army' Gray Market: Pay to Boost Likes, Shares, and Comments
type: Case
break id: C0050
stix type: report
summary: Police in Liangshan, Sichuan uncovered a series of cases exposing an 'online water army' gray industry chain that openly prices services for inflating likes, comments, reposts, and view counts. Clients can purchase fake engagement to manufacture popularity and influence.
case category: news_report
incident time: 2025-02
keywords: online water army
keywords: gray market chain
keywords: fake engagement
keywords: purchased likes
keywords: Liangshan police
keywords: paid comments
keywords: view count manipulation
keywords: bot accounts
related risks: Bulk Fake Account Manipulation
related attack tools: Mobile Phone Emulator
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Astroturfing Networks
citation: Exposing the 'online water army' gray industry chain: openly priced, pay to achieve 'reposts, comments, likes'_News Channel...
updated: 2026-06-18
version: 1

Over 20 Million Fake Reviews Busted — 'Cash for Good Ratings' Scheme Ruled Illegal
type: Case
break id: C0051
stix type: report
summary: Public security authorities dismantled an online click farm operation in which a criminal gang developed automated order-brushing software to log into bulk sock-puppet accounts on e-commerce platforms. The group placed fake orders, simulated deliveries, and posted fabricated positive reviews for more than 5,000 merchants, generating over 20 million fake transactions, 40 million bogus review likes,
case category: criminal_verdict
incident time: 2024-04
keywords: click farm
keywords: order-brushing software
keywords: fake positive reviews
keywords: e-commerce platform
keywords: bulk sock-puppet accounts
keywords: cash for good ratings
keywords: Yunhe County Public Security Bureau
keywords: Zhejiang Lishui
keywords: fabricated reviews
keywords: online review manipulation
related risks: Bulk Fake Account Manipulation
related risks: AI-Generated Fake Reviews
related attack tools: Bulk Account Registration Tool
related attack tools: Automation Scripts
related attack tools: Task Completion Tools
related threat actors: Freebie Hunters
related threat actors: Astroturfing Networks
citation: Over 20 Million Fake Reviews Flooded: These 'Cash for Good Reviews' Schemes Are Illegal! | Financial Headlines
citation: China Police Daily: Online Water Army Ring Busted After Over 20 Million Fake Orders
updated: 2026-06-18
version: 1

Using Cheats to Farm Song Plays for Easy Monthly Income? Lawyer Says Speculators May Face Fraud Charges
type: Case
break id: C0052
stix type: report
summary: The report exposes a cheating scheme involving bulk-purchasing NetEase Cloud Music accounts, then running them on web pages or virtual emulators to automatically inflate song play counts. Through this method, speculators can rapidly boost a track's popularity and profit from it.
case category: news_report
incident time: 2025-03
keywords: NetEase Cloud Music
keywords: play count manipulation
keywords: streaming fraud
keywords: bulk accounts
keywords: virtual emulator
keywords: bot farming
keywords: fraud charges
keywords: underground industry
related risks: Bulk Fake Account Manipulation
related attack tools: Mobile Phone Emulator
related attack tools: Bulk Account Registration Tool
related attack tools: Offline Game Bots
related attack tools: Automation Scripts
related attack tools: Ranking Manipulation Tools
related threat actors: Freebie Hunters
related threat actors: Account Dealers
related threat actors: Astroturfing Networks
citation: Earning Over 10,000 Yuan Monthly by Mindlessly Boosting Song Plays with Cheats? Lawyer: Opportunists May Face Fraud Charges | Tencent News
updated: 2026-06-18
version: 1

Onion Group's KOC Model Collapses: Recruitment-Driven Pyramid Scheme Leads to Business Implosion
type: Case
break id: C0053
stix type: report
summary: Onion Group relied on a KOC (Key Opinion Consumer) commission model for viral growth, structured into three tiers: 'Progressive Store Owner,' 'Honorary Store Owner,' and 'Banquet Service Provider,' each requiring a franchise fee. The model incentivized recruitment over actual sales, resulting in a large number of KOCs becoming 'zombie accounts.' In the first half of 2022, over 300,000 out of 750,0
case category: news_report
incident time: 2023-01
keywords: KOC zombie accounts
keywords: three-tier distribution
keywords: franchise fee
keywords: GMV decline
keywords: NYSE delisting
keywords: recruitment incentives
keywords: Onion Group pyramid scheme
related risks: Fake Viral Referral
citation: This e-commerce platform delisted, market value evaporated 98%, founder was once sentenced_Tencent News
updated: 2026-06-18
version: 1

Cloud Pay Sentenced for Pyramid Scheme via Agent and Infinite Fission Model
type: Case
break id: C0054
stix type: report
summary: Cloud Pay, a cardless payment platform, rapidly expanded by recruiting downlines through an agent and infinite fission model, promoting no investment and high returns. In 2017, the model went viral on social media, but after the case was exposed, the platform was shut down, and the founder and multiple agents were sentenced and fined.
case category: criminal_verdict
incident time: 2020-01
keywords: Cloud Pay pyramid scheme
keywords: agent infinite fission model
keywords: cardless payment platform
keywords: downline recruitment
keywords: pyramid selling verdict
keywords: agent sentencing
related risks: Fake Viral Referral
citation: ...Yunfu, once the hottest representative of cardless payment, expanded almost wildly through an 'agent + infinite fission' model...
updated: 2026-06-18
version: 1

Little Swan Dongshan Store Hit by 70 Million Yuan Pricing Error Exploit
type: Case
break id: C0055
stix type: report
summary: In August 2024, a pricing error at Little Swan's Dongshan store caused a high-end washing machine originally priced at 5,000 yuan to be listed for 500 yuan. Exploiters using automated scripts placed massive orders within 30 minutes, resulting in a staggering 70 million yuan in goods being fraudulently obtained, shocking the industry.
case category: news_report
incident time: 2024-08
keywords: Little Swan pricing error
keywords: e-commerce pricing exploit
keywords: automated script ordering
keywords: promotion abuse
keywords: wool-pulling gangs
keywords: online store mispricing
keywords: e-commerce security incident
keywords: 2024 e-commerce fraud
related risks: Promotional Activity Cheating
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
citation: The evolution of wool-pullers: gold diggers on the flip side of the internet_Tencent News
updated: 2026-06-18
version: 1

Lyu’s Fake Return Fraud of Over 4 Million Yuan Against Kans
type: Case
break id: C0056
stix type: report
summary: Between December 2023 and March 2024, Lyu rented multiple accounts to place orders on the Kans flagship store on Douyin, then used fake logistics tracking numbers to simulate returns for over 10,000 orders. After obtaining refunds, Lyu resold the unreturned cosmetics, illicitly profiting over 4 million yuan. The court convicted Lyu of fraud and sentenced him to 6 years in prison.
case category: criminal_verdict
incident time: 2023-12
keywords: fake returns
keywords: fraud conviction
keywords: fake logistics tracking
keywords: Kans flagship store
keywords: Douyin e-commerce
keywords: refund fraud
keywords: return fraud
keywords: e-commerce platform exploit
keywords: fake return scheme
related risks: Promotional Activity Cheating
related attack tools: Account Rental Platforms
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Freebie Hunters
related threat actors: Payment Fraud Groups
citation: Sentenced! Wool-puller defrauded merchants of over 4 million yuan, gets 6 years|E-commerce|Online shopping|Wool-puller|Fraud_Mobile...
citation: Shanghai Fengxian District People's Procuratorate: fake return fraud case
updated: 2026-06-18
version: 1

Yangpu District Shopping Mall Parking Fee Fraud via Points Arbitrage
type: Case
break id: C0057
stix type: report
summary: Between 2020 and 2021, Yang and Xia exploited malicious software to virtually register new users on Shopping Mall A's official app, accumulating points to offset parking fees. Approximately 120 vehicles were involved, each linked to thousands of phone numbers, profiting from the platform's marketing campaign through fake accounts.
case category: criminal_verdict
incident time: 2020-12
keywords: points arbitrage
keywords: virtual registration
keywords: malicious software
keywords: parking fee fraud
keywords: Shopping Mall A app
keywords: coupon scalping
keywords: fake accounts
keywords: marketing campaign abuse
keywords: Yangpu District
related risks: Promotional Activity Cheating
related attack tools: Bulk Account Registration Tool
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
citation: Direct Line 990: Be Careful When Exploiting Promotions, It May Be a Crime
citation: They were sentenced for making a living by 'wool-pulling'|App|Wool-puller|Parking fees_NetEase Subscription
updated: 2026-06-18
version: 1

Pinduoduo System Vulnerability Exploited for Nearly 10 Million Yuan
type: Case
break id: C0058
stix type: report
summary: In early 2019, a system vulnerability on Pinduoduo allowed users to claim 100-yuan no-threshold coupons for free. Coupon hunters quickly spread the news via social platforms, leading to nearly 10 million yuan being exploited overnight, demonstrating how groups exploit loopholes in platform marketing campaigns for large-scale arbitrage.
case category: news_report
incident time: 2019-01
keywords: Pinduoduo
keywords: system vulnerability
keywords: coupon hunters
keywords: no-threshold coupons
keywords: marketing campaign exploitation
keywords: large-scale arbitrage
keywords: social platform diffusion
keywords: 2019
related risks: Promotional Activity Cheating
related threat actors: Freebie Hunters
citation: The evolution of wool-pullers: gold diggers on the flip side of the internet-Huxiu Net
updated: 2026-06-18
version: 1

Post-00s Xiaoya Falsely Returned Goods to Scam 130,000 Yuan, Sentenced to 2 Years
type: Case
break id: C0059
stix type: report
summary: Xiaoya exploited the e-commerce platform's seven-day no-questions-asked return policy by returning empty packages or only free gifts to fraudulently obtain refunds for high-value items such as phones, computers, and cosmetics, scamming over 130,000 yuan in five months. The Shanghai Qingpu District People's Court sentenced her to 2 years in prison, suspended for 2 years, with a fine of 8,000 yuan f
case category: criminal_verdict
incident time: 2024-11
keywords: false returns
keywords: seven-day no-questions-asked
keywords: fraud conviction
keywords: e-commerce platform
keywords: empty package returns
keywords: refund fraud
keywords: coupon scalping
keywords: suspended sentence
related risks: Promotional Activity Cheating
related threat actors: Freebie Hunters
citation: Defendant sentenced for fraudulently obtaining e-commerce refunds by returning empty packages or gifts
citation: Heaven has eyes, wool-pullers caught and jailed|Fine|Probation|Xiaoya|Fraud_NetEase Subscription
updated: 2026-06-18
version: 1

Hubei Xiangyang Reports Qiai 'Wellness Cigarettes' for Suspected False Advertising
type: Case
break id: C0060
stix type: report
summary: Market regulatory authorities in Xiangyang, Hubei, reported that Qiai 'wellness cigarettes' are suspected of illegal activities including publishing illegal advertisements. The product allegedly exaggerated wellness benefits in its promotions, misleading consumers, and has been investigated by regulators.
case category: administrative_enforcement
incident time: 2026-06
keywords: Qiai
keywords: wellness cigarettes
keywords: false advertising
keywords: illegal advertisement
keywords: Xiangyang Hubei
keywords: market regulation
keywords: misleading consumers
keywords: wellness claims
related risks: False Advertising
citation: Xiangyang, Hubei Reports Qiai 'Health Smoke' for Suspected False Advertising: Allegations Include Publishing Illegal Ads
citation: Fancheng Market Regulator Statement on Alleged False Advertising of Qiai Wellness Cigarettes
updated: 2026-06-18
version: 1

Beijing Guanyou Shikong Digital Technology Fined 230,000 Yuan for False Game Advertising
type: Case
break id: C0061
stix type: report
summary: Beijing Guanyou Shikong Digital Technology Co., Ltd. was penalized by the Shijingshan District Market Supervision Administration for false advertising in a game promotion. A video advertisement claimed that recharging one yuan would grant multiple high-level in-game items, but no such promotion existed in the actual game. The company was fined approximately 230,000 yuan for the discrepancy between
case category: administrative_enforcement
incident time: 2022-12
keywords: Guanyou Shikong
keywords: false game advertising
keywords: Tian Long Ba Bu Glory Edition
keywords: one-yuan recharge
keywords: false advertising
keywords: Shijingshan District Market Supervision Bureau
keywords: game ad penalty
keywords: 230,000 fine
related risks: False Advertising
citation: Game CP convicted for molesting a minor; company fined 230,000 yuan for false game advertising | Weekly roundup
updated: 2026-06-18
version: 1

Chongqing Police Dismantle Aphrodisiac Fraud Ring Posing as Medical Experts
type: Case
break id: C0062
stix type: report
summary: Chongqing police dismantled a gang that defrauded victims by first using false advertising to add them as contacts, then impersonating male health specialists to conduct diagnoses. They used scripted pitches to persuade victims to purchase so-called 'personalized secret formula' aphrodisiacs, swindling over 5,000 middle-aged and elderly individuals out of more than 5 million yuan.
case category: criminal_verdict
incident time: 2022-09
keywords: aphrodisiac fraud
keywords: false advertising
keywords: impersonating medical expert
keywords: elderly scam
keywords: male health diagnosis scam
keywords: Chongqing police
keywords: personalized formula scam
keywords: health product fraud
keywords: telecom fraud ring
related risks: False Advertising
related threat actors: Telecom Fraud Gangs
citation: Wanzhou Police Arrest 20 Suspects in Aphrodisiac Miracle Drug Fraud Case
citation: ...The fraud ring first falsely advertised to add friends, then posed as male health experts for diagnosis...
updated: 2026-06-18
version: 1

Chengdu Chenghua Hanhou Medical Cosmetology Hospital Fined ¥409,800 for False Advertising of Cosmetic Procedure Results
type: Case
break id: C0063
stix type: report
summary: Chengdu Chenghua Hanhou Medical Cosmetology Hospital falsely advertised treatment efficacy during a livestream e-commerce promotion, using claims such as 'single session lasts 9–12 months' to guarantee results, which did not match actual outcomes. The Chenghua District Market Supervision Administration fined the hospital ¥409,800.
case category: administrative_enforcement
incident time: 2025-01
keywords: medical cosmetology
keywords: livestream e-commerce
keywords: false advertising
keywords: efficacy guarantee
keywords: SAMR
keywords: illegal advertisement
keywords: Chenghua District Market Supervision
keywords: Hanhou medical aesthetics
keywords: fine
related risks: False Advertising
citation: False advertising penalized! SAMR publishes ten typical cases of illegal advertisements
citation: SAMR publishes ten typical cases of illegal advertisements
updated: 2026-06-18
version: 1

False Advertising Case of a Metal Products Company in Chengdu
type: Case
break id: C0064
stix type: report
summary: A metal products company in Chengdu used the phrase "best choice" in its promotional materials for filing cabinets sold on an e-commerce platform, which was suspected of false advertising. The company was investigated and penalized by the market regulatory authority for failing to provide supporting evidence.
case category: administrative_enforcement
incident time: 2022-07
keywords: false advertising
keywords: best choice claim
keywords: filing cabinet
keywords: e-commerce platform
keywords: Chengdu
keywords: market regulation
keywords: false promotion
keywords: administrative penalty
related risks: False Advertising
citation: Unlicensed operations, false advertising... 'First violation no penalty' typical cases released!
citation: Chengdu Market Regulation: Typical First-Offense Non-Punishment Cases
updated: 2026-06-18
version: 1

Multiple Real Estate Livestreamers in Inner Mongolia Banned for False and Exaggerated Promotions That Misled Consumers
type: Case
break id: C0065
stix type: report
summary: The Cyberspace Affairs Office of the Ordos Municipal Committee in Inner Mongolia, together with other departments, summoned several real estate livestreamers and permanently banned their accounts for inaccurately conveying policy information and engaging in false or exaggerated promotions that misled consumers.
case category: administrative_enforcement
incident time: 2025-09
keywords: real estate livestreamer
keywords: false advertising
keywords: exaggerated promotion
keywords: misleading consumers
keywords: Ordos
keywords: Inner Mongolia
keywords: permanent account ban
keywords: cyberspace affairs summons
keywords: livestreaming violation
related risks: False Advertising
citation: Ordos Cyberspace Authority Disposes of Illegal Self-Media Accounts
citation: Notice! Multiple real estate livestreamers in Inner Mongolia mislead consumers with false and exaggerated promotions!
updated: 2026-06-18
version: 1

Hainan Man Sentenced for Fraud via Fake Second-Hand Billiard Cue Ads
type: Case
break id: C0066
stix type: report
summary: A man surnamed Lao from Lingao County, Hainan, posted fake advertisements for second-hand billiard cues on social platforms to defraud a victim surnamed Yin. After gaining the victim's trust, he tricked them into transferring money through multiple methods. Lao was sentenced to four months of criminal detention and fined 1,000 yuan.
case category: criminal_verdict
incident time: 2025-08
keywords: fake advertisement fraud
keywords: second-hand billiard cue scam
keywords: social platform fraud
keywords: Lingao County fraud case
keywords: online transaction fraud
keywords: criminal detention for fraud
keywords: Lao Moudi fraud case
keywords: money transfer scam
related risks: False Advertising
related threat actors: Telecom Fraud Gangs
citation: Lingao Man Sentenced for Fraudulent Sale of Second-Hand Billiard Cues on Douyin
citation: Hainan man convicted for publishing false advertising fraud
updated: 2026-06-18
version: 1

Shenzhen Cracks Down on AI Accounts for Exaggerated Claims and Marketing
type: Case
break id: C0067
stix type: report
summary: The cyberspace affairs authority in Shenzhen reported a crackdown on a batch of AI-operated accounts, some of which spread pseudo-scientific content in the health and wellness sector, engaging in exaggerated claims and marketing in violation of regulations, misleading the public.
case category: administrative_enforcement
incident time: 2026-01
keywords: Shenzhen Cyberspace Administration
keywords: AI accounts
keywords: pseudo-science
keywords: health and wellness
keywords: exaggerated claims
keywords: false marketing
keywords: AI misuse
keywords: online ecosystem governance
keywords: Kankan Yangsheng
related risks: False Advertising
related attack tools: Malicious AI Applications
related attack tools: AI Deepfake Tools
related attack tools: Digital Human Generation Tools
related attack tools: AI Data Poisoning and Prompt Injection Tool
related threat actors: AI Tool Abusers
citation: Shenzhen reports typical enforcement cases from the Qinglang special campaigns
updated: 2026-06-18
version: 1

JD.com sends SMS warning users not to use third-party price comparison tools or plugins
type: Case
break id: C0068
stix type: report
summary: In June 2024, some users received SMS messages from JD.com stating that their accounts might have been maliciously used, advising them not to use any third-party price comparison tools or plugins and recommending password changes, otherwise accounts suspected of being exploited would face ongoing restrictions. The move was interpreted externally as JD.com using account security as a pretext to pre
case category: news_report
incident time: 2024-06
keywords: JD.com price comparison plugin
keywords: cross-platform price comparison tool
keywords: e-commerce account security SMS
keywords: JD.com account restriction
keywords: third-party shopping plugin
keywords: malicious account use
keywords: customer retention e-commerce
keywords: price comparison plugin ban
related risks: Third-Party Price Comparison
related attack tools: Browser Extensions
citation: Reminding users not to use price comparison plugins, JD.com may be reluctant to compare prices with rivals | E-commerce | JD Group | Shopping site
updated: 2026-06-18
version: 1

Report on Unfair Competition Cases Involving Browser Extensions
type: Case
break id: C0069
stix type: report
summary: According to a report on 27 unfair competition disputes involving browser extensions, online shopping price comparison extensions are one of three major categories of extensions involved in such cases. These extensions use technical means to scrape product information from other platforms for price comparison, which has been deemed by courts as an act of unfair competition using network technology
case category: news_report
incident time: 2022-07
keywords: price comparison browser extension
keywords: browser extension unfair competition
keywords: anti-unfair competition law
keywords: data scraping legal case
keywords: e-commerce platform dispute
keywords: extension cashback
keywords: judicial case
related risks: Third-Party Price Comparison
related risks: Unauthorized Plugin Cashback
related attack tools: Browser Extensions
citation: Special report | Case study on unfair competition involving browser plugins | Anti-Unfair Competition Law | Plugin
updated: 2026-06-18
version: 1

Unfair Competition Case Involving the 'Shengqianzhao' Price Comparison Plugin
type: Case
break id: C0070
stix type: report
summary: In November 2021, analysis indicated that price comparison plugins redirecting user traffic from third-party websites to other platforms undermine competitor user stickiness, constituting unfair competition. Such plugins embed themselves in third-party sites to induce users to jump to other shopping platforms for price comparison and purchase.
case category: news_report
incident time: 2021-11
keywords: price comparison plugin
keywords: induced redirect
keywords: unfair competition
keywords: Shengqianzhao
keywords: user traffic hijacking
keywords: third-party website embedding
keywords: shopping platform comparison
related risks: Third-Party Price Comparison
related risks: Unauthorized Promotional Redirection
related attack tools: Browser Extensions
related threat actors: Competitors
citation: Top Ten Typical Cases of Anti-Unfair Competition Involving Data from Beijing Intellectual Property Court
updated: 2026-06-18
version: 1

Alipay App Wake-up Strategy Hijacking Case
type: Case
break id: C0071
stix type: report
summary: In November 2020, Alipay discovered that when users selected "Alipay" for payment on iOS, the interface was forcibly redirected to a selection pop-up for the "Jiazhengjia" app, causing payment failures and leading users to question Alipay's security. Investigation revealed that Jiangsu Bama Software Technology Co., Ltd. had defined its Jiazhengjia app's URL Scheme identically as "alipay://", sever
case category: criminal_verdict
incident time: 2020-11
keywords: Alipay
keywords: URL Scheme
keywords: alipay://
keywords: wake-up hijacking
keywords: Jiazhengjia
keywords: Jiangsu Bama
keywords: pre-litigation act preservation
keywords: Pudong New Area Court
keywords: traffic hijacking
keywords: iOS redirect
related risks: Access Link Hijacking
related threat actors: Competitors
citation: Shanghai Pudong Court Issues Preservation Order in App Wake-Up Strategy Unfair Competition Case
citation: Special report | Judicial analysis of internet traffic hijacking _ Tencent News
updated: 2026-06-18
version: 1

Daqing Police Crack Nation's First Telecom Operator DNS Hijacking Case
type: Case
break id: C0072
stix type: report
summary: In November 2021, the Cyber Police Branch of the Daqing Public Security Bureau solved the nation's first DNS hijacking case involving a telecom operator. The core members of the criminal gang bribed an insider at the operator to install a hijacking program on the core switch server in the operator's server room. This program mirrored and tampered with user internet traffic, forcibly redirecting us
case category: criminal_verdict
incident time: 2021-11
keywords: DNS hijacking
keywords: traffic hijacking
keywords: telecom operator
keywords: gambling site redirection
keywords: ad commission fraud
keywords: Daqing cyber police
keywords: insider threat
keywords: server hijacking program
related risks: Access Link Hijacking
related threat actors: Online Gambling Gangs
related threat actors: Malicious Insiders
citation: Daqing police crack nation's first case involving telecom operator DNS hijacking; 21 arrested in 'traffic hijacking' case _ The Paper
citation: China Peace: Daqing Police Crack China's First Telecom-Operator DNS Hijacking Case
updated: 2026-06-18
version: 1

First Case of Traffic Hijacking via Smart Router Gateways
type: Case
break id: C0073
stix type: report
summary: In May 2018, the People's Procuratorate of Xuhui District, Shanghai, approved the arrest of suspect Zhang for allegedly compromising computer information systems by hijacking traffic through smart router gateways. Between February and March 2018, Zhang exploited network techniques to compromise over 20 smart router gateways nationwide, implanting a worm virus that redirected users' web requests to
case category: criminal_verdict
incident time: 2018-05
keywords: traffic hijacking
keywords: smart router gateway
keywords: worm virus
keywords: gambling site redirection
keywords: man-in-the-middle attack
keywords: router compromise
keywords: web traffic interception
keywords: router malware
keywords: DNS hijacking
keywords: router exploit
related risks: Access Link Hijacking
related attack tools: Trojan Virus
related attack tools: IoT Firmware and Device Exploitation Tools
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related threat actors: Online Gambling Gangs
related threat actors: Malicious Hackers
citation: Shanghai Xuhui Procuratorate Approves Arrest in the City's First Smart Router Gateway Traffic Hijacking Case
citation: First suspect arrested using smart routing gateway: charge of traffic hijacking - jetz - Blog Park
updated: 2026-06-18
version: 1

Fu Moumou and Huang Moumou Computer Information System Destruction Case (Supreme People's Court Guiding Case No. 102)
type: Case
break id: C0074
stix type: report
summary: From late 2013 to October 2014, defendants Fu Moumou, Huang Moumou, and others rented multiple servers and used malicious code to alter the DNS settings of internet users' routers. This caused users attempting to visit a specific navigation website to be redirected to a different designated navigation site. The defendants then sold the hijacked user traffic to the owner of that designated site for
case category: criminal_verdict
incident time: 2014-10
keywords: DNS hijacking
keywords: traffic hijacking
keywords: computer information system destruction
keywords: router
keywords: malicious code
keywords: navigation website
keywords: Fu Moumou
keywords: Huang Moumou
keywords: SPC Guiding Case No. 102
related risks: Access Link Hijacking
related attack tools: Trojan Virus
citation: Distinguishing technical nuances to precisely punish traffic hijacking acts _ Supreme People's Procuratorate of the PRC
updated: 2026-06-18
version: 1

Guangxi Gongcheng Traffic Hijacking Case
type: Case
break id: C0075
stix type: report
summary: In January 2025, the People's Procuratorate of Gongcheng Yao Autonomous County, Guangxi, discovered during an investigation that suspect Zhang not only acted as a middleman in information network crimes but also discussed traffic hijacking targets with traffic owners in advance, and provided technical support, issue feedback, and hijacking optimization throughout the process. Zhang, knowing that X
case category: criminal_verdict
incident time: 2025-01
keywords: traffic hijacking
keywords: illegal website promotion
keywords: middleman
keywords: technical support
keywords: domain hijacking
keywords: Guangxi Gongcheng
keywords: aiding information network crime
keywords: access link hijacking
related risks: Access Link Hijacking
citation: People's Procuratorate of Gongcheng Yao Autonomous County, Guangxi
updated: 2026-06-18
version: 1

Casino Job Leads to a Lucrative Scheme: He Launched a Traffic Hijacking Service
type: Case
break id: C0076
stix type: report
summary: Between 2019 and 2022, Zhang, along with Tu, Xie, Gao, and others, deployed servers in telecom operator facilities and used technical methods to forcibly alter user access paths, redirecting visitors from specific websites to overseas gambling and pornographic sites. The group earned over 25 million yuan in promotion fees and more than 5 million yuan in illegal profits by providing traffic hijacki
case category: criminal_verdict
incident time: 2019-04
keywords: traffic hijacking
keywords: illegal control of computer information systems
keywords: gambling site promotion
keywords: DNS hijacking
keywords: user access path manipulation
keywords: Mianzhu Procuratorate
related risks: Access Link Hijacking
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
citation: Found a 'lucrative path' while working at a casino, he started a traffic hijacking service | Tonight at 9:30
updated: 2026-06-18
version: 1

Shanghai Pudong Court Issues China's First Verdict in a Traffic Hijacking Case
type: Case
break id: C0077
stix type: report
summary: Between late 2013 and October 2014, defendants Fu and Huang rented multiple servers and used malicious code to alter the DNS settings of internet users' routers. This caused users attempting to visit navigation sites like '2345.com' to be forcibly redirected to their designated '5w.com' site. The two sold the hijacked traffic for profit, generating illegal gains of over 754,700 yuan. In 2015, the
case category: criminal_verdict
incident time: 2013-12
keywords: traffic hijacking
keywords: DNS hijacking
keywords: damaging computer information systems
keywords: router
keywords: malicious code
keywords: 2345.com
keywords: 5w.com
keywords: Pudong Court
keywords: Fu
keywords: Huang
related risks: Access Link Hijacking
related attack tools: Trojan Virus
citation: Shanghai Pudong Court adjudicates nation's first traffic hijacking case _ CNR News
citation: Fu Xuanhao and Huang Zichao computer information system sabotage case
updated: 2026-06-18
version: 1

Webpage Keeps Redirecting Automatically? You Might Be Facing Traffic Hijacking
type: Case
break id: C0078
stix type: report
summary: An information technology company and its employees Wang, Li Ji, Xiao, and Li Lei were prosecuted by the Minhang District Procuratorate in Shanghai for traffic hijacking. The court convicted the company of illegally controlling computer information systems, fined it 200,000 yuan, and sentenced the four individuals to suspended prison terms ranging from one year and nine months to three years, alon
case category: criminal_verdict
incident time: 2024-10
keywords: traffic hijacking
keywords: illegal control of computer information systems
keywords: webpage auto-redirect
keywords: Minhang District Procuratorate
keywords: suspended sentence
keywords: link hijacking
keywords: click hijacking
related risks: Access Link Hijacking
citation: Technology Company Convicted for Profiting from Traffic Hijacking Through Browser Plugins
citation: Webpages always auto-redirecting? You might be experiencing traffic hijacking - Shaoxing Illegal and Harmful Information Reporting Center
updated: 2026-06-18
version: 1

MIIT Cracks Down on Malicious “Shake-to-Jump” Ads During 618 Shopping Festival
type: Case
break id: C0079
stix type: report
summary: On June 9, 2026, in response to rampant splash-screen pop-ups and highly sensitive “shake-to-jump” ads that maliciously redirect users during the 618 promotion, the Ministry of Industry and Information Technology ordered companies to conduct self-inspections and rectifications. Many apps exploited accidental touches, triggering forced redirects with slight movements, while close buttons were rende
case category: administrative_enforcement
incident time: 2026-06
keywords: MIIT
keywords: app splash-screen pop-ups
keywords: shake-to-jump ads
keywords: malicious redirects
keywords: 618 promotion
keywords: app rectification
keywords: user experience
keywords: app store delisting
related risks: Unauthorized Promotional Redirection
citation: MIIT Information and Communications Administration guides regulation of app information-window jump behavior
updated: 2026-06-18
version: 1

Chongqing Police Dismantle 'Video QR Code Injection' Scheme for Aiding Information Network Crimes
type: Case
break id: C0080
stix type: report
summary: The Chongqing Public Security Bureau's cyber security division uncovered a criminal gang led by Kang that inserted QR codes containing gambling and pornography links into short videos. The gang received these QR codes from upstream groups and embedded them into videos to earn advertising promotion fees from platforms involved in pornography, gambling, and fraud. They then distributed the videos on
case category: criminal_verdict
incident time: 2024-09
keywords: video QR code injection
keywords: aiding information network crime
keywords: QR code promotion
keywords: short-video platform
keywords: gambling traffic diversion
keywords: pornography traffic diversion
keywords: Kang criminal gang
keywords: Chongqing cyber security
keywords: black and gray industry
keywords: advertising promotion
related risks: Unauthorized Promotional Redirection
related attack tools: Malicious QR Code Generators
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
citation: Public security organs achieve phased results in combating ad-promotion-type cyber black and gray market crimes; MPS releases 8...
updated: 2026-06-18
version: 1

Jiangsu Police Dismantle 'Traffic Hijacking' Computer Information System Sabotage Case in Internet Cafes
type: Case
break id: C0081
stix type: report
summary: An investigation by the cyber security division of Jiangsu police revealed that suspects Chen and Li co-developed a hacking program and colluded with internet cafe operation staff to illegally implant it in nearly 200,000 computers across 5,000 internet cafes in 20 provinces and cities. The program directly tampered with popular online game configuration files to illicitly capture traffic generate
case category: criminal_verdict
incident time: 2024-09
keywords: internet cafe traffic hijacking
keywords: computer information system sabotage
keywords: hacking program implantation
keywords: game promotion fraud
keywords: traffic hijacking scheme
keywords: Jiangsu cyber police
keywords: game configuration file tampering
related risks: Unauthorized Promotional Redirection
related attack tools: Trojan Virus
related threat actors: Malware Developers
citation: MPS releases 8 typical cases of combating ad-promotion-type cyber black and gray market crimes
citation: Public security authorities make staged progress against ad-promotion cyber black and gray market crimes; MPS releases 8 typical cases
updated: 2026-06-18
version: 1

Nanjing Police Dismantle Ground Promotion Flyer Ring Serving Overseas Telecom Fraud Compounds
type: Case
break id: C0082
stix type: report
summary: In May 2025, Nanjing police expanded an investigation based on patrol discoveries and identified a profit-driven criminal group with clear internal division that conducted flyer-based ground promotion for overseas telecom fraud compounds. Officers coordinated a multi-city operation and arrested 15 suspects. Victims were lured onto fraudulent pages by scanning QR codes on the small cards.
case category: criminal_verdict
incident time: 2025-08
keywords: ground promotion flyers
keywords: QR code fraud
keywords: telecom fraud
keywords: overseas fraud compounds
keywords: Nanjing police
keywords: criminal ring
keywords: coordinated arrest
related risks: Unauthorized Promotional Redirection
related attack tools: Malicious QR Code Generators
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
citation: Jiangsu police rigorously crack down on illegal small ad ground promotion and traffic diversion crimes
updated: 2026-06-18
version: 1

Malicious Merchants Use Fake QR Code Ads to Redirect Users to Counterfeit Product Pages
type: Case
break id: C0083
stix type: report
summary: On June 15, 2024, media reported that unscrupulous merchants embedded fake QR codes in advertisements to lure users onto pages selling counterfeit goods or into fraudulent loan schemes. Examples included scanning a bike-share QR code that led to a loan link, and scanning a parcel code that triggered an unwanted subscription.
case category: news_report
incident time: 2024-06
keywords: fake QR codes
keywords: ad redirection
keywords: bike-sharing
keywords: parcel scams
keywords: counterfeit goods
keywords: loan links
keywords: unauthorized promotions
keywords: scan-to-redirect
related risks: Unauthorized Promotional Redirection
related attack tools: Malicious QR Code Generators
related threat actors: Malicious Merchants
citation: Scanning a shared bike QR code leads to a loan link? Scanning a courier package QR code results in 'being subscribed'...
updated: 2026-06-18
version: 1

Douyin Streamer Detained After Displaying Pornographic QR Code During Livestream
type: Case
break id: C0084
stix type: report
summary: Douyin platform detected a streamer who, after gaining viewer traction, suddenly displayed a pornographic traffic-diversion QR code to guide viewers into downloading a hookup app. The platform immediately banned the account's livestream permissions and reported the leads to police. The suspect was criminally detained on suspicion of illegally using information networks. The act involved inducing v
case category: criminal_verdict
incident time: 2025-08
keywords: Douyin livestream
keywords: pornographic traffic diversion
keywords: QR code
keywords: hookup app
keywords: illegal use of information networks
keywords: criminal detention
keywords: black-market accounts
keywords: platform ban
related risks: Unauthorized Promotional Redirection
related attack tools: Malicious QR Code Generators
related threat actors: Criminal Organizations
citation: Douyin Notice: Immediate Bans for Pornographic and Vulgar Content
citation: Douyin: Since 2025, 890,000 pornographic traffic-diversion black market accounts permanently banned, 66 offenders...
updated: 2026-06-18
version: 1

Douyin Streamer Detained for Cross-Platform Traffic Redirection to Overseas Accounts via VPN
type: Case
break id: C0085
stix type: report
summary: Douyin platform detected users purchasing VPN circumvention software to post pornographic content on overseas social platforms and redirect followers to offshore accounts for illicit traffic. The platform promptly disabled relevant accounts and assisted investigations, leading to the criminal detention of three individuals. This scheme used cross-platform redirection to lure users from legitimate
case category: criminal_verdict
incident time: 2026-06
keywords: Douyin
keywords: streamer
keywords: VPN circumvention
keywords: overseas social platform
keywords: pornographic content
keywords: cross-platform redirection
keywords: criminal detention
keywords: illicit traffic promotion
related risks: Unauthorized Promotional Redirection
related threat actors: Malicious Users
related threat actors: Telecom Fraud Gangs
citation: Douyin Releases Notice on Further Cracking Down on Online Black and Gray Market Activity
updated: 2026-06-25
version: 1

Chongqing Dismantles “Video QR Injection” Scheme: QR Codes Embedded in Short Videos to Drive Gambling and Pornography Traffic
type: Case
break id: C0086
stix type: report
summary: The cyber security division of Chongqing’s public security authorities identified a criminal gang led by Kang, who embedded QR codes containing gambling and pornographic links into short videos to earn advertising promotion fees from pornographic, gambling, and fraud platforms. The gang published hundreds of thousands of such injected videos using platform accounts. Viewers who scanned the codes w
case category: criminal_verdict
incident time: 2024-09
keywords: video QR injection
keywords: short video traffic diversion
keywords: QR code
keywords: online gambling
keywords: pornography traffic redirection
keywords: Kang criminal gang
keywords: Chongqing public security
keywords: advertising promotion fees
keywords: platform accounts
related risks: Unauthorized Promotional Redirection
related attack tools: Malicious QR Code Generators
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
citation: Cracking down on ad promotion and traffic diversion crimes, MPS releases 8 typical cases
citation: Public security authorities make staged progress against ad-promotion cyber black and gray market crimes; MPS releases 8 typical cases
updated: 2026-06-18
version: 1

Maiduo Mall Pyramid Scheme Case
type: Case
break id: C0087
stix type: report
summary: Henan-based 'Maiduo Mall' operated a consumer rebate and multi-level commission model through its app. Users became agents after purchasing products and earned points-based rebates by promoting products and recruiting downline members. The platform was deemed by police to involve organizing and leading a pyramid scheme, and multiple agents were prosecuted.
case category: criminal_verdict
incident time: 2023-06
keywords: Maiduo Mall pyramid scheme
keywords: consumer rebate fraud
keywords: multi-level commission model
keywords: agent recruitment scheme
keywords: points rebate system
keywords: Henan Maiduo e-commerce
keywords: organizing pyramid scheme crime
keywords: Shao Yupeng case
keywords: illegal rebate model
related risks: Unauthorized Plugin Cashback
citation: Henan 'Maiduo Mall' accused of pyramid schemes, three consumers sued for promoting products to earn points and rebates | ...
updated: 2026-06-18
version: 1

Can a no-threshold referral-rebate plugin constitute pyramid scheme crime?
type: Case
break id: C0088
stix type: report
summary: A legal seminar case examines a quantitative trading assistant plugin offered free of charge. Users who refer others can receive a share of the 30% profit the plugin platform earns, with rebate layers extending up to five levels. The discussion analyzes whether this model constitutes pyramid scheme crime, focusing on the source and basis of the rebate, noting its similarity to schemes where a port
case category: academic_research
incident time: 2024-07
keywords: quantitative trading plugin
keywords: referral rebate
keywords: pyramid scheme crime
keywords: multi-level rebate
keywords: commission split
keywords: financial compliance
keywords: legal analysis
related risks: Unauthorized Plugin Cashback
citation: Could a no-threshold recommendation plugin offering rebates be suspected of constituting a pyramid scheme crime?
updated: 2026-06-18
version: 1

Uncovering the Yunji Pin Pyramid Scheme: How 'Consumer Rebates' Defrauded 300 Million People
type: Case
break id: C0089
stix type: report
summary: The 'Yunji Pin' platform, operated by Shenzhen Qianhai Yunji Pin E-Commerce Co., Ltd., conducted pyramid scheme activities by having users set up online stores, recruit downlines, and earn rebates for introducing new members. The platform attracted users through consumer rebates before being dismantled by police, with key suspects arrested. This model is a typical violation that uses rebates as ba
case category: criminal_verdict
keywords: Yunji Pin
keywords: Shenzhen Qianhai Yunji Pin
keywords: pyramid scheme
keywords: consumer rebate fraud
keywords: downline recruitment
keywords: online pyramid scheme
keywords: police crackdown
keywords: illegal rebate model
related risks: Unauthorized Plugin Cashback
citation: Shenzhen Police Dismantled the Yunjipin Major Online Pyramid Scheme
citation: Unveiling the Yunji Pin scam, 'consumer rebates' defrauded 300 million people _ Pyramid scheme
updated: 2026-06-18
version: 1

Illegal Production and Sale of WeChat Plug-in 'Mini-Tools' Leads to Prison Terms and Fines for Two Individuals
type: Case
break id: C0090
stix type: report
summary: Zhang and Wang conspired to download the source code of a 'WeChat robot,' then developed multiple plug-in mini-tools including mini-program QR code sharing and keyword-based group pulling. They sold these tools online, earning a profit of 15,000 yuan. The court determined their actions constituted the crime of providing programs or tools for intruding into or illegally controlling computer informa
case category: criminal_verdict
incident time: 2022-11
keywords: WeChat plug-in
keywords: WeChat robot source code
keywords: mini-program plugin
keywords: illegal control of computer information systems
keywords: providing intrusion tools
keywords: keyword-based group pulling
keywords: QR code sharing
keywords: unauthorized plugin distribution
related risks: Unauthorized Plugin Promotion
related attack tools: Automation Scripts
related attack tools: Decompilation Tools
related attack tools: Mobile App Repackaging Toolchain
related threat actors: Malware Developers
citation: Illegal manufacturing and sale of WeChat plug-in add-ons, two convicted and fined - China Court Network
citation: Illegal manufacturing and sale of WeChat plug-in add-ons, two convicted and fined - Xinfu District People's Court
citation: Making and selling WeChat plug-in add-ons led to criminal punishment
updated: 2026-06-18
version: 1

Browser Plugin Hijacks Traffic: Baidu Sues Operator and Wins Compensation
type: Case
break id: C0091
stix type: report
summary: The 'New Media Manager Plus' browser plugin operated by Shanghai Zhengkai Information Technology Co., Ltd. inserted links into Baidu web pages, forcibly redirecting traffic to its own website. After Baidu filed a lawsuit, the court ordered Zhengkai to compensate for economic losses and eliminate the adverse effects.
case category: criminal_verdict
incident time: 2021-11
keywords: browser plugin traffic hijacking
keywords: Baidu
keywords: Shanghai Zhengkai Information Technology
keywords: New Media Manager Plus
keywords: forced redirect
keywords: unfair competition
keywords: court ruling
keywords: plugin hijack
related risks: Unauthorized Plugin Promotion
related attack tools: Browser Extensions
related threat actors: Competitors
citation: Browser Plugin Accused of Traffic Hijacking: Baidu Sues Operator and Wins Compensation - China Court Network
updated: 2026-06-18
version: 1

Jiangsu Police Dismantle Forced Pop-up Operation for Illegal Computer System Control
type: Case
break id: C0092
stix type: report
summary: Suspects, under the guise of ad removal and antivirus, colluded with internet cafe maintenance staff to install a software called 'X Hunter' on cafe computers. The software modified and replaced browser process parameters, locked homepages, and increased pop-ups to illegally control the computers, directing traffic to fraud and gambling schemes.
case category: criminal_verdict
incident time: 2024-09
keywords: forced pop-up
keywords: illegal computer system control
keywords: internet cafe computers
keywords: browser process hijacking
keywords: traffic diversion
keywords: gambling referral
keywords: Jiangsu police
keywords: ad-promotion black market
related risks: Unauthorized Plugin Promotion
related attack tools: Custom Browsers
related attack tools: Browser Extensions
related threat actors: Telecom Fraud Gangs
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
citation: Ministry of Public Security Announces 8 Typical Cases of Cracking Down on Ad-Promotion Cyber Gray and Black Industries
updated: 2026-06-18
version: 1

Taobao Sues 'Shopping Party' Price Comparison Plugin for Unfair Competition, Claiming 3.2 Million Yuan
type: Case
break id: C0093
stix type: report
summary: Taobao alleged that the price comparison plugin offered for download by the 'Shopping Party' website directly embedded content on Taobao's pages, obscuring and overlaying its webpages, severely disrupting user browsing experience and constituting unfair competition, leading to a lawsuit claiming 3.2 million yuan in damages.
case category: administrative_enforcement
incident time: 2016-02
keywords: Taobao
keywords: Shopping Party
keywords: price comparison plugin
keywords: unfair competition
keywords: browser extension
keywords: page overlay
keywords: 3.2 million claim
keywords: online shopping
related risks: Unauthorized Plugin Promotion
related attack tools: Browser Extensions
related threat actors: Competitors
citation: Taobao Sues 'Shopping Party' Price Comparison Plugin for Unfair Competition, Claiming 3.2 Million Yuan | ifanr
updated: 2026-06-18
version: 1

Browser Plugin Hijacks Web Traffic, Baidu Sues; Shanghai Tech Firm Ordered to Pay 830,000 Yuan for Unfair Competition
type: Case
break id: C0094
stix type: report
summary: Shanghai Zhengkai Information Technology Co., Ltd. operated the "New Media Butler Plus" browser plugin, which inserted links into Baidu web pages and forcibly redirected users to its own websites, hijacking Baidu's traffic. The court ruled this constituted unfair competition and ordered the company to pay 830,000 yuan in compensation.
case category: criminal_verdict
incident time: 2021-11
keywords: browser plugin traffic hijacking
keywords: Baidu traffic hijacking lawsuit
keywords: New Media Butler Plus plugin
keywords: forced redirect plugin
keywords: Shanghai Zhengkai unfair competition
keywords: webpage tampering plugin
keywords: malicious plugin promotion
related risks: Unauthorized Plugin Promotion
related attack tools: Browser Extensions
related threat actors: Malicious Merchants
citation: Plugin Installation Hijacks Web Traffic, Baidu Files Lawsuit: Shanghai IT Company Ordered to Pay 830,000 Yuan in First Instance for Unfair Competition
updated: 2026-06-18
version: 1

Illegal Control of Computer Information Systems: Software Bundled with Malicious Plugin Installer
type: Case
break id: C0095
stix type: report
summary: In November 2024, the People's Procuratorate of Minhang District, Shanghai, initiated a public prosecution. An information technology company bundled a malicious plugin installer within legitimate software. The defendant entity was fined 200,000 yuan for the crime of illegally controlling computer information systems; defendants Wang, Li Ji, Xiao, and Li Lei were sentenced to fixed-term imprisonme
case category: criminal_verdict
incident time: 2024-11
keywords: software bundling
keywords: malicious plugin
keywords: illegally controlling computer information systems
keywords: suspended sentence
keywords: fine
keywords: Shanghai Minhang
keywords: information technology company
keywords: webpage hijacking
keywords: installer
related risks: Unauthorized Plugin Promotion
related attack tools: Trojan Virus
related attack tools: Browser Extensions
related attack tools: Fake Apps
related threat actors: Malware Developers
related threat actors: Criminal Organizations
citation: Technology Company Convicted for Profiting from Traffic Hijacking Through Browser Plugins
citation: Warning! If This Happens, Your Webpage May Be 'Hijacked' | Hijacking | Installation Package | Plugin |...
updated: 2026-06-18
version: 1

Jiangsu “Traffic Hijacking” Computer Information System Sabotage Case
type: Case
break id: C0096
stix type: report
summary: The Jiangsu public security cyber department found that suspect Chen, together with Li, developed a hacking program and colluded with internet cafe operations staff to implant it on nearly 200,000 computers across over 5,000 internet cafes in 20 provinces and cities. They directly tampered with popular online game configuration files to illegally capture traffic generated by game promotions within
case category: criminal_verdict
incident time: 2024-09
keywords: traffic hijacking
keywords: computer information system sabotage
keywords: internet cafe
keywords: game promotion
keywords: ad commission
keywords: hacking program
keywords: online game
keywords: Jiangsu public security
keywords: Ministry of Public Security
related risks: Ad Link Hijacking
related attack tools: Trojan Virus
related threat actors: Malware Developers
related threat actors: Malicious Insiders
citation: Cracking Down on Ad-Promotion Traffic Diversion Crimes: Ministry of Public Security Releases 8 Typical Cases | Tencent News
citation: Public security authorities make staged progress against ad-promotion cyber black and gray market crimes; MPS releases 8 typical cases
updated: 2026-06-18
version: 1

Thai Supreme Court Establishes Judicial Principles on Affiliate Commission Callback Hijacking
type: Case
break id: C0097
stix type: report
summary: Thailand's Supreme Court has set judicial principles in cases involving IT fraud, electronic manipulation, and commission diversion. The court ruled that third parties who hijack commissions by overwriting tracking cookies, intercepting redirect chains, injecting affiliate IDs into callback URLs, or using malware and browser extensions to replace affiliate IDs—thereby causing the wrong affiliate t
case category: news_report
incident time: 2026-05
keywords: Thailand Supreme Court
keywords: affiliate commission hijacking
keywords: callback hijacking
keywords: cookie overwriting
keywords: ad fraud
keywords: Computer Crime Act
keywords: commission diversion
keywords: IT fraud
related risks: Ad Link Hijacking
related attack tools: Browser Extensions
related attack tools: Cookie Login Tools
related attack tools: Ad Attribution Fraud Tool
related attack tools: Infostealers
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related threat actors: Ad Attribution Fraud Groups
related threat actors: Payment Fraud Groups
citation: Affiliate Commission Callback Hijack Claims in THAILAND
updated: 2026-06-18
version: 1

Improving Click Fraud Detection with Real-Time Data Fusion in IEEE 2008 Research
type: Case
break id: C0098
stix type: report
summary: This study identifies click fraud as a criminal activity in pay-per-click online advertising, where automated scripts or programs simulate legitimate user clicks to generate charges without genuine interest. It proposes CCFDP V1.0, a real-time detection and prevention system that fuses client-side and server-side multi-source data, and tests it using real advertising campaign data, demonstrating t
case category: academic_research
incident time: 2008-12
keywords: click fraud detection
keywords: real-time data fusion
keywords: CCFDP
keywords: pay-per-click advertising
keywords: client-side detection
keywords: server-side detection
keywords: IEEE 2008
keywords: ad fraud prevention
keywords: multi-source data fusion
keywords: automated click scripts
related risks: Click Fraud
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related threat actors: Freebie Hunters
citation: Improving Click Fraud Detection by Real-Time Data Fusion
updated: 2026-06-18
version: 1

Legal Discussion on the Illegality of Using Click Software to Fraudulently Click Others' Ads
type: Case
break id: C0099
stix type: report
summary: A legal analysis article from October 7, 2024, discusses whether using click software to fraudulently click on others' advertisements is illegal. The article points out that such click software behavior indirectly leads to the dissemination of false advertising, and advertisers or advertising companies can be held accountable under relevant laws, revealing the legal risks of artificially generatin
case category: academic_research
incident time: 2024-10
keywords: click fraud software
keywords: fake ad clicks
keywords: ad fraud
keywords: click spamming
keywords: advertiser liability
keywords: false advertising dissemination
keywords: click bot
keywords: ad click inflation
related risks: Click Fraud
related attack tools: Click Simulation Tools
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Is Clicking Software to Spam Others' Ads Illegal? | SEO | Advertisers | Advertising Companies | People's Republic of...
updated: 2026-06-18
version: 1

Guangzhou's First Fraud Case Involving Cheating Software Simulating Manual Clicks to Fabricate Traffic
type: Case
break id: C0100
stix type: report
summary: In November 2018, police in Guangzhou's Nansha district dismantled an online fraud ring that used cheating software to simulate manual clicks and fabricate APP advertising traffic, arresting 10 suspects and raiding 3 hideouts. The group defrauded a company of over 5 million yuan in advertising promotion fees. This was the first case cracked by Guangzhou police involving cheating apps simulating ma
case category: criminal_verdict
incident time: 2018-11
keywords: cheating software
keywords: simulate manual clicks
keywords: fabricate traffic
keywords: fake clicks
keywords: advertising promotion fee fraud
keywords: online fraud ring
keywords: Guangzhou Nansha police
keywords: APP advertising
keywords: traffic fraud
related risks: Click Fraud
related attack tools: Click Simulation Tools
related threat actors: Criminal Organizations
citation: First Case in Guangzhou! Cheating Software Simulates Manual Clicks to Fake Traffic: New Online Fraud Gang Busted | Southern...
updated: 2026-06-18
version: 1

Yu et al. Contract Fraud Case (Guiding Case No. 1480)
type: Case
break id: C0101
stix type: report
summary: This guiding case addresses the legal characterization of organizing online water armies to manually click on advertisements. The adjudication reasoning states that such batch manual clicking is inherently deceptive and constitutes invalid malicious clicks, not the proper performance of an advertising promotion contract, and that collecting advertising fees from the platform constitutes contract f
case category: criminal_verdict
keywords: contract fraud crime
keywords: online water army
keywords: manual click
keywords: fake click
keywords: advertising fraud
keywords: invalid malicious click
keywords: advertising promotion contract
keywords: Guiding Case No. 1480
keywords: Yu
keywords: platform advertising fees
related risks: Click Fraud
related attack tools: Click Simulation Tools
related threat actors: Astroturfing Networks
citation: Yu et al. Contract Fraud Case - People's Court Case Database
citation: (2023) Contract Fraud Case of Yu et al. - Organizing Online Water Army for Batch Manual Ad Clicking
updated: 2026-06-18
version: 1

Click Fraud Detection in Pay-Per-Click Streams of Online Advertising Networks
type: Case
break id: C0102
stix type: report
summary: The pay-per-click model in online advertising faces significant fraud: attackers use automated scripts or bots to click on ads without genuine interest, draining advertiser budgets or generating illicit revenue. This not only depletes advertiser funds but also erodes trust between advertisers and publishers, leading to multiple class-action lawsuits against major ad networks.
case category: academic_research
incident time: 2008-06
keywords: click fraud
keywords: pay-per-click
keywords: PPC
keywords: online advertising networks
keywords: invalid clicks
keywords: advertiser
keywords: publisher
keywords: automated scripts
keywords: bot clicks
related risks: Click Fraud
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related threat actors: Freebie Hunters
citation: Detecting Click Fraud in Pay-Per-Click Streams of Online Advertising Networks
updated: 2026-06-18
version: 1

Ad Click Fraud Detection: A Study of Machine Learning and Deep Learning Approaches
type: Case
break id: C0103
stix type: report
summary: Juniper Research estimates that by the end of 2023, ad fraud will cost advertisers $84 billion, accounting for over 22% of global online ad spend. An estimated 17% of PC and desktop clicks are invalid, yielding no return on ad spend. This study applies feature engineering methods to distinguish bot-generated clicks from genuine user clicks.
case category: academic_research
incident time: 2025-01
keywords: click fraud detection
keywords: ad fraud machine learning
keywords: deep learning click fraud
keywords: feature engineering
keywords: invalid clicks
keywords: bot detection online advertising
keywords: Juniper Research ad fraud report
related risks: Click Fraud
citation: Ad Click Fraud Detection Using Machine Learning and Deep Learning Algorithms
updated: 2026-06-18
version: 1

BotSpot: A Hybrid Learning Framework to Uncover Bot Install Fraud in Mobile Advertising
type: Case
break id: C0104
stix type: report
summary: This study addresses bot install fraud in mobile advertising by proposing BotSpot, a hybrid learning framework for detecting fake installs. By analyzing advertiser feedback on whether installs are normal or bot-driven, the model identifies fraudulent activities that use automated scripts or bot accounts to simulate user installs, with relevant case studies demonstrated.
case category: academic_research
keywords: bot install fraud detection
keywords: mobile advertising fraud
keywords: hybrid learning framework
keywords: fake install detection
keywords: install farms
keywords: automated scripts
keywords: BotSpot
related risks: Fake App Installs
related risks: Fake Conversion and Install Farm
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related threat actors: Ad Attribution Fraud Groups
citation: BotSpot: A Hybrid Learning Framework to Uncover Bot Install Fraud in Mobile Advertising
updated: 2026-06-18
version: 1

Botspot++: A Hierarchical Deep Ensemble Model for Bots Install Fraud Detection in Mobile Advertising
type: Case
break id: C0105
stix type: report
summary: This study proposes Botspot++, a hierarchical deep ensemble model for detecting bot-driven install fraud in mobile advertising. Using advertiser feedback labels (normal installs or bot installs), case studies and data visualization are conducted to identify fraudulent activities that use automated programs to simulate user installations, aiming to mitigate the damage of fake install volumes on the
case category: academic_research
keywords: mobile advertising fraud
keywords: bot installs
keywords: install farms
keywords: fake install detection
keywords: deep learning
keywords: ensemble model
keywords: Botspot++
keywords: advertiser feedback
keywords: automated programs
keywords: mobile advertising ecosystem
related risks: Fake App Installs
related risks: Fake Conversion and Install Farm
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Virtual Machine
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Botspot++: A Hierarchical Deep Ensemble Model for Bots Install Fraud Detection in Mobile Advertising
updated: 2026-06-18
version: 1

Shanghai Putuo District Phone Farming Fraud Case for Ad Promotion Fees
type: Case
break id: C0106
stix type: report
summary: In 2022, the People's Procuratorate of Putuo District, Shanghai, handled a case involving the use of a traffic-farming tool to automatically alter phone parameters, disguise devices as new, and simulate user clicks to download and install designated apps in order to defraud advertising promotion fees. The orchestrators generated fake installations and fake active users to illicitly obtain large su
case category: criminal_verdict
incident time: 2022-08
keywords: phone farming
keywords: ad promotion fee fraud
keywords: fake app installs
keywords: contract fraud conviction
keywords: traffic farming tool
keywords: altering phone parameters
keywords: simulate user clicks
keywords: Putuo District Procuratorate
related risks: Fake App Installs
related attack tools: Device Spoofing Tools
related attack tools: Click Simulation Tools
related threat actors: Ad Attribution Fraud Groups
citation: ...Creating Fake Users Through Click Farming to Fraudulently Obtain Promotion Fees: Behind-the-Scenes Manipulator Convicted of Contract Fraud | People's Republic of...
citation: Shanghai Putuo District People's Court criminal judgment
citation: Using phones for traffic farming may be illegal: real cases show why not to game the system
updated: 2026-06-18
version: 1

Machine Advertising Analyzes Sources of App Install Fraud
type: Case
break id: C0107
stix type: report
summary: In 2018, Machine Advertising found that app install fraud is a global issue, with high proportions of malicious actors in Russia, Israel, and Southeast Asia. Fraud methods include using device farms for manual click flooding and technical approaches such as SDK spoofing and install hijacking to generate fake installs, siphoning advertisers' cost-per-install budgets.
case category: news_report
incident time: 2018-10
keywords: Machine Advertising
keywords: app install fraud
keywords: fake installs
keywords: SDK spoofing
keywords: install hijacking
keywords: device farms
keywords: cost-per-install
keywords: mobile ad fraud detection
related risks: Fake App Installs
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: The Who, How and Why of App Install Fraud
updated: 2026-06-18
version: 1

Fraudlogix Breaks Down Mobile App Install Fraud Techniques
type: Case
break id: C0108
stix type: report
summary: Fraudlogix highlights how mobile app install fraud exploits fake installs, click injection, SDK spoofing, and device farms to drain advertising budgets. Fraudsters use these techniques to simulate large volumes of fake installs, contaminating downstream metrics such as retention rates and in-app revenue, preventing advertisers from accurately measuring the effectiveness of genuine user acquisition
case category: news_report
keywords: Fraudlogix
keywords: install fraud
keywords: click injection
keywords: SDK spoofing
keywords: device farms
keywords: fake installs
keywords: mobile ad fraud
keywords: app install fraud
related risks: Fake App Installs
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Install Fraud: Click Injection, SDK Spoofing & Fake Installs | Fraudlogix
updated: 2026-06-18
version: 1

LinkedIn Article Reveals Hidden Losses from Fake Installs
type: Case
break id: C0109
stix type: report
summary: An industry analysis reveals that one in four mobile app installs may be fraudulent. Beyond wasting ad budgets, fake installs contaminate downstream metrics such as user retention, in-app revenue, and lifetime value once counted as genuine, preventing marketers from accurately evaluating channel performance.
case category: news_report
keywords: mobile ad fraud
keywords: fake installs
keywords: user retention
keywords: lifetime value
keywords: ad spend
keywords: marketing analytics
keywords: attribution fraud
keywords: app install fraud
related risks: Fake App Installs
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: 1 in 4 Installs Are Often Fraudulent. The Bigger Loss Starts After the...
updated: 2026-06-18
version: 1

Man Arrested for Operating Over 1,000 Phones to Manipulate Views and Comments
type: Case
break id: C0110
stix type: report
summary: In August 2023, the Economic Development Branch of the Anqing Public Security Bureau cracked a case involving illegal profit from fake traffic, arrested one suspect, dismantled one operating site, and seized 1,052 mobile phones. The suspect used more than a thousand phones in a rented room to manipulate live-stream rankings, inflate traffic, and control comments for profit.
case category: administrative_enforcement
incident time: 2023-08
keywords: phone farm
keywords: view manipulation
keywords: comment manipulation
keywords: device farm
keywords: fake traffic
keywords: display fraud
keywords: click farming
keywords: Anqing police
keywords: rented apartment operation
related risks: Impression Fraud
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
citation: Man Simultaneously Controls Thousands of Phones for Click Farming and Comment Manipulation Arrested! Footage from Inside Rental Room Exposed
citation: Anqing Police: Over One Thousand Phones Running Simultaneously in a Rented Room
updated: 2026-06-18
version: 1

Henan Yuzhou Court Sentences Defendant in Livestream Traffic Fraud Case
type: Case
break id: C0111
stix type: report
summary: In May 2026, the Yuzhou Court in Henan Province sentenced a defendant, Wang Moumou, to five years and three months in prison and a fine of 80,000 yuan for organizing fake traffic generation in livestream rooms. The scheme artificially inflated viewer counts and popularity metrics to deceive consumers and advertisers.
case category: criminal_verdict
incident time: 2026-05
keywords: livestream traffic fraud
keywords: fake viewership
keywords: illegal business operations
keywords: Yuzhou Court
keywords: Wang Moumou
keywords: advertiser deception
keywords: consumer fraud
keywords: livestream popularity manipulation
related risks: Impression Fraud
related threat actors: Astroturfing Networks
citation: Henan court case selected among 2025 national consumer-rights protection typical judicial cases
citation: ...Henan Yuzhou Court: Convicted of Illegal Business Operations, Sentenced to Five Years and Three Months, Fined 80,000 Yuan...
updated: 2026-06-18
version: 1

Hangzhou Jiefu Culture Media Fined RMB 200,000 for False Livestream Product Performance Claims
type: Case
break id: C0112
stix type: report
summary: A livestream e-commerce typical case published by the State Administration for Market Regulation showed that Hangzhou Jiefu Culture Media Co., Ltd. provided livestream operation hosting and promotion planning services for the 'jovs618 ultrasonic beauty device' session of the 'Xiaobinggan' livestream room. During the session, the host used scripts supplied by the company to claim that the product could 'form muscle memory without rebound' and 'do hundreds of thousands of crunches per minute,' but the company could not provide supporting evidence. In January 2025, the Yuhang District Market Supervision Administration of Hangzhou fined the company RMB 200,000 for false product performance advertising.
case category: administrative_enforcement
incident time: 2025-01
keywords: livestreaming false advertising
keywords: product performance claims
keywords: livestreaming e-commerce
keywords: Yuhang District Market Supervision Administration
keywords: Hangzhou Jiefu Culture Media
keywords: jovs618 ultrasonic beauty device session
keywords: host misleading claims
keywords: consumer deception
related risks: Impression Fraud
citation: State Administration for Market Regulation Releases Typical Livestream E-Commerce Cases
updated: 2026-06-18
version: 1

Criminal Gang Providing Fake Reviews for Over 4,000 Online Stores Busted
type: Case
break id: C0113
stix type: report
summary: The public security bureau of Rongjiang County, Qiandongnan Prefecture, Guizhou Province, dismantled a click-farm criminal gang engaged in fake transactions and review manipulation. Since 2019, the gang had provided fake review services for over 4,000 online stores, fabricating transactions and ratings to inflate merchant metrics, with a total involved capital flow of 370 million yuan. This case r
case category: criminal_verdict
incident time: 2024-09
keywords: click farm
keywords: fake transaction
keywords: fabricated review
keywords: review manipulation
keywords: e-commerce brushing
keywords: fictitious transaction
keywords: Rongjiang Guizhou
keywords: traffic fraud
related risks: Impression Fraud
related threat actors: Astroturfing Networks
citation: Guizhou Public Security Notice on Four Typical Cybercrime Cases in 2024
citation: ...Official Report on CCTV Exposure of Toxic Goji Berries; Criminal Gang Providing Fake Reviews for Over 4,000 Online Stores...
updated: 2026-06-18
version: 1

Multiple Illegal Cases Filed and Investigated: SAMR Reports Disposition of Issues Exposed at the '3·15' Gala
type: Case
break id: C0114
stix type: report
summary: In March 2026, the State Administration for Market Regulation reported progress on addressing issues exposed at the '3·15' Gala. It launched a campaign to improve online food safety compliance, targeting problems in livestream-sold food and health food, and cracked down on illegal practices such as false marketing and forging or misusing test reports. The actions included investigations into fraud
case category: administrative_enforcement
incident time: 2026-03
keywords: SAMR
keywords: 3·15 Gala
keywords: livestream e-commerce
keywords: false marketing
keywords: forged test reports
keywords: food safety
keywords: health food
keywords: online food safety compliance
keywords: case filing
keywords: display fraud
related risks: Impression Fraud
citation: Multiple Illegal Cases Filed and Investigated! State Administration for Market Regulation Reports on Handling of 'March 15' Gala Exposure Issues...
citation: Transcript of SAMR's regular press conference for the first quarter of 2026
updated: 2026-06-18
version: 1

Impression Fraud in Mobile Advertising
type: Case
break id: C0115
stix type: report
summary: Impression fraud in mobile advertising involves generating fake ad views that are never actually seen by real users. Common techniques include pixel stuffing, ad stacking, and pop-ups, allowing fraudsters to inflate impression counts and overcharge advertisers.
case category: academic_research
keywords: impression fraud
keywords: mobile advertising
keywords: pixel stuffing
keywords: ad stacking
keywords: pop-up fraud
keywords: advertiser overcharging
keywords: AppsFlyer
keywords: fake impressions
related risks: Impression Fraud
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: What Is Impression Fraud? | AppsFlyer Mobile Glossary
updated: 2026-06-18
version: 1

Legal Risk Analysis of Click Fraud and Attribution Fraud
type: Case
break id: C0116
stix type: report
summary: An article by Boss & Young Attorneys-at-Law explains that attribution fraud refers to fraudulent channels exploiting vulnerabilities in third-party attribution strategies by fabricating impressions or clicks to steal credit for user conversions. Common practices include click fraud, where massive fake clicks are sent to hijack organic user installs, leading to wasted advertiser budgets. This behav
case category: academic_research
incident time: 2025-08
keywords: click fraud
keywords: attribution fraud
keywords: last-click attribution model
keywords: fake clicks
keywords: advertiser budget waste
keywords: organic traffic
keywords: channel traffic
keywords: traffic attribution
keywords: mobile advertising
keywords: fraudulent channels
related risks: Traffic Attribution Fraud
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Boss & Young Law Firm
updated: 2026-06-18
version: 1

A Major Insurer's Ad Fraud Prevention Case
type: Case
break id: C0117
stix type: report
summary: A leading domestic insurance company faced fraudulent traffic generated by black-market actors using emulators and device farms. Shumei Technology successfully identified 16% of risky devices through real-time risk device recognition, effectively reducing exposure to fraudulent traffic and saving tens of millions in annual advertising costs.
case category: news_report
incident time: 2025-04
keywords: ad fraud prevention
keywords: traffic attribution fraud
keywords: emulator detection
keywords: device farm detection
keywords: fake traffic
keywords: Shumei Technology
keywords: insurance digital marketing
keywords: risk device identification
related risks: Traffic Attribution Fraud
related attack tools: Mobile Phone Emulator
related attack tools: Mass Control Systems
related threat actors: Ad Attribution Fraud Groups
citation: Fancy Insurance Fraud! Seven Typical Insurance Fraud Cases Exposed - Shanghai Municipal Financial Office
updated: 2026-06-18
version: 1

Jiangsu Police Uncover Traffic Hijacking Case Involving Computer System Sabotage
type: Case
break id: C0118
stix type: report
summary: An investigation by Jiangsu police cyber units found that suspect Chen conspired with Li to develop a hacking program. They colluded with internet cafe operators to illegally install the program on nearly 200,000 computers across 5,000 internet cafes in 20 provinces and cities. The program directly altered popular online game configuration files to illicitly capture traffic generated by game promo
case category: criminal_verdict
incident time: 2024-09
keywords: traffic hijacking
keywords: computer system sabotage
keywords: internet cafe malware
keywords: game config tampering
keywords: game promotion fraud
keywords: traffic attribution fraud
keywords: black market game commissions
keywords: Jiangsu police
related risks: Traffic Attribution Fraud
related attack tools: Game Cheats
related attack tools: Ad Attribution Fraud Tool
related threat actors: Criminal Organizations
citation: The collapse of traffic hijacking profiteering
updated: 2026-06-18
version: 1

Manually Operating 800 Phones to Generate Fake Traffic for E-Commerce Livestreams: Online Water Army Gang Busted
type: Case
break id: C0119
stix type: report
summary: Daqing cyber police in Heilongjiang cracked an online water army case, arresting seven suspects and seizing over 800 mobile phones. The gang manually manipulated large numbers of phones to create fake viewership and traffic for short-video platform livestreams, with the amount involved exceeding 1 million yuan, constituting a typical case of fake traffic ad fraud.
case category: criminal_verdict
keywords: online water army
keywords: fake traffic
keywords: ad fraud
keywords: livestream view boosting
keywords: phone wall
keywords: Daqing cyber police
keywords: e-commerce livestream
keywords: fake popularity
keywords: gang operation
related risks: Ad Fraud
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
citation: Manually Controlling 800 Phones to Generate Fake Traffic for E-Commerce Livestreams: Online Water Army Gang Arrested | Zhan...
citation: Manual Operation of 800 Phones for Ranking Fraud: Click-Farm Gang Busted
updated: 2026-06-18
version: 1

Douyin Platform Crackdown on Pornographic Gambling Referral, Proxy Reporting, and Fake Traffic Leads to Arrest of 162 Suspects
type: Case
break id: C0120
stix type: report
summary: Douyin platform collaborated with authorities to dismantle criminal gangs, resulting in the arrest of 162 suspects. These gangs engaged in pornographic gambling referral, proxy reporting, and fake traffic generation on Douyin, exploiting fraudulent traffic for ad monetization and undermining the platform's advertising ecosystem.
case category: criminal_verdict
incident time: 2026-06
keywords: Douyin
keywords: pornographic referral
keywords: gambling referral
keywords: fake traffic
keywords: ad fraud
keywords: proxy reporting
keywords: black-market gangs
keywords: platform governance
related risks: Ad Fraud
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related attack tools: Ad Attribution Fraud Tool
related threat actors: Telecom Fraud Gangs
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
related threat actors: Astroturfing Networks
related threat actors: Ad Attribution Fraud Groups
citation: Douyin Announcement on Deepening Crackdowns Against Online Black and Gray-Market Activity
citation: Engaging in Pornographic Gambling Traffic Diversion, Proxy Reporting, Fake Traffic, and Other Acts on Douyin Platform: 162 Criminals...
updated: 2026-06-18
version: 1

Tongli IP | Exploring Anti-Unfair Competition Law Approaches to Platform Governance of Traffic Fraud
type: Case
break id: C0121
stix type: report
summary: The article analyzes the harm of traffic fraud to platform ecosystems, noting that in 2023, abnormal ad exposure accounted for 23.9% and abnormal clicks 20.4%. It cites the Tencent v. Ant Help Platform case, revealing how ad fraud severs the virtuous cycle between quality content and user engagement, undermining advertisers' value assessment.
case category: academic_research
incident time: 2024-09
keywords: traffic fraud
keywords: platform governance
keywords: anti-unfair competition law
keywords: ad fraud
keywords: abnormal ad exposure
keywords: abnormal clicks
keywords: Tencent v. Ant Help Platform
keywords: advertiser value assessment
related risks: Ad Fraud
citation: Tongli Intellectual Property | Exploring the Anti-Unfair Competition Law Approach to Platform Governance of Fake Traffic Fraud_Tencent News
updated: 2026-06-18
version: 1

Cyber Police Bust 'Online Water Army' Fake Traffic Case
type: Case
break id: C0122
stix type: report
summary: The cyber division of the public security bureau cracked a case involving the paid provision of fake traffic services. Suspects An, Zang, Ji, and others, driven by profit, built websites and set up mobile phone farms to illegally provide services such as fake live-stream viewers, follower boosts, likes, comments, and view counts for online broadcast rooms, charging fees ranging from tens to hundre
case category: criminal_verdict
incident time: 2025-03
keywords: online water army
keywords: fake traffic
keywords: illegal business operations crime
keywords: fake engagement
keywords: live stream viewers
keywords: follower boost
keywords: mobile phone farm
keywords: view botting
related risks: Ad Fraud
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Offline Game Bots
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Cyber Police | Manipulating 'Online Water Army' to Create 'Fake Traffic', Multiple Arrests Made!
updated: 2026-06-18
version: 1

Huang et al. Exploiting Ad Settlement Loopholes to Defraud Advertising Fees
type: Case
break id: C0123
stix type: report
summary: The Shanghai Putuo District Court found that Huang, acting with intent to illegally possess, colluded with others to exploit ad settlement loopholes and defraud over 50 million yuan in advertising fees while also selling counterfeit trademark goods. Wu defrauded over 20 million yuan in advertising fees. Wei and eight others participated in selling counterfeit trademark goods. Huang and Wu's action
case category: criminal_verdict
incident time: 2026-04
keywords: ad settlement loophole
keywords: defraud advertising fees
keywords: contract fraud
keywords: selling counterfeit trademark goods
keywords: Shanghai Putuo District Court
keywords: ad fraud
keywords: traffic spoofing
keywords: fake accounts
related risks: Ad Fraud
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Exploiting Ad Settlement Loopholes to Freeload Traffic! Over 70 Million Yuan in Ad Fees Defrauded, 5,400 Fake Accounts Maliciously...
citation: Shanghai People's Procuratorate: exploiting refund timing gaps to defraud advertising fees
updated: 2026-06-18
version: 1

DECAF: Detecting Mobile In-App Ad Fraud
type: Case
break id: C0124
stix type: report
summary: A research team designed the DECAF system to automatically detect ad display fraud in mobile apps. By automating app navigation and scanning visual elements, it checks whether ads violate scalable placement and display rules. DECAF has been applied to 1,150 tablet apps and 50,000 phone apps, and was used by Microsoft's ad fraud team to uncover numerous instances of ad fraud.
case category: academic_research
incident time: 2014
keywords: DECAF ad fraud detection
keywords: mobile ad display fraud
keywords: in-app ad placement rules
keywords: automated app navigation
keywords: visual element scanning
keywords: Microsoft Research ad fraud
related risks: Ad Fraud
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: {DECAF}: Detecting and characterizing ad fraud in mobile apps
updated: 2026-06-18
version: 1

AlfScan-X: Detecting Ad Attribution Laundering Fraud
type: Case
break id: C0125
stix type: report
summary: A research team identified a novel collusive mobile ad fraud scheme called ad attribution laundering fraud (ALF), in which multiple apps conspire to hide the true source of ad impressions, allowing low-quality apps to steal the reputation of legitimate ones. The developed AlfScan-X tool achieved 92% precision and recall on a real-world dataset of 200 apps, identifying 4,515 unique fraudulent apps
case category: academic_research
incident time: 2025-03
keywords: ad attribution laundering
keywords: ALF
keywords: mobile ad fraud
keywords: collusive fraud
keywords: AlfScan-X
keywords: ad fraud detection
keywords: attribution laundering
keywords: mobile apps
keywords: fraud clusters
related risks: Ad Fraud
related attack tools: Ad Attribution Fraud Tool
related threat actors: Ad Attribution Fraud Groups
citation: Collaborative ad fraud detection in ad networks
updated: 2026-06-18
version: 1

Exploiting Platform Loopholes for Fraudulent Gains: 'Petty Theft' May Lead to Criminal Charges
type: Case
break id: C0126
stix type: report
summary: In December 2021, CNR reported multiple cases of malicious exploitation of platform policies. A user in Wuhan exploited a food delivery platform's rapid refund policy by submitting photoshopped images of foreign objects, filing 115 fraudulent claims in six months and obtaining nearly 20,000 yuan, resulting in a fraud conviction. In Nantong, Jiangsu, a user registered new accounts to harvest e-comm
case category: news_report
incident time: 2021-12
keywords: platform policy abuse
keywords: coupon fraud
keywords: fraud conviction
keywords: food delivery platform
keywords: rapid refund loophole
keywords: photoshopped evidence
keywords: new user promo exploitation
keywords: e-commerce platform
keywords: organized illicit chain
related risks: Malicious Benefit Abuse
related risks: Unauthorized Discount Purchase
related threat actors: Freebie Hunters
related threat actors: Fraudulent Claims Gangs
citation: Maliciously Exploiting Platform Rule Loopholes to 'Woolgather': Beware of Criminal Charges for 'Petty Gains'_Tencent...
updated: 2026-06-18
version: 1

New 'Wool-Pulling' Fraudulent Ordering Scam Drains Idle Taobao Store Deposits
type: Case
break id: C0127
stix type: report
summary: In October 2022, China Youth Daily reported that a Shanghai Taobao store owner, Mr. Liu, had his idle store for nearly three years targeted by multiple buyers who placed 27 orders in a short time. The buyers then complained about non-delivery, causing the platform to automatically deduct 2,322 yuan from his deposit as compensation. Another store owner, Ms. Qin, experienced a similar incident, losi
case category: news_report
incident time: 2022-10
keywords: malicious ordering
keywords: wool-pulling scam
keywords: Taobao store deposit fraud
keywords: virtual phone numbers
keywords: platform compensation rules
keywords: idle store exploitation
keywords: buyer complaint abuse
keywords: China Youth Daily
related risks: Malicious Benefit Abuse
related attack tools: Black SIM Cards
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
related threat actors: Professional Counterfeit Claimants
citation: New 'Woolgathering' Scam via Malicious Ordering? Taobao Store Idle but Deducted Thousands in Deposits...
updated: 2026-06-18
version: 1

Shanghai White-Collar Worker Sentenced for Exploiting Parking Discounts via SMS Verification Code App
type: Case
break id: C0128
stix type: report
summary: Between August and December 2020, a Shanghai-based white-collar worker surnamed Li exploited the 'Hesheng Tong' app's new member parking promotion at Hopson One Plaza. Using the 'Juma JieMa' app to purchase virtual phone numbers and verification codes, he registered fake new accounts to accumulate points and redeem free parking time, defrauding the mall of over 5,000 yuan in parking fees. Twenty-f
case category: criminal_verdict
incident time: 2020-08
keywords: SMS verification code app
keywords: virtual phone number
keywords: parking fee fraud
keywords: Hopson One Plaza
keywords: Hesheng Tong app
keywords: Juma JieMa
keywords: fraud conviction
keywords: aiding information network crime
keywords: membership points abuse
keywords: promo abuse
related risks: Malicious Benefit Abuse
related risks: Coupon Restriction Bypass
related risks: Unauthorized Discount Purchase
related risks: After-Sales Rights Abuse
related risks: Membership / Subscription Abuse
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
related threat actors: Malware Developers
citation: Is 'Woolgathering' a Crime? White-Collar Worker Sentenced for Parking All Day for 80 Cents!_Tencent News
citation: One License Plate Bound to Over 1,000 Mobile Numbers to Fraudulently Obtain Parking Fee Discounts
updated: 2026-06-18
version: 1

Refund-Only Scam Nets 4 Million Yuan from Merchants, Fraudster Sentenced to 6 Years
type: Case
break id: C0129
stix type: report
summary: In January 2026, it was reported that a 17-year-old named Lü discovered a vulnerability on an official cosmetics platform allowing refunds without returning goods. He exploited his own and relatives' accounts, rented additional accounts, placed bulk orders for skincare products, requested refunds with fake returns, and resold the items. In total, he executed over 11,900 orders involving goods wort
case category: criminal_verdict
incident time: 2026-01
keywords: refund-only fraud
keywords: fake returns
keywords: e-commerce platform vulnerability
keywords: cosmetics resale
keywords: Lü case
keywords: criminal fraud conviction
keywords: 6-year sentence
keywords: bulk ordering scam
keywords: account renting
related risks: Malicious Benefit Abuse
related threat actors: Freebie Hunters
citation: Refund-Only Woolgathering Defrauds Merchants of 4 Million Yuan, Wool Party Sentenced to 6 Years_Tencent News
citation: Shanghai Fengxian District People's Procuratorate: fake return fraud case
updated: 2026-06-18
version: 1

Shanghai Putuo Police Detain Woman for Fabricating Hotel Hygiene Claims
type: Case
break id: C0130
stix type: report
summary: In May 2025, China Police Daily reported that Shanghai Putuo police had solved a series of picking-quarrels-and-provoking-trouble cases. The suspect Wang used her own allergic condition to fabricate hotel hygiene problems and demand room-fee compensation. Police found that she had moved through more than ten hotels in Shanghai within one month and repeatedly demanded refunds on the same grounds. Wang was placed under criminal detention.
case category: criminal_verdict
incident time: 2025-03
keywords: fabricated hotel hygiene claim
keywords: picking quarrels provoking trouble
keywords: Shanghai Putuo police
keywords: criminal detention
keywords: consumer dispute scam
keywords: hotel refund scam
related risks: Malicious Benefit Abuse
related threat actors: Freebie Hunters
citation: Shanghai Putuo police solve series of picking-quarrels cases; suspect detained
updated: 2026-06-26
version: 1

Exploiting Refund Time Gap for 'Wool Pulling'
type: Case
break id: C0131
stix type: report
summary: In September 2025, it was reported that two cross-border e-commerce company owners, Huang and Wu, discovered a time gap in an advertising platform's refund process where ads continued to run for two hours after a refund was requested. They directed employees to use thousands of fake ad accounts to repeatedly execute 'top-up, run ads, request refund' cycles, fraudulently siphoning up to 70 million
case category: criminal_verdict
incident time: 2025-09
keywords: refund time gap
keywords: ad platform
keywords: fake accounts
keywords: cross-border e-commerce
keywords: contract fraud
keywords: advertising fee theft
keywords: Huang
keywords: Wu
keywords: malicious exploitation
related risks: Malicious Benefit Abuse
related threat actors: Freebie Hunters
citation: Exploiting Refund Time Gap to 'Woolgather' | Cross-Border E-Commerce | Cross-Border E-Commerce Company | Contract Fraud Crime |...
citation: Shanghai People's Procuratorate: exploiting refund timing gaps to defraud advertising fees
updated: 2026-06-18
version: 1

Henan Du Fake Transaction Coupon Abuse Case
type: Case
break id: C0132
stix type: report
summary: The Henan High People's Court reported that Du sought to obtain platform subsidies by misusing other people's identity information to register two stores on an e-commerce platform, collecting relatives' and friends' phone numbers and verification codes to register new platform accounts in bulk, claiming new-user coupons and red packets, placing orders in his own stores, and buying fake logistics tracking numbers to fabricate transaction records. The closed loop of fake orders caused the platform to pay more than 13,000 yuan in subsidies. The court found that Du misused identity information and fabricated transactions for illegal possession, constituting fraud, and sentenced him to seven months in prison with a one-year suspended sentence and a 2,000 yuan fine.
case category: criminal_verdict
incident time: 2025-06
keywords: fake transactions
keywords: coupon abuse
keywords: platform subsidy fraud
keywords: new user coupons
keywords: fake logistics tracking number
keywords: bulk account registration
keywords: identity misuse
keywords: Dengfeng People's Court
keywords: Du
keywords: fraud judgment
related risks: Malicious Benefit Abuse
related threat actors: Freebie Hunters
citation: Fake Transactions for Coupon Abuse: Failed Enrichment Turns into Debt - Henan High People's Court
updated: 2026-06-26
version: 1

Shanghai Police Investigate Illegal Currency Exchange Using Online Game Tokens
type: Case
break id: C0133
stix type: report
summary: China Peace reported that Shanghai police, under the MPS-deployed Operation Jianji 22, continued to crack down on criminal chains that used offshore companies and underground banks to transfer illicit proceeds overseas. In September 2022, Shanghai police investigated a case involving a privately built online currency-exchange platform that used recycling and top-ups of online game tokens for illegal currency exchange. The method exploited the cross-border circulation and price stability of virtual game items, using them as a medium for hidden illegal exchange transactions and fund transfers.
case category: criminal_verdict
incident time: 2022-11
keywords: game token recharge
keywords: illegal currency exchange
keywords: underground banking
keywords: online game tokens
keywords: Shanghai police
keywords: game token recycling
keywords: foreign exchange
keywords: money laundering
keywords: illegal funds channel
keywords: Operation Jianji 22
related risks: Unauthorized Third-Party Top-Up Services
related threat actors: Underground Money Houses
citation: More than 100 Cases Solved, over 70 Billion Yuan Involved: Shanghai Police Crack Down on Money-Laundering Crimes
citation: Risk Removal and Safety Building: Can Game Tokens Also Make Money?
updated: 2026-06-18
version: 1

12 Players Face Criminal Charges for Illegal Top-Ups, Sega and Square Enix Lose Over 1 Billion Yen
type: Case
break id: C0134
stix type: report
summary: The Tokyo Metropolitan Police Department filed charges against 12 players, with 4 arrested and 8 referred to prosecutors. The players contacted top-up providers through RMT sites, paying only 2% to 6% of the official price for in-game currency. The providers sent fraudulent payment information to game company servers to illegally obtain virtual currency, causing cumulative losses exceeding 1 billi
case category: criminal_verdict
incident time: 2025-07
keywords: illegal top-up
keywords: RMT
keywords: fake payment
keywords: virtual currency
keywords: Sega
keywords: Square Enix
keywords: Tokyo Metropolitan Police
keywords: game black market
keywords: criminal referral
keywords: economic loss
related risks: Unauthorized Third-Party Top-Up Services
citation: Sega Notice and User Guidance on Fraudulent In-Game Purchases
citation: Square Enix Notice and User Guidance on Fraudulent In-Game Purchases in Game Apps
citation: 12 Players Face Criminal Liability for Illegal Top-Ups, Sega and Square Enix Suffer Cumulative Losses Exceeding 1 Billion Yen...
updated: 2026-06-18
version: 1

Beware: Discounted Utility Bill Payments Used as Money Laundering Front, Leading to One-Year Prison Sentence
type: Case
break id: C0135
stix type: report
summary: Xiamen Anti-Fraud Center reveals a case where Liu found a store on Xianyu offering 20% off electricity bill payments, resold them to neighbors at a 10% discount to earn a margin, and unwittingly became a money laundering conduit. Separately, Xia, a power sales agent in Fengcheng, Liaoning, recruited customers with 3% to 5% discounts on bill payments, knowingly collected user funds and forwarded th
case category: criminal_verdict
incident time: 2026
keywords: discounted electricity bill payment
keywords: money laundering
keywords: utility bill discount
keywords: Xianyu
keywords: power sales agent
keywords: laundering fraudulent funds
keywords: aiding information network criminal activities
keywords: Liu
keywords: Xia
keywords: Fengcheng
related risks: Unauthorized Third-Party Top-Up Services
related threat actors: Money Laundering Gangs
citation: Fengcheng Procuratorate Warning on Discounted Electricity Bill Payments Used to Launder Telecom Fraud Proceeds
citation: Warning! Low-Cost Electricity Top-Ups May Be Money Laundering Traps, One Person Sentenced to One Year for This_Discount_Price Difference_Illegal
updated: 2026-06-18
version: 1

Using Mobile Phone Slow-Recharge Services to Launder Money for Gambling Crime Syndicates
type: Case
break id: C0136
stix type: report
summary: Police in Zibo, Shandong dismantled a major criminal case involving aiding information network criminal activities, with a total amount exceeding 20 billion yuan. The criminal group exploited mobile phone slow-recharge services, programmatically linking top-up orders to gambling websites. Funds paid for the top-ups were used as illicit capital to launder money for gambling crime syndicates. The ta
case category: criminal_verdict
incident time: 2023-03
keywords: phone credit slow recharge
keywords: money laundering
keywords: aiding information network criminal activities
keywords: gambling platform
keywords: Zibo police
keywords: payment settlement
keywords: order hijacking
keywords: major cybercrime case
related risks: Unauthorized Third-Party Top-Up Services
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
citation: Using Mobile Slow-Top-Up Services for Phone Bills to Launder Money for Gambling Gangs! Police Bust Major Aiding and Abetting Case...
citation: Zichuan Police Crack the “12.06” Major Aiding Information Network Criminal Activities Case
updated: 2026-06-18
version: 1

Black-market gang offering discounted membership top-ups dismantled by police
type: Case
break id: C0137
stix type: report
summary: In October 2023, Hangzhou cyber police uncovered a black-market gang exploiting a vulnerability in Apple's in-app purchase mechanism to sell discounted membership services, offering subscriptions originally priced at nearly 300 yuan for half the cost. The gang illegally sold 59,339 pieces of personal information before being taken down.
case category: criminal_verdict
incident time: 2023-10
keywords: discounted top-up
keywords: Apple in-app purchase
keywords: mechanism vulnerability
keywords: Hangzhou cyber police
keywords: membership service
keywords: illegal data sale
keywords: personal information leak
keywords: black-market gang
related risks: Unauthorized Third-Party Top-Up Services
related threat actors: Freebie Hunters
related threat actors: Criminal Organizations
citation: Top Celebrity Identity Info Available for Monthly Subscription, Hacker Behind It Turns Out to Be a Post-00s Youth! Police Report...
updated: 2026-06-18
version: 1

Shanghai Police Dismantle a Game Cheat Black-Market Chain
type: Case
break id: C0138
stix type: report
summary: In December 2024, the Shanghai Public Security Bureau reported that Jinshan and Jing'an police had cracked two cases involving computer information system sabotage during the 'Lijian 2024' special operation, dismantling black-market chains that produced and sold game cheats. In the Jinshan case, police found that a game streamer used a DMA cheat with wallhack and auto-lock capabilities to attract traffic and recruit resellers. In September 2024, police arrested 16 suspects across multiple locations and seized computers, phones, phone-control equipment, and other crime tools.
case category: criminal_verdict
incident time: 2024-12
keywords: game cheats
keywords: DMA cheat
keywords: computer information system compromise
keywords: Shanghai police
keywords: Jinshan police
keywords: Jing'an police
keywords: Lijian 2024
keywords: game streamer
keywords: cheat resellers
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Gold Farming Studios
citation: Shanghai Police Crack Down on Cybercrime and Protect Companies' Legitimate Rights
updated: 2026-06-25
version: 1

Tianjin Dismantles Entire Criminal Chain of Game Account Trading Fraud Ring
type: Case
break id: C0139
stix type: report
summary: The Criminal Investigation Division of the Tianjin Public Security Bureau dismantled an entire criminal chain of a fraud ring using game account trading scams, arresting 17 suspects. The Ministry of Public Security launched a nationwide coordinated strike, solving 59 cases of fake game transaction fraud during the summer public security crackdown.
case category: criminal_verdict
incident time: 2024-08
keywords: game account fraud
keywords: Tianjin Public Security Bureau
keywords: dismantle criminal chain
keywords: fake game transaction
keywords: Ministry of Public Security coordinated strike
keywords: summer public security crackdown
keywords: buying and selling game accounts
keywords: telecom network fraud
keywords: 17 suspects arrested
related risks: Game Account Reselling
related threat actors: Telecom Fraud Gangs
citation: Tianjin dismantles the entire chain of a game account trading fraud gang
citation: Summer operation: Tianjin police make further progress against fake game transaction fraud
updated: 2026-06-18
version: 1

Qufu Police Crack Novel Personal Information Infringement Case, Arresting Man Trading in Stolen Game Accounts
type: Case
break id: C0140
stix type: report
summary: Police in Qufu dismantled a criminal chain that used Trojan programs to steal gamers' login session data and virtual equipment. Over four million login session records were compromised and then used to hijack game accounts for resale, with the case involving more than 30 million yuan.
case category: criminal_verdict
incident time: 2024-12
keywords: Trojan credential theft
keywords: login session data
keywords: game account hijacking
keywords: virtual equipment theft
keywords: stolen account resale
keywords: Qufu police
related risks: Game Account Reselling
related attack tools: Trojan Virus
related threat actors: Account Dealers
citation: CrossFire Official Notice on Qufu Police Crackdown Against Session-Token Game Account Theft
citation: Qufu: New Type of Personal Information Infringement Case Solved, Arrest of Man Selling 'Black Accounts' Leads to...
updated: 2026-06-18
version: 1

Man Reselling Game Accounts Leads to a 30-Million-Yuan Case
type: Case
break id: C0141
stix type: report
summary: Qufu police in Shandong dismantled a criminal chain involved in stealing game accounts and virtual equipment, arresting 17 suspects with a total case value exceeding 30 million yuan. Low-level account dealers purchased illegally obtained black accounts below market price and resold them at a markup to card-issuing platforms, account rental platforms, and players.
case category: criminal_verdict
incident time: 2024-12
keywords: game account reselling
keywords: virtual equipment theft
keywords: black accounts
keywords: card-issuing platforms
keywords: account rental platforms
keywords: Qufu police
keywords: stolen game accounts
keywords: criminal chain
related risks: Game Account Reselling
related attack tools: Card Vending Platforms
related attack tools: Account Rental Platforms
related threat actors: Account Dealers
citation: CrossFire and Tencent Game Security Assist Qufu Police in Dismantling a 30-Million-Yuan Stolen Account Ring
citation: Man Reselling Game Accounts Leads to 30 Million Yuan Major Case
updated: 2026-06-18
version: 1

Cheat Tool Alters 'Premium' Attributes as Black Market Targets Game Account Trading
type: Case
break id: C0142
stix type: report
summary: Shanghai Pudong police dismantled a criminal gang illegally selling compromised game accounts, arresting two suspects. The suspect, He, used cheat software to bypass game security protections and modify the account's restricted 'premium' attribute ID codes, then resold the altered accounts at high prices ranging from 4,000 to 10,000 yuan each, with the pair profiting over 16,000 yuan in total.
case category: criminal_verdict
incident time: 2025-01
keywords: game account reselling
keywords: cheat software
keywords: game security bypass
keywords: account attribute modification
keywords: Shanghai Pudong police
keywords: illegal game account sales
keywords: criminal gang
keywords: game black market
related risks: Game Account Reselling
related attack tools: Game Cheats
related threat actors: Account Dealers
related threat actors: Malicious Users
citation: Exclusive 'Advanced' Attributes Generated Directly, Cheat 'Black Hands' Reach into Game Account Trading | Crime...
citation: Cheat-Tool Operators Targeted Game Account Trading: Two Men Sold Illegal Accounts
updated: 2026-06-18
version: 1

Resale of a Game Account and Subsequent Recovery Leads to Theft Conviction
type: Case
break id: C0143
stix type: report
summary: In October 2022, the Shanghai No. 2 Intermediate People's Court sentenced a player for theft. The player sold a game account and then recovered it through means such as filing a complaint, illegally possessing the already-sold virtual property, which constituted the crime of theft. This case clarifies that game accounts are protected by law as virtual property, and recovering an account after sale
case category: criminal_verdict
incident time: 2022-10
keywords: game account theft conviction
keywords: virtual property crime
keywords: account recovery theft
keywords: Shanghai No. 2 Intermediate People's Court
keywords: virtual property protection law
keywords: illegal possession virtual assets
keywords: game account resale fraud
related risks: Game Account Reselling
related threat actors: Malicious Players
citation: Company Fined 310,000 Yuan for Operating Without License; Player Sentenced to 3 Years 6 Months for Recovering Sold Account |...
citation: Shanghai No. 2 Intermediate Court: The 120,000-Yuan Game Account That Was Recovered
updated: 2026-06-18
version: 1

FBI Warns of Account Takeover Fraud via Impersonation of Financial Institution Support Staff
type: Case
break id: C0144
stix type: report
summary: The FBI issued an alert warning that cybercriminals are posing as financial institution employees or websites, using social engineering and phishing sites to obtain login credentials for victims' bank and payroll accounts, enabling account takeover (ATO) fraud to steal funds or data. Since January 2025, IC3 has received over 5,100 related complaints with reported losses exceeding $262 million.
case category: news_report
incident time: 2025-11
keywords: FBI
keywords: IC3
keywords: account takeover
keywords: ATO fraud
keywords: impersonation financial institution
keywords: social engineering
keywords: phishing sites
keywords: credential theft
keywords: funds theft
keywords: cybercrime alert
related risks: Account Privilege Reselling
related risks: Employee Account Compromise
related attack tools: Phishing Kits
related threat actors: Account Takeover Groups
citation: Account Takeover Fraud via Impersonation of Financial Institution ... - FBI
updated: 2026-06-18
version: 1

Customer Account Takeover: A Multi-Billion Dollar Problem
type: Case
break id: C0145
stix type: report
summary: A report reveals that platforms with 5 million to 300 million users face a median account takeover (ATO) exposure rate of 1.4%. Of particular concern is the rise of session hijacking techniques, where attackers use infostealer malware to steal session cookies, bypass MFA, and take over user accounts.
case category: news_report
keywords: account takeover
keywords: ATO
keywords: session hijacking
keywords: infostealer malware
keywords: session cookies
keywords: MFA bypass
keywords: credential theft
keywords: cyber threat
related risks: Account Privilege Reselling
related attack tools: Infostealers
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Account Takeover Groups
citation: The Account and Session Takeover Economy
updated: 2026-06-18
version: 1

Illegal Purchase of Personal Information to Redeem Credit Card Points for Resale Profit
type: Case
break id: C0146
stix type: report
summary: Individuals in Shandong, Shanghai, and other regions illegally purchased citizens' personal information, conducted fake transactions to accumulate credit card points, redeemed them for gifts, and resold those gifts on the market for profit. The involved persons were sanctioned for infringing on citizens' personal information and committing fraud.
case category: criminal_verdict
incident time: 2019-05
keywords: infringing on citizens' personal information
keywords: credit card points arbitrage
keywords: fake transactions
keywords: points reselling
keywords: points farming
keywords: personal information trading
keywords: account benefit resale
related risks: Account Privilege Reselling
related threat actors: Freebie Hunters
related threat actors: Data Brokers
citation: Don't Let 'Woolgathering' Turn into Fraud: Illegally Accumulating Credit Card Points This Way Is Illegal_Sina Mobile
citation: Shanghai Huangpu: Accurate Determination and Strong Crime Crackdown
updated: 2026-06-18
version: 1

Xiangtan Police Crack Case Involving Stolen Online Accounts Sold for Profit
type: Case
break id: C0147
stix type: report
summary: In March 2025, China's Ministry of Public Security announced ten typical cases from its campaign against crimes involving citizens' personal information, including a case handled by Xiangtan police in Hunan. Cyber police found that since December 2022, a group led by Feng and Tan Hong had posted false promotional videos on short-video platforms offering free red envelopes and game skins, tricking victims into handing over online accounts and then selling those accounts for profit. In August 2024, police arrested 35 suspects, seized more than 6,000 stolen online accounts, and identified over 2 million yuan in case value.
case category: criminal_verdict
incident time: 2025-03
keywords: online accounts
keywords: personal information infringement
keywords: account trafficking
keywords: free red envelopes
keywords: game skins
keywords: false promotional videos
keywords: Xiangtan police
keywords: Ministry of Public Security typical case
related risks: Account Reselling
related threat actors: Account Dealers
citation: Ministry of Public Security Announces Ten Typical Cases Against Crimes Involving Citizens' Personal Information; One Hunan Case Included
updated: 2026-06-25
version: 1

Gray market schemes in the ChatGPT boom: selling accounts and courses mostly gimmicks
type: Case
break id: C0148
stix type: report
summary: In May 2023, a media investigation found numerous merchants on e-commerce platforms and social groups selling ChatGPT accounts at prices ranging from 25 to 259 yuan. These account transactions carry fraud risks, with some buyers reporting accounts becoming invalid within a month, and some services being mirror sites run by resellers, posing risks of user privacy leakage.
case category: news_report
incident time: 2023-05
keywords: ChatGPT
keywords: account reselling
keywords: e-commerce platforms
keywords: social groups
keywords: OpenAI
keywords: account invalidation
keywords: reseller mirrors
keywords: privacy leakage
keywords: CCTV News
related risks: Account Reselling
related threat actors: Account Dealers
related threat actors: Malicious Merchants
citation: Gray 'Business Tactics' Under the ChatGPT Trend: 'Copycat' Versions Flood the Internet, Account and Course Sales Mostly...
updated: 2026-06-18
version: 1

MPS Reveals Typical Case in 'Account Shutdown' Operation: Insider Collusion with Account Traffickers in Telecom Fraud
type: Case
break id: C0149
stix type: report
summary: In February 2022, the Ministry of Public Security released typical cases of cracking down on the black-market chain of online accounts. In one case, five insiders at a Guangdong telecom operator colluded with external individuals to provide account traffickers with 1.88 million unissued mobile phone numbers and SMS gateways for malicious registration and resale of online accounts. The total amount
case category: criminal_verdict
incident time: 2022-02
keywords: account shutdown operation
keywords: telecom insider threats
keywords: account traffickers
keywords: account resale
keywords: malicious registration
keywords: burner phones
keywords: SMS gateway abuse
keywords: online account black market
keywords: Guangdong telecom case
keywords: Ministry of Public Security China
related risks: Account Reselling
related attack tools: Black SIM Cards
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Account Dealers
related threat actors: Malicious Insiders
citation: Ministry of Public Security Announces Top 10 Typical Cases of 'Account Black Industry Chain' Crackdown in 'Account Suspension' Campaign...
updated: 2026-06-18
version: 1

Shanghai Police Dismantle Game Account Factory, Case Value Exceeds 2 Million Yuan
type: Case
break id: C0150
stix type: report
summary: In April 2026, police in Xuhui District, Shanghai, cracked a case involving illegal acquisition of computer information system data. They dismantled an entire criminal chain that combined account creation, nurturing, and selling, arresting 10 suspects including a man surnamed Zhang. The group stole citizens' personal information to register accounts for games such as Genshin Impact and Honkai: Sta
case category: criminal_verdict
incident time: 2026-04
keywords: game account factory
keywords: illegal acquisition of computer information system data
keywords: Genshin Impact
keywords: Honkai: Star Rail
keywords: account reselling
keywords: Shanghai Xuhui police
keywords: citizen information theft
keywords: starter account
keywords: account nurturing
keywords: e-commerce platform
related risks: Account Reselling
related attack tools: Bulk Account Registration Tool
related attack tools: Modem Pool
related attack tools: SMS Verification Code Platform
related attack tools: Cloud Phone
related attack tools: Account Rental Platforms
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Thousands of Citizens' Personal Information Used as Raw Material: Game Account Factory Production Line Exposed
updated: 2026-06-18
version: 1

Jiangsu Dismantles 'Account Factory': Illegally Obtained Citizen Data Used to Register and 'Fatten' Accounts for Sale
type: Case
break id: C0151
stix type: report
summary: In April 2026, procuratorial authorities in Jiangsu disclosed a case where a criminal gang illegally obtained citizens' personal information to register various online accounts in bulk, 'fattened' them up, and then sold them for profit. The case involved over 2 million yuan, and 10 suspects including Zhang were arrested.
case category: criminal_verdict
incident time: 2026-04
keywords: account factory
keywords: account farming
keywords: personal information infringement
keywords: bulk account registration
keywords: account reselling
keywords: Jiangsu procuratorate
keywords: infringing on citizens' personal information
keywords: cyber black market
keywords: Zhang criminal case
keywords: criminal crackdown
related risks: Account Reselling
related attack tools: Bulk Account Registration Tool
related attack tools: Web Scraping Tools
related attack tools: SMS Verification Code Platform
related threat actors: Data Brokers
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Citizen Data Used to Register and 'Fatten' Accounts for Sale: 'Account Factory' Dismantled in Jiangsu
updated: 2026-06-18
version: 1

Selling Accounts Lands Man in Prison: Huaiyuan Prosecutor Details Social Media Account Resale Case Under PRC’s “Aiding Cybercrime” Law
type: Case
break id: C0152
stix type: report
summary: Between 2022 and 2024, Defendant A knowingly sold over 200 social media accounts—including Douyin, QQ, and Kuaishou profiles—to buyers engaged in telecom fraud, resulting in one victim being defrauded of more than 1.8 million yuan. A earned over 30,000 yuan in illegal proceeds and was convicted of aiding information network criminal activities; he received a one-year prison term suspended for one
case category: criminal_verdict
incident time: 2026-02
keywords: aiding information network criminal activities
keywords: account resale
keywords: social media accounts
keywords: Douyin
keywords: QQ
keywords: Kuaishou
keywords: telecom fraud
keywords: Huaiyuan County Procuratorate
keywords: suspended sentence
related risks: Account Reselling
related risks: Account Renting / Lending
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
citation: [Case Interpretation] Lending and Selling Accounts Violates Criminal Law; Aiding Offenders Will Be Severely Punished
updated: 2026-06-18
version: 1

Guangzhou Police Dismantle Family-Run Gang Abusing Stolen 12306 Accounts to Scalp Train Tickets
type: Case
break id: C0153
stix type: report
summary: In 2024, Guangzhou police uncovered a family-based criminal gang led by a suspect surnamed Lu. The group stole personal identity information to register accounts on the 12306 railway ticketing platform, then conducted high-frequency number swaps, bulk ticket purchases, and mass cancellations to resell tickets for profit.
case category: criminal_verdict
incident time: 2024-04
keywords: 12306
keywords: account takeover
keywords: ticket scalping
keywords: family-run gang
keywords: Lu
keywords: Guangzhou police
keywords: high-frequency number swap
keywords: mass cancellations
keywords: identity information
keywords: cyber black market
related risks: Account Reselling
related attack tools: Credential Stuffing Tools
related threat actors: Scalpers
citation: Beijing Sihailong Intellectual Property - Crackdown! Full Exposure of Family-Run 12306 Account Scalping Case
citation: Guangzhou railway police uncover case of stolen identities used to register 12306 accounts and resell train tickets
updated: 2026-06-18
version: 1

"WeChat Auto Red Packet" Developer Zhangshang Yuanjing Ordered to Pay 4.75 Million Yuan
type: Case
break id: C0154
stix type: report
summary: The Beijing Intellectual Property Court concluded an unfair competition dispute, finding that Shenzhen Zhangshang Yuanjing's "WeChat Auto Red Packet" app used message monitoring and automatic clicking to grab red packets and implemented anti-ban protections, constituting unfair competition. The app had over 67.47 million downloads across multiple app stores, and the court ordered the company to pa
case category: criminal_verdict
incident time: 2021-07
keywords: WeChat auto red packet
keywords: Zhangshang Yuanjing
keywords: unfair competition
keywords: auto-grab software
keywords: message monitoring
keywords: plug-in
keywords: Tencent
keywords: 4.75 million yuan
keywords: 67.47 million downloads
keywords: Beijing Intellectual Property Court
related risks: Red Packet Grabbing Bot
related attack tools: Game Cheats
related attack tools: Click Simulation Tools
related threat actors: Malicious Users
citation: Beijing IP Court Concludes First Automatic WeChat Red Packet Grabbing Unfair Competition Case
citation: Grabbing Red Packets This Way Is Illegal! Tencent News
updated: 2026-06-18
version: 1

Baihao's 'Red Packet Hunter' Auto-Grab Software Ordered to Pay 700,000 Yuan Compensation
type: Case
break id: C0155
stix type: report
summary: The Hangzhou Internet Court ruled in its final judgment that Hangzhou Baihao Company and others developed and operated software such as 'Red Packet Hunter', which enabled automatic red packet grabbing by monitoring QQ notification bar messages and simulating clicks, constituting unfair competition. The software had set anti-limit techniques to guide users to grab packets dishonestly, and was order
case category: criminal_verdict
incident time: 2023-02
keywords: Red Packet Hunter
keywords: auto-grab red packets
keywords: unfair competition
keywords: Tencent
keywords: Baihao Company
keywords: notification bar monitoring
keywords: simulated clicks
keywords: Hangzhou Internet Court
keywords: QQ red packets
related risks: Red Packet Grabbing Bot
related attack tools: Click Simulation Tools
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
citation: Auto Red Packet Snatching Software Ruled Unfair Competition, Ordered to Pay Tencent 700,000 Yuan
citation: Is Automatic Red-Envelope Grabbing Software Lawful?
updated: 2026-06-18
version: 1

Changsha Police Dismantle WeChat Red Packet Gambling Ring Using Auto-Grab Cheats, 11 Arrested
type: Case
break id: C0156
stix type: report
summary: The Yuhua Branch of the Changsha Public Security Bureau dismantled a gang that used WeChat red packet relay games for gambling, arresting 11 individuals. The gang members deployed cheat software to set up 'immortal accounts' that automatically grabbed the first red packet in WeChat groups, ensuring consistent profits. The total amount involved exceeded 800,000 yuan.
case category: criminal_verdict
incident time: 2022-02
keywords: WeChat red packet gambling
keywords: auto-grab red packet cheat
keywords: immortal account
keywords: WeChat group gambling
keywords: Yuhua Branch Changsha
keywords: red packet relay gambling
keywords: 800,000 yuan gambling case
keywords: gambling ring bust
related risks: Red Packet Grabbing Bot
related attack tools: Game Cheats
related threat actors: Online Gambling Gangs
citation: WeChat Group Red Packet Grabbing: A 'No-Loss' Account That Guarantees Profit! 11 Arrested in Changsha
citation: Changsha Chang'an Network: Group Owner Used Auto-Grab Cheat in WeChat Red-Packet Gambling Case
updated: 2026-06-18
version: 1

Programmer Yang Lin Sentenced for Developing Red Packet Snatching Cracked App
type: Case
break id: C0157
stix type: report
summary: Programmer Yang Lin developed a cracked app with features like instant grabbing and mine avoidance for red packet grabbing, and sold activation codes for profit, illegally earning over 100,000 yuan. In October 2021, Yang Lin was sentenced for providing programs for intruding into or illegally controlling computer information systems, and was given a fixed-term imprisonment of five years and six mo
case category: criminal_verdict
incident time: 2021-10
keywords: red packet snatching cheat
keywords: cracked app
keywords: providing programs for intruding into computer information systems
keywords: Yang Lin
keywords: WeChat red packet
keywords: instant grab
keywords: mine avoidance
keywords: activation code
keywords: illegal profit
related risks: Red Packet Grabbing Bot
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: Can Red Packet Grabbing Be Cheated? Programmer Convicted for Selling a Transparent Red Packet App
citation: Programmer Sentenced for Developing Red Packet Cracking Tool and Didi Ride-Hailing Cheat
updated: 2026-06-18
version: 1

Two Post‑90s Sentenced for Earning Tens of Millions Selling Game Cheats
type: Case
break id: C0158
stix type: report
summary: In March 2020, Kunshan police cracked the “Chicken Leg” cheat case for Peacekeeper Elite. He, the operations director, and Wang, the finance director, sold cheats with aimbot and wallhack features, settling payments via Bitcoin. He illegally profited over 19.56 million yuan, and Wang over 9.78 million yuan. In 2023, the court convicted both of copyright infringement, sentencing each to four years
case category: criminal_verdict
incident time: 2023-08
keywords: Peacekeeper Elite
keywords: Chicken Leg cheat
keywords: aimbot
keywords: wallhack
keywords: Bitcoin settlement
keywords: copyright infringement
keywords: game cheat
keywords: Kunshan police
keywords: He
keywords: Wang
related risks: Game Cheating Software
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Piracy/Infringement Gangs
citation: Two 'Post-90s' Earned Tens of Millions Selling Game Cheats, Sentenced
citation: Peacekeeper Elite Official: Verdict in the World's Largest Game Cheat Case
updated: 2026-06-18
version: 1

Sichuan Police Crack Nation's First DMA Cheat Case for Game for Peace
type: Case
break id: C0159
stix type: report
summary: In 2025, Xuanhan police in Sichuan uncovered the first DMA cheat case involving Game for Peace. The cheat used hardware to directly access memory, enabling wallhacks and auto-aim with high stealth. Authorities dismantled multiple manufacturing and distribution dens, arrested four suspects, and identified over 3 million yuan in illicit proceeds.
case category: criminal_verdict
incident time: 2025-05
keywords: Game for Peace DMA cheat
keywords: DMA hardware cheat
keywords: direct memory access cheat
keywords: wallhack auto-aim
keywords: game cheat manufacturing
keywords: Xuanhan police game cheat
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Criminal Organizations
related threat actors: Malicious Players
citation: Game for Peace Reports Major DMA Cheat Case Cracked
citation: Sichuan Police Crack Nation's First 'Peace Elite' DMA Game Cheat Case, Involving Over 3 Million Yuan
updated: 2026-06-18
version: 1

Game Streamer Profits 3 Million Yuan from Selling Cheats, Placed Under Criminal Coercive Measures
type: Case
break id: C0160
stix type: report
summary: In 2024, Shanghai police cracked a game cheating case. Well-known streamer Xue promoted DMA cheats with wallhack and auto-aim features during live broadcasts. He recruited agents through fan groups, selling cheat hardware and verification codes, accumulating over 3 million yuan in illegal profits. Sixteen suspects were placed under criminal coercive measures.
case category: criminal_verdict
incident time: 2024-11
keywords: DMA cheat
keywords: wallhack
keywords: auto-aim
keywords: game cheat hardware
keywords: Valorant cheat
keywords: game streamer cheat promotion
keywords: cheat reselling
keywords: Shanghai police cheat crackdown
keywords: criminal coercive measures
related risks: Game Cheating Software
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Malicious Players
related threat actors: Criminal Organizations
citation: Game Streamer Earned 3 Million Yuan Selling Cheats, Placed Under Criminal Coercive Measures
citation: Shanghai Police Crack Down on Game Cheats to Protect the Business Environment
updated: 2026-06-18
version: 1

Three Men Sentenced for Reselling Game Cheat Access Codes at a Markup
type: Case
break id: C0161
stix type: report
summary: In October 2025, the Fuxin Intermediate People's Court in Liaoning published a case in which Zhan, Shi, and He knowingly purchased access codes for illegal game cheat programs and resold them at a markup. The court convicted them of providing programs or tools for intruding into or illegally controlling computer information systems, sentencing them to prison terms from three years to two years and six months, with suspended sentences and fines.
case category: criminal_verdict
incident time: 2023-11
keywords: game cheat
keywords: markup resale
keywords: access codes
keywords: illegal control of computer systems
keywords: suspended sentence
keywords: Fuxin court
keywords: online game cheating
keywords: criminal verdict
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: Three men sentenced for reselling game cheat access codes at a markup
updated: 2026-06-18
version: 1

Developing and Selling Game Cheats? Sheqi Court Sentences Defendants!
type: Case
break id: C0162
stix type: report
summary: From 2021 to 2022, the defendant Li developed a cheat program for the online game 'Assault Fire' and arranged its sale with Chen. The cheat provided unfair advantages and disrupted normal game operations. The court convicted both defendants of providing programs for intruding into or illegally controlling computer information systems, sentencing them to three years in prison with probation and fin
case category: criminal_verdict
incident time: 2023-05
keywords: game cheat
keywords: Assault Fire
keywords: providing programs for intrusion
keywords: illegal control of computer systems
keywords: Sheqi Court
keywords: probation
keywords: cheat program development
keywords: online game hacking
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: Truly 'Criminal'! Writing and Selling 'Game Cheats'? Sheqi Court Sentences Offenders!
citation: Writing and selling game cheats: two defendants sentenced and fined - China Court Network
updated: 2026-06-18
version: 1

Tech-Savvy Individual Sentenced for Developing and Selling Game Cheats, Illegally Profiting Over One Million Yuan
type: Case
break id: C0163
stix type: report
summary: A tech-savvy individual developed and sold cheat programs for a popular online game. The cheat could disrupt the game's program to increase the efficiency of earning in-game gold. The suspect made over one million yuan in illegal profits from selling the cheat and was ultimately sentenced by the court.
case category: criminal_verdict
incident time: 2023-11
keywords: game cheat
keywords: developing and selling cheats
keywords: illegal profit
keywords: damaging computer information systems
keywords: online game gold
keywords: China Court Network
keywords: cheat program
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: Tech Whiz Made and Sold 'Game Cheats', Illegally Earned Over a Million Yuan, Sentenced!
updated: 2026-06-18
version: 1

First Game Cheat Case for Tencent's Delta Force Cracked
type: Case
break id: C0164
stix type: report
summary: In 2024, the first cheat case involving Tencent's Delta Force was cracked. The suspect Xie tampered with the game's source code to create a cheat program for iOS featuring wallhacks and aimbots, selling it online and making nearly 60,000 yuan in illegal profits.
case category: criminal_verdict
incident time: 2024-10
keywords: Delta Force cheat
keywords: game cheat iOS
keywords: wallhack aimbot cheat
keywords: source code tampering
keywords: illegal profit cheat sales
keywords: Delta Force Tencent
keywords: iOS game hack
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: First Tencent 'Delta Force' Game Cheat Case Cracked, Over 1,300 Accounts Using the Tech Banned
citation: First Delta Force cheat case cracked; police-enterprise cooperation quickly arrests offenders
updated: 2026-06-18
version: 1

First-Instance Verdict in China's Largest 'PUBG' Cheat Case
type: Case
break id: C0165
stix type: report
summary: The court issued a verdict in China's largest 'PUBG' cheat case. The involved cheat programs provided functions such as auto-aim, character wallhack, and item display, disrupting the normal operational flow and functioning of the online game and infringing upon the game copyright holder's interests.
case category: criminal_verdict
incident time: 2023-06
keywords: game cheat
keywords: PUBG
keywords: auto-aim
keywords: wallhack
keywords: item display
keywords: copyright infringement
keywords: first-instance verdict
keywords: online game
related risks: Game Cheating Software
related attack tools: Game Cheats
related threat actors: Piracy/Infringement Gangs
citation: Nation's Largest 'PUBG' Game Cheat Case: First Instance Verdict Announced Today
citation: Tencent Game Security: Verdict in the World's Largest Game Cheat Case
updated: 2026-06-18
version: 1

Global Largest Game Cheat Case Cracked: Amount Involved Reaches Hundreds of Millions of Yuan
type: Case
break id: C0166
stix type: report
summary: In 2021, Kunshan police cracked the world's largest game cheat case, involving hundreds of millions of yuan. The cheat, known as 'Chicken Leg', provided features such as auto-aim and wallhacks, severely disrupting game balance.
case category: criminal_verdict
incident time: 2021-03
keywords: game cheat
keywords: Chicken Leg cheat
keywords: auto-aim
keywords: wallhack
keywords: Kunshan police
keywords: cheat case
keywords: hundreds of millions of yuan
keywords: game balance
related risks: Game Cheating Software
related attack tools: Game Cheats
citation: World's Largest Game Cheat Case Cracked, Involving Hundreds of Millions of Yuan
citation: CCTV Legal Online report: the fall of the world's largest cheat organization
updated: 2026-06-18
version: 1

Where Winds Meet Cheat Case Cracked: One Arrested for Illegal Profit of Tens of Thousands of Yuan
type: Case
break id: C0167
stix type: report
summary: In November 2025, NetEase Legal, in collaboration with public security authorities, arrested cheat developer Qin in Hunan Province. Qin had created a cheat program for the game 'Where Winds Meet' in January 2025 and sold it through QQ groups. The cheat featured functions such as speed hacks, damage reduction, and instant kills, generating illegal profits of tens of thousands of yuan. Qin has been
case category: criminal_verdict
incident time: 2025-11
keywords: Where Winds Meet cheat
keywords: game cheat developer arrested
keywords: NetEase anti-cheat enforcement
keywords: speed hack
keywords: damage reduction exploit
keywords: instant kill hack
keywords: QQ group cheat sales
keywords: compulsory measures
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: Where Winds Meet Anti-Cheat Enforcement Progress Announcement
citation: 'Where Winds Meet' Cheat Case Cracked: One Arrested, Illegally Earned Tens of Thousands of Yuan
updated: 2026-06-18
version: 1

First National "AI Cheat" Case: Principal Offender Sentenced
type: Case
break id: C0168
stix type: report
summary: In May 2024, the People's Court of Yujiang District, Yingtan City, issued a first-instance verdict against Wang, the principal offender in the nation's first "AI cheat" case. Starting in 2022, Wang organized multiple individuals to develop AI cheat programs featuring auto-aim and auto-fire functions, illegally profiting over 6.29 million yuan by selling access codes. Wang was sentenced to three ye
case category: criminal_verdict
incident time: 2024-05
keywords: AI cheat
keywords: game cheating
keywords: auto-aim
keywords: auto-fire
keywords: Valorant
keywords: illegal profit
keywords: Yujiang District People's Court
keywords: cheat program
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Malware Developers
related threat actors: Malicious Players
citation: Earned 6.29 Million Yuan! Nation's First 'AI Cheat' Case: Main Culprit Sentenced
citation: Nation's first AI cheat case publicly sentenced: principal offender illegally profited over 6.29 million yuan and received three years
citation: How was the nation's first AI cheat case cracked? A warning for would-be cheat buyers
citation: A national first: a Jiangxi court publicly announces the verdict
updated: 2026-06-18
version: 1

The AI Cheat That Frustrated FPS Players Finally Faced Legal Consequences
type: Case
break id: C0169
stix type: report
summary: In September 2023, police in Yujiang, Jiangxi, cracked China's first case involving the production and sale of an AI-powered cheat, arresting 10 suspects. The cheat used AI visual recognition to achieve rapid auto-aim and headshot locking, functioning across multiple FPS titles including Valorant. Tencent's security team assisted law enforcement, resulting in over 100,000 banned cheating accounts.
case category: criminal_verdict
incident time: 2023-09
keywords: AI cheat
keywords: AI visual recognition
keywords: auto-aim headshot
keywords: Valorant
keywords: FPS game
keywords: Tencent security team
keywords: Yujiang police
keywords: cheat production and sale
keywords: account ban
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related attack tools: Malicious AI Applications
related threat actors: Malware Developers
citation: AI Cheats That Plagued FPS Players Finally Face Legal Consequences
citation: China's First AI Game Cheat Case: Jiangxi Police Dismantle the Chain
citation: China's First AI Cheat Case Publicly Sentenced by Yujiang Court
updated: 2026-06-18
version: 1

Self-Developed Game Cheat Earns 200,000 Yuan, Developer Sentenced to Three Years
type: Case
break id: C0170
stix type: report
summary: In the first half of 2024, Gai Moumou initially acted as an agent selling cheats for the game 'Dragon Oath' before learning programming on his own to develop a custom cheat named 'Wuming Cheat.' The tool employed memory injection techniques to automate in-game functions such as map clearing and resource collection. From July to December 2024, Gai earned over 200,000 yuan in illegal profits from se
case category: criminal_verdict
incident time: 2025-11
keywords: game cheat
keywords: memory injection
keywords: auto-farming bot
keywords: Dragon Oath
keywords: TLBB
keywords: illegal profit
keywords: suspended sentence
keywords: cheat distribution
keywords: self-developed cheat
related risks: Cheating Tools / Game Hacks
related attack tools: Game Cheats
related threat actors: Malware Developers
citation: From Reselling Cheats to Self-Developed Sales: Prosecutors Explain a Game Cheat Case Involving Over RMB 200,000 in Illegal Gains
citation: IP Tie-In Backfires: Authorized Party Still Ordered to Pay 5 Million Yuan; Self-Developed Cheat Earned 200,000 Yuan, Sentenced to 3 Years | Weekly Review
updated: 2026-06-18
version: 1

Blocking Web Page Elements with the AdGuard Browser Extension
type: Case
break id: C0171
stix type: report
summary: In December 2024, a tutorial detailed how to use the AdGuard browser extension to block web page elements, including ads and unwanted content. The case demonstrated specific operations such as removing the search pop-up when selecting text on CSDN, and blocking collection prompts and login pop-ups on Juejin, illustrating the practical application of ad-blocking plugins.
case category: news_report
incident time: 2024-12
keywords: AdGuard
keywords: browser extension
keywords: ad blocking
keywords: element blocking
keywords: CSDN
keywords: Juejin
keywords: pop-up blocking
keywords: content filtering
related risks: Ad Blocking
related attack tools: Browser Extensions
citation: AdGuard Ad Blocker Browser Extension | Overview
updated: 2026-06-18
version: 1

Measuring and disrupting anti-adblockers using differential execution analysis
type: Case
break id: C0172
stix type: report
summary: This study employs differential execution analysis to automatically detect anti-adblocker mechanisms, finding that 30.5% of Alexa top 10,000 websites deploy such measures, with over 90% showing no visible warning. It also develops JavaScript rewriting and API hooking schemes to help ad blockers evade anti-adblock detection.
case category: academic_research
incident time: 2018-01
keywords: anti-adblocker
keywords: differential execution analysis
keywords: ad blocking
keywords: JavaScript rewriting
keywords: API hooking
keywords: web measurement
keywords: Alexa top sites
keywords: Zhu Shitong
keywords: NSF
related risks: Ad Blocking
citation: Measuring and Disrupting Anti-Adblockers Using Differential Execution Analysis
updated: 2026-06-18
version: 1

CV-Inspector: Towards Automating Detection of Adblock Circumvention
type: Case
break id: C0173
stix type: report
summary: This study develops CV-INSPECTOR, a machine learning method that automatically detects whether websites use adblock circumvention services through differential execution analysis, achieving 93% accuracy. It identifies circumvention sites among the top 20,000 websites, helping the adblock community automate and scale filter rule maintenance.
case category: academic_research
incident time: 2021-01
keywords: adblock circumvention detection
keywords: CV-INSPECTOR
keywords: differential execution analysis
keywords: adblock filter rules
keywords: anti-adblock circumvention
keywords: website detection
related risks: Ad Blocking
citation: Cv-Inspector: Towards Automating Detection of Adblock Circumvention
updated: 2026-06-18
version: 1

The ad wars: retrospective measurement and analysis of anti-adblock filter lists
type: Case
break id: C0174
stix type: report
summary: This study retrospectively measures and analyzes anti-adblock filter lists, finding that third-party domains deliver ads by circumventing filtering rules. It explores the arms race between adblockers and anti-adblockers, and how anti-adblockers detect adblockers and prompt users.
case category: academic_research
incident time: 2017-01
keywords: anti-adblock
keywords: filter lists
keywords: ad blocking
keywords: advertising
keywords: measurement
keywords: retrospective analysis
keywords: third-party domains
keywords: circumvention
related risks: Ad Blocking
citation: The Ad Wars: Retrospective Measurement and Analysis of Anti-Adblock Filter Lists
updated: 2026-06-18
version: 1

Ad-blocking: A study on performance, privacy and counter-measures
type: Case
break id: C0175
stix type: report
summary: This study analyzes the impact of ad-blocking on web performance and privacy, identifies cases of adversarial interplay between websites and ad-blockers, and proposes ad detection methods to help ad-blockers counter publisher circumvention strategies.
case category: academic_research
incident time: 2017-01
keywords: ad-blocking
keywords: web performance
keywords: privacy
keywords: ad detection
keywords: counter-measures
keywords: ad-blocker circumvention
keywords: ACM
keywords: online advertising
related risks: Ad Blocking
citation: Ad-Blocking: A Study on Performance, Privacy and Counter-Measures
updated: 2026-06-18
version: 1

Adversarial: Perceptual Ad Blocking Meets Adversarial Machine Learning
type: Case
break id: C0176
stix type: report
summary: This research demonstrates that ad blocker detection pipelines can be attacked via adversarial machine learning, allowing publishers or ad networks to bypass ad blocker detection and even exploit its high privilege level to evade blocking.
case category: academic_research
incident time: 2019-01
keywords: adversarial machine learning
keywords: perceptual ad blocking
keywords: ad blocking bypass
keywords: machine learning attack
keywords: detection pipeline
keywords: adblock
keywords: adversarial examples
keywords: publisher ad network
related risks: Ad Blocking
related attack tools: AI Data Poisoning and Prompt Injection Tool
citation: Adversarial: Perceptual Ad Blocking Meets Adversarial Machine Learning
updated: 2026-06-18
version: 1

Yulin Car Owner Blocked from Buying Auto Insurance by Unauthorized 'Locked Order'
type: Case
break id: C0177
stix type: report
summary: In December 2019, a car owner in Yulin, Guangxi, Ms. Li, attempted to renew her auto insurance at a 4S dealership but was told her compulsory traffic insurance had been 'locked' by someone else. Investigation revealed that an insurance salesperson, Xu, had entered her insurance application into the platform without consent to pre-confirm the order and occupy the quota, forcing Ms. Li to purchase o
case category: news_report
incident time: 2019-12
keywords: auto insurance lock order
keywords: compulsory traffic insurance
keywords: insurance salesperson
keywords: pre-confirm insurance application
keywords: consumer choice rights
keywords: order squatting
keywords: 4S dealership renewal
keywords: Guangxi Yulin
keywords: property insurance company
related risks: Inventory Denial
citation: Yulin Car Owner Told Insurance Policy Was 'Locked' When Trying to Buy; Who Was Behind It?
updated: 2026-06-18
version: 1

Inner Mongolia Su et al. Producing and Selling Counterfeit Sunflower Seeds Case
type: Case
break id: C0178
stix type: report
summary: In February 2024, Ulanqab police cracked a case involving the production and sale of counterfeit sunflower seeds. Su, the sales director of an Inner Mongolia seed company, sold expired sunflower seeds from 2013 at a low price of 50 yuan per bag to clear inventory. Salespersons Gao and Lin knowingly sold the deteriorated seeds to farmers, resulting in empty shells across 1,600 acres and causing ove
case category: criminal_verdict
incident time: 2024-02
keywords: counterfeit seeds
keywords: sunflower seeds
keywords: expired seeds
keywords: producing and selling substandard products
keywords: Inner Mongolia Seed Company
keywords: Ulanqab
keywords: Su
keywords: farmer losses
keywords: empty shells
related risks: Inventory Denial
citation: Inner Mongolia Public Security and Agriculture Departments Hold Law Enforcement Sword, Spring Plowing Protection Press Conference
citation: Sold Spoiled Seeds to Clear Inventory, Causing Farmers Over 2 Million Yuan in Losses; 4 Arrested
updated: 2026-06-18
version: 1

Hangzhou Xiaoshan Online Pharmaceutical Wholesaler Price Gouging Case
type: Case
break id: C0179
stix type: report
summary: In January 2023, the Market Supervision Administration of Xiaoshan District, Hangzhou, investigated an online pharmaceutical wholesaler. Despite its supplier of Yinqiao Jiedu Granules not announcing any price increase and the product being out of stock, the wholesaler repeatedly raised its online listed price from over 8 yuan to 22 yuan per box starting December 7, 2022. This constituted illegal price gouging and led to a 120,000 yuan fine.
case category: administrative_enforcement
incident time: 2023-01
keywords: price gouging
keywords: online pharmaceutical wholesale
keywords: Yinqiao Jiedu Granules
keywords: Hangzhou Xiaoshan
keywords: market supervision administration
keywords: listed price manipulation
keywords: out-of-stock price hike
keywords: administrative penalty
related risks: Inventory Denial
citation: Price gouging? Fined: Xiaoshan carries out key inspections of epidemic-related material prices and competition order
updated: 2026-06-18
version: 1

"Your Negative Review Has Been Deleted"—Who Did It? This Group Made 900,000 RMB by Fabrication
type: Case
break id: C0180
stix type: report
summary: In March 2026, Shanghai Minhang police cracked a corporate 'online water army' case, dismantling a criminal gang specializing in paid deletion of negative reviews. The group exploited platform moderation loopholes by fabricating extortion chat logs and mass-posting fake reviews, deleting over 4,500 negative reviews for more than 700 merchants, with the amount involved reaching over 900,000 RMB. Ei
case category: criminal_verdict
incident time: 2026-03
keywords: online water army
keywords: paid review deletion
keywords: illegal business operations
keywords: Minhang police
keywords: short-video platform
keywords: fake reviews
keywords: fabricated chat logs
keywords: merchant review removal
keywords: platform moderation loophole
related risks: Malicious Negative Reviews
related threat actors: Astroturfing Networks
citation: 'Your Negative Review Has Been Deleted' — Who Did It? This Group Earned 900,000 Yuan by Fabricating Reviews
citation: People's Public Security Daily: Who Deleted Your Negative Review?
updated: 2026-06-18
version: 1

Student sued for negative review sparks debate on boundary between fair criticism and defamation
type: Case
break id: C0181
stix type: report
summary: In January 2022, a graduate student in Beijing posted comments on Zhihu about a liberal arts postgraduate exam prep service, using phrases like 'covetously eyeing' and 'cyber-mobbed'. The company, Guangxi Wenkao Education Consulting Co., Ltd., sued for defamation. The court ruled the language constituted insult or slander, ordering compensation and a public apology. Another user was similarly foun
case category: news_report
incident time: 2022-01
keywords: malicious negative review
keywords: defamation lawsuit
keywords: Zhihu review
keywords: online defamation
keywords: fair criticism vs defamation
keywords: insult and slander
keywords: Guangxi Wenkao Education
keywords: reputation infringement
related risks: Malicious Negative Reviews
related threat actors: Professional Negative Reviewers
citation: Negative Review Leads to Lawsuit: Where Is the Boundary Between Reasonable Criticism and Malicious Infringement? | Tencent News
updated: 2026-06-18
version: 1

High School Student Recruits Apprentices to Extort Merchants: "Professional Bad Review" Gang Operation
type: Case
break id: C0182
stix type: report
summary: Starting in 2020, a student surnamed Zhang from a vocational college in Jiangxi exploited e-commerce platform rules by fabricating product defects using Photoshop to maliciously claim compensation from merchants. The criminal group behind him, known as "Big Pig Group," had over 30 core members and trained more than 400 apprentices, teaching extortion scripts and charging "apprenticeship fees" rang
case category: criminal_verdict
incident time: 2021-04
keywords: professional bad review extortion
keywords: malicious negative reviews
keywords: extortion racket
keywords: e-commerce platform abuse
keywords: malicious refund claims
keywords: Photoshop fabricated defects
keywords: Big Pig Group
keywords: Guangzhou Nansha police
keywords: apprenticeship fee scam
related risks: Malicious Negative Reviews
related attack tools: AI Deepfake Tools
related threat actors: Professional Negative Reviewers
citation: Ministry of Public Security Briefing on Typical Cases of Online Organized-Crime-Related Offenses
citation: Ministry of Public Security Publishes Ten Typical Cases of Online Organized-Crime-Related Offenses
citation: ...Taking Disciples to Maliciously Extort Merchants | Guangzhou | Compensation Claims | Extortion | Professional Negative Reviewers | Products_Sina News
updated: 2026-06-18
version: 1

Man Sentenced to 8 Months for 712 Malicious Food Delivery Refund Scams
type: Case
break id: C0183
stix type: report
summary: Between August 2020 and May 2022, a man surnamed Zhang exploited loopholes in Meituan Waimai's compensation rules, filing 712 fraudulent claims for multiple damages citing food safety and product quality issues. He fraudulently obtained 17,000 yuan in compensation and caused merchants to refund 4,600 yuan. The Xiangcheng City Court in Henan Province sentenced Zhang to eight months in prison and fi
case category: criminal_verdict
incident time: 2023-01
keywords: malicious negative reviews
keywords: fraudulent refund claims
keywords: food delivery scam
keywords: Meituan Waimai
keywords: food safety complaint
keywords: multiple damages
keywords: Xiangcheng City Court
keywords: criminal fraud verdict
related risks: Malicious Negative Reviews
related risks: Malicious Claims
related threat actors: Professional Negative Reviewers
citation: Xiangcheng Prosecutors Charge Food Delivery Negative Review Fraud Case
citation: Malicious Negative Reviews = Fraud! Customer Claims Compensation 712 Times via Food Delivery, Sentenced to 8 Months! | Malicious Negative Reviews | Food Delivery...
updated: 2026-06-18
version: 1

Nine Defendants Sentenced for Paid Negative Review Deletion Services
type: Case
break id: C0184
stix type: report
summary: In June 2024, China Court reported a case heard by the Kaihua County People's Court in Zhejiang involving illegal paid negative review deletion services. Lin and others exploited platform loopholes to remove negative reviews for merchants for a fee, disrupting the platform review mechanism and market order. The court convicted nine defendants of illegal business operations, sentencing them to prison terms from five years to six months and imposing fines from 300,000 yuan to 23,000 yuan.
case category: criminal_verdict
incident time: 2024-06
keywords: negative review deletion
keywords: paid review removal
keywords: platform loophole
keywords: illegal business operations
keywords: Kaihua County People's Court
keywords: merchant reviews
keywords: review manipulation control
keywords: illegal gains
related risks: Malicious Negative Reviews
related threat actors: Professional Negative Reviewers
citation: Defendants convicted of illegal business operations for paid negative review deletion services
updated: 2026-06-18
version: 1

Li Sentenced for Profiting Over 30,000 Yuan by Removing Negative Reviews for a Fee
type: Case
break id: C0185
stix type: report
summary: In September 2025, the Enshi Municipal People's Court in Hubei Province tried a case involving illegally obtaining computer information system data to remove negative reviews for a fee. The defendant Li illegally intruded into the platform's system using technical means to delete negative reviews for merchants, profiting over 30,000 yuan. His actions constituted a crime and he was sentenced.
case category: criminal_verdict
incident time: 2025-09
keywords: paid review removal
keywords: illegal computer intrusion
keywords: delete negative reviews
keywords: Enshi Municipal People's Court
keywords: food delivery platform
keywords: criminalizing review deletion
keywords: computer information system crime
related risks: Malicious Negative Reviews
related threat actors: Malicious Users
citation: Paid Deletion of Negative Reviews: Defendant Sentenced
citation: Profiting Over 30,000 Yuan by Deleting Negative Reviews for a Fee, Li Sentenced | Zhang Sen | Food Delivery_NetEase Subscription
updated: 2026-06-18
version: 1

Yangzhou Company Convicted for Paid Deletion of Negative Reviews, Illegal Business Operations
type: Case
break id: C0186
stix type: report
summary: In November 2024, the People's Procuratorate of Yangzhou Economic and Technological Development Zone prosecuted an e-commerce company and its legal representative, Deng, for illegal business operations. The company, originally engaged in e-commerce training, shifted to offering paid deletion of negative reviews due to poor profitability. The court fined the company 500,000 yuan, while Deng receive
case category: criminal_verdict
incident time: 2024-11
keywords: paid deletion of negative reviews
keywords: illegal business operations
keywords: e-commerce training
keywords: Deng
keywords: Yangzhou Economic and Technological Development Zone People's Procuratorate
keywords: fine
keywords: suspended sentence
keywords: malicious negative reviews
related risks: Malicious Negative Reviews
related threat actors: Malicious Merchants
related threat actors: Professional Negative Reviewers
citation: Sentenced for Deleting Negative Reviews? This Act May Constitute Illegal Business Operations!
citation: Yangzhou Economic Development Zone Procuratorate: Paid Deletion of Negative Reviews May Constitute Illegal Business Operations
updated: 2026-06-18
version: 1

Keqiao Police Dismantle 'Live Stream Idle Viewer Farming' Part-Time Job Scam
type: Case
break id: C0187
stix type: report
summary: In 2017, police in Keqiao, Zhejiang Province, cracked a part-time job scam disguised as 'farming viewer numbers for live streams.' The syndicate lured victims with promises of high returns, collecting referral fees and deposits, with total illicit proceeds exceeding 6 million yuan. The tightly organized group had clear role divisions, and some members were former victims who later turned into scam
case category: criminal_verdict
incident time: 2017-04
keywords: live stream viewer farming
keywords: idle viewer bot
keywords: part-time job scam
keywords: deposit fraud
keywords: Keqiao police
keywords: fake traffic generation
keywords: telecom fraud
keywords: online black market
related risks: Fake Viewer Count Inflation
related threat actors: Telecom Fraud Gangs
citation: Boosting Livestream Viewers Online, Easy Money While Lying Down? Police Reveal It's Just a New Part-Time Scam | 163...
updated: 2026-06-18
version: 1

Yanggu Police Dismantle Online Water Army Hubs Using Group-Control Devices to Inflate Livestream Viewer Numbers
type: Case
break id: C0188
stix type: report
summary: In February 2025, police in Yanggu County, Shandong Province, dismantled two online water army hubs. Suspects used group-control devices to generate fake engagement for livestream rooms, illegally manipulating large numbers of accounts to simulate real user interactions in order to boost livestream metrics and profit from the scheme.
case category: administrative_enforcement
incident time: 2024-12
keywords: group-control devices
keywords: online water army
keywords: livestream viewer inflation
keywords: fake engagement
keywords: Yanggu police
keywords: account manipulation
keywords: livestream data fraud
keywords: illegal account operation
related risks: Fake Viewer Count Inflation
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
citation: 6 Devices Operating 120 Phones Simultaneously: The Operator Behind the Scheme Was Caught
updated: 2026-06-25
version: 1

CCTV 3·15 Gala Exposes Cloud-Controlled Systems Artificially Inflating Livestream Engagement
type: Case
break id: C0189
stix type: report
summary: The 2023 CCTV 3·15 Gala exposed companies including Shaanxi Yarunjin Network Technology Co., Ltd. for providing cloud-controlled systems capable of bulk liking, inflating viewer counts, and boosting online presence in livestreams. The practice creates a false sense of popularity through technical means, misleading consumers and distorting platform algorithms.
case category: news_report
incident time: 2023-03
keywords: CCTV 3·15
keywords: cloud-controlled system
keywords: livestream view inflation
keywords: Shaanxi Yarunjin Network Technology
keywords: bulk liking
keywords: fake engagement
keywords: algorithm manipulation
keywords: livestream traffic fraud
related risks: Fake Viewer Count Inflation
related attack tools: Mass Control Systems
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: CCTV 3.15 Exposes Shocking Material! Netizens Outraged: Don't You Have a Conscience! Must Share with Parents_Tencent News
updated: 2026-06-18
version: 1

Ordinary Video Gains 3 Million Views Overnight: Shaanxi Police Expose Fake Traffic Scam
type: Case
break id: C0190
stix type: report
summary: Shaanxi police cracked a major online water-army fraud case involving media companies that sold fake video views by promoting the idea that high traffic could quickly be monetized. One company claimed that 19,800 yuan could buy 10 million exposures, while the actual traffic-farming cost was only 30 yuan and the labor for video editing and copywriting totaled 150 yuan. Police arrested 195 suspects, seized 197 computers and 290 mobile phones, and had criminally detained 128 people on suspicion of fraud at the time of the report.
case category: criminal_verdict
incident time: 2023-11
keywords: group control
keywords: phone farm
keywords: fake views
keywords: short video
keywords: livestream
keywords: inflate viewer count
keywords: traffic fraud
keywords: platform data manipulation
related risks: Fake Viewer Count Inflation
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
citation: Ordinary Video Gains 3 Million Views Overnight: Police Expose Fake Traffic Scam
citation: Thousands of Phones Generate Tens of Millions of Fake Video Views, Priced at Nearly 20,000 Yuan, Costing Only 180 Yuan_Tencent News
updated: 2026-06-18
version: 1

Supreme People's Procuratorate Disclosed Luoyang's 150-Million-Yuan Click-Farming Platform False Advertising Case
type: Case
break id: C0191
stix type: report
summary: In July 2025, the Supreme People's Procuratorate disclosed a 150-million-yuan click-farming platform false advertising case handled by the Luoyang High-tech Zone People's Procuratorate. Zhang Yong, Ye Mei and others operated the Taojingling and Jifeng click-farming platforms, connected more than 3,000 e-commerce merchants upstream, organized over 50,000 click workers downstream, and built a closed loop of order receiving, dispatching, fake transactions and rebates. From October 2022 to November 2023, the platforms fabricated 839,000 transactions, inflated gross merchandise value by 150 million yuan, and generated more than 5.41 million yuan in illegal gains. The court adopted the procuratorate's charges and sentencing recommendations and convicted five defendants of false advertising, imposing prison terms, suspended sentences and fines.
case category: criminal_verdict
incident time: 2025-07
keywords: Luoyang High-tech Zone procuratorate
keywords: click-farming platform
keywords: Taojingling
keywords: Jifeng
keywords: false advertising crime
keywords: fake transactions
keywords: fake reviews
keywords: 839000 orders
keywords: 150 million yuan
keywords: click workers
related risks: Fake Viewer Count Inflation
related threat actors: Astroturfing Networks
related threat actors: Telecom Fraud Gangs
citation: Digging Into a Small Case Uncovered a 100-Million-Yuan Click-Farming Network
updated: 2026-06-26
version: 1

How Fake Viewers, Followers, and Bots Are Used in Livestreams: Operational Methods and Platform Logic
type: Case
break id: C0192
stix type: report
summary: The article reveals how livestreams on Douyin and Kuaishou inflate viewer counts using software or scripts that simulate user interactions, generating fake online numbers and engagement data. The goal is to leverage herd mentality to attract real users, capture organic platform traffic, and help new streamers build psychological confidence, indirectly boosting conversion potential.
case category: news_report
incident time: 2026-04
keywords: fake livestream viewers
keywords: fake followers
keywords: livestream bots
keywords: Douyin livestream
keywords: Kuaishou livestream
keywords: simulated interactions
keywords: platform traffic manipulation
keywords: herd mentality
keywords: livestream operations
related risks: Fake Viewer Count Inflation
related attack tools: Mobile Phone Emulator
related attack tools: Cloud Phone
related attack tools: Multi-Instance Tools
related attack tools: Offline Game Bots
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Virtual Machine
related threat actors: Astroturfing Networks
citation: Revealing How Fake Viewers, Fake Followers, and Fake Interactions Work in Livestreams, and How to Do It_Interaction_Data_Traffic
updated: 2026-06-18
version: 1

Douyin Live Streaming Popularity Tricks: Introducing Third-Party Tools Like "Terracotta Warriors" to Inflate Data
type: Case
break id: C0193
stix type: report
summary: The article introduces methods to boost popularity on Douyin live streams, mentioning unofficial third-party tools known in the industry as "Terracotta Warriors." These tools primarily simulate real user actions to inflate data for accounts, short videos, and live streams, including generating fake followers, views, comments, dummy viewers in live rooms, and fake gifts, creating a false sense of p
case category: news_report
incident time: 2026-04
keywords: Douyin live streaming
keywords: inflating viewer count
keywords: Terracotta Warriors tools
keywords: fake data generation
keywords: fake followers
keywords: fake live viewers
keywords: herd effect manipulation
keywords: fake gifts
keywords: third-party streaming tools
keywords: view botting
related risks: Fake Viewer Count Inflation
related attack tools: Automation Scripts
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: How to Increase Popularity on Douyin Livestreams? Tips for Using Fake Viewers and Fake Followers to Attract Fans? Even Beginners Can...
updated: 2026-06-18
version: 1

Over 150,000 Fake Accounts Farmed to Provide Fake Likes and Followers—Click Farm Ring Busted
type: Case
break id: C0194
stix type: report
summary: During the “Clean Net 2022” operation, Guangzhou police dismantled a criminal group that used technical means to provide fake follower boosts, likes, and artificial popularity services for entertainment celebrities and influencers. The group developed and operated short-video engagement manipulation programs that simulated real users in bulk, maintaining over 150,000 fake accounts and generating a
case category: criminal_verdict
incident time: 2023-01
keywords: click farm
keywords: fake likes
keywords: follower boosting
keywords: engagement manipulation
keywords: short-video platform
keywords: Guangzhou cyber police
keywords: Clean Net 2022
keywords: fake accounts
keywords: bot accounts
related risks: Bulk Following
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: Guangzhou Police Advance the Clean Net 2022 Special Operation to Crack Down on Prominent Cybercrimes Across the Full Chain
citation: Over 150,000 Fake Accounts Cultivated to Provide Fake Likes and Followers! This 'Water Army' Gang Busted...
updated: 2026-06-18
version: 1

Python-based Weibo bulk following and mutual following
type: Case
break id: C0195
stix type: report
summary: This CSDN blog post describes a method for bulk following on Weibo using Python scripts. The approach involves logging into a Weibo account, joining mutual-follow groups to collect large numbers of user IDs, and then programmatically executing bulk follow actions to rapidly grow followers through reciprocal following.
case category: academic_research
incident time: 2018-03
keywords: Weibo automation
keywords: Python scripting
keywords: bulk following
keywords: mutual following
keywords: social media growth
keywords: CSDN
keywords: web crawling
keywords: account automation
related risks: Bulk Following
related attack tools: Automation Scripts
related attack tools: Web Scraping Tools
related threat actors: Freebie Hunters
citation: Guy Earns Tens of Thousands Daily Using Python to Boost Weibo Followers; Netizens: Tech Skills Are Awesome
updated: 2026-06-18
version: 1

Python Script for Automated Bulk Following on Instagram
type: Case
break id: C0196
stix type: report
summary: A CSDN blog post details a Python script designed to automate bulk following of Instagram users. The script navigates to each target user's profile, locates the blue 'Follow' button, and clicks it to perform mass follow actions for follower growth tasks.
case category: news_report
incident time: 2025-07
keywords: Instagram automation
keywords: Python script
keywords: bulk follow
keywords: CSDN
keywords: follower growth
keywords: Selenium
keywords: web scraping
keywords: social media bot
related risks: Bulk Following
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
citation: Using a Python Open-Source Bot and $5, I Got 2,500 Real Followers on Instagram
updated: 2026-06-18
version: 1

Tampermonkey Script for Bulk Unfollowing on Weibo
type: Case
break id: C0197
stix type: report
summary: A Zhihu article introduces a Tampermonkey-based script designed to automate bulk unfollowing on Weibo. While Weibo offers a native bulk unfollow feature, it requires manual selection of each account, prompting the author to develop this script for efficiently cleaning up the following list.
case category: news_report
incident time: 2023-11
keywords: Tampermonkey
keywords: Weibo bulk unfollow
keywords: automation script
keywords: user script
keywords: following list cleanup
keywords: Zhihu
related risks: Bulk Following
related attack tools: Automation Scripts
related attack tools: Browser Extensions
citation: Weibo Batch Unfollow - Chrome Web Store
updated: 2026-06-18
version: 1

CCTV Investigation: Rapid Follower Growth Tricks Using Mutual Follows and Likes to Fake Traffic
type: Case
break id: C0198
stix type: report
summary: A CCTV 'Common Concern' investigation reveals online tricks for rapidly gaining followers through mutual follows and likes, creating an illusion of traffic. This fake engagement does not reflect an account's true quality, violates principles of honesty and integrity, and constitutes typical batch following and engagement manipulation.
case category: news_report
keywords: CCTV investigation
keywords: Common Concern program
keywords: fake followers
keywords: mutual follow
keywords: mutual likes
keywords: fake traffic
keywords: engagement manipulation
keywords: batch following
keywords: social media fraud
keywords: follower growth tricks
related risks: Bulk Following
related attack tools: Automation Scripts
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: [Joint Attention] Attention·Investigation: The 'Secret' to Rapid Follower Growth, Mutual Following and Likes Create Traffic Illusions...
updated: 2026-06-18
version: 1

Tunyan Network Sues Huoyi Network Over App Store Delisting After Rank-Manipulation Campaign for 'Qu Guandan' Game
type: Case
break id: C0199
stix type: report
summary: Tunyan (Shanghai) Network provided chart-boosting promotion services for Huoyi Network's 'Qu Guandan' game by using the 'Kaopu Trial' app to generate downloads and inflate rankings. After Apple's App Store detected the manipulation and delisted the game, a payment dispute arose and both parties filed mutual lawsuits. The court ruled the rank-manipulation contract void for violating public order an
case category: criminal_verdict
incident time: 2024-01
keywords: App Store delisting
keywords: chart-boosting contract void
keywords: public order and good morals
keywords: Tunyan Network
keywords: Huoyi Network
keywords: Qu Guandan
keywords: Kaopu Trial
keywords: download manipulation
keywords: game promotion fraud
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Ranking Manipulation Tools
related threat actors: Malicious Merchants
citation: Notice of the General Office of the Supreme People's Court on the 2023 National Court System Outstanding Case Analysis Selection Results
citation: After Signing the Contract, My Game Was Removed from the App Store Rankings. Can I Get Money Back from the Ranking Manipulation Company?...
updated: 2026-06-18
version: 1

CAC Shuts Down Over 400 Sites and Platforms for Traffic Manipulation
type: Case
break id: C0200
stix type: report
summary: Since 2024, the Cyberspace Administration of China has continued its crackdown on online water armies, targeting activities such as review manipulation, follower inflation, and vote rigging. The campaign has resulted in the closure of over 400 websites and platforms, the removal of 4.82 million pieces of illegal content, and the sanctioning of 2.39 million accounts, shops, and 52,000 groups.
case category: administrative_enforcement
incident time: 2025-01
keywords: CAC enforcement
keywords: online water army
keywords: traffic manipulation
keywords: review manipulation
keywords: follower inflation
keywords: vote rigging
keywords: platform shutdown
keywords: account sanction
keywords: illegal content removal
related risks: Metric Manipulation / Ranking Fraud
related threat actors: Astroturfing Networks
citation: Cyberspace authorities strictly crack down on online water army problems
updated: 2026-06-18
version: 1

MPS Releases Typical Cases of Online Water Army Manipulating Metrics and Controlling Comments
type: Case
break id: C0201
stix type: report
summary: On December 11, 2024, the Ministry of Public Security released 10 typical cases of cracking down on 'online water army' illegal activities across Shandong, Liaoning, Jiangxi, Sichuan, Henan, Zhejiang, Jiangsu, and Guangdong, involving individuals who illegally profited tens of millions of yuan through metric manipulation and comment control.
case category: criminal_verdict
incident time: 2024-12
keywords: MPS
keywords: online water army
keywords: metric manipulation
keywords: comment control
keywords: illegal profit
keywords: ranking manipulation
keywords: traffic fraud
keywords: click farming
keywords: review astroturfing
related risks: Metric Manipulation / Ranking Fraud
related threat actors: Astroturfing Networks
citation: Typical Cases of 'Online Water Army' Crimes: Someone Profited Tens of Millions Through Traffic Manipulation and Comment Control
citation: Public security organs announce 10 typical cases of cracking down on online water army crimes
citation: Ministry of Public Security announces typical cases of cracking down on online water army crimes
citation: MPS publishes typical cases of cracking down on online water army crimes
updated: 2026-06-18
version: 1

Jiangsu Suqian: Zong and Others Used Bot Farm Software to Inflate Livestream and Fan Circle Metrics
type: Case
break id: C0202
stix type: report
summary: The Suqian Public Security Bureau in Jiangsu Province found that Zong and others set up a workshop, purchased multiple bot farm software and numerous mobile phones, and illegally controlled a large number of online accounts to provide paid services for artificially inflating reposts, likes, and comments for the livestreaming industry and fan circles.
case category: criminal_verdict
incident time: 2024-12
keywords: bot farm software
keywords: inflating livestream metrics
keywords: fake reposts
keywords: fake likes
keywords: fake comments
keywords: fan circle manipulation
keywords: illegal account control
keywords: Suqian Jiangsu
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Mass Control Systems
related threat actors: Astroturfing Networks
citation: Typical Cases of 'Online Water Army' Crimes: Someone Profited Tens of Millions Through Traffic Manipulation and Comment Control
citation: MPS Publishes Ten Typical Cases in the Crackdown on Online Water Army Crimes
updated: 2026-06-18
version: 1

Xingyuan App for Celebrity Traffic Manipulation Sealed, Raked in Over 8 Million Yuan in Half a Year
type: Case
break id: C0203
stix type: report
summary: In June 2019, Beijing cyber police reported that the 'Xingyuan' app, a tool used to inflate social media engagement metrics for celebrities, was shut down by Beijing police. The app exploited fan demand for boosting celebrity popularity, generating over 8 million yuan in revenue within six months. The case followed controversy over a Weibo post by Cai Xukun that had been forwarded over 100 million
case category: administrative_enforcement
incident time: 2019-06
keywords: Xingyuan app
keywords: traffic manipulation
keywords: fake engagement
keywords: Weibo
keywords: Cai Xukun
keywords: data fraud
keywords: Beijing police
keywords: app seizure
keywords: fan economy
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: Behind the 'Xiao Zhan Is Finished' Incident, Chaos in Fandom Culture: Idol Worship in Classrooms, Ranking Manipulation and Support Activities_Stars
citation: Supreme People’s Procuratorate: Focus on China’s First Weibo Mass-Reposting Case
updated: 2026-06-18
version: 1

Changsha County Police Dismantle Online Click Farm Ring Involving Over 40 Million Yuan
type: Case
break id: C0204
stix type: report
summary: In July 2023, the cyber police brigade of the Changsha County Public Security Bureau found during online patrols that a studio in Quantang was suspected of providing paid fake traffic services. The studio mainly targeted electronics, jewelry, and other products, using online click farms to manipulate engagement and reviews for profit. Changsha County police cracked the illegal business operation case, involving more than 40 million yuan, arrested two suspects, and dismantled one criminal den.
case category: criminal_verdict
incident time: 2023-07
keywords: click farm
keywords: fake engagement
keywords: paid likes and comments
keywords: Changsha County police
keywords: fake traffic
keywords: illegal business operation
keywords: electronics and jewelry reviews
keywords: criminal den
keywords: manipulate online metrics
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Changsha County dismantles an online click farm ring
updated: 2026-06-18
version: 1

CAC Shuts Down Over 400 Fake Traffic Websites and Platforms
type: Case
break id: C0205
stix type: report
summary: Since 2024, the Cyberspace Administration of China has continued cracking down on organized online water armies engaging in fake reviews, inflated follower counts, and manipulated rankings. It coordinated the shutdown of over 400 websites and platforms, urged the cleanup of 4.82 million pieces of illegal information, and handled 2.39 million accounts and merchant stores.
case category: administrative_enforcement
incident time: 2024-01
keywords: online water army
keywords: fake traffic
keywords: fake reviews
keywords: inflated followers
keywords: manipulated rankings
keywords: CAC
keywords: website shutdown
keywords: illegal information cleanup
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Cyberspace authorities strictly crack down on online water army problems
updated: 2026-06-18
version: 1

Cyber Police Dismantle Massive Traffic-Farming Online Water Army
type: Case
break id: C0206
stix type: report
summary: Public security cyber units uncovered a large-scale traffic-farming online water army case. Led by suspect Hu, the group used purchased water army accounts to repost and spread articles on social platforms for profit. The operation destroyed six dens, captured 23 suspects, seized over 6,000 devices, identified more than 30,000 water army accounts, with the involved amount exceeding 200 million yua
case category: criminal_verdict
incident time: 2025-04
keywords: online water army
keywords: traffic farming
keywords: click farming
keywords: social media manipulation
keywords: fake accounts
keywords: cyber police
keywords: Hu
keywords: criminal syndicate
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Mobile Phone Emulator
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Automation Scripts
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Freebie Hunters
related threat actors: Account Dealers
related threat actors: Astroturfing Networks
citation: Cyber Police Crack Major 'Traffic Manipulation and Redirection' Online Water Army Case: Amount Involved Exceeds 200 Million Yuan
citation: MPS releases ten typical cases on cracking down on illegal online water-army operations
updated: 2026-06-18
version: 1

CAC Releases App Governance Rules Banning Fake Rankings, Inflated Metrics, and Manipulated Reviews
type: Case
break id: C0207
stix type: report
summary: In June 2022, the Cyberspace Administration of China issued the revised Provisions on the Administration of Mobile Internet Application Information Services, explicitly requiring app providers to refrain from using automated or manual means to fabricate rankings, inflate engagement metrics, or manipulate user reviews, thereby creating fraudulent traffic. The regulation aims to discipline the app m
case category: administrative_enforcement
incident time: 2022-06
keywords: CAC
keywords: mobile internet application information service regulations
keywords: app store ranking manipulation
keywords: fake installs
keywords: review fraud
keywords: inflated metrics
keywords: click farming
keywords: fabricated traffic
keywords: data falsification
keywords: 2022
related risks: Metric Manipulation / Ranking Fraud
related attack tools: Ranking Manipulation Tools
related threat actors: Astroturfing Networks
citation: Provisions on the Administration of Mobile Internet Application Information Services
updated: 2026-06-18
version: 1

Yunhe, Zhejiang Dismantles Massive Online Water Army Click-Farming Operation
type: Case
break id: C0208
stix type: report
summary: In April 2024, public security authorities in Yunhe County, Lishui, Zhejiang Province cracked a major online water army click-farming case, apprehending 15 suspects. The group developed multiple click-farming software tools and provided fake order services to over 5,000 merchants, generating more than 20 million fake transactions and over 40 million fake reviews and likes. The total illicit capita
case category: criminal_verdict
incident time: 2024-04
keywords: online water army
keywords: click farming
keywords: fake reviews
keywords: Yunhe public security
keywords: Yunchuang Assistant
keywords: Yiping Assistant
keywords: fake orders
keywords: full-chain crackdown
keywords: illegal business operation
keywords: reputation manipulation
related risks: Order Brushing
related attack tools: Automation Scripts
related attack tools: Ranking Manipulation Tools
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Over 20 Million Fake Orders... This Gang Busted!_Tencent News
citation: China Police Daily: Online Water Army Ring Busted After Over 20 Million Fake Orders
updated: 2026-06-18
version: 1

Jiangxi Man Sentenced for Building Fake Order Platform, Earning 7.8 Million Yuan
type: Case
break id: C0209
stix type: report
summary: Between June 2020 and January 2024, a man surnamed Chen from Xiushui County, Jiangxi Province, created a fake order platform called 'Taoyuanzhijia' and recruited people to place fraudulent orders for online stores. Over three years, more than 5.42 million fake orders were placed, with Chen charging merchants 8 yuan per order and illegally profiting over 7.8 million yuan. In May 2025, a court convi
case category: criminal_verdict
incident time: 2025-05
keywords: fake order platform
keywords: Taoyuanzhijia
keywords: false advertising crime
keywords: e-commerce brushing
keywords: fake reviews
keywords: Xiushui County
keywords: criminal verdict
keywords: online store fraud
related risks: Order Brushing
related threat actors: Malicious Merchants
related threat actors: Malicious Users
citation: Man Sentenced for Earning 7.8 Million Yuan by Posting Fake Positive Reviews for Online Stores, Revealing the Dark Side of Fake Orders_China.com
updated: 2026-06-18
version: 1

Man in Xunwu Sentenced for Brushing and Fake Review Operations on Overseas Amazon Platform
type: Case
break id: C0210
stix type: report
summary: Between August 2023 and April 2024, a man surnamed Zhang operated a studio in Xunwu County, Jiangxi, taking orders via WeChat to provide brushing and fake review services for merchants on overseas Amazon platforms. The case was lawfully handled by the Xunwu County People's Procuratorate, and Zhang faced criminal liability for suspected illegal business operations, exposing the severe damage such p
case category: criminal_verdict
incident time: 2025-11
keywords: Amazon
keywords: brushing
keywords: fake reviews
keywords: illegal business operations
keywords: e-commerce integrity
keywords: Xunwu County
keywords: cross-border e-commerce
keywords: fictitious transactions
keywords: platform manipulation
keywords: criminal prosecution
related risks: Order Brushing
citation: [Building an Honest Society] A Man in Xunwu Sentenced for 'Fake Orders and Review Manipulation' | Ganzhou Municipal People's Government
citation: Gannan Daily digital edition: Xunwu man sentenced for fake orders and review manipulation
citation: Xunwu County People's Procuratorate: Sentenced for Fake Orders and Review Manipulation
updated: 2026-06-18
version: 1

Guangzhou Cross-Border E-Commerce Bonded Warehouse Click-Farm Tax Fraud Verdict Announced
type: Case
break id: C0211
stix type: report
summary: In May 2018, the Guangzhou Intermediate People's Court delivered a verdict in a case involving click-farming through a cross-border bonded warehouse. A Guangzhou-based supply chain company used fabricated transactions to fraudulently obtain national tax incentives. The individuals involved were placed under criminal detention in December 2015 and arrested in January 2016. The case stands as a land
case category: criminal_verdict
incident time: 2018-05
keywords: cross-border e-commerce
keywords: bonded warehouse
keywords: click-farm tax fraud
keywords: supply chain company
keywords: fabricated transactions
keywords: tax incentives
keywords: Guangzhou Intermediate People's Court
keywords: criminal verdict
related risks: Order Brushing
related threat actors: Freebie Hunters
citation: First-Instance Criminal Judgment for Guangzhou Zhidu Supply Chain Management Co., Ltd. and Feng on Smuggling Ordinary Goods and Articles
citation: Cross-border bonded warehouse 'brushing' common, first criminal conviction
updated: 2026-06-18
version: 1

Fictitious Online Store Transactions to Defraud Return Shipping Insurance Case
type: Case
break id: C0212
stix type: report
summary: On May 15, 2025, Shanghai police uncovered an insurance fraud case involving fictitious transactions to fraudulently claim return shipping insurance. A criminal gang registered online stores, quickly obtained over a hundred orders from remote areas, returned all of them, and ceased operations after receiving return shipping compensation from the insurer. Thirteen suspects were arrested, with the a
case category: criminal_verdict
incident time: 2025-05
keywords: fictitious transactions
keywords: return shipping insurance
keywords: insurance fraud
keywords: shipping insurance claims
keywords: fake orders
keywords: online store fraud
keywords: return freight insurance
keywords: Shanghai police
related risks: Order Brushing
related threat actors: Fraudulent Claims Gangs
citation: ZhongAn Insurance Assists Police in Solving RMB 3 Million Return-Shipping Insurance Fraud Case
citation: Newly registered online store gets over 100 orders and returns; fictitious transaction insurance fraud case cracked
updated: 2026-06-18
version: 1

Shanghai Police Crack Down on “Wool-Gathering” Scheme: Fake Orders Defrauded Platform of Over 1.2 Million Yuan in Subsidies
type: Case
break id: C0213
stix type: report
summary: In October 2024, police in Xuhui District, Shanghai, received a report from an e-commerce platform and discovered that multiple chain supermarkets under the same brand were defrauding the platform of subsidies through fictitious transactions. The criminal group used low-priced eggs as bait to lure customers into placing empty orders on the app, fabricating transaction records to pocket the platfor
case category: criminal_verdict
incident time: 2025-04
keywords: wool-gathering
keywords: fake order brushing
keywords: subsidy fraud
keywords: e-commerce platform
keywords: Shanghai Xuhui police
keywords: low-priced eggs
keywords: fictitious transactions
keywords: platform subsidies
keywords: compulsory criminal measures
related risks: Subsidy Fraud
related risks: Unauthorized Discount Purchase
related threat actors: Freebie Hunters
citation: Xuhui Police Crack Coupon-Abuse Subsidy Fraud Case Involving Over RMB 1.2 Million
citation: Shanghai police bust a 'wool-pulling' case involving fake brushing to defraud subsidies
updated: 2026-06-18
version: 1

Ningbo Yinzhou Police Crack Government Voucher Cash-Out Fraud Ring
type: Case
break id: C0214
stix type: report
summary: In January 2023, police in Yinzhou, Ningbo, discovered that a suspect surnamed Xu and others were bulk-purchasing government-issued consumption vouchers, registering shell companies to conduct fictitious transactions, and using merchant POS terminals to process voucher redemptions in order to defraud government subsidies. By redeeming discount vouchers, they converted the subsidy funds into cash.
case category: criminal_verdict
incident time: 2023-06
keywords: government consumption vouchers
keywords: cash-out
keywords: fictitious transactions
keywords: POS terminal redemption
keywords: subsidy fraud
keywords: shell companies
keywords: Ningbo Yinzhou
keywords: Xu
keywords: voucher fraud
keywords: discount voucher abuse
related risks: Subsidy Fraud
related attack tools: Payment Fraud Automation Tool
related threat actors: Freebie Hunters
citation: Largest and Most Numerous in Recent Years: Ningbo Police Arrest 102 People
citation: Over 6.55 million yuan in government subsidies illegally obtained, 102 arrested | Consumer vouchers | Fraud
updated: 2026-06-18
version: 1

Shanghai's First Government Voucher Subsidy Fraud Verdict: Dicos Store Manager Cashes Out ¥137,000
type: Case
break id: C0215
stix type: report
summary: In November 2023, Xia, the operator of a well-known fast-food chain restaurant in Shanghai, exploited government-issued consumer vouchers for cash-out. She processed 459 vouchers through fictitious transactions over 19 days, each time fraudulently claiming a 300-yuan government subsidy, resulting in a total loss of over ¥137,000. Xia was convicted of fraud and ordered to return all illegal proceed
case category: criminal_verdict
incident time: 2025-06
keywords: government consumer vouchers
keywords: cash-out
keywords: fraud conviction
keywords: Dicos
keywords: store manager
keywords: fictitious transactions
keywords: subsidy fraud
keywords: Shanghai
keywords: fast-food chain
related risks: Subsidy Fraud
related threat actors: Freebie Hunters
citation: Shanghai's First Consumer-Coupon Subsidy Fraud Case Concluded
citation: A Dicos store manager cashes out 137,000 yuan via consumer vouchers, convicted of subsidy fraud
updated: 2026-06-18
version: 1

Guangxi Pingxiang Uncovers Export Tax Refund Fraud Case
type: Case
break id: C0216
stix type: report
summary: From 2021 to 2023, Huang, Xu, and others evaded commodity inspection by disguising farmers' live fish as originating from registered farms for export, and used fraudulent VAT invoices to fraudulently obtain export tax refunds totaling 28.6443 million yuan. The case involved multiple trading companies, with the value of live fish involved reaching 488 million yuan. Huang and Xu were sentenced to tw
case category: criminal_verdict
incident time: 2025-08
keywords: export tax refund fraud
keywords: fraudulent VAT invoices
keywords: evading commodity inspection
keywords: live fish export
keywords: Pingxiang
keywords: export tax refund scam
keywords: Huang
keywords: Xu
keywords: Pingxiang DeX import export company
keywords: fraudulent subsidy claims
related risks: Subsidy Fraud
citation: Guangxi: Targeted crackdown on malicious tax incentive and fiscal subsidy fraud, and various tax evasion crimes | Smuggling | ...
citation: Guangxi authorities disclose six tax-related crime cases
updated: 2026-06-18
version: 1

Guangdong Dongguan Section Chief Sentenced to 13 Years for Fabricating Documents to Defraud Over 10 Million in State Subsidies
type: Case
break id: C0217
stix type: report
summary: In August 2016, the Dongguan Intermediate People's Court issued a first-instance verdict in the corruption case involving Huang Xinzheng, former head of the Industrial Technology Unit of Chang'an Town's Economic and Information Bureau, and Jing Xiuyuan, former deputy director of the Provincial Economic and Information Commission's Industrial Development Division. Huang colluded with superiors to f
case category: criminal_verdict
incident time: 2016-08
keywords: state subsidy fraud
keywords: corruption conviction
keywords: fabricating documents
keywords: Industrial Technology Unit
keywords: Huang Xinzheng
keywords: Jing Xiuyuan
keywords: Dongguan Intermediate People's Court
keywords: Chang'an Town Economic and Information Bureau
keywords: misappropriation of public funds
related risks: Subsidy Fraud
citation: National Audit Office Announcement on the Handling of Transferred Discipline and Law Violation Leads
updated: 2026-06-18
version: 1

Qingdao PhD Indicted for Defrauding High-Tech Enterprise Subsidies of 2.1 Million Yuan
type: Case
break id: C0218
stix type: report
summary: In 2021, Han Moujia, a PhD holder in Qingdao, used seven ID cards to establish seven technology companies. To meet the evaluation criteria for high-tech enterprise government subsidies, he forged materials including accounting firm seals, CPA private seals, employee rosters, technology invention patent certificates, financial statements, and audit reports, fraudulently obtaining 2.1 million yuan i
case category: criminal_verdict
incident time: 2021-06
keywords: high-tech enterprise subsidy
keywords: government subsidy fraud
keywords: forged seals
keywords: audit report fabrication
keywords: Han Moujia
keywords: Qingdao
keywords: technology invention patent certificate
keywords: high-tech enterprise recognition
keywords: indictment for fraud
related risks: Subsidy Fraud
citation: PhD defrauds 2.1 million yuan, master's graduate defrauds 30,000 yuan in talent subsidies, both convicted! | Yao...
updated: 2026-06-18
version: 1

Supermarket 'Collusion' Click Farming to Defraud Subsidies: Shanghai Police Crack 'Order A Ship B' Scam
type: Case
break id: C0219
stix type: report
summary: In March 2025, Shanghai police dismantled a click farming fraud targeting an e-commerce platform. Suspects Dai and Zhu organized offline supermarket staff to conduct fake transactions using an 'Order A, Ship B' scheme—placing online orders but shipping empty packages or cheap substitutes to illicitly obtain platform coupons and rebates, involving over 1.2 million yuan.
case category: criminal_verdict
incident time: 2025-03
keywords: Order A Ship B
keywords: click farming fraud
keywords: fake transactions
keywords: e-commerce platform
keywords: coupon fraud
keywords: rebate abuse
keywords: empty package scam
keywords: Shanghai police
related risks: Fake Transactions
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: Xuhui Police Crack Platform Subsidy Fraud Case Involving H Supermarket Operations
citation: ...'Order A, ship B' subsidy fraud, supermarkets 'gang up' to fleece platforms! Shanghai busts a brushing fraud case...
updated: 2026-06-18
version: 1

Chain Supermarket Colludes to Defraud E-Commerce Platform of Over 1.2 Million Yuan
type: Case
break id: C0220
stix type: report
summary: In March 2025, franchisees of Shanghai-based supermarket chain 'H Supermarket', led by Yang, orchestrated a scheme involving offline staff to conduct fake transactions on an e-commerce platform using a 'buy A, ship B' method. They placed online orders but shipped empty packages or low-value items offline to fraudulently obtain platform-issued coupons and subsidies, accumulating illicit profits exc
case category: criminal_verdict
incident time: 2025-03
keywords: buy A ship B
keywords: fake transactions
keywords: e-commerce subsidy fraud
keywords: coupon arbitrage
keywords: empty package fraud
keywords: chain supermarket fraud
keywords: franchisee fraud
keywords: H Supermarket
keywords: e-commerce platform fraud
related risks: Fake Transactions
related threat actors: Malicious Merchants
citation: Xuhui Police Crack Chain-Supermarket Platform Subsidy Fraud Case Involving Over RMB 1.2 Million
citation: 'Order A, ship B' to defraud e-commerce subsidies, chain supermarkets collude to fleece platform of over 1.2 million yuan
updated: 2026-06-18
version: 1

Guangzhou Police Dismantle New-Type Fraud Gang Exploiting E-Commerce Promotions
type: Case
break id: C0221
stix type: report
summary: In August 2021, the Haizhu District Public Security Bureau in Guangzhou received a report from an e-commerce platform alleging that individuals were maliciously using virtual mobile numbers to register multiple accounts, repeatedly claiming platform coupons, and purchasing goods to profit from the price difference, causing a loss of approximately 700,000 yuan. Police arrested 10 suspects led by Wa
case category: criminal_verdict
incident time: 2021-08
keywords: e-commerce coupon fraud
keywords: virtual mobile number abuse
keywords: promotion abuse
keywords: coupon arbitrage
keywords: fake account registration
keywords: Wang fraud gang
keywords: Guangzhou Haizhu cybercrime
keywords: online black market
related risks: Fake Transactions
related attack tools: Black SIM Cards
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
citation: Guangzhou Police Chain-Breaking No. 7 Operation Cracks E-Commerce Coupon Abuse Fraud Gang
citation: Crackdown on telecom fraud crimes including fake customer service, fictitious transactions, and romance scams! Guangzhou...
updated: 2026-06-18
version: 1

Dropshipping Merchant Fined by Court for Fabricating Invoices and Purchase Contracts
type: Case
break id: C0222
stix type: report
summary: In June 2026, the Beijing Internet Court heard a network service contract dispute. The plaintiff, a trading company, operated a dropshipping model on an e-commerce platform, purchasing goods from other platforms only after receiving customer orders. After being penalized by the platform for 'inflated pricing,' the company paid a third party to fabricate 70 invoices and forge purchase contracts as
case category: criminal_verdict
incident time: 2026-06
keywords: dropshipping model
keywords: fabricated invoices
keywords: forged purchase contracts
keywords: falsified evidence
keywords: e-commerce platform penalty
keywords: Beijing Internet Court
keywords: judicial fine
keywords: network service contract dispute
related risks: Fake Transactions
citation: Case Review: Merchant Punished for Malicious Dropshipping Submitted Fake Invoices and Contracts, Resulting in a Court Fine
citation: Merchant maliciously ships no goods penalized by platform, 'fake transaction' results in real court fine | Plaintiff | Evidence | ...
updated: 2026-06-18
version: 1

Man Sentenced for Fraudulently Selling App Memberships on Second-Hand Platform
type: Case
break id: C0223
stix type: report
summary: Between late 2023 and February 2024, a young man named Zeng sought illegal profits by falsely listing educational app memberships for sale on a second-hand trading platform. He instructed his friend Liao and others to post the fake offers, collecting payments from buyers without delivering the memberships, defrauding victims of nearly 30,000 yuan. The Wuhua Court convicted him of fraud and sentenc
case category: criminal_verdict
incident time: 2025-04
keywords: second-hand trading platform
keywords: fake listing
keywords: app membership
keywords: educational app
keywords: fraud conviction
keywords: suspended sentence
keywords: Wuhua Court
keywords: Zeng
keywords: online fraud
related risks: Fake Transactions
related threat actors: Malicious Merchants
related threat actors: Malicious Users
citation: Wuhua County People's Court - Man uses second-hand trading platform for fake sale of APP memberships, convicted
updated: 2026-06-18
version: 1

Prosecution Team Breaks Down Typical E-Commerce Fraud Schemes: How to Avoid the Traps
type: Case
break id: C0224
stix type: report
summary: A case handled by the Tongzhou District Procuratorate in Beijing reveals that unscrupulous merchants sold counterfeit baby formula at low prices on e-commerce platforms after fraudulently registering companies under others' identities or purchasing business licenses to appear legitimate. The conduct involved falsified transactions, operating under false identities, and deceiving consumers.
case category: criminal_verdict
incident time: 2025-02
keywords: counterfeit online store
keywords: fraudulent company registration
keywords: e-commerce platform
keywords: low-price baby formula
keywords: falsified transactions
keywords: identity misappropriation
keywords: business license
keywords: Tongzhou District Procuratorate
keywords: consumer deception
related risks: Fake Transactions
related threat actors: Malicious Merchants
citation: Beijing: Cracking Down on E-Commerce Crimes to Safeguard Consumer Confidence
citation: Case team dissects typical criminal schemes in e-commerce transactions: Watch out for pitfalls! | Xu | Platform | Milk powder
updated: 2026-06-18
version: 1

Shanghai Police Crack Down on Return Shipping Insurance Fraud via Fictitious Transactions
type: Case
break id: C0225
stix type: report
summary: In January 2025, Shanghai police uncovered an insurance fraud scheme involving fictitious transactions to fraudulently claim return shipping insurance payouts, arresting 13 suspects and involving over 3 million yuan. Abnormal orders showed logistics information inconsistent with buyer details, addresses, and return times, with some returns occurring before receipt.
case category: criminal_verdict
incident time: 2025-01
keywords: return shipping insurance
keywords: insurance fraud
keywords: fictitious transactions
keywords: Shanghai police
keywords: economic crime
keywords: financial black and gray industry
keywords: fake returns
keywords: insurance scams
related risks: Fake Transactions
related risks: Return Fraud
related threat actors: Fraudulent Claims Gangs
citation: ZhongAn Insurance Assists Police in Solving RMB 3 Million Return-Shipping Insurance Fraud Case
citation: Cracking down on financial black and gray industries, Shanghai police have solved over 690 economic crime cases this year | Finance...
updated: 2026-06-18
version: 1

US Government Websites Hit by SEO Poisoning Attack
type: Case
break id: C0226
stix type: report
summary: In December 2025, a large-scale SEO poisoning attack targeted .gov domains across multiple US states and local governments. Attackers exploited public file upload functions on government websites to upload PDF files containing malicious links. Once these files were indexed by search engines, users clicking on official domain links were redirected to pages containing pornographic advertisements and
case category: security_incident
incident time: 2025-12
keywords: SEO poisoning attack
keywords: .gov domain hijack
keywords: PDF malicious file upload
keywords: Granicus file upload vulnerability
keywords: search engine index manipulation
keywords: government website redirect
keywords: pornographic ad redirect
keywords: domain redirect exploit
related risks: Search Result Manipulation
related attack tools: System/Application Vulnerability Exploitation Tools
related attack tools: Phishing Kits
related threat actors: Malicious Hackers
citation: Dominic Alvieri Original Disclosure of a .gov PDF SEO Poisoning Campaign
citation: U.S. government website hit by SEO poisoning attack: Official domain tampered to redirect to pornographic content entry
updated: 2026-06-18
version: 1

Malware-Driven E-Commerce Fraud: Black-Hat SEO Fraud Rings Targeting Japan
type: Case
break id: C0227
stix type: report
summary: A study reveals black-hat SEO e-commerce fraud campaigns targeting Japan. Attackers compromise legitimate websites and deploy SEO malware to poison search results, making search engines display deceptive landing pages as legitimate content from the hacked sites, thereby redirecting users to fraudulent e-commerce platforms. The research analyzes 10 malware families and nearly 700,000 fake websites.
case category: academic_research
keywords: black-hat SEO
keywords: e-commerce fraud
keywords: SEO malware
keywords: Japanese e-commerce scams
keywords: SEO poisoning
keywords: fake shopping sites
keywords: malicious redirects
keywords: compromised websites
related risks: Search Result Manipulation
related attack tools: Trojan Virus
related attack tools: Phishing Kits
related attack tools: Fraud-as-a-Service (FaaS) Platform
related threat actors: Malware Developers
related threat actors: Criminal Organizations
related threat actors: Payment Fraud Groups
citation: Malware-driven e-commerce fraud: Correlation analysis of a black-hat SEO e-commerce fraud ring targeting Japan
updated: 2026-06-18
version: 1

360 Search Fined 2 Million Yuan for Publishing False and Illegal Advertisements
type: Case
break id: C0228
stix type: report
summary: In April 2021, the Beijing Municipal Administration for Market Regulation completed an investigation into 360 Search for publishing false and illegal advertisements, and imposed an administrative penalty of 2 million yuan on Beijing Haosou Dianjing Technology Co., Ltd. The case originated from an exposé on the CCTV 3·15 Gala.
case category: administrative_enforcement
incident time: 2021-04
keywords: 360 Search
keywords: false advertising
keywords: administrative penalty
keywords: Beijing Municipal Administration for Market Regulation
keywords: Haosou Dianjing Technology
keywords: CCTV 315
keywords: 2 million yuan fine
keywords: illegal advertisements
related risks: Search Result Manipulation
citation: Beijing Municipal Market Regulation Bureau Fines 360 Search RMB 2 Million for False and Illegal Advertising
citation: April 14 | Morning Brief: Latest report: Dismissal and 7-day detention...
updated: 2026-06-18
version: 1

Shansuitui's '10,000-Keyword Dominance' Baidu Search Manipulation Case
type: Case
break id: C0229
stix type: report
summary: Shansuitui provided a '10,000-Keyword Dominance' service, leveraging high-authority websites to associate client promotional pages with search keywords or generating massive 'spam pages' embedded in third-party sites, pushing client content to the top of Baidu search results and disrupting normal ranking order. The court ruled this constituted unfair competition and ordered Shansuitui to pay Baidu
case category: criminal_verdict
incident time: 2023-04
keywords: Shansuitui
keywords: Baidu search manipulation
keywords: unfair competition
keywords: SEO spam
keywords: keyword stuffing
keywords: spam pages
keywords: search interference
related risks: Search Result Manipulation
related attack tools: Auto-Posting Bots
related attack tools: Ad Attribution Fraud Tool
related threat actors: Astroturfing Networks
citation: SPC Releases the 2022 Top Ten IP Cases and 50 Typical IP Cases of Chinese Courts
citation: Counterfeiting internationally renowned brands, principal offender convicted and fined 10 million yuan
updated: 2026-06-18
version: 1

US Government Websites Hit by SEO Poisoning Attack
type: Case
break id: C0230
stix type: report
summary: In December 2025, a large-scale SEO poisoning attack targeted .gov domains of multiple US state and local governments. Attackers exploited public file upload functions on government websites to upload PDF files containing malicious links. After these files were indexed by Google, users clicking on official domain links were redirected to pornographic content.
case category: security_incident
incident time: 2025-12
keywords: SEO poisoning
keywords: .gov domain
keywords: malicious PDF upload
keywords: Google indexing
keywords: Granicus
keywords: file upload vulnerability
keywords: government website attack
keywords: search engine manipulation
related risks: Search Result Manipulation
citation: Dominic Alvieri Original Disclosure of a .gov PDF SEO Poisoning Campaign
citation: Satoshi Nakamoto disappears for 15 years: The mystery of a million dormant bitcoins; GPT-5.2 debuts: OpenAI confronts...
updated: 2026-06-18
version: 1

Court Ruling: 2 Million Yuan Fine for Sharing Video Membership Accounts
type: Case
break id: C0231
stix type: report
summary: A judicial ruling imposed a 2 million yuan fine on parties responsible for illegally sharing video platform membership accounts. The case confirmed that selling or sharing a single-user membership with multiple people at low prices infringes on the platform's revenue rights for multi-device usage and is deemed illegal.
case category: criminal_verdict
incident time: 2021-04
keywords: video membership sharing
keywords: account sharing penalty
keywords: low-price resale
keywords: unfair competition
keywords: video platform revenue rights
keywords: 2 million yuan fine
keywords: Shenzhen People's Procuratorate
related risks: Unauthorized Account Sharing
related threat actors: Piracy/Infringement Gangs
citation: Is Sharing Video Membership Accounts Legal?
citation: Convicted! Sharing video streaming accounts this way results in a 2 million yuan fine... from Shenzhen People's Procuratorate...
updated: 2026-06-18
version: 1

Man Sentenced for Selling Access to Pornographic App Accounts
type: Case
break id: C0232
stix type: report
summary: In April 2023, Longwan Court in Wenzhou disclosed a case involving the illegal use of information networks. Zhao knew that an app contained large amounts of pornographic escort information, yet created ten QQ groups and charged users for the app's member accounts and passwords, helping them unlock escort advertisements and app links. Since May 2021, Zhao earned more than 20,000 yuan from the scheme. Longwan Court convicted Zhao of illegal use of information networks and sentenced Zhao to ten months in prison, suspended for one year and four months, with a 5,000 yuan fine.
case category: criminal_verdict
incident time: 2023-04
keywords: pornographic app
keywords: account sharing
keywords: illegal use of information networks
keywords: unauthorized sharing
keywords: criminal verdict
keywords: account resale
keywords: paid access
keywords: 2023
related risks: Unauthorized Account Sharing
citation: Playing “Sharing Economy” on an Obscene Platform? The Internet Is Not Beyond the Law
updated: 2026-06-25
version: 1

Man Sentenced for Reselling Dating Site Member Accounts
type: Case
break id: C0233
stix type: report
summary: In January 2025, a Shanghai man surnamed Chang was sentenced to six months in prison and fined 5,000 yuan for purchasing and reselling over 100 real-name verified dating site accounts, some of which were later used in online fraud.
case category: criminal_verdict
incident time: 2025-01
keywords: real-name verified accounts
keywords: dating site accounts
keywords: account reselling
keywords: personal information infringement
keywords: online fraud
keywords: criminal verdict
keywords: Chang
related risks: Unauthorized Account Sharing
related threat actors: Account Dealers
citation: Reselling Dating-Site Member Accounts Led to Criminal Conviction
citation: Man resells dating site member accounts, convicted
updated: 2026-06-18
version: 1

Shared Video Account Service Ordered to Pay 2 Million Yuan in Damages
type: Case
break id: C0234
stix type: report
summary: A company purchased Youku VIP accounts and offered paid video streaming services through its own app, claiming it was an innovative 'shared membership' model. The court ruled that this violated the principle of good faith, harmed Youku's legitimate rights and interests, and constituted unfair competition. The final judgment ordered the company to pay approximately 2 million yuan in damages to Youk
case category: criminal_verdict
incident time: 2021-04
keywords: Youku
keywords: shared membership
keywords: unfair competition
keywords: VIP account
keywords: video platform
keywords: 2 million yuan damages
keywords: mobile app
keywords: good faith principle
related risks: Unauthorized Account Sharing
related threat actors: Piracy/Infringement Gangs
citation: Is Sharing Paid Video Membership Accounts Legal? Beijing Court Explains
citation: Convicted! Sharing video streaming accounts this way results in a 2 million yuan fine
updated: 2026-06-18
version: 1

Kuaishou Penalized for Failure to Remove Illegal Information
type: Case
break id: C0235
stix type: report
summary: In November 2024, Kuaishou was penalized for failing to promptly remove illegal information from short videos and for inadequate implementation of youth mode, leading to the spread of harmful content and endangering minors' physical and mental health. Public security authorities issued a warning under the Cybersecurity Law and ordered a comprehensive cleanup of illegal information.
case category: administrative_enforcement
incident time: 2024-11
keywords: Kuaishou
keywords: illegal information
keywords: administrative penalty
keywords: youth mode
keywords: Cybersecurity Law
keywords: content moderation
keywords: short video platform
keywords: minor protection
related risks: Content Compliance Risk
citation: Behind Kuaishou's fine for violations: Pornographic content persists despite crackdowns, business growth slows
citation: Public security authorities impose administrative penalty on Kuaishou
updated: 2026-06-18
version: 1

Quark Platform Fined 500,000 Yuan for Displaying Pornographic Information
type: Case
break id: C0236
stix type: report
summary: In October 2023, the Cyberspace Administration of China stated that the Quark platform failed to comply with management requirements, presenting a large amount of pornographic information and recommending vulgar keywords during user searches, seriously violating relevant regulations. The platform had severe loopholes in content security review and management, disrupting the online ecosystem.
case category: administrative_enforcement
incident time: 2023-10
keywords: Quark platform fine
keywords: Cyberspace Administration of China
keywords: pornographic information
keywords: content moderation
keywords: administrative penalty
keywords: 500,000 yuan fine
keywords: search recommendation
keywords: online ecosystem
keywords: vulgar keywords
keywords: platform liability
related risks: Content Compliance Risk
citation: Cyberspace authorities lawfully handle illegal online ecosystem cases involving Quark and NetEase CC
updated: 2026-06-18
version: 1

Kuaishou Fined and Apologizes Repeatedly for Vulgar Content
type: Case
break id: C0237
stix type: report
summary: In February 2026, Kuaishou was penalized and apologized after a large volume of non-compliant content appeared on its platform, pledging resolute rectification. Previously, Kuaishou had been summoned and penalized multiple times for disseminating vulgar and inappropriate content involving minors, child softcore emoticons, and other issues, resulting in painful lessons.
case category: administrative_enforcement
incident time: 2026-02
keywords: Kuaishou vulgar content
keywords: minor protection
keywords: child softcore emoticons
keywords: administrative penalty
keywords: content compliance
keywords: platform governance
keywords: regulatory summons
related risks: Content Compliance Risk
citation: Kuaishou fined for massive rule-breaking content, issues apology: Resolute rectification! A deeply painful lesson
citation: Cyberspace authorities fine Kuaishou 119.1 million yuan over large volumes of pornographic and vulgar livestream content
updated: 2026-06-18
version: 1

Blogger Sentenced for Profiting from Unauthorized Derivative Works Using Unreleased Game Content
type: Case
break id: C0238
stix type: report
summary: In June 2023, a blogger was arrested for illegally obtaining unreleased game skin videos, creating derivative works, and posting them on short-video platforms to attract approximately 400,000 followers and generate profit. The individual was sentenced to three years in prison and fined 300,000 yuan.
case category: criminal_verdict
incident time: 2023-06
keywords: unreleased game assets
keywords: game skins
keywords: derivative works
keywords: short-video platform
keywords: copyright infringement
keywords: unauthorized access
keywords: follower monetization
keywords: content compliance
related risks: Content Compliance Risk
related threat actors: Piracy/Infringement Gangs
citation: First of Its Kind: Chengdu High-Tech Police Cracked Game Character Skin Leak-for-Profit Case
citation: Blogger illegally obtains unreleased game content for derivative works to attract followers and profit, sentenced to 3 years and fined 300,000 yuan
updated: 2026-06-18
version: 1

Wuhan Police Announce Typical Case of Online Disinformation About Heavy Rain
type: Case
break id: C0239
stix type: report
summary: In May 2026, during severe rainfall in Wuhan, a netizen surnamed Xu posted false claims on social media that 'Wuhan's torrential rain caused streets to flood,' attaching a flooding video from outside Wuhan to gain traffic. Police summoned Xu in accordance with the law and announced this typical case of spreading disinformation.
case category: administrative_enforcement
incident time: 2026-05
keywords: Wuhan heavy rain
keywords: online rumor
keywords: disinformation
keywords: clickbait traffic
keywords: police announcement
keywords: flood video
keywords: content compliance
keywords: Xu
related risks: Content Compliance Risk
citation: Wuhan Police Report Three Typical Cases of False Online Information About Heavy Rain Emergencies
citation: Wuhan police report typical case of false information related to rainstorm circulating online
updated: 2026-06-18
version: 1

University Student Sentenced for Distributing Child Obscene Videos via Hidden Networks
type: Case
break id: C0240
stix type: report
summary: In 2016, Beijing police, acting on a Ministry of Public Security lead forwarded from U.S. law enforcement, cracked Beijing's first case involving the distribution of child obscene videos through overseas hidden websites. University student Sun used hidden network spaces to post such videos and also bought and shared related content through QQ groups and Baidu Cloud links. The court found that from September 2015 to March 2016 he uploaded video files, 40 of which were identified as obscene materials, and sentenced him to one year and six months in prison for distributing obscene materials; the Beijing No. 3 Intermediate People's Court upheld the judgment on appeal.
case category: criminal_verdict
incident time: 2016-11
keywords: dark web
keywords: child pornography
keywords: distribution of obscene videos
keywords: Sun
keywords: university student
keywords: hidden network
keywords: forum
keywords: prison sentence
keywords: content compliance
related risks: Content Compliance Risk
related attack tools: Dark Web
citation: Self-Taught Student Sentenced for Using Circumvention Techniques to Spread Obscene Videos
updated: 2026-06-18
version: 1

China accused of flooding social media with spam to crowd out coverage of lockdown protests
type: Case
break id: C0241
stix type: report
summary: In December 2022, China was accused of using spam to flood social media platforms in order to suppress coverage of COVID-19 lockdown protests. A large volume of fake or repetitive posts was used to disrupt normal information dissemination, degrading user experience and raising compliance concerns.
case category: news_report
incident time: 2022-12
keywords: China social media spam
keywords: lockdown protests coverage
keywords: COVID-19 information disruption
keywords: platform compliance concerns
keywords: Guardian report
related risks: Spam Content
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: China accused of flooding social media with spam to crowd out...
updated: 2026-06-18
version: 1

Product spam on YouTube: A case study
type: Case
break id: C0242
stix type: report
summary: This case study reveals a large volume of product spam videos on YouTube that pollute product search results with low-quality SEO content. The study finds a high proportion of spam videos, significantly degrading platform content quality and user search experience.
case category: academic_research
keywords: YouTube
keywords: product spam
keywords: spam videos
keywords: SEO pollution
keywords: content quality
keywords: search result contamination
keywords: platform governance
related risks: Spam Content
citation: Product spam on YouTube: A case study
updated: 2026-06-18
version: 1

FTC Sues Experian for CAN-SPAM Act Violations
type: Case
break id: C0243
stix type: report
summary: The U.S. Federal Trade Commission (FTC) filed a lawsuit against Experian Consumer Services for violating the CAN-SPAM Act by sending commercial advertising emails without user consent. Experian ultimately agreed to pay a $650,000 civil penalty and committed to complying with the CAN-SPAM Act, ceasing the sending of unauthorized advertising emails. This case clarifies the legal boundary that compan
case category: administrative_enforcement
incident time: 2023-08
keywords: FTC
keywords: Experian
keywords: CAN-SPAM Act
keywords: commercial advertising emails
keywords: civil penalty
keywords: consumer protection
keywords: spam emails
keywords: unauthorized emails
keywords: email marketing
keywords: Federal Trade Commission
related risks: Spam Content
citation: FTC lawsuit reminds businesses: CAN-SPAM means CAN'T spam
updated: 2026-06-18
version: 1

A Survey of Machine Learning Applications in Spam Filtering by Major Email Providers
type: Case
break id: C0244
stix type: report
summary: This study surveys how machine learning techniques are applied in the spam filtering systems of major Internet Service Providers (ISPs) such as Gmail, Yahoo, and Outlook. It examines how these providers leverage content analysis and machine learning algorithms to identify and filter spam, including malicious links, deceptive advertisements, and fraudulent messages, in order to protect users from u
case category: academic_research
keywords: machine learning
keywords: spam filtering
keywords: Gmail
keywords: Yahoo
keywords: Outlook
keywords: content analysis
keywords: malicious links
keywords: deceptive advertising
keywords: ISP email security
related risks: Spam Content
citation: Machine learning for email spam filtering: review ... - ScienceDirect
updated: 2026-06-18
version: 1

A Literature Review on Social Media Spam Detection and Classification Systems
type: Case
break id: C0245
stix type: report
summary: This review highlights the rapid growth of spam on social media, including malicious links, fake applications, fake accounts, fake news, fake reviews, and rumors. It emphasizes that users struggle to identify such spam messages on platforms like Facebook, Twitter, YouTube, and email, leading to security risks and degraded user experience. The review systematically examines the application of machi
case category: academic_research
keywords: social media spam detection
keywords: fake account detection
keywords: fake news detection
keywords: machine learning spam classification
keywords: deep learning text classification
keywords: Facebook spam
keywords: Twitter spam
keywords: YouTube spam
related risks: Spam Content
citation: A systematic literature review on spam content detection and classification
updated: 2026-06-18
version: 1

Shanghai Customs Seizes Masks Infringing Minions Animation Copyright
type: Case
break id: C0246
stix type: report
summary: In July 2021, Shanghai Customs at Waigaoqiao Port conducted a thorough inspection of a shipment with multiple declaration irregularities and discovered over 220,000 disposable non-medical masks bearing the Minions animated character hidden in the rear of a container. After confirming with the rights holder, Universal City Studios LLC, that the masks infringed the copyright of the Minions character
case category: administrative_enforcement
incident time: 2021-07
keywords: Minions copyright infringement
keywords: Universal City Studios
keywords: Shanghai Customs seizure
keywords: Waigaoqiao Port inspection
keywords: disposable non-medical masks
keywords: counterfeit character masks
keywords: IPR border enforcement
keywords: customs administrative penalty
related risks: Content Infringement
related threat actors: Piracy/Infringement Gangs
citation: Shanghai Customs Releases Five Typical Intellectual Property Protection Cases
citation: Shanghai Customs releases five major typical cases on intellectual property protection
updated: 2026-06-18
version: 1

Kang Piyao v. Baotou Xincheng Yizhuo Real Estate Development Co., Ltd. – Copyright Ownership and Infringement Dispute
type: Case
break id: C0247
stix type: report
summary: The plaintiff Kang Piyao authored the literary work Baotou Fu. The defendant Baotou Xincheng Yizhuo Real Estate Development Co., Ltd. reproduced an excerpt of the work without authorization on a waterscape wall in its real estate development, failing to credit the author or pay remuneration. The Baotou Intermediate People's Court found that the defendant infringed the plaintiff's rights of attribu
case category: criminal_verdict
incident time: 2021
keywords: copyright infringement
keywords: Baotou Fu
keywords: right of attribution
keywords: right to remuneration
keywords: Kang Piyao
keywords: Xincheng Yizhuo Real Estate
keywords: waterscape wall
keywords: Baotou Intermediate People's Court
keywords: unauthorized reproduction
related risks: Content Infringement
citation: Inner Mongolia Press Conference on 2021 Intellectual Property Work and 2022 Key IP Tasks
citation: Enterprise penalized for misusing the centenary emblem of the founding of the CPC | Copyright | Trademark Law | Infringement | Exclusive Rights
updated: 2026-06-18
version: 1

Man Sentenced in Shaoxing for Selling Pirated Music Bundled on USB Drives
type: Case
break id: C0248
stix type: report
summary: The Yulin Police Station of Xinchang County Public Security Bureau, together with the criminal investigation unit, cracked an online copyright infringement case, arresting three suspects surnamed Wang, Qiu, and Yao. Over 4,000 infringed music tracks were seized, involving more than 210,000 yuan. The suspects sold unauthorized songs bundled on USB drives, violating the copyright holders' rights.
case category: criminal_verdict
incident time: 2022-10
keywords: USB drive music bundling
keywords: music copyright infringement
keywords: criminal copyright case
keywords: online piracy
keywords: unauthorized distribution
keywords: Xinchang County
keywords: Shaoxing
keywords: digital piracy
related risks: Content Infringement
related threat actors: Piracy/Infringement Gangs
citation: Man in Shaoxing, Zhejiang convicted for suspected infringement by bundling and selling songs - Maoming Municipal People's Government Portal
updated: 2026-06-18
version: 1

Zhang and Sun Operate Aggregation Apps Using Pirate Links to Disseminate Audiovisual Works
type: Case
break id: C0249
stix type: report
summary: A 2025 Supreme People's Procuratorate typical IP protection case reported that from late 2017 to January 2023, Zhang, Sun, and others developed and operated audiovisual aggregation apps including 'Yingshi Daquan Pure Edition' and 'Jinri Yingshi'. Without authorization from right holders, they disseminated more than 83,000 audiovisual works through pirate links and download-upload methods, and earned more than 392 million yuan in advertising promotion fees. On June 14, 2024, Wuxi Xinwu District People's Court convicted Zhang and Sun of copyright infringement, sentencing Zhang to five years and six months in prison with a 20 million yuan fine and Sun to three years in prison with a 4 million yuan fine.
case category: criminal_verdict
incident time: 2024-06
keywords: Supreme People's Procuratorate
keywords: intellectual property protection
keywords: typical cases
keywords: pirate links
keywords: copyright infringement crime
keywords: right to network dissemination of information
keywords: digital copyright
keywords: criminal prosecution
related risks: Content Infringement
related threat actors: Piracy/Infringement Gangs
citation: Typical Intellectual Property Protection Cases Handled by Procuratorial Organs
updated: 2026-06-18
version: 1

China's First Cross-Platform E-Commerce Image Theft Penalty
type: Case
break id: C0250
stix type: report
summary: In April 2021, market regulators in Changshu, Jiangsu Province penalized an online store for using software to clone product images, quality inspection reports, detail pages, and packaging designs from a competitor's storefront. Some pages showed over 90% similarity and even copied trademarks. The act constituted passing-off and confusion under the Anti-Unfair Competition Law, resulting in a 50,00
case category: administrative_enforcement
incident time: 2021-04
keywords: e-commerce image theft
keywords: cross-platform image theft
keywords: one-click store cloning
keywords: passing-off confusion
keywords: Anti-Unfair Competition Law
keywords: Changshu market regulation
keywords: online store image theft
keywords: product image misappropriation
keywords: quality inspection report copying
keywords: first case
related risks: Content Theft
related threat actors: Piracy/Infringement Gangs
citation: Protecting Intellectual Property Can Foster More Hit Products
updated: 2026-06-25
version: 1

Web Novel Scraping Case: Li Sentenced for Writing Crawler Scripts to Steal Novels
type: Case
break id: C0251
stix type: report
summary: In February 2025, a 27-year-old software test engineer surnamed Li in Taicang, Jiangsu Province, exploited his technical skills to write crawler scripts that illegally scraped original content from a web novel platform and provided it to readers for free. Together with his accomplice Lu, he also engaged in traffic diversion and promotion. This act severely infringed upon the rights of original aut
case category: criminal_verdict
incident time: 2025-02
keywords: web novel piracy
keywords: crawler script
keywords: copyright infringement conviction
keywords: illegal scraping
keywords: content theft
keywords: traffic diversion promotion
keywords: suspended sentence
keywords: Taicang
related risks: Content Theft
related attack tools: Web Scraping Tools
related threat actors: Piracy/Infringement Gangs
citation: Free Member-Only Reading Mini Programs Became a Copyright Infringement Black Hole
citation: Online novel piracy case reveals the boundary between law and morality: Li, Lu, and their actions
updated: 2026-06-18
version: 1

Woman's Photos Stolen and Maliciously Edited into Pornographic Group, Photo Thief Receives Administrative Penalty
type: Case
break id: C0252
stix type: report
summary: In January 2022, it was reported that multiple women's photos were stolen and posted to overseas chat groups, with some maliciously edited into nude images for others' gratification. One victim and three others reported the case to the police, and the perpetrator was ultimately given an administrative penalty for defamation and photo theft. Another woman whose photos were long-term stolen and pair
case category: administrative_enforcement
incident time: 2022-01
keywords: malicious photo editing
keywords: photo theft
keywords: pornographic chat groups
keywords: defamation penalty
keywords: administrative penalty
keywords: portrait rights violation
keywords: online harassment
keywords: overseas chat groups
keywords: Fuzhou Yishan Police Station
related risks: Content Theft
related attack tools: AI Deepfake Tools
related threat actors: Malicious Users
citation: Woman's photo stolen and used for nude images in pornographic group; lawyer says identifying suspect is difficult
updated: 2026-06-18
version: 1

SPP Releases Typical Case Involving Image Theft Infringement
type: Case
break id: C0253
stix type: report
summary: On April 22, 2026, the Supreme People's Procuratorate released typical intellectual property protection cases, including criminal acts of image theft infringement. In the 'Fu XX and 3 Others False Litigation Supervision Case,' offenders created vector graphics by tracing and matting, forged certificates to fraudulently obtain copyright registration, knowingly purchased counterfeit works, and fabri
case category: criminal_verdict
incident time: 2026-04
keywords: image theft infringement
keywords: vector graphic forgery
keywords: false litigation
keywords: copyright registration fraud
keywords: procuratorial supervision
keywords: fabricated infringement
keywords: SPP typical case
keywords: intellectual property crime
related risks: Content Theft
related threat actors: Piracy/Infringement Gangs
citation: Typical Intellectual Property Protection Cases by Procuratorial Organs
citation: Supreme People's Procuratorate releases typical cases involving image theft, infringement, and manufacturing and selling counterfeit perfumes - Xinhua
updated: 2026-06-18
version: 1

Mini-program piracy operation leads to criminal copyright infringement convictions for two individuals
type: Case
break id: C0254
stix type: report
summary: In February 2025, the Taicang Municipal Procuratorate in Jiangsu prosecuted an online content theft case. Defendants Li and accomplice Lu used mini-programs and technical means to illegally reproduce and distribute original works from online novel platforms. The court convicted Li of copyright infringement, sentencing him to three years in prison with a four-year probation period and a fine of 100
case category: criminal_verdict
incident time: 2025-02
keywords: mini-program
keywords: content theft
keywords: copyright infringement crime
keywords: online novels
keywords: illegal reproduction
keywords: distribution
keywords: Taicang Procuratorate
keywords: criminal verdict
related risks: Content Theft
related threat actors: Piracy/Infringement Gangs
citation: Two individuals convicted of copyright infringement for running a 'piracy' business via mini-programs - Jinniu District...
updated: 2026-06-18
version: 1

Beijing's First AI Copyright Infringement Criminal Case Sentenced
type: Case
break id: C0255
stix type: report
summary: On June 13, 2025, Beijing's first criminal case involving AI-generated models infringing copyright was sentenced. The Tongzhou District Procuratorate accused four individuals, including Luo and Yao, of using AI software to alter original online works and produce over 3,000 puzzle products for sale. The case resonated with many original authors, reflecting a common mentality among image-theft merch
case category: criminal_verdict
incident time: 2025-06
keywords: AI-generated content infringement
keywords: copyright criminal case
keywords: puzzle product sales
keywords: original work theft
keywords: Tongzhou District Procuratorate
keywords: online piracy
keywords: AI altered works
related risks: Content Theft
related attack tools: AI Deepfake Tools
related threat actors: Piracy/Infringement Gangs
related threat actors: AI Tool Abusers
citation: Beijing's First Criminal AI Copyright Infringement Case Sentenced
citation: Beijing's first criminal case involving AI-based copyright infringement adjudicated - CNR News
updated: 2026-06-18
version: 1

Beijing Internet Court Reports on Short-Video Copyright Case Handling
type: Case
break id: C0256
stix type: report
summary: On April 20, 2022, the Beijing Internet Court held a press briefing on its handling of short-video copyright cases. The official notice reported that from September 9, 2018 to February 28, 2022, the court accepted 2,812 short-video copyright disputes and concluded 2,026 of them; the alleged infringement forms were diverse, with clipping and reposting being common. The briefing also released ten typical cases covering unauthorized song uploads, background music use, long-video clip editing, and using literary works as subtitles in short videos.
case category: news_report
incident time: 2022-04
keywords: short video copyright infringement
keywords: video clipping and reposting
keywords: Beijing Internet Court
keywords: copyright typical cases
keywords: reproduction infringement
keywords: content misappropriation
keywords: derivative works
keywords: video copyright protection
related risks: Content Theft
related threat actors: Piracy/Infringement Gangs
citation: Internet Court Reports on Short-Video Copyright Case Handling
updated: 2026-06-18
version: 1

Online Streamer Sentenced for Using Insults to Drive Traffic
type: Case
break id: C0257
stix type: report
summary: A man surnamed Ji from Nantong, Jiangsu, posted numerous videos using local dialect to insult others in order to attract attention and monetize traffic. His actions, which included provoking influencers and malicious defamation, constituted the crime of insult. He was sentenced to eight months in prison with a one-year suspended term and prohibited from engaging in online livestreaming during the
case category: criminal_verdict
incident time: 2024-06
keywords: insult crime
keywords: malicious traffic generation
keywords: online defamation
keywords: traffic monetization
keywords: dialect insults
keywords: livestream ban
keywords: suspended sentence
keywords: Haimen District People's Court
related risks: Malicious Traffic Diversion
citation: Work Report of the People's Procuratorate of Haimen District, Nantong
citation: Rule of Law Online | Mistaken for 'traffic code': Online influencer sentenced for using 'insults' to attract viewers...
updated: 2026-06-18
version: 1

Shanghai Police Crack Down on Illegal Traffic Diversion in Cyber Underground Markets
type: Case
break id: C0258
stix type: report
summary: In December 2024, the Shanghai Municipal Public Security Bureau reported the results of the Clean Net 2024 and Lijian special operations. Police said cyber underground markets, hacking, personal information infringement, and online rumors were prominent categories. Targeting crimes such as traffic hijacking, illegal acquisition of online accounts, and illegal online traffic diversion and promotion, Shanghai police solved more than 2,500 cyber underground market cases and investigated more than 300 illegal apps and websites during the year.
case category: criminal_verdict
incident time: 2024-12
keywords: illegal traffic diversion
keywords: underground industry
keywords: illegal promotion
keywords: cyber underground market
keywords: Clean Net 2024
keywords: illegal app
keywords: illegal website
keywords: Shanghai police
keywords: cybercrime
related risks: Malicious Traffic Diversion
related risks: Malicious User Poaching
citation: Shanghai police take multiple measures to maintain a clean and orderly online environment
updated: 2026-06-26
version: 1

Hackers Divert Platform Users to Unlicensed Medical Aesthetic Clinics via Illegal Traffic Scheme
type: Case
break id: C0259
stix type: report
summary: Police in Changzhou, Jiangsu Province dismantled a criminal gang that used hacking techniques to illegally divert online traffic. The group cracked platform APIs to scrape user data from individuals interested in medical aesthetics, then impersonated consumers in private chats to fabricate positive experiences and funnel victims to unlicensed offline clinics. They illegally obtained over 50 millio
case category: criminal_verdict
incident time: 2022-03
keywords: hacking attack
keywords: data scraping
keywords: malicious traffic diversion
keywords: medical aesthetics clinics
keywords: Xiaohongshu
keywords: personal information leak
keywords: black market industry
keywords: API cracking
keywords: Changzhou police
keywords: illegal acquisition of citizen information
related risks: Malicious Traffic Diversion
related attack tools: Web Scraping Tools
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Scraping Gangs
related threat actors: Criminal Organizations
citation: Cutting Off the Profit Chain of Illegal Data Acquisition
citation: Changzhou: Cyber hackers attack multiple internet platforms, diverting user traffic to unlicensed medical aesthetics clinics
updated: 2026-06-18
version: 1

Sichuan Liangshan Police Crack Down on Short-Video-Driven Counterfeit Local Specialty Scam
type: Case
break id: C0260
stix type: report
summary: Police in Liangshan, Sichuan, dismantled an online fraud ring that staged poverty-themed short videos to fabricate tragic stories about the region, attracting traffic for live-stream sales of counterfeit local specialties. The group hired online water armies to inflate engagement, with the amount involved exceeding 20 million yuan, and over 50 suspects were taken into custody.
case category: criminal_verdict
incident time: 2023-09
keywords: Liangshan police
keywords: short video traffic diversion
keywords: counterfeit local specialties
keywords: live-stream selling
keywords: staged poverty clips
keywords: online water army
keywords: Liangshan Prefecture Public Security Bureau
keywords: false advertising
related risks: Malicious Traffic Diversion
related threat actors: Astroturfing Networks
related threat actors: Telecom Fraud Gangs
citation: Liangshan police in Sichuan bust online fraud ring: Using short videos to drive sales of counterfeit local specialties, involving...
citation: Sichuan reports first series of influencer livestreaming cases involving counterfeit Daliangshan products
updated: 2026-06-18
version: 1

Fujian Police Report Multiple Telecom Fraud Traffic-Funneling Rings Dismantled
type: Case
break id: C0261
stix type: report
summary: The Fujian Provincial Public Security Department reported that police in Fuding, Shishi, and other areas cracked down on dens providing traffic-funneling services for romance scams, online gambling, and similar criminal groups, dismantling 15 dens and arresting 50 suspects. Fuding police destroyed a fraud-related den that used short-video apps to funnel followers to upstream actors connected with overseas fraud groups, while Shishi police arrested two suspects for allegedly assisting information network crime through front-end traffic diversion.
case category: administrative_enforcement
incident time: 2021-03
keywords: telecom fraud gang
keywords: follower funneling
keywords: malicious traffic diversion
keywords: Fujian police
keywords: short-video apps
keywords: assisting information network crime
keywords: Fuding police
keywords: Shishi police
keywords: fraud den
related risks: Malicious Traffic Diversion
related attack tools: Infostealers
related threat actors: Telecom Fraud Gangs
citation: Severe punishment for funneling followers to fraudsters
updated: 2026-06-18
version: 1

Individuals Posing as Delivery Riders to Stage Sob Stories for Traffic Fined
type: Case
break id: C0262
stix type: report
summary: In Qinzhou, Guangxi, Wang, a former delivery worker, conspired with team members Huang and Liang to stage and post fake videos of 'rider-customer quarrels' across multiple platforms to attract followers and drive sales. In Taizhou, Jiangsu, Zhang fabricated salary slips using Excel and filmed false videos under the pretext of 'low rider pay and platform deductions,' with a single video reaching up
case category: administrative_enforcement
incident time: 2024-11
keywords: fake delivery rider
keywords: staged sob story
keywords: fabricated video traffic
keywords: malicious engagement farming
keywords: Qinzhou Public Security Bureau
keywords: Taizhou Hailing Public Security Bureau
keywords: administrative penalty
keywords: short video platform manipulation
related risks: Malicious Traffic Diversion
related threat actors: Astroturfing Networks
citation: Qinzhou Police Administratively Punish Four People for Staged Fake Delivery Rider Videos
citation: Four individuals face administrative penalties for posing as delivery drivers and staging pitiful videos to generate traffic | Customers | Investigation | Short Videos
updated: 2026-06-18
version: 1

Staged ‘Testing Strangers’ Honesty’ with a 280,000 Yuan LV Bag Leads to Penalty for Fake Content
type: Case
break id: C0263
stix type: report
summary: Liu Mouming, who runs a luxury goods buy-back shop in Jing’an District, Shanghai, scripted and hired actors to film a fake video claiming to ‘test strangers’ honesty with a 280,000 yuan LV bag’ in order to drive traffic. Police investigation determined the content was maliciously staged for traffic generation, and the individuals involved were penalized in accordance with the law.
case category: administrative_enforcement
incident time: 2025-08
keywords: staged video
keywords: traffic generation
keywords: testing strangers' honesty
keywords: LV bag
keywords: self-media
keywords: Shanghai Jing'an
keywords: police penalty
related risks: Malicious Traffic Diversion
related threat actors: Astroturfing Networks
citation: MPS Releases Ten Typical Cases in the Crackdown on Online Rumors
citation: Using a 280,000 yuan LV bag to 'test passersby's honesty' for traffic: Self-media staged fake video penalized | Shanghai | Police...
updated: 2026-06-18
version: 1

Netizen Stitches Video to Fabricate “Guangzhou Train Station Flooded” Rumor for Traffic and Follower Growth, Penalized
type: Case
break id: C0264
stix type: report
summary: A netizen in Guangzhou, approximately 30 years old, combined past disaster footage with current typhoon imagery during a storm to fabricate and publish rumors claiming a high-speed rail station was flooded and 800,000 people were in despair. The content spread widely. The individual was administratively penalized by public security authorities for rumor-mongering aimed at boosting online traffic a
case category: administrative_enforcement
incident time: 2025-12
keywords: Guangzhou train station
keywords: flooded rumor
keywords: stitched video
keywords: fabricated disaster
keywords: typhoon footage
keywords: viral misinformation
keywords: public security penalty
keywords: online rumor
keywords: traffic-driven fabrication
related risks: Malicious Traffic Diversion
related threat actors: Astroturfing Networks
citation: Netizen splices video to spread rumor that 'Guangzhou Railway Station is flooded' to attract followers and boost traffic; penalized | High-speed Rail Station...
citation: Guangzhou police report Net Clean 2025 cases including the fabricated Guangzhou Railway Station flooding rumor
updated: 2026-06-18
version: 1

Sales Manager Poached Clients for 1.38 Million Yuan, Multiple Suspects Arrested for Trade Secret Infringement
type: Case
break id: C0265
stix type: report
summary: A sales manager surnamed Chen in Liyang, Changzhou, secretly established a competing company during his employment and used his access to business information to poach clients with lower pricing. The scheme was exposed when a contract was mistakenly sent to the company group chat. Audits revealed illegal profits of over 1.38 million yuan. Chen and another suspect were arrested, while a third indiv
case category: criminal_verdict
incident time: 2022-03
keywords: trade secret infringement
keywords: employee poaching clients
keywords: competing company
keywords: client list theft
keywords: criminal coercive measures
keywords: Changzhou Liyang
keywords: illegal profit
keywords: sales manager misconduct
related risks: Malicious User Poaching
related threat actors: Malicious Insiders
citation: Sales Manager Was an Insider: Liyang Police Crack a Trade Secret Infringement Case
citation: Poaching company's 'cornerstone' yields 1.38 million yuan; multiple individuals suspected of trade secret infringement arrested
updated: 2026-06-18
version: 1

The Last 100-Meter Logistics Brawl: Cainiao Stations Lose Clients to Poaching
type: Case
break id: C0266
stix type: report
summary: A 2018 Jiemian News report reveals that in the last-mile delivery segment, third-party pickup points like Cainiao Stations face poaching by competitors. It notes that courier companies slash shipping prices to grab customers, fueling cutthroat competition, while some startups form alliances with courier firms to share benefits, lower costs, and boost revenue, effectively luring clients and busines
case category: news_report
incident time: 2018-01
keywords: Cainiao Station
keywords: last-mile logistics
keywords: last 100 meters
keywords: parcel pickup
keywords: customer poaching
keywords: STO Express
keywords: Feng Station
keywords: Douni Kaixin
keywords: cutthroat competition
related risks: Malicious User Poaching
related threat actors: Competitors
citation: Last-mile delivery chaos in the final 100 meters: Cainiao Station undermined | Express | Heike | Logistics
updated: 2026-06-18
version: 1

Wulingyuan Visitor Center Project Undermined: Toilet Left Exposed After Wall Demolished
type: Case
break id: C0267
stix type: report
summary: In August 2016, Rednet reported that a developer used an excavator to demolish walls and toilet facilities at the under-construction Wulingyuan Gateway Visitor Center in Zhangjiajie, Hunan. The neighboring commercial project 'Wuling Xintiandi' allegedly carried out the nighttime destruction to remove visual obstructions and boost its own shop sales, in what the project team described as a maliciou
case category: news_report
incident time: 2016-08
keywords: Wulingyuan
keywords: visitor center
keywords: Wuling Xintiandi
keywords: wall demolition
keywords: excavator
keywords: malicious destruction
keywords: sightline obstruction
keywords: Zhangjiajie
keywords: physical construction
keywords: developer dispute
related risks: Malicious User Poaching
related threat actors: Competitors
citation: Wulingyuan Tourist Service Center project suffers 'poaching'; toilets exposed to the outside - Hunan Channel
updated: 2026-06-18
version: 1

WeChat Enforcement Notice on Personal Accounts Promoting Prohibited Goods
type: Case
break id: C0268
stix type: report
summary: WeChat Security Center announced a crackdown on personal accounts posting marketing content for prohibited items, including tobacco, e-cigarettes, aphrodisiacs, and illicit health supplements. Since January 2023, a total of 7,236 accounts and 1,871 group chats have received graduated penalties such as feature restrictions or account bans for promoting prohibited goods.
case category: security_incident
incident time: 2023-05
keywords: WeChat Security Center
keywords: prohibited goods marketing
keywords: tobacco
keywords: e-cigarettes
keywords: aphrodisiacs
keywords: illicit health supplements
keywords: WeChat personal accounts
keywords: graduated penalties
keywords: WeChat group chats
related risks: Prohibited and Illegal Products
citation: Notice on Governance of WeChat Personal Accounts Publishing Prohibited-Goods Marketing Information
citation: Some already sentenced! Official notice: Do not post these items on WeChat Moments → | Illegal | Prohibited Goods | Security...
updated: 2026-06-18
version: 1

SPP Releases Typical Case on Manufacturing and Selling Counterfeit Goods: Pan et al. Producing and Selling Substandard Fire Extinguishers
type: Case
break id: C0269
stix type: report
summary: From March to July 2023, Pan and others borrowed another party's 3C certificate to organize the production of 'Sansheng' brand dry powder fire extinguishers with substandard wall thickness and unqualified extinguishing agent. They sold over 480,000 units to a Nanjing-based technology company, with receivables totaling over RMB 11.11 million. Testing confirmed that key indicators such as main agent
case category: criminal_verdict
incident time: 2025-03
keywords: SPP typical case
keywords: substandard fire extinguisher
keywords: 3C certification fraud
keywords: dry powder extinguisher
keywords: Pan XX
keywords: Sansheng brand
keywords: counterfeit firefighting equipment
keywords: product quality crime
related risks: Prohibited and Illegal Products
related threat actors: Malicious Merchants
citation: SPP Releases Typical Procuratorial Cases on Punishing Counterfeit and Shoddy Goods Crimes
citation: Supreme People's Procuratorate releases typical cases of procuratorial organs lawfully punishing crimes of manufacturing and selling counterfeit and shoddy goods
updated: 2026-06-18
version: 1

SPP Releases Typical Case of Manufacturing and Selling Counterfeit Goods: He Mouzhong et al. Producing and Selling Substandard Electrical Wires
type: Case
break id: C0270
stix type: report
summary: From 2020 until the case was uncovered, He Mouzhong manufactured and sold PVC-insulated electrical wires that failed to meet national standards without obtaining the mandatory China Compulsory Certification (3C). He Mouli registered 21 online stores to sell the wires to locations including Ganzhou, Jiangxi, with total sales exceeding RMB 23 million. Testing confirmed the wires did not conform to n
case category: criminal_verdict
incident time: 2026-03
keywords: SPP
keywords: manufacturing counterfeit goods
keywords: typical case
keywords: He Mouzhong
keywords: substandard electrical wires
keywords: 3C certification
keywords: non-conforming products
keywords: PVC-insulated wire
keywords: online storefronts
keywords: selling counterfeit products crime
related risks: Prohibited and Illegal Products
related threat actors: Malicious Merchants
citation: Typical Procuratorial Cases on Punishing Counterfeit and Shoddy Goods Crimes
citation: Supreme People's Procuratorate announces six typical cases of manufacturing and selling counterfeit and shoddy goods: Adding new chemical derivatives...
updated: 2026-06-18
version: 1

Fenyang Tianlang E-Commerce Co., Ltd. Fined for Online Product Descriptions Not Matching Actual Goods
type: Case
break id: C0271
stix type: report
summary: In February 2020, the Fenyang Market Supervision Administration penalized Fenyang Tianlang E-Commerce Co., Ltd. for selling products online with descriptions that did not match the actual goods, violating Article 20 of the Consumer Rights Protection Law. The company had its illegal gains of 200 yuan confiscated and was fined 1,800 yuan.
case category: administrative_enforcement
incident time: 2020-02
keywords: online product description mismatch
keywords: Consumer Rights Protection Law Article 20
keywords: Fenyang Tianlang E-Commerce
keywords: Fenyang Market Supervision Administration
keywords: false advertising e-commerce
keywords: administrative penalty online sales
keywords: confiscation of illegal gains
keywords: e-commerce consumer protection China
related risks: Prohibited and Illegal Products
citation: Fenyang Market Regulation Administration Notice on Illegal Cases During COVID-19 Prevention and Control (Issue 10)
citation: Fenyang Market Supervision Administration Reports on Illegal Cases During Epidemic Prevention and Control
updated: 2026-06-18
version: 1

Huzhou Police Crack Down on Counterfeit Apparel Sold via Douyin Livestreams
type: Case
break id: C0272
stix type: report
summary: The Deqing County Public Security Bureau discovered that suspects were selling counterfeit 'Ainuo Siyashi' brand clothing on a livestreaming platform without authorization, with styles, trademarks, and hangtags identical to authentic products from a Zhejiang-based apparel company. Police arrested 10 suspects, dismantled four sales and storage sites for counterfeit trademarked goods, seized over 15
case category: criminal_verdict
incident time: 2024-07
keywords: Douyin livestream
keywords: counterfeit trademark
keywords: apparel
keywords: selling counterfeits
keywords: Deqing police
keywords: intellectual property crime
keywords: livestream e-commerce
keywords: Ai Mou Shi
related risks: Prohibited and Illegal Products
related threat actors: Piracy/Infringement Gangs
citation: Brand Clothing Sold via Livestream for 200 Yuan? Police Crack Livestream Counterfeit Sales Case Worth Over 5 Million Yuan
citation: Huzhou Exposes Typical Cases of Illegal Online Livestream Marketing
updated: 2026-06-18
version: 1

Jiangsu Taicang Police Use Big Data Models to Catch Web Crawlers in Piracy Cases
type: Case
break id: C0273
stix type: report
summary: In July 2023, a well-known reading platform's original novels were illegally crawled and distributed for profit, causing corporate losses exceeding 10 million yuan. Taicang police filed a case and arrested 25 people across 5 provinces and 9 cities, shutting down over 10 websites and public accounts and seizing more than 200,000 pirated novel chapters. In March 2025, paid hit series on a video plat
case category: criminal_verdict
incident time: 2023-07
keywords: web crawler
keywords: pirated novels
keywords: pirated films
keywords: big data model
keywords: Taicang police
keywords: illegal crawling
keywords: technical piracy
keywords: copyright infringement
keywords: cyber black market
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
related threat actors: Piracy/Infringement Gangs
citation: Ministry of Public Security: Taicang Builds Joint Intellectual Property Protection System
updated: 2026-06-18
version: 1

Beijing Chaoyang Police Bust Internet Company Using Crawlers to Steal Livestream Data, 23 Detained
type: Case
break id: C0274
stix type: report
summary: In October 2021, Chaoyang police cracked a case of illegally obtaining computer information system data. A sudden surge in traffic was detected in a shopping website's livestream rooms. Investigation revealed that a criminal gang led by Wang Yiyi, Yang Yuning, and Yang used crawler software to illegally steal livestream data and sold it online at high prices for profit. The gang registered a compa
case category: criminal_verdict
incident time: 2021-10
keywords: web crawler
keywords: livestream data theft
keywords: illegal data acquisition
keywords: traffic surge
keywords: Chaoyang police
keywords: criminal coercive measures
keywords: shopping website
keywords: data scraping
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
citation: Chaoyang Cyber Police Dismantle 23-Person Ring Stealing Livestream Data with Crawlers
citation: Busted! Beijing Chaoyang Internet Company Raided by Police, 23 Taken Away... (Crawling is Risky, Be Cautious)
updated: 2026-06-18
version: 1

Two Defendants Sentenced for Illegally Scraping E-Commerce Data Using Crawler Technology
type: Case
break id: C0275
stix type: report
summary: In November 2024, the Shuangliu District People's Court in Chengdu, Sichuan Province, concluded a case involving the use of crawler software to illegally scrape e-commerce data. The defendants were convicted of illegally controlling computer information systems for using crawler technology to unlawfully obtain data from e-commerce platforms. They received prison sentences ranging from six to eight
case category: criminal_verdict
incident time: 2024-11
keywords: web crawler
keywords: illegal data scraping
keywords: e-commerce data
keywords: illegal control of computer information systems
keywords: Shuangliu District People's Court
keywords: crawler technology
keywords: computer crime
keywords: data theft
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
citation: Using 'Crawler' Technology to Illegally Scrape E-commerce Data: Two Defendants Sentenced - China Court Network
citation: Using crawler technology to illegally scrape e-commerce data: two defendants sentenced
updated: 2026-06-18
version: 1

Crawler Criminalization Case: Shanghai Company Convicted for Bypassing Anti-Crawling Measures to Scrape Public Data
type: Case
break id: C0276
stix type: report
summary: In one of the People's Court's Top Ten Criminal Cases of 2019, Shanghai Mou Pin Network Technology Co., Ltd. was convicted of illegally obtaining computer information system data. The case established that even when scraping publicly available data, using technical means to circumvent anti-crawling protections can constitute a criminal offense, significantly impacting the determination of criminal
case category: criminal_verdict
incident time: 2019
keywords: web crawler
keywords: anti-crawling measures
keywords: public data scraping
keywords: illegally obtaining computer information system data
keywords: crawler criminalization
keywords: Shanghai Mou Pin Network Technology
keywords: data crawling
keywords: bypassing anti-crawl
keywords: criminal compliance
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
citation: China's First Criminal Case on Crawler-Based Intrusion into Computer Information Systems
citation: Sun Yu: On Criminal Compliance of Web Crawlers | Law Science Magazine 202201 | Criminal Law | Copyright - NetEase Subscription
updated: 2026-06-18
version: 1

Zhejiang "StarChain Data Case": AI Crawlers Illegally Harvested 530 Million Citizen Records for Resale
type: Case
break id: C0277
stix type: report
summary: In 2023, Zhejiang police uncovered the "StarChain Data Case," where a criminal syndicate used AI crawler technology to illegally harvest 530 million citizen information records and resold them through outbound call robots at 0.3 yuan per record. The case directly violated Article 10 of the Personal Information Protection Law and Article 253a of the Criminal Law. A 2024 Supreme People's Court typic
case category: criminal_verdict
incident time: 2023
keywords: StarChain Data Case
keywords: AI crawler
keywords: citizen personal information
keywords: illegal data harvesting
keywords: outbound call robot
keywords: data black market
keywords: Personal Information Protection Law
keywords: Zhejiang police
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related attack tools: Malicious AI Applications
related attack tools: LLM Automated Attack Tools
related threat actors: Scraping Gangs
related threat actors: Criminal Organizations
related threat actors: Data Broker
citation: The Logic Behind Customer Acquisition Systems and Outbound AI Robots | 315 Gala | Outbound Calls | Robots | Crawlers |...
citation: Artificial Intelligence Security Research Report
updated: 2026-06-18
version: 1

Sentencing Issues in Web Crawler Crimes: Analysis of 88 Sample Cases
type: Case
break id: C0278
stix type: report
summary: In January 2023, China Court Network published an article analyzing 88 sample cases of web crawler crimes, finding that judicial practice tends to impose relatively lenient sentences. The reason is that the methods of web crawling are not given due weight as sentencing factors alongside profit-seeking motives, and the amount of money involved plays a key role in sentencing while the social harm of
case category: academic_research
incident time: 2023-01
keywords: web crawler crime sentencing
keywords: crawler criminal case analysis
keywords: China Court Network
keywords: judicial practice crawler
keywords: illegal crawler use
keywords: social harm of crawling
keywords: criminal penalty crawler
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
citation: Sentencing Issues and Countermeasures for Web Crawler Crimes - China Court Network
updated: 2026-06-18
version: 1

Web Scraping Overreach Cannot Escape Legal Boundaries: Supreme People's Court Clarifies Criminal Prosecution for Illegal Data Scraping
type: Case
break id: C0279
stix type: report
summary: In March 2025, the Supreme People's Court emphasized that while web scraping technology serves as a cornerstone for search engines, its illegal use—even when generating massive traffic and profits—cannot evade legal consequences. The article states that technology must operate within the legal framework, firmly uphold legal boundaries, and subject illegal data scraping to criminal prosecution, cle
case category: news_report
incident time: 2025-03
keywords: Supreme People's Court
keywords: web scraping
keywords: illegal data scraping
keywords: criminal prosecution
keywords: data security
keywords: legal boundaries
keywords: web crawler
keywords: judicial policy
related risks: Web Scraping Risk
related attack tools: Web Scraping Tools
related threat actors: Scraping Gangs
citation: Crawlers Crossing the Line Cannot Overstep Legal Boundaries - Supreme People's Court of the People's Republic of China
updated: 2026-06-18
version: 1

Huang and Others Illegally Obtained CHSI Academic Credentials for Sale
type: Case
break id: C0280
stix type: report
summary: From August 2021, defendant Huang and accomplices bypassed the CHSI real-name verification system by renting phone numbers to receive verification codes, fabricating ID images, and using dynamic verification videos. They illegally accessed and downloaded MOE electronic academic credential filings to sell for profit, forming a chain of device rental, account registration, fake verification, data ex
case category: criminal_verdict
incident time: 2021-08
keywords: CHSI
keywords: academic credential leak
keywords: infringing citizens' personal information
keywords: fake real-name verification
keywords: data reselling
keywords: student record
keywords: verification code bypass
keywords: Beijing Xicheng District Court
related risks: Data Exfiltration Risk
related risks: Data Breach
related risks: Unauthorized Use of Shared Data
related attack tools: SMS Verification Code Platform
related attack tools: AI Deepfake Tools
related attack tools: Automation Scripts
related threat actors: Data Broker
citation: Supreme People's Court Releases Typical Cases on Punishing Personal Information Crimes and Related Offenses
citation: Frequent Government and Enterprise Data Breach Cases: Multiple Individuals Convicted for Selling Student Records and Academic Credentials for Profit - Tencent News
updated: 2026-06-18
version: 1

A data exfiltration and remote exploitation attack on consumer 3D printers
type: Case
break id: C0281
stix type: report
summary: This research reveals data exfiltration and remote exploitation attacks targeting consumer-grade 3D printers. The study found that the printers store data of printed and in-progress objects on an unauthenticated web server, and flaws in the transport layer security implementation allow sensitive intellectual property data to be remotely stolen and manipulated.
case category: academic_research
incident time: 2016-06
keywords: 3D printer exploitation
keywords: data exfiltration
keywords: remote attack
keywords: MakerBot
keywords: unauthenticated web server
keywords: TLS flaws
keywords: intellectual property theft
keywords: consumer device security
related risks: Data Exfiltration Risk
related attack tools: IoT Firmware and Device Exploitation Tools
related attack tools: Data Export and DLP Bypass Tool
related threat actors: Malicious Hackers
related threat actors: Corporate Spies
citation: A Data Exfiltration and Remote Exploitation Attack on Consumer 3D Printers
updated: 2026-06-18
version: 1

Exploiting Internet of Things Protocols for Malicious Data Exfiltration Activities
type: Case
break id: C0282
stix type: report
summary: This research presents a method that leverages the MQTT protocol to establish tunneling attacks for data exfiltration. Since MQTT is widely used in IoT environments and commonly permitted through firewalls, attackers can encapsulate and exfiltrate sensitive information. The study validates the attack's effectiveness and proposes a machine learning-based detection approach achieving over 95% accura
case category: academic_research
incident time: 2021-07
keywords: MQTT protocol
keywords: IoT security
keywords: data exfiltration
keywords: tunneling attack
keywords: machine learning detection
keywords: malicious data theft
keywords: IoT protocol exploitation
keywords: firewall bypass
related risks: Data Exfiltration Risk
related attack tools: IoT Firmware and Device Exploitation Tools
related attack tools: Industrial and Vehicle Protocol Exploitation Tools
related attack tools: Data Export and DLP Bypass Tool
related threat actors: Industrial and Connected Vehicle Attackers
citation: Exploiting Internet of Things Protocols for Malicious Data Exfiltration Activities
updated: 2026-06-18
version: 1

Frequent Data Breach Incidents: Entities Involved Span Daily Life and Production, Maximum Fine of 1 Million Yuan
type: Case
break id: C0283
stix type: report
summary: In August 2023, multiple enterprises were administratively penalized for failing to fulfill data security protection obligations, leading to data breaches across sectors such as technology, education, and healthcare. A technology company was fined 1 million yuan for leaking sensitive business data collected by government agencies, and its project supervisor was fined 80,000 yuan.
case category: administrative_enforcement
incident time: 2023-08
keywords: data security protection obligations
keywords: data breach
keywords: administrative penalty
keywords: technology company
keywords: government agency data
keywords: 1 million yuan fine
keywords: project supervisor
keywords: sensitive business data
keywords: failure to fulfill security obligations
related risks: Data Exfiltration Risk
citation: Zhejiang Cyber Police Fine an Entity RMB 1 Million Under the Data Security Law
citation: Frequent Data Breach Cases: Entities Involved Often Related to Daily Production and Life, Maximum Fine of 1 Million Yuan - Oriental Fortune...
updated: 2026-06-18
version: 1

Equifax Fined $700 Million for Massive Data Breach
type: Case
break id: C0284
stix type: report
summary: In 2017, U.S. credit reporting agency Equifax suffered a massive data breach exposing the Social Security numbers and other personal information of approximately 143 million consumers. In July 2019, Equifax agreed to pay roughly $700 million to settle with the U.S. Federal Trade Commission.
case category: administrative_enforcement
incident time: 2019-07
keywords: Equifax
keywords: data breach
keywords: credit reporting agency
keywords: FTC settlement
keywords: Social Security numbers
keywords: consumer information
keywords: massive exposure
related risks: Data Exfiltration Risk
related risks: Data Breach
citation: US Credit Giant Equifax Fined $700 Million for Massive Data Breach - Sina Mobile
citation: FTC: Equifax Data Breach Settlement
updated: 2026-06-18
version: 1

Acer Suffers Breach: 160GB of Sensitive Data Leaked in Hacker Attack
type: Case
break id: C0285
stix type: report
summary: In mid-February 2023, Taiwan-based tech firm Acer was hit by a cyberattack. A hacker using the alias 'Kernelware' claimed to have exfiltrated 160GB of sensitive data, encompassing 655 directories and 2,869 files. The stolen information includes internal corporate and user records, leaked from internal systems through unauthorized access.
case category: security_incident
incident time: 2024-06
keywords: Acer
keywords: Kernelware
keywords: data exfiltration
keywords: 160GB leak
keywords: internal data breach
keywords: hacker intrusion
keywords: sensitive records
keywords: Taiwan tech
related risks: Data Exfiltration Risk
related threat actors: Malicious Hackers
citation: 2023 Data Breach Incident Review | Anyong Information
citation: Acer 2022 Sustainability Report
updated: 2026-06-18
version: 1

Negative Review Triggers SMS Bombing: Malicious Code and Privacy Databases Freely Available
type: Case
break id: C0286
stix type: report
summary: In June 2023, a researcher from Southern Metropolis Daily found that many netizens experienced SMS bombing after leaving negative reviews on e-commerce platforms, receiving hundreds of messages per day. Attackers exploited malicious code to hijack SMS verification login interfaces of multiple legitimate websites, sending a flood of verification code messages to specific phone numbers. Some website
case category: news_report
incident time: 2023-06
keywords: SMS bombing
keywords: verification code bombing
keywords: social engineering database
keywords: doxing
keywords: malicious code
keywords: SMS interface hijacking
keywords: e-commerce platform
keywords: negative review retaliation
related risks: SMS Resource Exhaustion
related risks: Malicious User Harassment
related attack tools: Social Engineering Database
related threat actors: Malicious Users
related threat actors: Professional Negative Reviewers
citation: Bombarded with Texts After a Negative Review? Malicious Code and Privacy Databases Available for Free - Tencent...
updated: 2026-06-18
version: 1

1,000 SMS Bombs Per Minute: Guangxi's First SMS Bombing Case Cracked
type: Case
break id: C0287
stix type: report
summary: In October 2021, police in Laibin, Guangxi, announced the resolution of the region's first SMS bombing case. Suspect Zhuo Moujian acted as an agent for a 'call-you-to-death' SMS bombing service, developing over 450 sub-agents, one of whom launched more than 5 million bombing messages. The illicit operation used crawlers to harvest SMS interfaces from numerous corporate websites and integrated them
case category: criminal_verdict
incident time: 2021-10
keywords: SMS bombing
keywords: call-you-to-death
keywords: crawler harvesting
keywords: SMS interface abuse
keywords: verification code bombing
keywords: Zhuo Moujian
keywords: Guangxi Laibin
keywords: Tencent Security Tianyu
keywords: cyber black market
related risks: SMS Resource Exhaustion
related attack tools: Web Scraping Tools
related threat actors: Criminal Organizations
citation: Guangxi's First SMS Bombing Case Cracked: Thousands of Messages Can Be Sent in One Minute
updated: 2026-06-18
version: 1

Hangzhou Police Crack First Illegal SMS Bombing Software Case, Two Suspects Detained
type: Case
break id: C0288
stix type: report
summary: In June 2016, Hangzhou police cracked the first case of illegally manufacturing and selling SMS bombing software. Suspects Zhong Mouhuang and Zhong Moucheng developed an application that exploited data interface vulnerabilities in SMS verification platforms of certain company websites to send unlimited registration messages to targeted phone numbers. Since January 2016, the two illegally controlle
case category: criminal_verdict
incident time: 2016-06
keywords: SMS bombing
keywords: illegal manufacturing
keywords: Hangzhou police
keywords: Zhong Mouhuang
keywords: Zhong Moucheng
keywords: SMS verification platform
keywords: data interface vulnerability
keywords: malicious SMS consumption
keywords: SMS bombing as a service
keywords: criminal detention
related risks: SMS Resource Exhaustion
related risks: SMS Bombing as a Service
citation: Two Cousins Sentenced for Producing and Selling SMS Bombing Software
citation: Hangzhou Police Crack First Illegal SMS Bombing Software Case, Two Suspects Detained - China News Network
updated: 2026-06-18
version: 1

SMS Bombing Attacks Target Baidu and Nine Other Apps via Exploited Interfaces
type: Case
break id: C0289
stix type: report
summary: In Q2 2021, the MIIT reported that the 12321 Reporting Center received 20,074 complaints about malicious SMS bombing, a 7.3% increase quarter-over-quarter. Due to insufficient cybersecurity protection, the top 10 platforms exploited by attackers using SMS bombing platforms included Kuaishou Technology, Gaotu Techedu, Baidu, Pinduoduo, and ZhongAn Insurance, whose SMS interfaces were abused to send
case category: security_incident
incident time: 2021-09
keywords: SMS bombing
keywords: verification code bombing
keywords: SMS interface exploitation
keywords: 12321 Reporting Center
keywords: MIIT
keywords: Kuaishou Technology
keywords: Gaotu Techedu
keywords: Baidu
keywords: Pinduoduo
keywords: ZhongAn Insurance
related risks: SMS Resource Exhaustion
citation: MIIT Notice on Telecommunications Service Quality, 2021 No. 3
citation: Malicious Attacks Using SMS Bombing Platforms Target Apps Including Baidu | Ministry of Industry and Information Technology...
updated: 2026-06-18
version: 1

Winter Shield: Police Dismantle SMS Bombing Service Chain, Leaving Cybercrime Nowhere to Hide
type: Case
break id: C0290
stix type: report
summary: In December 2025, police in Zoucheng, Shandong, cracked a case involving the provision of tools for intruding into computer information systems, dismantling a long-running cybercriminal gang engaged in SMS bombing services. Five suspects were arrested. Investigations revealed that suspect Li and others, motivated by profit, developed SMS bombing websites and software programs, then sold access rig
case category: criminal_verdict
incident time: 2025-12
keywords: SMS bombing
keywords: intruding into computer information system tools
keywords: cybercriminal gang
keywords: Zoucheng police
keywords: verification code harassment
keywords: Winter Shield operation
keywords: providing intrusion tools offense
keywords: Shandong Zoucheng
keywords: malicious resource consumption
related risks: SMS Resource Exhaustion
related threat actors: Criminal Organizations
citation: Zoucheng Municipal People's Government Work Updates [Winter Protection] Police Cut Off 'SMS Bombing' Service...
updated: 2026-06-18
version: 1

When Verification Codes Became a Harassment Tool: Who Was Behind It?
type: Case
break id: C0291
stix type: report
summary: In May 2023, police in Suining, Sichuan, arrested a suspect surnamed Xiong. Investigations revealed that Xiong modified SMS bombing source code obtained online, hijacked registration interfaces of multiple commercial websites to control their SMS verification platforms, and developed a program called 'Super SMS Bomber' capable of continuously sending verification code messages to a specified phone
case category: criminal_verdict
incident time: 2023-05
keywords: SMS bombing
keywords: verification code harassment
keywords: malicious SMS consumption
keywords: Xiong
keywords: SMS bomber source code
keywords: Super SMS Bomber
keywords: commercial website registration interface
keywords: Suining police Sichuan
related risks: SMS Resource Exhaustion
related attack tools: Bulk Account Registration Tool
related attack tools: Card Vending Platforms
related attack tools: Decompilation Tools
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Malware Developers
related threat actors: Criminal Organizations
citation: Verification Codes Became a Harassment Tool: Who Was Behind It?
citation: Verification Codes Turned into Harassment Tools, Who is Behind It? - The Paper Government Affairs - The Paper
updated: 2026-06-18
version: 1

Fengze Court Hears 'Call You to Death' Software Supply Chain Case
type: Case
break id: C0292
stix type: report
summary: In early September 2021, Quanzhou cybersecurity police found people selling SMS bombing and soft-force debt collection tools, including 'Call You to Death' software, in overseas instant messaging groups. The tools abused legitimate government and enterprise SMS and VoIP interfaces to continuously send text or voice messages to target phone numbers. Police arrested Wang Moubin, Fu Moufeng, Zhang Moujun, and others in October 2021, and the Fengze District People's Court later sentenced seven defendants for providing programs and tools for intruding into or illegally controlling computer information systems.
case category: criminal_verdict
incident time: 2023-08
keywords: Call You to Death
keywords: SMS bombing
keywords: soft-force debt collection
keywords: Wang Moubin
keywords: Fu Moufeng
keywords: Quanzhou cybersecurity
keywords: Fengze Court
keywords: malicious consumption
keywords: VoIP interface abuse
keywords: harassment tools
related risks: SMS Resource Exhaustion
citation: Seven Sentenced for Selling 'Call You to Death' Software
updated: 2026-06-18
version: 1

Shanxi Cyber Police Strike Back at Online Criminal Activities
type: Case
break id: C0293
stix type: report
summary: In the early hours of April 13, 2026, Mr. Wang, a resident of Datong, experienced a sudden barrage of SMS verification codes, with hundreds of messages flooding his phone within minutes and nearly paralyzing the device. This was a remote attack using SMS bombing software, a tactic commonly seen in underground cybercrime. Shanxi cyber police released several typical cases of combating online illega
case category: news_report
incident time: 2026-04
keywords: SMS bombing
keywords: underground cybercrime
keywords: Shanxi cyber police
keywords: Clean Net 2025
keywords: SMS verification code attack
keywords: remote attack
keywords: online illegal activities
keywords: Datong
related risks: SMS Resource Exhaustion
related threat actors: Criminal Organizations
citation: Wherever Cyber 'Black Hands' Reach, Shanxi Cyber Police Strike - Shanxi News Network
updated: 2026-06-18
version: 1

Osmosis Chain Liquidity Pool Drain Vulnerability Incident
type: Case
break id: C0294
stix type: report
summary: A critical vulnerability was discovered in the Cosmos ecosystem DEX Osmosis, allowing anyone to add liquidity to any pool and receive an extra 50% return upon removal, potentially draining all liquidity pools. The team later confirmed the vulnerability, estimated the loss at approximately $5 million, and urgently halted on-chain activity to fix the bug.
case category: security_incident
incident time: 2022-06
keywords: Osmosis DEX exploit
keywords: Cosmos liquidity pool drain
keywords: smart contract vulnerability
keywords: decentralized exchange hack
keywords: Osmosis chain halt
keywords: liquidity pool exploit
keywords: Cosmos ecosystem bug
related risks: Resource Exhaustion Attack
related risks: Token Minting and Deflation Bug
related attack tools: Smart Contract Exploitation Framework
related attack tools: DeFi Attack Scripts
related threat actors: DeFi Protocol Attackers
citation: PA Daily | Alibaba Cloud Launches NFT Solution; PayPal Supports Third-Party Wallet Addresses - Tencent News
citation: Osmosis Updates from the Lab Recap, Osmocon and Exploit Fix
updated: 2026-06-18
version: 1

Domain Hit by DDoS and CC Attacks Leading to Resource Exhaustion
type: Case
break id: C0295
stix type: report
summary: A Tencent Cloud developer community article describes how a domain's business faced DDoS and CC attacks. The DDoS attack used a 'human wave' tactic to saturate server bandwidth, while the CC attack consumed server CPU and connection resources with a flood of seemingly legitimate requests, ultimately causing resource exhaustion and service paralysis. The article provides a full-process protection g
case category: news_report
incident time: 2025-08
keywords: DDoS attack
keywords: CC attack
keywords: domain security
keywords: server resource exhaustion
keywords: bandwidth saturation
keywords: Tencent Cloud
keywords: traffic scrubbing
keywords: protection guide
related risks: Resource Exhaustion Attack
citation: Domain Name Stolen or Attacked? A Complete Protection Guide from Discovery to Resolution...
updated: 2026-06-18
version: 1

Rampart Defense System Against Web Application CPU-Exhaustion Attacks
type: Case
break id: C0296
stix type: report
summary: Research presented at the USENIX Security conference introduces Rampart, a system designed to protect web applications from CPU-exhaustion DoS attacks. Attackers can drain CPU resources on web servers such as WordPress and Drupal by sending computationally intensive requests, leading to denial of service.
case category: academic_research
incident time: 2018
keywords: Rampart
keywords: CPU-exhaustion attack
keywords: web application DoS
keywords: USENIX Security
keywords: WordPress CPU drain
keywords: Drupal resource exhaustion
keywords: computationally intensive requests
keywords: DoS defense
related risks: Resource Exhaustion Attack
citation: Rampart: Protecting Web Applications from CPU-Exhaustion ... - USENIX
updated: 2026-06-18
version: 1

RECUR Attack: Resource Exhaustion via Recursive Entropy-Guided Counterfactual Exploitation and Reflection
type: Case
break id: C0297
stix type: report
summary: Researchers propose the RECUR attack method, which induces excessive reflection in large reasoning models (LRMs) by constructing counterfactual problems, leading to an 11× increase in output length and a 90% drop in throughput, thereby consuming computational resources. This attack reveals inherent resource exhaustion vulnerabilities within the reasoning process itself.
case category: academic_research
keywords: RECUR attack
keywords: recursive entropy-guided
keywords: counterfactual exploitation
keywords: resource exhaustion
keywords: large reasoning models
keywords: LRM
keywords: excessive reflection
keywords: reasoning model vulnerability
keywords: throughput degradation
keywords: adversarial attack
related risks: Resource Exhaustion Attack
citation: RECUR: Resource Exhaustion Attack via Recursive-Entropy Guided ...
updated: 2026-06-18
version: 1

Runtime Detection of CPU-Exhaustion DoS Attacks
type: Case
break id: C0298
stix type: report
summary: This research proposes a detection mechanism for application-layer CPU-exhaustion denial-of-service attacks. Unlike traditional high-volume attacks, these attacks exploit algorithmic or implementation vulnerabilities to consume significant server CPU resources with a small number of carefully crafted requests, and they lack identifiable patterns.
case category: academic_research
keywords: application-layer DoS
keywords: CPU exhaustion
keywords: runtime detection
keywords: resource exhaustion
keywords: algorithmic complexity vulnerability
keywords: low-rate attack
keywords: server protection
related risks: Resource Exhaustion Attack
citation: Coda: Runtime Detection of Application-Layer CPU-Exhaustion DoS Attacks ...
updated: 2026-06-18
version: 1

Adversarial Defense Against Bandwidth Depletion DDoS Attacks
type: Case
break id: C0299
stix type: report
summary: This study investigates defense mechanisms against bandwidth depletion DDoS attacks using adversarial methods. Bandwidth depletion attacks flood the victim's network with massive unwanted traffic, exhausting network bandwidth resources and preventing legitimate traffic from reaching the target system.
case category: academic_research
keywords: bandwidth depletion
keywords: DDoS attack
keywords: adversarial defense
keywords: network flooding
keywords: resource exhaustion
keywords: IEEE
keywords: denial-of-service attack
keywords: traffic scrubbing
related risks: Resource Exhaustion Attack
citation: Research on Counter Bandwidth Depletion DDoS Attacks Based on ...
updated: 2026-06-18
version: 1

KillNet Group Leverages CC-Attack Script for DDoS Campaigns
type: Case
break id: C0300
stix type: report
summary: SecurityScorecard analysis reveals that the hacktivist group KillNet is using a script called CC-Attack to launch distributed denial-of-service attacks. The script automates the exploitation of open proxy servers to relay attack traffic, flooding target servers with forged HTTP requests to exhaust resources, characteristic of a typical challenge collapsar attack.
case category: security_incident
keywords: KillNet
keywords: CC-Attack
keywords: DDoS
keywords: HTTP flood
keywords: open proxy
keywords: SecurityScorecard
keywords: botnet
keywords: traffic relay
related risks: CC Attack
related attack tools: Automation Scripts
related threat actors: Criminal Organizations
citation: KillNet Utilizes CC-Attack: A Quick & Dirty DDoS Method
updated: 2026-06-18
version: 1

HTTP Flood Mitigation: A Metadata-Based Detection Approach
type: Case
break id: C0301
stix type: report
summary: A 2015 IEEE conference paper proposes a metadata monitoring method to defend against HTTP GET flood attacks. Attackers use botnets to exhaust server resources with massive volumes of legitimate-looking HTTP GET requests. The approach identifies IP addresses with anomalous request frequencies through real-time big data analytics and maintains normal service even under 9 Gbps attack traffic.
case category: academic_research
incident time: 2015-08
keywords: HTTP GET flood
keywords: metadata analysis
keywords: botnet
keywords: CC attack
keywords: IEEE
keywords: application-layer DDoS
keywords: request frequency anomaly
keywords: real-time big data analytics
keywords: attack mitigation
related risks: CC Attack
related attack tools: Headless Browsers
related attack tools: Automation Scripts
related threat actors: Scraping Gangs
citation: Mitigating HTTP flooding attacks with meta-data analysis
updated: 2026-06-18
version: 1

Real-Time Detection and Defense Algorithm for CC Attacks Based on Information Entropy
type: Case
break id: C0302
stix type: report
summary: This algorithm applies information entropy theory to detect Challenge Collapsar (CC) attacks in real time, identify attack sources, and block malicious connections. It addresses application-layer DDoS attacks that flood servers with forged HTTP requests by providing an online protection mechanism.
case category: academic_research
keywords: information entropy
keywords: CC attack detection
keywords: real-time DDoS defense
keywords: application-layer DDoS
keywords: HTTP request flooding
keywords: attack source identification
keywords: connection blocking
keywords: entropy-based algorithm
related risks: CC Attack
citation: An Algorithm of Detecting and Defending CC Attack in Real Time
updated: 2026-06-18
version: 1

Packet-Based Detection of Challenge Collapsar Attack Traffic
type: Case
break id: C0303
stix type: report
summary: This study proposes a new method for detecting Challenge Collapsar (CC) attack traffic. CC attacks launch denial of service by frequently sending forged HTTP requests to target servers. Experimental results show the model achieves a detection accuracy of 98.55% and an F1 score of 98.59%, representing a 3% improvement over previous methods.
case category: academic_research
keywords: Challenge Collapsar
keywords: CC attack detection
keywords: HTTP request flooding
keywords: denial of service
keywords: packet analysis
keywords: detection model
keywords: F1 score
related risks: CC Attack
citation: Challenge Collapsar (CC) Attack Traffic Detection Based on Packet ...
updated: 2026-06-18
version: 1

Analysis of DDoS Attacks Against 911 Emergency Services
type: Case
break id: C0304
stix type: report
summary: Researchers demonstrate how attackers can launch anonymous DDoS attacks against 911 emergency services using a mobile phone botnet. By leveraging a rootkit embedded in baseband firmware, attackers can randomize phone identifiers and repeatedly place emergency calls, overwhelming public safety answering points and preventing legitimate calls from being processed. Simulations show that fewer than 6,
case category: academic_research
incident time: 2017-04
keywords: 911 emergency services
keywords: DDoS attack
keywords: mobile botnet
keywords: baseband firmware rootkit
keywords: public safety answering point
keywords: emergency call system
keywords: anonymous attack
keywords: service disruption
keywords: North Carolina
related risks: Distributed Denial of Service
related attack tools: Pre-installed Mobile Trojan Backdoor
related attack tools: Root/Jailbreak Tools
related attack tools: IoT Botnet and C2 Tools
related threat actors: IoT Botnet Operators
citation: 9-1-1 DDoS: attacks, analysis and mitigation
updated: 2026-06-18
version: 1

FBI Dismantles IoT Botnets Behind Massive DDoS Attacks
type: Case
break id: C0305
stix type: report
summary: U.S. federal law enforcement dismantled four IoT botnets—Aisuru, Kimwolf, JackSkid, and Mossad—responsible for a series of record-breaking distributed denial-of-service (DDoS) attacks. The attacks leveraged a large number of compromised IoT devices to generate massive traffic floods aimed at paralyzing target services.
case category: security_incident
incident time: 2026-03
keywords: FBI
keywords: IoT botnet
keywords: DDoS attack
keywords: Aisuru
keywords: Kimwolf
keywords: JackSkid
keywords: Mossad
keywords: distributed denial-of-service
keywords: botnet takedown
keywords: KrebsOnSecurity
related risks: Distributed Denial of Service
related attack tools: IoT Botnet and C2 Tools
related threat actors: IoT Botnet Operators
citation: Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
citation: DOJ: Authorities Disrupt IoT DDoS Botnets Responsible for Record-Breaking Attacks
updated: 2026-06-18
version: 1

Beijing Haidian DDoS Attack Platform Case
type: Case
break id: C0306
stix type: report
summary: The Supreme People's Procuratorate reported that a DDoS attack platform case prosecuted by the Haidian District Procuratorate in Beijing received a first-instance judgment on July 17, 2020. The defendant Wang built a dedicated online DDoS attack platform and openly sold attack packages labeled bronze, silver, gold, and diamond. After users placed orders and paid fees, they could maliciously attack target websites. The court convicted Wang of illegally using information networks and sentenced him to one year in prison and a 50,000 yuan fine.
case category: criminal_verdict
incident time: 2020-07
keywords: DDoS attack
keywords: DDoS attack platform
keywords: illegal use of information networks
keywords: Haidian District Procuratorate
keywords: Beijing cyber police
keywords: attack packages
keywords: Wang
keywords: criminal judgment
keywords: Supreme People's Procuratorate
keywords: distributed denial of service
related risks: Distributed Denial of Service
related threat actors: Malicious Hackers
citation: Beijing Haidian: Suspect in DDoS Attack Platform Case Sentenced - Supreme People's Procuratorate
updated: 2026-06-26
version: 1

Operation PowerOFF Seizes 53 DDoS Domains and Arrests 4 Individuals
type: Case
break id: C0307
stix type: report
summary: The international law enforcement initiative Operation PowerOFF seized 53 domains linked to commercial DDoS-for-hire services and arrested four suspects. These DDoS rental services were used by over 75,000 cybercriminals. The operation disrupted access to these services and dismantled their underlying technical infrastructure.
case category: security_incident
incident time: 2026-04
keywords: Operation PowerOFF
keywords: DDoS-for-hire seizure
keywords: booter service takedown
keywords: domain seizure
keywords: DDoS infrastructure dismantled
keywords: international law enforcement operation
keywords: DDoS rental service
related risks: Distributed Denial of Service
related risks: Denial of Service Risk
citation: Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal ...
citation: Europol: Operation PowerOFF Targets Over 75,000 DDoS Users
updated: 2026-06-18
version: 1

Authorities Dismantle World's Largest IoT DDoS Botnet
type: Case
break id: C0308
stix type: report
summary: The U.S. Department of Justice announced the successful takedown of the world's largest IoT DDoS botnet. Court documents revealed that the Aisuru botnet issued over 200,000 DDoS attack commands, while the KimWolf botnet issued over 25,000, both used to launch record-breaking attacks.
case category: security_incident
keywords: IoT botnet takedown
keywords: DDoS attack infrastructure
keywords: Aisuru botnet
keywords: KimWolf botnet
keywords: U.S. Department of Justice
keywords: distributed denial of service
related risks: Distributed Denial of Service
related attack tools: IoT Botnet and C2 Tools
related threat actors: IoT Botnet Operators
citation: Authorities disrupt world's largest IoT DDoS botnets responsible for ...
updated: 2026-06-18
version: 1

Legal Regulation of DDoS Attacks
type: Case
break id: C0309
stix type: report
summary: An IEEE conference paper examines legal frameworks addressing DDoS attacks, noting their status as one of the most dangerous and prevalent cyber threats. A single large-scale attack can cause billions in losses. The study analyzes legal instruments for attributing liability in Japan, Germany, and Australia.
case category: academic_research
incident time: 2020-09
keywords: DDoS regulation
keywords: distributed denial-of-service
keywords: cybercrime liability
keywords: Japanese cyber law
keywords: German IT security law
keywords: Australian cybercrime legislation
keywords: IEEE conference paper
keywords: legal attribution
related risks: Distributed Denial of Service
citation: Legal regulation of incidents related to DDoS attacks
updated: 2026-06-18
version: 1

Wan'an Public Security Cracks a DDoS Hacking Case
type: Case
break id: C0310
stix type: report
summary: In December 2022, the Cyber Surveillance Unit of the Wan'an County Public Security Bureau identified a resident surnamed Song who was conducting DDoS attacks against a website, suspected of endangering network security. Officers located and summoned the suspect after analysis and investigation. The investigation revealed that Song obtained DDoS attack scripts while building websites for others and
case category: criminal_verdict
incident time: 2022-12
keywords: DDoS attack
keywords: denial-of-service attack
keywords: hacking scripts
keywords: Wan'an County Public Security Bureau
keywords: website attack
keywords: cybercrime investigation
related risks: Denial of Service Risk
related attack tools: Automation Scripts
related threat actors: Malicious Hackers
citation: Wan'an Public Security: Cracked a DDoS hacking attack case - Public Security - Jiangxi Political and Legal Network
updated: 2026-06-18
version: 1

Real-Time Detection of Slow HTTP/2 Denial-of-Service Attacks
type: Case
break id: C0311
stix type: report
summary: Researchers conducted an empirical study of Slow HTTP/2 DoS attacks against web servers on the internet and identified multiple vulnerable servers. Attackers exploit HTTP/2 protocol features by sending requests slowly to exhaust server resources, causing denial of service. The study proposes a real-time detection scheme based on event sequence analysis.
case category: academic_research
keywords: Slow HTTP/2 DoS
keywords: denial-of-service attack
keywords: event sequence analysis
keywords: real-time detection
keywords: HTTP/2 protocol
keywords: web server vulnerability
keywords: traffic analysis
keywords: empirical study
related risks: Denial of Service Risk
citation: Delays Have Dangerous Ends: Slow HTTP/2 DoS Attacks Into the Wild and Their Real-Time Detection Using Event Sequence Analysis
updated: 2026-06-18
version: 1

An Empirical Study of Slow HTTP DoS Attack Vulnerabilities on Web Servers
type: Case
break id: C0312
stix type: report
summary: An empirical study examined internet-facing HTTP servers for Slow HTTP DoS vulnerabilities and found that some servers are susceptible to such attacks. By sending HTTP requests at an extremely slow rate, attackers exhaust server connection resources, preventing legitimate users from accessing services. The study proposes a detection method based on traffic ratio characteristics.
case category: academic_research
keywords: Slow HTTP DoS
keywords: denial-of-service attack
keywords: HTTP server vulnerability
keywords: traffic ratio detection
keywords: connection resource exhaustion
keywords: HTTP protocol flaw
keywords: empirical study
keywords: attack detection method
related risks: Denial of Service Risk
citation: How secure are web servers? An empirical study of slow HTTP DoS attacks and detection
updated: 2026-06-18
version: 1

Macroscopic Characterization of Large-Scale DoS Ecosystems
type: Case
break id: C0313
stix type: report
summary: This study reveals over 20 million reflection amplification DoS attacks through macroscopic internet monitoring. Attacks exploit open services such as DNS to amplify small requests into massive traffic, exhausting target network bandwidth and causing service disruptions. The victim population is vast, with median attack duration dropping to 240 seconds.
case category: academic_research
keywords: reflection amplification DoS
keywords: DNS amplification
keywords: botnet traffic attacks
keywords: internet-scale measurement
keywords: open DNS resolvers
keywords: network bandwidth exhaustion
keywords: DDoS ecosystem analysis
related risks: Denial of Service Risk
citation: Millions of targets under attack: a macroscopic characterization of the DoS ecosystem
updated: 2026-06-18
version: 1

DNS DDoS Amplification Attack Detection Using Multi-Layer Perceptron
type: Case
break id: C0314
stix type: report
summary: Focusing on DNS amplification attacks, this study employs a multi-layer perceptron (MLP) classifier to analyze network traffic data for detection. Attackers exploit DNS resolvers to amplify small queries into large traffic volumes, overwhelming the victim's network and causing denial of service. The research incorporates optimization techniques such as ADAM and SGD to enhance detection performance
case category: academic_research
keywords: DNS amplification attack
keywords: DDoS detection
keywords: multi-layer perceptron
keywords: MLP classifier
keywords: denial of service
keywords: ADAM optimization
keywords: SGD optimization
keywords: DNS resolver
keywords: network traffic analysis
related risks: Denial of Service Risk
citation: DNS DDoS Amplification Attack Detection Using Multi-Layer Perceptron ...
updated: 2026-06-18
version: 1

Guangzhou Police Dismantle Telecom Insider Ring for Mass WeChat Account Registration
type: Case
break id: C0315
stix type: report
summary: Between February and March 2021, Guangzhou police took down two insider rings within the telecommunications industry. The groups exploited internal access to bulk-obtain unactivated mobile numbers and verification codes, using proprietary software to register an average of 39,000 WeChat accounts per day. In total, they registered and resold 2.5 million accounts, which were then sold through interm
case category: criminal_verdict
incident time: 2021-02
keywords: telecom insider threat
keywords: bulk WeChat account registration
keywords: verification code theft
keywords: mobile number harvesting
keywords: SIM box fraud
keywords: SMS relay platform
keywords: Guangzhou police operation
keywords: overseas telecom fraud syndicate
keywords: internal privilege abuse
related risks: Bulk Account Registration
related attack tools: Bulk Account Registration Tool
related attack tools: Modem Pool
related attack tools: SMS Verification Code Platform
related threat actors: Malicious Insiders
related threat actors: Telecom Fraud Gangs
related threat actors: Account Dealers
citation: Guangzhou Police Continue Advancing the Card-Cutting Campaign
citation: Registered and resold 2.5 million WeChat accounts, telecom operator insider profited 87 million yuan | Telecom fraud_NetEase Subscription
updated: 2026-06-18
version: 1

Zibo Police Dismantle Massive Illegal Social Account Registration and Trafficking Ring
type: Case
break id: C0316
stix type: report
summary: In May 2022, police in Zibo, Shandong province, dismantled a major operation involving the illegal registration and sale of social media accounts, arresting 71 suspects. Since 2017, the group had used illicitly obtained carrier data, device spoofing tools, and phone farms to mass-register tens of millions of accounts on platforms like WeChat, selling them to overseas criminal syndicates and genera
case category: criminal_verdict
incident time: 2022-05
keywords: illegal account registration
keywords: social account trafficking
keywords: bulk registration
keywords: WeChat
keywords: phone farm
keywords: device spoofing
keywords: carrier data breach
keywords: Zibo police
keywords: black market
keywords: account farming
related risks: Bulk Account Registration
related attack tools: Device Spoofing Tools
related attack tools: Mass Control Systems
related attack tools: Bulk Account Registration Tool
related threat actors: Account Dealers
related threat actors: Cross-border Criminal Organizations
citation: Police Dismantle Illegal WeChat Account Registration and Trafficking Chain
citation: 71 arrested! Police busted a criminal gang illegally registering and selling social media accounts | Den_NetEase Subscription
updated: 2026-06-18
version: 1

Shanghai's First Verdict in Programmatic Bulk Real-Name Game Account Registration Case
type: Case
break id: C0317
stix type: report
summary: On February 20, 2025, the Jing'an District Court in Shanghai delivered the city's first verdict in a case involving programmatic bulk real-name registration of game accounts. The defendant, Ma, used automated methods to bypass real-name verification mechanisms, registering game accounts in bulk for illegal profit.
case category: criminal_verdict
incident time: 2025-02
keywords: programmatic bulk registration
keywords: game account
keywords: real-name verification bypass
keywords: Ma
keywords: Shanghai Jing'an Court
keywords: criminal verdict
keywords: illegal profit
keywords: account registration underground industry
related risks: Bulk Account Registration
related attack tools: Bulk Account Registration Tool
related attack tools: Automation Scripts
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Shanghai cyber-prosecution cases released
citation: Top 10 Influential Events of the Year in Gaming Law 2025_Tencent News
updated: 2026-06-24
version: 2

Tang XX Used 'Changyou Registration Bot' for Mass Game Account Creation
type: Case
break id: C0318
stix type: report
summary: Defendant Tang XX purchased a registration bot and its source code online, then modified it into 'Changyou Registration Bot.exe'. The software automatically generated registration details and obtained phone numbers and verification codes via third-party code-receiving platforms to mass-register game accounts. The court adjudicated the case accordingly.
case category: criminal_verdict
keywords: Changyou registration bot
keywords: mass account registration
keywords: game accounts
keywords: code-receiving platform
keywords: verification code
keywords: registration bot source code
keywords: automated registration
keywords: account fraud ring
keywords: Criminal Verdict
keywords: Tang XX
related risks: Bulk Account Registration
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related threat actors: Account Dealers
citation: Analysis of criminal liability of code-receiving platforms in the bulk account registration industry chain - Theoretical Research---Shaoxing...
citation: Cases Included in the Zhejiang High Court Work Report: The First Malicious Account-Registration Case
updated: 2026-06-18
version: 1

Tencent Warns Users Against Bulk Malicious Registration of WeChat Accounts
type: Case
break id: C0319
stix type: report
summary: In December 2018, Tencent issued a warning that black-market actors were using SIM card vendors and SMS relay platforms to obtain phone numbers and verification codes, then employing tools like modem pools and device farms to register WeChat accounts in bulk for malicious purposes. Such activities may face legal penalties.
case category: news_report
incident time: 2018-12
keywords: WeChat
keywords: bulk registration
keywords: malicious account creation
keywords: black market
keywords: modem pool
keywords: device farm
keywords: SMS relay platform
keywords: Tencent
related risks: Bulk Account Registration
related attack tools: Modem Pool
related attack tools: Mass Control Systems
related attack tools: SMS Verification Code Platform
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Criminal Organizations
citation: Tencent reminds users not to maliciously register WeChat accounts in bulk: may face legal sanctions_10% Company...
updated: 2026-06-18
version: 1

City's First Case: Prosecutors Unravel Scheme of Mass Game Account Registration with Real-Name Verification
type: Case
break id: C0320
stix type: report
summary: In 2024, suspect Ma XX used self-written programs to bypass the security measures of Game Company A's platform. By employing SMS interception software to obtain overseas phone numbers and verification codes, he automated the mass registration of blank game accounts. These accounts were then authenticated using illegally acquired personal information and handed over to Liu XX for sale, generating o
case category: criminal_verdict
incident time: 2025-02
keywords: bulk game account registration
keywords: illegal real-name verification
keywords: SMS interception software
keywords: overseas phone numbers
keywords: automated scripts
keywords: personal information trading
keywords: game account selling
keywords: bypassing security measures
keywords: Ma XX
keywords: Liu XX
related risks: Bulk Account Registration
related risks: Overseas Number Registration
related risks: Minor Age Verification Bypass
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related attack tools: Automation Scripts
related threat actors: Account Dealers
related threat actors: Data Brokers
citation: Shanghai’s First Programmatic Bulk Real-Name Game Account Registration Case: How Prosecutors Uncovered the Scheme
citation: First case in the city! Prosecutor cracks bulk real-name registration of game accounts - Tencent News
updated: 2026-06-18
version: 1

Shandong Dismantles Massive Black-Gray Industry Ring: Over 3,000 Phones Auto-Registering WeChat Accounts
type: Case
break id: C0321
stix type: report
summary: Zibo police in Shandong cracked the '9·16' major black-gray industry case, uncovering a crime den with over 3,000 phones simultaneously powered on and running automated scripts to bulk-register WeChat accounts. The group leveraged technical means for large-scale, automated account registration to fuel subsequent black-gray market transactions.
case category: criminal_verdict
incident time: 2023-08
keywords: black-gray industry
keywords: bulk account registration
keywords: WeChat
keywords: phone farm
keywords: automated scripts
keywords: group control
keywords: Zibo
keywords: cybercrime
related risks: Bulk Account Registration
related attack tools: Bulk Account Registration Tool
related attack tools: Mass Control Systems
related attack tools: Automation Scripts
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Shandong Public Security Department: Zibo Cracks the Ministry-Supervised 9·16 Major Cybercrime Assistance Case
citation: Shandong busted a major black and gray industry series case: over 3,000 phones automatically registering WeChat accounts...
updated: 2026-06-18
version: 1

Barracuda Warns of Surging Advanced OAuth Phishing Attacks Exploiting Protocol Flaws to Hijack Accounts
type: Case
break id: C0322
stix type: report
summary: Cybersecurity firm Barracuda warned that phishing gangs are abusing Microsoft OAuth authorization flows to gain stealthy access to accounts. Attackers trick users into granting malicious applications permissions, enabling token-based access that can bypass traditional password-centric defenses and support account takeover.
case category: news_report
incident time: 2025-11
keywords: OAuth phishing
keywords: account takeover
keywords: Barracuda
keywords: authorization flow
keywords: authentication bypass
keywords: third-party authorization
keywords: OAuth protocol exploit
keywords: advanced phishing campaign
related risks: Third-Party Account Risk
related attack tools: SaaS OAuth Abuse Tool
related threat actors: Account Takeover Groups
citation: Barracuda Email Threat Radar: Phishing Gangs Abuse Microsoft OAuth for Stealthy Access
updated: 2026-06-25
version: 1

Microsoft Exposes Threat Actors Abusing OAuth Applications for Automated Financial Attacks
type: Case
break id: C0323
stix type: report
summary: Microsoft's security team disclosed in December 2023 that threat groups are abusing OAuth applications as automation tools to conduct financially motivated attacks. Attackers exploit the OAuth authorization mechanism to create or compromise high-privilege third-party apps, gaining persistent access to enterprise cloud services such as Microsoft 365 through legitimate authentication flows, then per
case category: news_report
incident time: 2023-12
keywords: OAuth abuse
keywords: Microsoft 365
keywords: financial attacks
keywords: credential theft
keywords: lateral movement
keywords: cloud security
keywords: third-party app authorization
keywords: threat actors
keywords: automated attacks
related risks: Third-Party Account Risk
related risks: OAuth / SSO Authorization Abuse
related risks: SaaS Third-Party App Authorization Abuse
related attack tools: SaaS OAuth Abuse Tool
related attack tools: API Automated Abuse Tools
related threat actors: SaaS Data Thieves
related threat actors: Payment Fraud Groups
citation: Threat actors misuse OAuth applications to automate financially driven ...
updated: 2026-06-18
version: 1

Microsoft Warns: OAuth Redirect Abuse Leads to Phishing and Malware Distribution
type: Case
break id: C0324
stix type: report
summary: Microsoft observed phishing attacks exploiting OAuth redirect abuse. Attackers send phishing links to victims, which trigger an OAuth authorization flow upon clicking, tricking users into granting permissions to malicious applications. This method can be used for data theft or malware distribution, exploiting user trust in third-party logins to bypass existing security verifications.
case category: security_incident
incident time: 2026-03
keywords: OAuth redirect abuse
keywords: phishing attack
keywords: malware distribution
keywords: Microsoft
keywords: authorization flow
keywords: third-party app
keywords: SaaS security
keywords: authentication bypass
related risks: Third-Party Account Risk
related risks: SaaS Third-Party App Authorization Abuse
related attack tools: SaaS OAuth Abuse Tool
related threat actors: SaaS Data Thieves
citation: OAuth redirection abuse enables phishing and malware delivery
updated: 2026-06-18
version: 1

Analysis and Prevention of Recent OAuth Vulnerability Exploits
type: Case
break id: C0325
stix type: report
summary: Tencent Cloud Developer Community published an analysis revealing that some OAuth 2.0 providers fail to properly validate callback URLs or have bypassable validation, allowing hackers to craft phishing pages that trick users into authorizing access, thereby gaining account permissions and enabling identity impersonation.
case category: news_report
incident time: 2018-02
keywords: OAuth 2.0
keywords: callback URL validation
keywords: phishing page
keywords: identity impersonation
keywords: account takeover
keywords: vulnerability analysis
keywords: Tencent Cloud
keywords: authorization exploit
related risks: Third-Party Account Risk
related attack tools: Phishing Kits
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: SaaS OAuth Abuse Tool
related threat actors: Malicious Hackers
citation: Analysis and prevention suggestions for the recent 'eye-catching OAuth vulnerability' - Tencent Cloud Development...
updated: 2026-06-18
version: 1

Hackers colluded with telecom employees to register and resell WeChat accounts, involving millions in illicit gains
type: Case
break id: C0326
stix type: report
summary: An employee surnamed Liu at a Guizhou subsidiary of a telecom group exploited his position to build a covert channel within the company's industry gateway system. Collaborating with others, he enabled large numbers of unregistered, inactive mobile numbers to pass SMS verification and successfully register WeChat accounts. The case uncovered three criminal groups, with 28 individuals convicted, inv
case category: criminal_verdict
incident time: 2024-09
keywords: inactive number registration
keywords: WeChat account
keywords: SMS verification
keywords: industry gateway
keywords: telecom company
keywords: position exploitation
keywords: criminal group
keywords: account reselling
keywords: black market
keywords: unauthorized access
related risks: Inactive Number Registration
related threat actors: Account Dealers
related threat actors: Malicious Insiders
citation: A Network Cable Uncovered Three Criminal Groups
citation: Hackers colluded with telecom company employees to register and sell WeChat accounts for profit, involving tens of millions! _Tencent News
updated: 2026-06-18
version: 1

China's First Inactive SIM SMS Hijacking Case: Using Unactivated SIMs to Register Accounts
type: Case
break id: C0327
stix type: report
summary: Hunan Xianshang Technology used automated software to register internet accounts in bulk with inactive phone numbers. When platforms sent verification SMS, the messages appeared to fail but actually reached the carrier's system. An insider at the telecom operator provided server IP, account credentials, and passwords, enabling connection to the carrier's system and interception of SMS verification
case category: criminal_verdict
keywords: inactive SIM hijacking
keywords: SMS verification interception
keywords: telecom insider
keywords: fake account registration
keywords: WeChat fraud
keywords: unactivated SIM card
keywords: SMS hijacking exploit
keywords: carrier system breach
related risks: Inactive Number Registration
related attack tools: Bulk Account Registration Tool
related threat actors: Malicious Insiders
related threat actors: Account Dealers
citation: MPS Announces Nine Typical Cases in Crackdown on Online Disorder
citation: China's first case of empty number SMS hijacking: using inactive SIM cards to register accounts - Ninghua Online
updated: 2026-06-18
version: 1

Telecom Insider Sells Dormant Numbers, Aiding Telecom Fraud
type: Case
break id: C0328
stix type: report
summary: The report reveals that insiders at a telecom operator exploited their positions to sell dormant phone numbers, facilitating telecom and online fraud. These numbers were used to register accounts on various internet platforms, allowing criminals to conceal their real identities and carry out downstream illegal activities.
case category: news_report
incident time: 2023-08
keywords: telecom insider
keywords: dormant number sales
keywords: phone number registration
keywords: identity concealment
keywords: online platform accounts
keywords: telecom fraud accomplice
related risks: Inactive Number Registration
related threat actors: Malicious Insiders
citation: Telecom operator insiders sold empty numbers, becoming accomplices in telecom fraud
updated: 2026-06-18
version: 1

Ningbo Jiangbei Dismantles a Full-Chain "Virtual Number Factory"
type: Case
break id: C0329
stix type: report
summary: Between March and June 2025, defendants Zhou, Xu, and others obtained unverified virtual mobile numbers from upstream "number dealers." Using "high daily pay" part-time job lures, they tricked job seekers into providing identity information and facial recognition, then unknowingly used these to bulk-register virtual numbers and app accounts. The accounts were sold at marked prices to fraud gangs.
case category: criminal_verdict
incident time: 2026-05
keywords: virtual mobile numbers
keywords: real-name verification bypass
keywords: part-time job baiting
keywords: facial recognition
keywords: bulk account registration
keywords: number dealers
keywords: fraud gangs
keywords: Ningbo Jiangbei
keywords: personal information infringement
related risks: Virtual Number Registration
related attack tools: Black SIM Cards
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
citation: Cutting Off the Source Black-Market Chain Behind Telecom Fraud and Punishing an Illegal Virtual Number Factory
citation: Ningbo Jiangbei cracks down on 'virtual number factories' across the entire chain_Tencent News
updated: 2026-06-18
version: 1

Shanghai Mall Parking Points Case: License Plate Bound to 1,000+ Phone Numbers to Register Fake Users and Defraud Parking Fees
type: Case
break id: C0330
stix type: report
summary: The Supreme People's Procuratorate reported that in December 2020 a shopping mall in Shanghai's Yangpu District found that one Jiangsu-plated vehicle was bound to more than 1,000 phone numbers and repeatedly used new-member points in the mall's official app to offset parking fees. Backend review showed more than 120 similar vehicles, each bound to hundreds or thousands of phone numbers, causing direct parking-fee losses of over 370,000 yuan to that mall in 2020 alone. After prosecution by the Yangpu District procuratorate, four defendants who used malicious SMS-code software to bulk-register fake new users and defraud parking fees were convicted of fraud and received suspended prison sentences plus fines; the software operator was convicted of aiding information-network crimes.
case category: criminal_verdict
incident time: 2025-12
keywords: virtual phone numbers
keywords: parking fee fraud
keywords: mall parking
keywords: reward points scam
keywords: SMS-code platform
keywords: bulk account registration
keywords: fake users
keywords: fraud conviction
related risks: Virtual Number Registration
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
citation: Crackdown on telecom and online fraud: one license plate bound to over a thousand phone numbers to register fake users and defraud parking fees
updated: 2026-06-18
version: 1

Guangxi Baise Yu Gang Ethnic Asset Unfreezing Fraud Case
type: Case
break id: C0331
stix type: report
summary: In November 2022, public security authorities in Baise, Guangxi dismantled a fraud ring led by Yu Gang, arresting 60 individuals and identifying a total amount involved of 70 million yuan. Investigations revealed that Yu and his associates established an internet technology company and recruited former participants in ethnic asset unfreezing scams. They falsely claimed that overseas ethnic assets
case category: criminal_verdict
incident time: 2022-11
keywords: ethnic asset unfreezing
keywords: SIM card fraud
keywords: Yu Gang
keywords: Guangxi Baise
keywords: virtual number registration
keywords: internet technology company
keywords: telecom operators
keywords: China Mobile
keywords: China Unicom
keywords: China Telecom
related risks: Virtual Number Registration
related threat actors: Telecom Fraud Gangs
citation: Public Security Authorities Report Progress Against Ethnic Asset Unfreezing Fraud
citation: Public security organs crack down on 'national asset thawing' fraud crimes
updated: 2026-06-18
version: 1

Man Sentenced in Zhaoqing for Reselling WeChat Accounts
type: Case
break id: C0332
stix type: report
summary: The Dinghu Court in Zhaoqing tried a case where defendant Su purchased large quantities of personal information such as citizen ID numbers, names, and phone cards online. He used this data to register real-name verified WeChat accounts, 'raised' them by logging in for 8 to 15 days, and then sold the verified accounts for profit. Su was convicted and sentenced to criminal penalties along with a fin
case category: criminal_verdict
keywords: personal information infringement
keywords: reselling WeChat accounts
keywords: account raising
keywords: real-name verification
keywords: Su
keywords: Dinghu Court
keywords: criminal verdict
keywords: underground cyber industry
related risks: Virtual Number Registration
related threat actors: Account Dealers
citation: Case Explanation: Is Reselling WeChat Accounts a Way to Profit? The Court Says It Is a Crime
citation: Zhaoqing man sentenced for reselling WeChat accounts, fined
updated: 2026-06-18
version: 1

Guixi Court Convicts Individual for Registering Company to Facilitate Cybercrime
type: Case
break id: C0333
stix type: report
summary: In December 2023, the defendant Huang, knowing that others were using information networks to commit crimes, still applied for a business license and opened a corporate bank account as instructed to provide assistance for others' criminal activities in order to seek illegal profits. The Guixi Municipal People's Court sentenced Huang to seven months in prison and fined him 10,000 yuan for aiding in
case category: criminal_verdict
incident time: 2023-12
keywords: aiding information network criminal activities
keywords: corporate account money mule
keywords: business license fraud
keywords: Guixi Municipal People's Court
keywords: Chinese criminal verdict
keywords: cybercrime facilitation
keywords: shell company registration
related risks: Virtual Number Registration
related attack tools: Identity Document Set (4-Piece)
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: Guixi Court: Registering a company to assist crimes? Defendant gets 7 months!
updated: 2026-06-18
version: 1

Jiaxing Yuhe Culture Media Exposed for Bulk Registering Short-Video Accounts Using IoT SIMs
type: Case
break id: C0334
stix type: report
summary: During the 2023 CCTV 315 Gala, Jiaxing Yuhe Culture Media Co., Ltd. was exposed for using IoT SIM cards to bulk-register accounts on short-video platforms for online marketing and fake engagement operations. This practice represents a typical case of fraudulent account registration on internet platforms using IoT SIMs.
case category: news_report
incident time: 2023-03
keywords: Jiaxing Yuhe Culture Media
keywords: IoT SIM card account registration
keywords: bulk account creation
keywords: short-video platform accounts
keywords: fake account registration
keywords: CCTV 315 Gala exposure
keywords: fake engagement operations
keywords: online marketing fraud
related risks: IoT SIM Card Registration
related attack tools: Black SIM Cards
related threat actors: Astroturfing Networks
citation: What is the IoT card mentioned at the 3.15 Gala? Why can it register thousands of accounts...
updated: 2026-06-18
version: 1

Double 11 Investigation: IoT SIM Card Abuse on E-Commerce Platforms Under Tightened Regulations
type: Case
break id: C0335
stix type: report
summary: During the 2022 Double 11 shopping festival, an investigation uncovered widespread abuse of IoT SIM cards on e-commerce platforms. Activation required registering on an IoT management platform called 'Wuxianji Communication', and such cards were often used for fraudulent registration of internet accounts, posing regulatory risks.
case category: news_report
incident time: 2022-11
keywords: IoT SIM card abuse
keywords: e-commerce platform IoT cards
keywords: Double 11 IoT card sales
keywords: Wuxianji Communication platform
keywords: IoT management platform registration
keywords: fake account registration IoT
keywords: real-name policy IoT
keywords: cyber black market SIM
related risks: IoT SIM Card Registration
citation: Double 11 investigation: IoT cards under strict regulation—rampant e-commerce sales, hidden dangers
updated: 2026-06-18
version: 1

Anti-Telecom Fraud Law Explicitly Bans Illegal Trading, Renting, and Lending of IoT SIMs
type: Case
break id: C0336
stix type: report
summary: The Anti-Telecommunications Network Fraud Law, passed on September 2, 2022, explicitly prohibits any entity or individual from illegally trading, renting, or lending phone cards and IoT cards, or opening phone cards, IoT cards, financial accounts, or internet accounts under false identities or fabricated agency relationships. It also requires telecom operators to enforce real-name registration and risk-monitoring duties.
case category: news_report
incident time: 2022-09
keywords: Anti-Telecom Fraud Law
keywords: IoT SIM cards
keywords: illegal SIM trading
keywords: SIM rental lending
keywords: real-name registration
keywords: phone card ban
keywords: telecom fraud legislation
keywords: identity fraud SIM
related risks: IoT SIM Card Registration
citation: Anti-Telecommunications Network Fraud Law of the People's Republic of China
updated: 2026-06-18
version: 1

Europol Dismantles SIM Farm Network Tied to 49 Million Fake Accounts
type: Case
break id: C0337
stix type: report
summary: Europol, through Operation SIMCARTEL, took down a SIM farm network that used large numbers of SIM cards to mass-register fake accounts for fraud. The infrastructure supported 49 million fraudulent accounts and caused €5 million in fraud losses.
case category: security_incident
incident time: 2025-10
keywords: Europol
keywords: SIM farm
keywords: SIMCARTEL
keywords: bulk SIM registration
keywords: fake accounts
keywords: device farm
keywords: fraud loss
keywords: mass account creation
keywords: SIM box fraud
keywords: account farming
related risks: IoT SIM Card Registration
related risks: Fake Conversion and Install Farm
related attack tools: Black SIM Cards
related attack tools: Modem Pool
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
related threat actors: SIM Card Dealers (Phone Numbers)
citation: Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts...
citation: Europol: Cybercrime-as-a-Service Takedown: 7 Arrested
updated: 2026-06-18
version: 1

Shanghai's First Case: Criminal Sentencing for Bulk Real-Name Game Account Registration
type: Case
break id: C0338
stix type: report
summary: Shanghai police cracked the city's first case involving programmatic bulk real-name registration of game accounts. The criminal gang illegally obtained citizens' personal information, wrote scripts to bypass game company registration restrictions, and registered and verified game accounts in bulk before selling the accounts and passwords for profit. The principal offender, Ma, earned over 100,000
case category: criminal_verdict
incident time: 2025-03
keywords: bulk registration
keywords: real-name verification
keywords: game accounts
keywords: personal information infringement
keywords: illegally obtaining computer information system data
keywords: script registration
keywords: Ma
keywords: account reselling
related risks: Interceptor Card Registration
related attack tools: Automation Scripts
related threat actors: Account Dealers
citation: Shanghai cyber-prosecution cases released
citation: Listed game company's actual controller arrested; 1.7 billion yuan involved, gift card top-ups suspected of money laundering | Weekly roundup...
updated: 2026-06-24
version: 2

Chongqing “4·01” Cross-Provincial VAT Invoice Fraud: Registering “Fake Enterprises” Using Others’ Identities
type: Case
break id: C0339
stix type: report
summary: A criminal gang fraudulently used, rented, or stole personal identity information, or induced individuals to register “fake enterprises.” Without any actual goods transactions, they issued a large volume of false VAT invoices externally. The involved parties registered 64 shell companies using purchased identity information, with cumulative false invoicing amounting to 7.18 billion yuan, severely
case category: criminal_verdict
incident time: 2021-09
keywords: false VAT invoicing
keywords: shell company registration
keywords: identity theft
keywords: cross-provincial invoice fraud
keywords: tax inspection
keywords: Chongqing
keywords: fictitious enterprise
keywords: empty shell company
related risks: Fake Registration
citation: State Taxation Administration Publishes Eight Typical Illegal False-Invoicing Cases
citation: Using others' ID cards to register 'fake enterprises', issuing 7.18 billion yuan in fraudulent invoices
updated: 2026-06-18
version: 1

Over 100 Villagers' Identities Misused for Business License Registration in Dawu County, Hubei Province
type: Case
break id: C0340
stix type: report
summary: From 2011 to 2023, former industrial and commercial office staff Deng and Fang in Lvwang Town, during a 'Market Entity Increment Campaign,' improperly obtained villagers' identity information from town government personnel and illegally processed 154 business licenses involving 134 villagers in Liuyuan Village. An additional 84 illegal registrations were identified in other townships. The relevant
case category: administrative_enforcement
incident time: 2024-05
keywords: Dawu County
keywords: Lvwang Town
keywords: business license
keywords: identity misuse
keywords: fraudulent registration
keywords: Market Entity Increment Campaign
keywords: illegal processing
keywords: accountability
keywords: villager information leakage
keywords: Deng
related risks: Fake Registration
related threat actors: Malicious Insiders
citation: Over 100 villagers' identities fraudulently used to register business licenses, official announcement!
citation: Dawu County Government Office Notice on the Investigation of Irregular Business License Registrations
updated: 2026-06-18
version: 1

Henan Shangqiu: Organizing Ground Promoters to Guide Passersby in Assisting WeChat Registration for Criminal Use Leads to Sentencing
type: Case
break id: C0341
stix type: report
summary: Since spring 2020, defendants Zhang and Li, knowing that the registered WeChat accounts would be used by upstream parties for illegal activities, organized ground promotion teams to guide passersby in assisting with WeChat account registration and provided them to the upstream. Both were sentenced to seven months in prison and fined for the crime of aiding information network criminal activities.
case category: criminal_verdict
incident time: 2025-03
keywords: aiding information network criminal activities
keywords: fraudulent registration
keywords: WeChat account
keywords: ground promotion
keywords: assisted registration
keywords: Henan Shangqiu
keywords: Suiyang District People's Court
keywords: Zhang
keywords: Li
related risks: Fake Registration
related threat actors: Gou Tui (Telecom Fraud Operatives)
related threat actors: Account Dealers
citation: Organizing ground promotions to guide passersby in registering WeChat accounts for others—two defendants sentenced
updated: 2026-06-18
version: 1

Shandong Zibo Police Bust Massive Illegal Bulk Registration and Sale of WeChat Accounts
type: Case
break id: C0342
stix type: report
summary: Zibo police dismantled a criminal gang led by a suspect surnamed Xu. Since 2018, the gang illegally obtained data from Tencent and three major telecom operators, used batch-controlled mobile phones to register WeChat accounts in bulk, and sold them for use in telecom fraud and other criminal activities. Forty-three suspects were escorted back to Zibo.
case category: criminal_verdict
incident time: 2022-04
keywords: bulk account registration
keywords: WeChat account selling
keywords: Tencent data breach
keywords: telecom operator data
keywords: SIM box fraud
keywords: account farming
keywords: Zibo police
related risks: Fake Registration
related attack tools: Bulk Account Registration Tool
related attack tools: Mass Control Systems
related attack tools: SMS Verification Code Platform
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
citation: Seventy-One Arrested as Police Dismantle an Illegal Social Account Registration and Resale Ring
citation: Shandong Zibo massive illegal bulk registration and sale of WeChat accounts case cracked
updated: 2026-06-18
version: 1

Scalpers Use Automated Scripts to Mass-Register Accounts for Snatching Sneakers and Concert Tickets
type: Case
break id: C0343
stix type: report
summary: Scalpers deployed automated scripts to complete registration, login, and purchase processes within 0.8 seconds. By forging 17 different device IDs and bypassing CAPTCHA, they mass-registered accounts to snatch limited-edition sneakers and concert tickets, reselling them at inflated prices on other platforms after official sell-outs. The total amount involved reached 327 million yuan.
case category: news_report
keywords: automated scripts
keywords: mass account registration
keywords: scalping bots
keywords: CAPTCHA bypass
keywords: sneaker bots
keywords: concert ticket scalping
keywords: fake registrations
keywords: device ID spoofing
related risks: Fake Registration
related attack tools: Automation Scripts
related attack tools: GPS Spoofing Tools
related attack tools: Image CAPTCHA Recognition Tools
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: ...black market case; scalper software completes ticket grabbing in 0.8 seconds, using automated scripts for bulk registration...
updated: 2026-06-18
version: 1

Man Born in the 1990s Sentenced for Registering 200,000 Fake Accounts to Fraudulently Obtain Over 20,000 Cans of Milk Powder
type: Case
break id: C0344
stix type: report
summary: In 2017, Huang Xiaotian used scripts to batch-register 200,000 fake accounts on a maternal and infant app and modified the app's verification function, allowing these accounts to participate in a 'buy one, get one free' promotion. He profited over 60,000 yuan from selling the fake accounts, causing the merchant a loss of over 20,000 cans of milk powder. Huang was sentenced to three years and six m
case category: criminal_verdict
incident time: 2019-10
keywords: batch account registration
keywords: script automation
keywords: fake account farming
keywords: promo abuse
keywords: maternal and infant app
keywords: buy one get one free fraud
keywords: computer intrusion programs
keywords: account black market
related risks: Fake Registration
related attack tools: Bulk Account Registration Tool
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
citation: Post-90s man sentenced: Registered 200,000 fake accounts, stole over 20,000 cans of milk powder
citation: Legal Analysis of the Fake-Account Milk-Powder Coupon Abuse Case Prosecuted by Haidian Prosecutors
updated: 2026-06-18
version: 1

Jiangxi Netizen Penalized for Bulk Purchasing Virtual Phone Numbers to Register and Sell App Accounts for Illegal Profit
type: Case
break id: C0345
stix type: report
summary: A netizen surnamed Luo in Jiangxi province purchased large quantities of virtual phone numbers to fraudulently register over 4,000 accounts on a specific app, then sold them to unspecified individuals for profit. Public security authorities imposed penalties including confiscation of illegal gains, a fine, and administrative detention.
case category: administrative_enforcement
incident time: 2025-08
keywords: virtual phone numbers
keywords: bulk account registration
keywords: app account selling
keywords: fraudulent registration
keywords: administrative detention
keywords: Jiangxi
keywords: illegal profit
related risks: Fake Registration
related attack tools: Black SIM Cards
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
related threat actors: Account Dealers
citation: Selling App Accounts Registered with Virtual Phone Numbers: Jiangxi Netizen Penalized
updated: 2026-06-18
version: 1

Couple Falsely Registered for Civil Service Exams 758 Times, Court Convicts
type: Case
break id: C0346
stix type: report
summary: During a provincial civil service exam registration period, a couple stole others' identity card information and falsely registered for the exam 758 times, creating the illusion of high applicant numbers to deter competitors. The act violated personal information laws, and the court later sentenced them.
case category: criminal_verdict
incident time: 2025-12
keywords: civil service exam
keywords: false registration
keywords: identity card theft
keywords: personal information infringement
keywords: exam registration disruption
keywords: civil service recruitment
keywords: fake registration
keywords: criminal verdict
related risks: Fake Registration
related attack tools: Bulk Account Registration Tool
related threat actors: Malicious Users
citation: Couple falsely registered for civil service exam 758 times, court rules
updated: 2026-06-18
version: 1

SEC Issues Risk Alert on Master/Sub-Account Misuse
type: Case
break id: C0347
stix type: report
summary: The U.S. Securities and Exchange Commission issued a risk alert warning that insider trading may be conducted through sub-accounts to evade detection. Master account holders who are not registered broker-dealers can use sub-accounts to conceal trading activity, making it difficult for regulators to trace the actual controlling person—a typical case of sub-account abuse.
case category: administrative_enforcement
keywords: SEC
keywords: master account
keywords: sub-account
keywords: insider trading
keywords: risk alert
keywords: regulatory evasion
keywords: broker-dealer
keywords: beneficial ownership
related risks: Sub-Account Abuse
citation: [PDF] National Exam Risk Alert on Master/Sub-accounts - SEC.gov
updated: 2026-06-18
version: 1

Sub-Account Security Vulnerabilities in IoT Management Platforms
type: Case
break id: C0348
stix type: report
summary: An academic study identified security flaws in 9 out of 42 IoT management platforms, where attackers can exploit sub-account functionality by sending an invitation to a victim and gaining access to that sub-account, enabling malicious operations and highlighting insufficient sub-account access controls in IoT platforms.
case category: academic_research
keywords: IoT management platform
keywords: sub-account security
keywords: access control vulnerability
keywords: privilege escalation
keywords: IoT security
keywords: sub-account abuse
keywords: ACM
related risks: Sub-Account Abuse
citation: All your IoT devices are belong to us: Security weaknesses in IoT management platforms
updated: 2026-06-18
version: 1

Cloudflare Launches Account Abuse Protection
type: Case
break id: C0349
stix type: report
summary: Cloudflare announced the launch of an Account Abuse Protection suite designed to prevent fake account creation and promotion abuse. New features include disposable email detection and email risk assessment to identify fraudulent sign-ups using temporary email addresses, along with hashed user IDs to gain visibility into suspicious account activity and block bulk fake account attacks.
case category: news_report
incident time: 2026-03
keywords: Cloudflare account abuse protection
keywords: fake account creation prevention
keywords: promotion abuse detection
keywords: disposable email detection
keywords: email risk assessment
keywords: hashed user ID
keywords: bulk fake account attacks
related risks: Sub-Account Abuse
citation: Announcing Cloudflare Account Abuse Protection: prevent ...
updated: 2026-06-18
version: 1

State-Owned Bank Managers Misappropriated Reserve Funds
type: Case
break id: C0350
stix type: report
summary: The Supreme People's Procuratorate's 47th batch of guiding cases disclosed that Li, a former president of a state-owned bank, Wang, a former vice president, and others pushed for early redemption of a wealth-management product for personal investment gains even though the termination conditions were not met, and illegally used more than 480 million yuan of bank reserve funds. The funds were later repaid through a separately established trust plan, while 21 subscribers obtained more than 126 million yuan in gains. In October and November 2019, prosecutors charged six defendants including Li with misappropriation of public funds. The court sentenced the six defendants to prison terms ranging from one year and two months to five years and six months, and the second-instance court upheld the judgment.
case category: criminal_verdict
incident time: 2009-07
keywords: state-owned bank
keywords: public fund misappropriation
keywords: reserve funds
keywords: early redemption of wealth-management products
keywords: financial duty crime
keywords: illegal proceeds recovery
keywords: bank internal controls
keywords: procuratorial guiding case
related risks: Sub-Account Abuse
related threat actors: Malicious Insiders
citation: 47th Batch of Guiding Cases: Li and Others Misappropriation of Public Funds
updated: 2026-06-18
version: 1

GM Hit by Credential Stuffing Attack Exposing Car Owner Personal Data
type: Case
break id: C0351
stix type: report
summary: In April 2022, General Motors detected malicious login activity and found that attackers had used credentials leaked from other non-GM sites to launch a credential stuffing attack against its online platform. After successfully accessing customer accounts, the attackers stole personal information and redeemed reward points for gift cards. GM subsequently required affected users to reset their pass
case category: security_incident
incident time: 2022-05
keywords: General Motors
keywords: credential stuffing
keywords: reward points redemption
keywords: gift card fraud
keywords: online account takeover
keywords: malicious login
keywords: password reset
keywords: PII exposure
related risks: Credential Stuffing
related attack tools: Credential Stuffing Tools
related threat actors: Malicious Hackers
citation: GM hit by credential stuffing attack, owner personal info exposed
citation: California DOJ: General Motors Data Breach Notification Sample
updated: 2026-06-18
version: 1

Jiangsu Yancheng Police Dismantle Credential Stuffing Account Theft Ring
type: Case
break id: C0352
stix type: report
summary: In April 2021, police in Yancheng, Jiangsu Province uncovered a criminal group using credential stuffing techniques. The group aggregated leaked username-password pairs from the internet, built a database, and launched mass login attempts against a major e-commerce platform, reaching up to one million abnormal logins per day. After gaining access, they exploited stored coupons to purchase goods at
case category: criminal_verdict
incident time: 2021-04
keywords: credential stuffing
keywords: account takeover
keywords: leaked credentials database
keywords: coupon arbitrage
keywords: e-commerce platform
keywords: Yancheng police
keywords: dark web credential trade
keywords: bulk login attack
related risks: Credential Stuffing
related risks: Third-Party Account Aggregation
related attack tools: Credential Stuffing Tools
related attack tools: Social Engineering Database
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Account Takeover Groups
related threat actors: Criminal Organizations
citation: Yancheng Police Crack Credential Stuffing Account Theft Case
updated: 2026-06-18
version: 1

Talent Outreach Disguised as Illegal Credential Stuffing: Nationwide Registered Architects Targeted
type: Case
break id: C0353
stix type: report
summary: Between 2023 and 2024, Zhuli Company used crawlers to scrape public data and then performed credential stuffing attacks against a specific app using obtained ID numbers, in an attempt to complete private information such as phone numbers. The company illegally obtained and sold over 3.8 million pieces of citizens' personal information, making an illicit profit of 73,600 yuan.
case category: criminal_verdict
incident time: 2026-06
keywords: credential stuffing
keywords: data scraping
keywords: personal information trading
keywords: registered architect data leak
keywords: bulk login attempt
keywords: illegal profit from data
keywords: citizen personal information
related risks: Credential Stuffing
related attack tools: Web Scraping Tools
related attack tools: Credential Stuffing Tools
related threat actors: Criminal Organizations
related threat actors: Data Broker
citation: Late-night code hunting: 'Talent recruitment' actually illegal credential stuffing, nationwide registered construction engineers targeted
citation: Midnight Code Hunt: “Talent at Your Door” Exposed as Credential Stuffing Against Registered Constructors
updated: 2026-06-18
version: 1

Company Ordered to Pay 350,000 Yuan for Data Obtained via Credential Stuffing
type: Case
break id: C0354
stix type: report
summary: The Hangzhou Railway Transport Court heard an unfair competition dispute in which the defendant, Zhejiang C Network Technology Company, obtained data belonging to plaintiffs Hangzhou A Technology Company and Hangzhou B Technology Company through credential stuffing and other improper means. The court ordered the defendant to immediately cease the infringement, pay a total of 350,000 yuan in econom
case category: criminal_verdict
incident time: 2019-11
keywords: credential stuffing
keywords: credential filling
keywords: unfair competition
keywords: data acquisition
keywords: Hangzhou Railway Transport Court
keywords: Zhejiang C Network Technology
keywords: Hangzhou A Technology
keywords: Hangzhou B Technology
keywords: economic loss 350000
keywords: civil compensation
related risks: Credential Stuffing
related attack tools: Credential Stuffing Tools
related threat actors: Competitors
citation: Obtaining data via 'credential stuffing'—company ordered to pay 350,000 yuan in compensation
updated: 2026-06-18
version: 1

Nanjing Yuhuatai Court Concludes Credential Stuffing Case Involving Personal Information Infringement
type: Case
break id: C0355
stix type: report
summary: From March 2023 to May 2024, the defendant Zou purchased large volumes of account credentials for QQ Mail, Taobao, Weibo, and other platforms, used credential-stuffing software to identify valid login combinations for a targeted online platform, and sold them. A buyer, Wang, used the purchased credentials to log into victims' accounts and withdraw funds, stealing a total of 518,000 yuan. Zou was c
case category: criminal_verdict
incident time: 2024-05
keywords: credential stuffing
keywords: infringing citizens' personal information
keywords: QQ Mail
keywords: Taobao
keywords: Weibo
keywords: automated login
keywords: credential filling
keywords: account takeover
keywords: Zou
keywords: Nanjing Yuhuatai District Court
related risks: Credential Stuffing
related risks: Login Credential Reuse
related risks: Automated Login Risk
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
related threat actors: Account Dealers
citation: People’s Court Daily: Using credential stuffing software to obtain and sell others’ account credentials
citation: Stop being lazy with same passwords, beware of hackers 'credential stuffing' to steal your money
updated: 2026-06-18
version: 1

Credential Stuffing Attack to Obtain Credit Information Constitutes a Crime
type: Case
break id: C0356
stix type: report
summary: A project manager at a large international trust company illegally obtained citizens' personal information through credential stuffing, constituting the crime of infringing on citizens' personal information, and was sentenced to one year in prison. This case was released as a typical case by the Beijing High People's Court.
case category: criminal_verdict
incident time: 2023-11
keywords: credential stuffing
keywords: credential filling
keywords: infringing on citizens' personal information
keywords: credit information
keywords: project manager
keywords: trust company
keywords: Beijing High People's Court
related risks: Credential Stuffing
related attack tools: Credential Stuffing Tools
related threat actors: Malicious Insiders
citation: Using 'credential stuffing' to obtain credit information constitutes a crime
updated: 2026-06-18
version: 1

Guancheng Hui District Court in Zhengzhou Sentences Defendant in Credential Stuffing Personal Information Theft Case
type: Case
break id: C0357
stix type: report
summary: Between May 2020 and November 2021, the defendant Zhang purchased QQ email accounts and passwords through QQ groups and used credential stuffing techniques to compromise accounts on other websites for profit. The case was tried and adjudicated by the Guancheng Hui District People's Court in Zhengzhou.
case category: criminal_verdict
incident time: 2023-05
keywords: credential stuffing
keywords: personal information theft
keywords: QQ email
keywords: account compromise
keywords: Guancheng Hui District Court
keywords: criminal verdict
keywords: cyber underground economy
keywords: password reuse attack
related risks: Credential Stuffing
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
citation: One set of account passwords for the entire web? Beware of 'credential stuffing' stealing your personal info
updated: 2026-06-18
version: 1

15 Suspects Arrested in Payment Account Takeover Case Cracked by Cyber Police
type: Case
break id: C0358
stix type: report
summary: The Yantai public security cyber division dismantled a payment account fraud case, arresting 15 suspects. The criminal gang illegally obtained user accounts and identity information, exploiting weak payment passwords to repeatedly crack credentials and drain funds from compromised accounts.
case category: criminal_verdict
incident time: 2025-08
keywords: payment password brute force
keywords: credential stuffing
keywords: account takeover
keywords: Yantai cyber police
keywords: illegally obtained personal information
keywords: payment account fraud
keywords: password spraying attack
keywords: identity information theft
keywords: cyber division investigation
keywords: criminal gang payment fraud
related risks: Password Spraying
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Criminal Organizations
citation: “Who Moved My Wallet?” Simple Payment Passwords Led to Account Theft
citation: 15 suspects arrested; cyber police crack theft case due to simple payment passwords
updated: 2026-06-18
version: 1

Door-Gap Squeezing and Password Guessing: Gongshu Police Crack Theft Case
type: Case
break id: C0359
stix type: report
summary: A thief in Hangzhou's Gongshu District first broke into a warehouse by squeezing through a door gap. After the owner upgraded to a combination lock, the thief successfully cracked the code through repeated trial and error and stole again. Police eventually apprehended the suspect and recovered the stolen items.
case category: criminal_verdict
incident time: 2026-01
keywords: password spraying
keywords: trial password
keywords: brute force attack
keywords: door gap intrusion
keywords: theft
keywords: Hangzhou
keywords: Gongshu
keywords: Chaoming Police Station
keywords: physical intrusion
keywords: combination lock
related risks: Password Spraying
related attack tools: Password Dictionaries/Rainbow Tables
citation: Squeezing through door gaps, trying passwords... Gongshu police crack theft case
updated: 2026-06-18
version: 1

Beijing Police Dismantle Credential Stuffing Attack Exploiting Website Vulnerability
type: Case
break id: C0360
stix type: report
summary: In 2023, Beijing police uncovered a case in which a hacker exploited a weak SMS verification API on a recruitment app to conduct credential stuffing attacks. The suspect, surnamed Yu, discovered the website's single signature algorithm and wrote a malicious program to attack the interface, successfully matching over 300,000 registered accounts. Another suspect, Jiao, purchased the program and used
case category: criminal_verdict
incident time: 2023-12
keywords: credential stuffing
keywords: SMS verification vulnerability
keywords: recruitment app
keywords: API attack
keywords: personal data leak
keywords: malicious program
keywords: Yu
keywords: Jiao
keywords: Beijing police
keywords: password spraying
related risks: Password Spraying
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
citation: Public Safety: Reusing Passwords Across Platforms Risks Credential Stuffing Account Theft
citation: One password for multiple platforms? Beware of hackers 'credential stuffing' to steal accounts
updated: 2026-06-18
version: 1

Yantai Police Crack Case of Stolen Payments Due to Weak Passwords
type: Case
break id: C0361
stix type: report
summary: In August 2025, the cybersecurity division of the Yantai Public Security Bureau uncovered a case where funds were illicitly transferred from accounts due to overly simple payment passwords. A criminal gang illegally obtained users' online payment platform accounts and personal identity information, then exploited the vulnerability of weak passwords to repeatedly crack them and drain account funds.
case category: criminal_verdict
incident time: 2025-08
keywords: payment password
keywords: credential stuffing
keywords: online payment platform
keywords: account takeover
keywords: personal information leak
keywords: Yantai police
keywords: criminal gang
keywords: unauthorized transfer
related risks: Password Spraying
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Criminal Organizations
related threat actors: Telecom Fraud Gangs
citation: “Who Moved My Wallet?” Simple Payment Passwords Led to Account Theft
citation: 15 suspects arrested in cyber police crackdown on theft enabled by weak payment passwords - News Channel
updated: 2026-06-18
version: 1

Self-Developed Decryption Program Used Over 2.18 Million Times by Others
type: Case
break id: C0362
stix type: report
summary: Defendant Li built a website offering a cracking program, which was used over 2.18 million times. Zhuo further wrote scripts for batch cracking and extraction, illegally obtaining over 15,000 sets of share links and their extraction passwords. Li was sentenced for providing programs used to invade computer information systems.
case category: criminal_verdict
incident time: 2022-11
keywords: password spraying
keywords: cracking program
keywords: batch cracking
keywords: extraction password
keywords: invade computer information system
keywords: decryption tool
keywords: credential extraction
related risks: Password Spraying
related attack tools: Automation Scripts
related attack tools: Credential Stuffing Tools
related threat actors: Malicious Users
citation: Self-made decryption program used over 2.18 million times by others - China Court Network
updated: 2026-06-18
version: 1

Credential Brute-Force Attack on a Beijing Education Company's Academic Scheduling System Leads to Data Breach
type: Case
break id: C0363
stix type: report
summary: On August 1, 2023, a post on an overseas forum titled 'Over 700,000 Order Records Exposed from an Education Site' indicated a suspected data breach at a Beijing-based education company. An investigation by the Beijing Haidian cyber police found that the company's academic scheduling system transmitted account credentials without encryption, allowing attackers to gain system access through credenti
case category: administrative_enforcement
incident time: 2023-08
keywords: academic scheduling system
keywords: credential brute-force
keywords: data breach
keywords: order information
keywords: Beijing Haidian cyber police
keywords: administrative penalty
keywords: weak password
keywords: unencrypted transmission
related risks: Credential Brute Force
related attack tools: Credential Stuffing Tools
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Malicious Hackers
citation: Beijing Companies Penalized for Failing to Fulfill Cybersecurity Protection Obligations
citation: Ministry of Public Security announces four cybersecurity administrative penalty cases involving weak password accounts and website defacement
updated: 2026-06-18
version: 1

Credential Brute-Force Attack in the Canva Data Breach
type: Case
break id: C0364
stix type: report
summary: In the Canva data breach, the attacker GnosticPlayers used credential stuffing—a form of brute-force attack—to steal user data. The attack involved large-scale automated attempts against login interfaces, leveraging previously leaked credential sets or common password lists to successfully gain access to valid accounts, resulting in the exposure of a large volume of user information.
case category: academic_research
keywords: credential stuffing
keywords: credential brute-force
keywords: Canva breach
keywords: GnosticPlayers
keywords: automated login attack
keywords: password list attack
keywords: login interface exploitation
related risks: Credential Brute Force
related attack tools: Automation Scripts
related attack tools: Credential Stuffing Tools
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Data Broker
citation: A case study of credential stuffing attack: Canva data breach
updated: 2026-06-18
version: 1

Analysis of Brute-Force Attacks Against SSH Servers
type: Case
break id: C0365
stix type: report
summary: A study of authentication logs from SSH servers reveals that a high volume of consecutive failed login attempts serves as a typical indicator of brute-force attacks. Attackers employ automated tools to guess credentials by trying various username and password combinations in an attempt to gain server access. This research analyzes attack patterns and detection methods through case studies.
case category: academic_research
keywords: SSH brute-force
keywords: authentication log analysis
keywords: credential guessing
keywords: automated attack tools
keywords: intrusion detection
keywords: server security
keywords: brute-force attack
related risks: Credential Brute Force
related attack tools: Automation Scripts
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Malicious Hackers
citation: Who is trying to compromise your SSH server? An analysis of authentication logs and detection of bruteforce attacks
updated: 2026-06-18
version: 1

CAUDIT: Mitigating SSH Brute-Force Attacks Through Continuous Auditing
type: Case
break id: C0366
stix type: report
summary: A paper presented at USENIX NSDI '19 introduces CAUDIT, a system for continuously auditing SSH servers to mitigate brute-force attacks. The research highlights that credential guessing traffic constitutes the majority of attack attempts. By detecting anomalous login behavior to defend against credential stuffing, the system achieves an approximate 100-fold reduction in attack attempts.
case category: academic_research
keywords: SSH brute-force mitigation
keywords: CAUDIT system
keywords: credential guessing detection
keywords: NSDI 2019
keywords: USENIX
keywords: continuous auditing
keywords: login anomaly detection
keywords: credential stuffing defense
related risks: Credential Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Malicious Hackers
citation: {CAUDIT}: Continuous auditing of {SSH} servers to mitigate {Brute-Force} attacks
updated: 2026-06-18
version: 1

Beijing Education Company’s Scheduling System Breached via Password Brute-Force, Leading to Data Leak
type: Case
break id: C0367
stix type: report
summary: On August 1, 2023, a post on an overseas forum exposed over 700,000 order records from a Beijing-based education company. An investigation by Haidian cyber police found that the company’s academic scheduling system transmitted account credentials without encryption, making it susceptible to brute-force attacks. Attackers cracked passwords through brute-force methods, gained access, and exported la
case category: administrative_enforcement
incident time: 2023-08
keywords: academic scheduling system
keywords: password brute-force
keywords: data leak
keywords: education company
keywords: Haidian cyber police
keywords: weak password
keywords: backend data
keywords: administrative fine
keywords: order information exposure
related risks: Credential Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Malicious Hackers
citation: Beijing Companies Penalized for Failing to Fulfill Cybersecurity Protection Obligations
citation: Ministry of Public Security announces four cybersecurity administrative penalty cases involving weak password accounts and website defacement - Tencent
updated: 2026-06-18
version: 1

Cracking User Passwords with Hashcat in HTB Perfection Machine
type: Case
break id: C0368
stix type: report
summary: During the penetration test of the HTB Perfection machine, after gaining shell access as user susan via SSTI injection, an SQLite database file was discovered in the user's home directory. The password hash was identified as SHA256. Based on the password format rules leaked in emails (firstname_firstnameReversed_randomDigits), Hashcat was used with a dictionary and mask attack to successfully reco
case category: security_incident
incident time: 2024-03
keywords: hashcat
keywords: sha256
keywords: password cracking
keywords: ssti injection
keywords: sqlite
keywords: dictionary attack
keywords: mask attack
keywords: htb perfection
keywords: credential recovery
related risks: Credential Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
citation: Perfection
citation: HTB Perfection write-up: Ruby-based SSTI injection, use of password cracking tool hashcat
updated: 2026-06-18
version: 1

CISA Alert: Cyber Attackers Targeting U.S. Organizations with Password Spraying
type: Case
break id: C0369
stix type: report
summary: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning that malicious cyber actors are increasingly using password spraying, a variant of brute-force credential attacks, against U.S. and overseas organizations. This technique attempts a small set of common passwords against many accounts to evade account lockout policies.
case category: vulnerability_advisory
incident time: 2018-03
keywords: CISA
keywords: password spraying
keywords: credential brute-force
keywords: account lockout policy
keywords: TTPs
keywords: targeted intrusion
keywords: U.S. organizations
related risks: Credential Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
citation: Brute Force Attacks Conducted by Cyber Actors - CISA
updated: 2026-06-18
version: 1

GSM Hijacking and SMS Sniffing Used to Steal Verification Codes for Fraud
type: Case
break id: C0370
stix type: report
summary: In 2018, attackers across multiple regions in China used GSM hijacking and SMS sniffing techniques to intercept SMS verification codes while victims slept. By combining these codes with personally identifiable information obtained through social engineering, they conducted unauthorized transactions and fraudulent online loans. The attack exploited vulnerabilities in the 2G network to capture SMS m
case category: security_incident
incident time: 2018-08
keywords: GSM hijacking
keywords: SMS sniffing
keywords: IMSI catcher
keywords: verification code interception
keywords: 2G vulnerability
keywords: SIM swapping
keywords: payment fraud
keywords: social engineering attack
related risks: Verification Code Brute Force
related attack tools: SIM Swap Toolkit
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
citation: Henan High Court: How to Prevent Overnight SMS-Sniffing Account Theft
updated: 2026-06-18
version: 1

WordPress App Builder Plugin OTP Brute Force Vulnerability (CVE-2024-9302)
type: Case
break id: C0371
stix type: report
summary: Disclosed in October 2024, a critical vulnerability (CVE-2024-9302) exists in the WordPress App Builder plugin version 5.3.7 and earlier. The password reset function's OTP verification mechanism lacks brute-force protection, allowing unauthenticated attackers to enumerate OTP codes and take over any user account, including administrators. The CVSS score is 9.8.
case category: vulnerability_advisory
incident time: 2024-10
keywords: WordPress
keywords: App Builder
keywords: CVE-2024-9302
keywords: OTP brute force
keywords: verification code brute force
keywords: Wordfence
keywords: password reset
keywords: privilege escalation
keywords: plugin vulnerability
keywords: CVSS 9.8
related risks: Verification Code Brute Force
citation: NVD - CVE-2024-9302
updated: 2026-06-18
version: 1

Keycloak Separates Password and OTP Brute-Force Protection to Prevent OTP Bypass Attacks
type: Case
break id: C0372
stix type: report
summary: In 2024, a security flaw was discovered in the open-source identity management software Keycloak, where an attacker who obtained a user's password could brute-force the OTP verification code, bypassing two-factor authentication. To address this, Keycloak proposed an enhancement in issue #46164 to separate password and OTP brute-force protection policies, preventing OTP brute-force attacks that cou
case category: vulnerability_advisory
incident time: 2024
keywords: Keycloak OTP brute-force
keywords: two-factor authentication bypass
keywords: account takeover
keywords: identity management flaw
keywords: OTP brute-force protection
keywords: Keycloak issue 46164
related risks: Verification Code Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Account Takeover Groups
citation: Separate password and OTP brute force protection to prevent OTP
updated: 2026-06-18
version: 1

Brute-Force Attacks on SMS Verification Codes for IoT Device Account Takeover
type: Case
break id: C0373
stix type: report
summary: A 2018 academic paper identifies a vulnerability in the password reset mechanism of IoT device accounts that relies on SMS verification codes. Attackers can use automated tools to brute-force the SMS codes and gain unauthorized account access. The study develops an automation tool to demonstrate account takeover by brute-forcing SMS verification codes.
case category: academic_research
incident time: 2018
keywords: IoT device
keywords: SMS verification code
keywords: brute-force attack
keywords: account takeover
keywords: authentication bypass
keywords: automated attack tool
keywords: password reset vulnerability
keywords: SMS brute forcing
related risks: Verification Code Brute Force
related attack tools: Automation Scripts
related attack tools: Password Dictionaries/Rainbow Tables
citation: Cracking IoT Device User Account via Brute-force Attack to SMS
updated: 2026-06-18
version: 1

OTP Brute-Force Attack Payload Lists Published on GitHub
type: Case
break id: C0374
stix type: report
summary: Security researchers have publicly released dedicated dictionary files on GitHub containing all possible combinations of 4-digit, 5-digit, and 6-digit numeric verification codes. These payloads can be used for brute-force testing or attacks against applications lacking rate limiting.
case category: security_incident
keywords: OTP brute-force
keywords: dictionary file
keywords: numeric verification code
keywords: GitHub payload
keywords: rate limiting bypass
keywords: brute-force payload
keywords: security research
keywords: 4-digit OTP
keywords: 6-digit OTP
related risks: Verification Code Brute Force
related attack tools: Password Dictionaries/Rainbow Tables
citation: GitHub - iamtutu/OTP_bruteforce_payloads: 4, 5, and 6 OTP for
updated: 2026-06-18
version: 1

Three Sentenced for Stealing 370,000 Yuan in Tips by Hacking Accounts
type: Case
break id: C0375
stix type: report
summary: A creator surnamed Liu in Nanjing was suddenly unable to log into an account used for seven years. After recovering it, Liu discovered over 8,000 yuan in tips had been stolen. Police found that three individuals, including Lin, used illegal software to obtain platform account credentials, replaced the bound WeChat accounts, and withdrew the funds. By the time of arrest, Li had stolen 190,000 yuan
case category: criminal_verdict
incident time: 2025-05
keywords: account hijacking
keywords: tips theft
keywords: theft crime
keywords: content platform
keywords: password cracking
keywords: WeChat withdrawal
keywords: cyber theft
keywords: criminal verdict
related risks: Account Takeover
related attack tools: Credential Stuffing Tools
related attack tools: Password Dictionaries/Rainbow Tables
related threat actors: Account Takeover Groups
citation: Seven-Year Writing Account Stolen and Reward Balance Withdrawn
updated: 2026-06-18
version: 1

Google TAG Discloses Phishing and Cookie Theft Campaign Targeting YouTube Creators
type: Case
break id: C0376
stix type: report
summary: Google Threat Analysis Group disclosed that, since 2019, financially motivated attackers have targeted YouTube creators with phishing campaigns. The attackers impersonated software, games, or collaboration opportunities to trick targets into downloading malware capable of stealing cookies, which were then used to hijack YouTube channels. Google said it identified about 15,000 actor accounts and 1,011 related domains, and blocked around 1.6 million phishing messages.
case category: security_incident
keywords: phishing email
keywords: account takeover
keywords: YouTube
keywords: Google TAG
keywords: cookie theft
keywords: fake collaboration offer
keywords: malware
keywords: social engineering
related risks: Account Takeover
related attack tools: Phishing Kits
related threat actors: Account Takeover Groups
citation: Phishing campaign targets YouTube creators with cookie theft malware
updated: 2026-06-18
version: 1

To Recover Players' Accounts, They Even Fake Online Romance with Account Thieves
type: Case
break id: C0377
stix type: report
summary: The report reveals how sellers in online game account trading exploit initial email access to reclaim sold accounts. After-sales staff from an account trading platform tracked down the thief through offline investigation and fake online romance, ultimately handing them over to the police. The case shows how thieves use the initial email—the highest authority credential—to steal accounts.
case category: news_report
incident time: 2022-11
keywords: Steam
keywords: account theft
keywords: initial email
keywords: account recovery
keywords: fake online romance
keywords: account trading platform
keywords: after-sales investigation
related risks: Account Takeover
related threat actors: Malicious Users
related threat actors: Malicious Players
citation: To help players recover accounts, they even resort to online dating with account thieves - Tencent News
updated: 2026-06-18
version: 1

Bypassing Passwords Entirely: Tencent Assists in Dismantling a Massive Account Theft Ring Involving Over 30 Million Yuan
type: Case
break id: C0378
stix type: report
summary: Tencent assisted law enforcement in taking down a criminal chain that used trojan programs to steal gamers' accounts and virtual equipment, with the total amount involved exceeding 30 million yuan. The criminals employed a novel theft method by stealing 'login state' data to bypass password verification and directly take over user accounts.
case category: criminal_verdict
incident time: 2025-02
keywords: trojan program
keywords: login state theft
keywords: game account
keywords: virtual equipment
keywords: Tencent
keywords: account theft ring
keywords: bypass password verification
keywords: cyber black market
related risks: Account Takeover
related attack tools: Trojan Virus
related attack tools: Cookie Login Tools
related threat actors: Account Takeover Groups
citation: Police Crack Down on Game Account Theft Using Login State Data
updated: 2026-06-18
version: 1

Trojan Account Theft and Impersonation Scam: Three Suspects Criminally Detained by Nanshan Police in Shenzhen
type: Case
break id: C0379
stix type: report
summary: In 2021, Nanshan police in Shenzhen cracked a series of impersonation fraud cases. The suspects, Lin and his wife Liang, created Trojan horse links to steal chat app account credentials and then defrauded the victims' friends and relatives. Lin learned the techniques from fraud rings, purchased a large number of accounts for wide-net phishing, and laundered the proceeds through specific gambling platforms or other laundering channels.
case category: criminal_verdict
incident time: 2021-12
keywords: Trojan account theft
keywords: impersonation scam
keywords: chat app credential theft
keywords: Shenzhen Nanshan police
keywords: account hijacking
keywords: money laundering
keywords: gambling platform
keywords: Trojan horse link
related risks: Account Takeover
related risks: Game Account Laundering
related attack tools: Trojan Virus
related threat actors: Telecom Fraud Gangs
citation: Shenzhen Nanshan police crack a series of acquaintance-impersonation fraud cases
updated: 2026-06-18
version: 1

Credential Stuffing Gang Steals 12,900 Accounts, Involving Nearly 10 Million Yuan
type: Case
break id: C0380
stix type: report
summary: Yancheng police cracked a credential stuffing case where suspects repeatedly attempted logins on a major e-commerce platform using home broadband addresses, successfully stealing 12,900 accounts with an involved amount of nearly 10 million yuan. The case is under further investigation.
case category: criminal_verdict
incident time: 2021-11
keywords: credential stuffing
keywords: account takeover
keywords: Yancheng police
keywords: e-commerce platform
keywords: home broadband
keywords: account theft
keywords: cyber black market
keywords: criminal investigation
related risks: Account Takeover
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Yancheng Police Crack Credential-Stuffing Account Theft Case Involving 12,900 Accounts
updated: 2026-06-18
version: 1

Photo Studio Anniversary Recharge Scam Ends in Closure and Flight, Professional Closer Sentenced
type: Case
break id: C0381
stix type: report
summary: A photo studio in Ningbo, Zhejiang, lured long-time members like Wang Xue into recharging for a grand prize under the guise of an anniversary event. After collecting over 1.4 million yuan in prepayments, staff blocked customers and shut down the business. Investigation revealed the studio was taken over by Zheng at zero cost and manipulated by a planning company specializing in defrauding consumer
case category: criminal_verdict
incident time: 2023-03
keywords: professional business closer
keywords: photo studio
keywords: recharge scam
keywords: prepayment fraud
keywords: absconding with funds
keywords: fraud conviction
keywords: Ningbo
keywords: consumer rights
keywords: planning company
related risks: Merchant Disappearance / Runaway
related threat actors: Malicious Merchants
related threat actors: Malicious Users
citation: Supreme People's Court Typical Prepaid-Consumption Case: Zheng Moushun et al. Fraud Case
updated: 2026-06-18
version: 1

Shanghai's First Professional Store Closer Tao Sentenced to 5 Years for Zero-Yuan Gym Takeover and Fleecing
type: Case
break id: C0382
stix type: report
summary: Defendant Tao, in less than one year, took over four failing fitness clubs in Shanghai through zero-yuan transfers, lured over 200 consumers into prepaying 750,000 yuan in membership fees with low prices, then quickly closed the gyms and absconded while defaulting on rent and wages. Tao concealed his role as the actual controller behind a nominal legal representative and was ultimately convicted o
case category: criminal_verdict
incident time: 2024-05
keywords: professional store closer
keywords: contract fraud
keywords: gym fleece
keywords: prepaid membership
keywords: zero-yuan transfer
keywords: nominal legal representative
keywords: Shanghai Baoshan District
keywords: consumer prepayment
keywords: absconding with funds
related risks: Merchant Disappearance / Runaway
citation: Shanghai Hongkou Procuratorate: First Criminal Case Against a Professional Store Closer
updated: 2026-06-18
version: 1

Multiple Ningbo Professional Store Closers Sentenced for Fraud in Prepaid Consumer Scam
type: Case
break id: C0383
stix type: report
summary: In February 2023, Qian, Li, and others took over a struggling prepaid consumer store in Ningbo, lured consumers with low-price promotions to top up their cards, then abruptly closed the store and disappeared, absconding with large amounts of prepaid funds. The Ningbo Yinzhou District People's Court found their actions constituted fraud, sentencing several 'professional store closers' to criminal p
case category: criminal_verdict
incident time: 2023-02
keywords: professional store closers
keywords: prepaid consumer fraud
keywords: fraud conviction
keywords: Ningbo Yinzhou District People's Court
keywords: prepaid card scam
keywords: consumer recharge fraud
keywords: organized prepaid fraud
keywords: store closure scam
related risks: Merchant Disappearance / Runaway
related threat actors: Payment Fraud Groups
citation: Prepaid consumer businesses abscond with funds; multiple "professional store closers" sentenced - China Court Network
updated: 2026-06-18
version: 1

Qinghai Decoration Firm Absconds After Low-Price Renovation Contracts, Suspects Sentenced
type: Case
break id: C0384
stix type: report
summary: In 2024, Xining police cracked a contract fraud case. A decoration engineering company used false advertising and low-price tactics to lure homeowners into signing renovation contracts. After collecting deposits exceeding 50% of the contract value, the actual controller, knowing the company lacked the ability to perform, carried out only token construction before absconding with the funds. In Sept
case category: criminal_verdict
incident time: 2024
keywords: contract fraud
keywords: decoration company
keywords: low-price contract
keywords: absconding with funds
keywords: high deposit
keywords: Xining police
keywords: economic crime
keywords: decoration engineering
keywords: false advertising
keywords: Qinghai
related risks: Merchant Disappearance / Runaway
related threat actors: Malicious Merchants
citation: Qinghai Public Security Typical Economic Crime Cases: Decoration Contract Fraud Case
updated: 2026-06-18
version: 1

Chengdu Qingyang Police Dismantle Small-Loan Fraud Ring Preparing to Abscond with Funds
type: Case
break id: C0385
stix type: report
summary: In March 2026, Chengdu Qingyang police dismantled a criminal gang that defrauded over 30 victims of 2 million yuan under the guise of small loans. The group used staged lures and contract signing before planning to flee with the money. During the operation, police seized fraud scripts, contracts, and other evidence, and traced the case upstream to a telemarketing company.
case category: criminal_verdict
incident time: 2026-03
keywords: small-loan fraud
keywords: abscond with funds
keywords: Chengdu Qingyang police
keywords: fraud scripts
keywords: telemarketing lead generation
keywords: contract fraud
keywords: disappearing scam
keywords: gang takedown
related risks: Merchant Disappearance / Runaway
related threat actors: Telecom Fraud Gangs
citation: Preparing to abscond with funds! Over 30 victims scammed out of 2 million yuan; Chengdu Qingyang police dismantle a "small loan"
updated: 2026-06-18
version: 1

Yueqing Employee Convicted for Absconding with Company Funds
type: Case
break id: C0386
stix type: report
summary: In late August 2025, the head of a Wenzhou trading company reported that an employee had misappropriated company funds using their position and then disappeared. Following intervention by the Yueqing People's Procuratorate, the employee was sentenced to imprisonment for embezzlement. The case involved losses from overseas business, and the procuratorate assisted the company in recovering part of t
case category: criminal_verdict
incident time: 2025-08
keywords: embezzlement
keywords: employee absconding with funds
keywords: Yueqing People's Procuratorate
keywords: Wenzhou trading company
keywords: overseas business loss
keywords: criminal verdict
keywords: internal controls failure
related risks: Merchant Disappearance / Runaway
related threat actors: Malicious Insiders
citation: Procuratorate Daily: Yueqing Prosecutors Handle Overseas Employee Embezzlement Case
updated: 2026-06-18
version: 1

Gym Owner Tao Sentenced for Taking Over Multiple Stores and Absconding with Funds
type: Case
break id: C0387
stix type: report
summary: Between October 2023 and September 2024, Tao took over several failing gyms without the ability to operate them, aggressively sold long-term memberships and personal training sessions by promising high commissions, defrauded over 750,000 yuan in membership fees, then closed the stores and absconded. The court sentenced Tao to five years in prison for contract fraud and imposed a fine.
case category: criminal_verdict
incident time: 2023-10
keywords: contract fraud
keywords: professional store closer
keywords: gym absconding
keywords: Tao
keywords: prepaid consumption
keywords: membership fee fraud
keywords: takeover and abscond
keywords: Shanghai Hongkou District
keywords: criminal verdict
related risks: Merchant Disappearance / Runaway
citation: Consumer Rights Day Special: Shanghai’s First “Professional Closure Operator” Sentenced
citation: "Taking over" a gym just to abscond with funds! The money-grabbing tactics of "professional store closers" exposed - Crime
updated: 2026-06-18
version: 1

Business Closures and Absconding Dominate Prepaid Consumption Disputes
type: Case
break id: C0388
stix type: report
summary: From 2022 to the first half of 2025, the Beijing Xicheng District People's Court saw a sharp rise in prepaid consumption dispute cases. The primary cause was operators shutting down and absconding, making contract fulfillment impossible. Some operators maliciously evaded debts by transferring funds in advance or changing legal representatives, severely infringing on consumer rights.
case category: news_report
incident time: 2025-08
keywords: prepaid consumption disputes
keywords: business closure absconding
keywords: consumer rights protection
keywords: contract disputes
keywords: Beijing Xicheng District People's Court
keywords: malicious debt evasion
keywords: legal representative change
keywords: prepaid cards
related risks: Merchant Disappearance / Runaway
citation: What to do when prepaid consumption leads to fund absconding and refund difficulties? Court offers guidance - Evidence - Court
updated: 2026-06-18
version: 1

SEC Suspends Trading in 255 Dormant Shell Companies
type: Case
break id: C0389
stix type: report
summary: The U.S. Securities and Exchange Commission launched "Operation Shell Expel," temporarily suspending trading in the securities of 255 dormant shell companies. These companies lacked ongoing operations and were highly susceptible to being misused for fraudulent purposes.
case category: administrative_enforcement
incident time: 2014
keywords: SEC
keywords: Operation Shell Expel
keywords: dormant shell companies
keywords: trading suspension
keywords: microcap fraud
keywords: anti-fraud enforcement
keywords: securities regulation
keywords: shell company
related risks: Ghost Stores
citation: SEC Continues Microcap Fraud Crackdown, Proactively Suspends
updated: 2026-06-18
version: 1

SEC Suspends Trading in 379 Dormant Shell Companies in a Single Day
type: Case
break id: C0390
stix type: report
summary: The SEC intensified its crackdown by suspending trading in 379 dormant shell companies in a single day, setting a historic record. These companies had long failed to disclose information and remained inactive, representing typical zombie firms.
case category: administrative_enforcement
incident time: 2012
keywords: SEC
keywords: dormant shell companies
keywords: trading suspension
keywords: microcap
keywords: disclosure failures
keywords: zombie companies
keywords: securities fraud
keywords: regulatory enforcement
keywords: U.S. Securities and Exchange Commission
related risks: Ghost Stores
citation: SEC Microcap Fraud-Fighting Initiative Expels 379 Dormant Shell
updated: 2026-06-18
version: 1

Finding a “Money-Making Scheme” in “Zombie Stores”
type: Case
break id: C0391
stix type: report
summary: In 2025, a young man named Xiao Lin exploited a loophole in Tmall's platform rules by identifying unattended “zombie stores” that would not ship orders. He placed bulk orders and then filed complaints demanding compensation for delayed or out-of-stock shipments, draining the store deposits. Over 100 Tmall stores nationwide had their deposits emptied, with total losses exceeding 1 million yuan and
case category: criminal_verdict
incident time: 2025-08
keywords: Tmall zombie stores
keywords: deposit fraud
keywords: delayed shipment compensation
keywords: platform rule loophole
keywords: Xiao Lin
keywords: Taizhou
keywords: complaint claim
related risks: Ghost Stores
related threat actors: Malicious Users
citation: Finding a 'Money-Making Path' in 'Zombie Stores'
updated: 2026-06-18
version: 1

Too Many Zombies: Exploring Challenges and Motivations for (Not) Deleting Unused Online Accounts
type: Case
break id: C0392
stix type: report
summary: This study investigates the challenges and motivations behind users' failure to delete unused online accounts. These abandoned accounts, which store potentially sensitive data but remain unmanaged, become 'zombie accounts' in the digital world, analogous to 'zombie shops' on e-commerce platforms that have ceased operations yet retain active storefronts.
case category: academic_research
keywords: zombie accounts
keywords: unused account deletion
keywords: online account management
keywords: digital hygiene
keywords: user behavior
keywords: data privacy
keywords: abandoned accounts
keywords: account dormancy
keywords: cybersecurity awareness
keywords: zombie stores
related risks: Ghost Stores
citation: Too Many Zombies: Exploring Challenges and Motivations for (Not) Deleting Unused Online Accounts
updated: 2026-06-18
version: 1

Inmate Recounts Myanmar Scam Camp: Raising Accounts with Beauty Videos, Beaten with Electric Batons for Bans
type: Case
break id: C0393
stix type: report
summary: An inmate named Li Jun worked over ten hours daily as an account raiser in a Myanmar scam compound, posting beauty videos on Douyin and Kuaishou to build follower bases. Accounts that were banned resulted in electric baton beatings; matured accounts were handed to other teams for fraud operations.
case category: news_report
incident time: 2025-02
keywords: Myanmar scam compounds
keywords: account raising
keywords: Douyin
keywords: Kuaishou
keywords: beauty video
keywords: account ban
keywords: electric baton
keywords: inmate
keywords: automated account farming
related risks: Automated Account Seasoning
related attack tools: Automation Scripts
related attack tools: Auto-Posting Bots
related threat actors: Telecom Fraud Gangs
related threat actors: Scam Compound Operator
citation: Dialogue | Inmates Reenact Telecom Fraud in Northern Myanmar: Posting Beauty Videos to 'Farm Accounts,' Beaten with Electric Batons for Account Bans...
updated: 2026-06-18
version: 1

Illegal Acquisition of Personal Data to Run an 'Account Farming Factory'
type: Case
break id: C0394
stix type: report
summary: Police in Yingtan, Jiangxi, uncovered a case of infringing citizens' personal information. Since 2021, the suspect surnamed Xu illegally purchased over ten million real-name email accounts and passwords, used automated scripts to mass-farm accounts and raise their levels, then sold the matured accounts to minors to bypass game anti-addiction systems. Over a hundred phones running farming scripts s
case category: criminal_verdict
incident time: 2026-05
keywords: account farming factory
keywords: real-name email accounts
keywords: passwords
keywords: automated scripts
keywords: game anti-addiction bypass
keywords: minors
keywords: infringing citizens' personal information
keywords: Yingtan Jiangxi
related risks: Automated Account Seasoning
related attack tools: Automation Scripts
related threat actors: Account Dealers
citation: Illegal Purchase of Personal Information to Open an 'Account Farming Factory' - City and County News - Jiangxi Political and Legal Network
updated: 2026-06-18
version: 1

Two Men Illegally Obtained Over 3 Million Personal Records to Farm and Sell Accounts in 'Love and Deepspace'
type: Case
break id: C0395
stix type: report
summary: Lin and Xie illegally acquired more than 3 million pieces of citizens' personal information, developed automated scripts for the game 'Love and Deepspace', batch-registered and real-name verified game accounts, used scripts to auto-login, check in, and complete daily tasks to farm the accounts, then sold them through online stores, making over 1.6 million yuan in profit. They were prosecuted and s
case category: criminal_verdict
incident time: 2025-05
keywords: Love and Deepspace
keywords: automated scripts
keywords: batch registration
keywords: account farming
keywords: personal information
keywords: game accounts
keywords: illegal acquisition
keywords: real-name verification
keywords: online store sales
related risks: Automated Account Seasoning
related attack tools: Bulk Account Registration Tool
related attack tools: Automation Scripts
related threat actors: Account Dealers
related threat actors: Gold Farming Studios
citation: Procuratorate Daily: Two Men Convicted for Farming Love and Deepspace Accounts with Stolen Personal Data
updated: 2026-06-18
version: 1

Huaxi Procuratorate: Organizing Phone Number Trading and Douyin Account Operations Leads to Conviction
type: Case
break id: C0396
stix type: report
summary: In September 2023, He organized personnel to buy and sell mobile phone numbers and to register, operate, and sell Douyin accounts for illegal profit. After purchasing large batches of phone numbers, the group divided work among account registration, video posting to attract followers, and customer matching for account sales; some accounts were later used in illegal activities. The Huaxi District People's Procuratorate prosecuted He for infringing citizens' personal information, and the court sentenced He to imprisonment.
case category: criminal_verdict
incident time: 2023-09
keywords: account farming
keywords: infringing personal information crime
keywords: Douyin accounts
keywords: mobile phone numbers
keywords: account registration
keywords: account operations
keywords: illegal account sales
keywords: Huaxi District People's Procuratorate
related risks: Automated Account Seasoning
related attack tools: Automation Scripts
related attack tools: SMS Verification Code Platform
related threat actors: Account Dealers
citation: Case explanation
updated: 2026-06-18
version: 1

Over 200 Million Unverified Accounts Tied to Massive Black-Market Account Farming Platform Busted by Jiangsu Police
type: Case
break id: C0397
stix type: report
summary: Police in Xuzhou, Jiangsu Province dismantled a large-scale underground account farming platform used to mass-manage unverified QQ accounts for cybercriminals, linking over 200 million non-real-name accounts and facilitating illegal activities.
case category: criminal_verdict
keywords: account farming
keywords: unverified accounts
keywords: QQ accounts
keywords: bulk account management
keywords: cyber black market
keywords: Jiangsu police
keywords: Xuzhou cyber division
keywords: black-market automation
related risks: Automated Account Seasoning
related threat actors: Account Dealers
citation: Ministry of Public Security: Jiangsu Xuzhou Police Dismantle Non-Real-Name QQ Account Black Market Platform
updated: 2026-06-18
version: 1

Account Warming Crosses Legal Red Line, Leads to Prison Sentence
type: Case
break id: C0398
stix type: report
summary: The defendant Li discovered an overseas pornographic website in 2023 and used pornographic posts to attract traffic and warm up accounts. He collected pornographic images and videos, posting 879 threads containing 906 short videos on the site, of which 831 were identified as obscene. He attracted netizens to add his WeChat. He was sentenced to 8 months in prison for the crime of disseminating obsc
case category: criminal_verdict
incident time: 2025-09
keywords: disseminating obscene materials
keywords: account warming
keywords: pornographic website
keywords: obscene videos
keywords: social media traffic diversion
keywords: overseas website
keywords: WeChat
keywords: criminal verdict
related risks: Automated Account Seasoning
citation: Pornographic Traffic Diversion Violates the Law; Illegal Account Farming Leads to Prosecution
citation: 'Account Farming' Crosses Legal Red Line, Results in Prison Sentence!
updated: 2026-06-18
version: 1

WeChat Account Farming and Resale to Overseas Fraud Rings
type: Case
break id: C0399
stix type: report
summary: China Peace reported that a gang led by Lu specialized in WeChat account farming, raising account activity through Moments posts, likes, WeChat Pay activation, and step-count activity before selling the accounts to overseas fraud rings and providing unblocking support. From November 2019 to August 2020, Lu's group sold more than 1,000 WeChat accounts and gained over 2.2 million yuan illegally; Wen and others sold more than 380 accounts and gained over 1 million yuan. Some of the sold accounts were linked to more than 40 fraud cases in Lianyungang, Tianjin, Shenzhen, and other places.
case category: criminal_verdict
incident time: 2021-07
keywords: account farming
keywords: WeChat account farming
keywords: social media account farming
keywords: WeChat account selling
keywords: telecom fraud
keywords: Lianyungang
keywords: helping information network crimes
keywords: account unblocking
keywords: pig butchering scam
keywords: black market accounts
related risks: Automated Account Seasoning
related attack tools: Black SIM Cards
related attack tools: Mass Control Systems
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
citation: More than 1,000 WeChat Accounts Farmed and Sold, Linked to over 40 Fraud Cases; Lianyungang Haizhou Procuratorate Approves Arrest of Two Suspects
citation: Correcting Misconceptions in the Legal Characterization of Social Media Account Farming
updated: 2026-06-18
version: 1

Beijing Police Dismantle a Criminal Gang Providing 'Account Farming' and Other Underground Cyber Services
type: Case
break id: C0400
stix type: report
summary: In June 2021, the Mentougou cyber security division of Beijing police discovered individuals developing specialized software for 'account farming' and 'group spamming,' offering underground cyber services to downstream crimes. The gang used technical means to bulk-maintain account activity and lower risk scores, supplying these accounts for use in fraud, gambling, and other illegal activities.
case category: criminal_verdict
incident time: 2022-01
keywords: account farming
keywords: group spamming
keywords: underground cyber services
keywords: account activity maintenance
keywords: Mentougou cyber security
keywords: Beijing police
keywords: downstream crime
keywords: automated account nurturing
keywords: fraud enablement
keywords: gambling enablement
related risks: Automated Account Seasoning
related attack tools: Mass Control Systems
related attack tools: Automation Scripts
related attack tools: Cloud Phone
related attack tools: Multi-Instance Tools
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
related threat actors: Online Gambling Gangs
related threat actors: Criminal Organizations
citation: Ministry of Public Security Announces Typical Account Black-Market Cases in Operation Duanhao
updated: 2026-06-18
version: 1

Microsoft Discloses Tycoon2FA AiTM Phishing Kit Operating at Scale
type: Case
break id: C0401
stix type: report
summary: In March 2026, Microsoft disclosed how the Tycoon2FA adversary-in-the-middle phishing kit operated at scale. The phishing-as-a-service kit can proxy a fake login flow, induce victims to enter credentials and complete MFA, and steal session cookies to bypass MFA protections.
case category: security_incident
incident time: 2026-03
keywords: Tycoon2FA
keywords: phishing kit
keywords: adversary-in-the-middle
keywords: session cookie hijacking
keywords: MFA bypass
keywords: Microsoft 365
keywords: credential theft
keywords: phishing as a service
keywords: reverse proxy
keywords: Any.run
related risks: Login Credential Theft
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Telecom Fraud Gangs
related threat actors: Account Takeover Groups
citation: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
updated: 2026-06-18
version: 1

Slack Flaw Allowed Attackers to Force User Redirects and Steal Session Cookies
type: Case
break id: C0402
stix type: report
summary: In 2019, a researcher on a bug bounty platform discovered a vulnerability in Slack that allowed attackers to forcibly redirect users to a rogue session, enabling theft of their session cookies. The flaw granted access to any data shared within Slack and posed a serious threat to numerous organizations. Slack patched the issue within 24 hours.
case category: vulnerability_advisory
incident time: 2019
keywords: Slack
keywords: session redirect
keywords: cookie theft
keywords: session hijacking
keywords: bug bounty
keywords: web vulnerability
keywords: OAuth
keywords: login credential theft
related risks: Login Credential Theft
related attack tools: Cookie Login Tools
related attack tools: Phishing Kits
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Malicious Hackers
citation: HackerOne Report #737140: Mass Account Takeovers Using HTTP Request Smuggling in Slack
updated: 2026-06-18
version: 1

Exploiting XSS to Steal Cookies for Admin Session Hijacking
type: Case
break id: C0403
stix type: report
summary: On March 14, 2026, a security researcher set up an XSS attack environment by injecting a malicious script into a message board. When an administrator reviewed the message, the payload was triggered, stealing their cookie containing the PHPSESSID. Using BurpSuite to replace the cookie, the researcher gained direct access to the admin panel without a username or password, fully reproducing the attac
case category: academic_research
incident time: 2026-03
keywords: XSS cookie theft
keywords: session hijacking attack
keywords: PHPSESSID
keywords: BurpSuite cookie manipulation
keywords: stored XSS payload
keywords: admin panel takeover
keywords: BlueLotus_XSSReceiver
keywords: attack chain reproduction
related risks: Login Credential Theft
related attack tools: Packet Capture Tools
related attack tools: Packet Sending/Modification Tools
related attack tools: Cookie Login Tools
related threat actors: Malicious Hackers
citation: [XSS] Stealing User Cookies via XSS - Tencent Cloud Developer Community
updated: 2026-06-18
version: 1

Cookie Theft to Business Email Compromise: Attackers Use AiTM Phishing Sites as Entry Point
type: Case
break id: C0404
stix type: report
summary: Microsoft security researchers discovered that attackers used adversary-in-the-middle (AiTM) phishing sites to steal user session cookies. Even when the targeted organization had multi-factor authentication (MFA) enabled, attackers could use the stolen cookies containing MFA claims to bypass authentication and directly access user accounts. The attackers then accessed finance-related emails and fi
case category: news_report
incident time: 2022-07
keywords: AiTM phishing
keywords: adversary-in-the-middle attack
keywords: cookie theft
keywords: session hijacking
keywords: business email compromise
keywords: BEC
keywords: MFA bypass
keywords: Microsoft security team
keywords: financial fraud
keywords: session cookie theft
related risks: Login Credential Reuse
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: Cookie Login Tools
related attack tools: Phishing Kits
related attack tools: Infostealers
related threat actors: Telecom Fraud Gangs
related threat actors: Account Takeover Groups
citation: From Cookie Theft to BEC: Attackers Use AiTM Phishing Sites as Entry...
updated: 2026-06-18
version: 1

Credentials Still the 'Achilles' Heel'? Cisco's Latest Report Reveals New Threats from Old Attack Patterns
type: Case
break id: C0405
stix type: report
summary: The 2025 Cisco Cybersecurity Readiness Index reports that identity-based attacks accounted for 60% of Cisco Talos incident response cases. Attackers use stolen or abused valid accounts to support initial access, lateral movement, and privilege escalation, exposing identity-security risks from credential reuse, phishing, and abused cloud access tokens.
case category: news_report
incident time: 2025-10
keywords: Cisco
keywords: threat report
keywords: login credentials
keywords: credential reuse
keywords: credential stuffing
keywords: phishing attacks
keywords: OAuth tokens
keywords: cloud security
keywords: lateral movement
related risks: Login Credential Reuse
related attack tools: Credential Stuffing Tools
related attack tools: Phishing Kits
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: SaaS OAuth Abuse Tool
related threat actors: Account Takeover Groups
citation: 2025 Cisco Cybersecurity Readiness Index
updated: 2026-06-18
version: 1

Nanjing Yuhuatai District Court Concludes Credential Stuffing Personal Information Infringement Case
type: Case
break id: C0406
stix type: report
summary: From March 2023 to May 2024, defendant Zou illegally purchased account credentials for QQ Mail, Taobao, and Weibo, using credential stuffing tools to identify valid logins for an online platform and sold them to Wang. Wang then directly logged into others' accounts to withdraw funds, stealing a total of 518,000 yuan. Zou was sentenced to three years and six months in prison.
case category: criminal_verdict
incident time: 2024-05
keywords: credential stuffing
keywords: personal information infringement
keywords: QQ Mail
keywords: Taobao
keywords: Weibo
keywords: account takeover
keywords: login credential reuse
keywords: Yuhuatai District Court
related risks: Login Credential Reuse
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
related threat actors: Account Dealers
citation: No Case Is Too Small: How Risky Is Password Reuse and Credential Stuffing?
citation: Stop Being Lazy with the Same Passwords, Beware of Hackers 'Credential Stuffing' Theft_Tencent News
updated: 2026-06-18
version: 1

Uber and Cisco Breaches via Push Bombing
type: Case
break id: C0407
stix type: report
summary: Push bombing, also known as MFA fatigue, has been exploited in high-profile breaches at Uber and Cisco. Attackers, including the ransomware group Scattered Spider, leverage this technique to bypass multi-factor authentication by overwhelming users with repeated push notifications until they approve one, granting unauthorized access.
case category: news_report
keywords: push bombing
keywords: MFA fatigue
keywords: multi-factor authentication bypass
keywords: Uber
keywords: Cisco
keywords: Scattered Spider
keywords: ransomware
keywords: social engineering attack
keywords: cybersecurity incident
related risks: MFA Fatigue Attack
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Account Takeover Groups
citation: Uber Security Update
citation: Cisco Talos Shares Insights Related to Recent Cyber Attack on Cisco
citation: What Is Push Bombing? And How Beyond Identity Makes It Impossible
updated: 2026-06-18
version: 1

MFA Fatigue Attacks in Cloud Environments
type: Case
break id: C0408
stix type: report
summary: A study on multi-factor authentication security examines how attackers executed MFA fatigue attacks by flooding users with repeated authentication requests after obtaining valid credentials. The findings show that while MFA is effective, it can be circumvented through user manipulation, underscoring the human element as a critical vulnerability.
case category: academic_research
keywords: MFA fatigue
keywords: MFA bombing
keywords: push notification spam
keywords: credential compromise
keywords: social engineering
keywords: cloud security
keywords: multi-factor authentication bypass
keywords: user manipulation
related risks: MFA Fatigue Attack
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Account Takeover Groups
citation: Study and Enhancement of MFA Security Through Predictive Phishing Detection in Cloud Environments
updated: 2026-06-25
version: 1

Uber MFA Fatigue Attack Incident
type: Case
break id: C0409
stix type: report
summary: In September 2022, an 18-year-old hacker obtained an Uber employee's credentials and bombarded the employee with MFA push notifications for over an hour. The attacker then contacted the employee on WhatsApp, posing as a member of Uber's IT team, and claimed that approving the request was necessary to stop the notifications. Due to fatigue and manipulation, the employee eventually approved the requ
case category: security_incident
incident time: 2022-09
keywords: Uber
keywords: MFA fatigue attack
keywords: multi-factor authentication
keywords: social engineering
keywords: credential theft
keywords: WhatsApp phishing
keywords: internal server breach
keywords: authentication bypass
related risks: MFA Fatigue Attack
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Malicious Hackers
citation: Dealing with MFA Fatigue: Protecting Your Cybersecurity_Hackers_Usernames_Authentication - Sohu
citation: Uber: 2022 Security Update
updated: 2026-06-18
version: 1

Attackers Combine Fake IT Support Calls with MFA Fatigue Attacks
type: Case
break id: C0410
stix type: report
summary: Attackers repeatedly send MFA push requests to create pressure, then follow up with phone calls or messages impersonating IT support, claiming users need to approve the request to stop the notifications. They exploit users' trust in technical support and their urgency to resolve the issue, tricking them into completing authentication approval.
case category: news_report
keywords: MFA fatigue attack
keywords: push bombing
keywords: multi-factor authentication
keywords: fake IT support
keywords: social engineering
keywords: credential theft
keywords: push notification spam
keywords: MFA push bombing
related risks: MFA Fatigue Attack
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Telecom Fraud Gangs
citation: MFA Fatigue: A Growing Security Concern
updated: 2026-06-18
version: 1

Penetration Testing with the 2FA Bypass Phishing Toolkit: Evilginx2
type: Case
break id: C0411
stix type: report
summary: Evilginx2 is a tool that proxies real login pages to capture usernames, passwords, and session cookies, thereby directly bypassing two-factor authentication (2FA). It employs a man-in-the-middle attack to steal session tokens after users complete MFA verification, enabling account takeover.
case category: academic_research
incident time: 2026-03
keywords: Evilginx2
keywords: 2FA bypass
keywords: man-in-the-middle
keywords: session hijacking
keywords: phishing toolkit
keywords: MFA
keywords: cookie theft
keywords: reverse proxy
keywords: adversary-in-the-middle
keywords: AiTM
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: Phishing Kits
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Malicious Hackers
citation: Researcher Releases Tool That Can Bypass Two-Factor Authentication for Phishing Attacks
updated: 2026-06-18
version: 1

Technical Breakdown: HackerOne Two-Factor Authentication Bypass Vulnerability
type: Case
break id: C0412
stix type: report
summary: On the HackerOne platform, researchers identified a flaw in the vulnerability reporting system. While the main submission page enforced two-factor authentication (2FA), this check was bypassed when submitting reports via an embedded form, allowing users without 2FA enabled to successfully submit, exposing a bypass in the MFA process.
case category: vulnerability_advisory
incident time: 2026-02
keywords: HackerOne
keywords: two-factor authentication bypass
keywords: 2FA bypass
keywords: MFA bypass
keywords: vulnerability reporting system
keywords: embedded form
keywords: authentication flaw
keywords: security research
related risks: Multi-Factor Authentication (MFA) Bypass
related threat actors: Malicious Hackers
citation: HackerOne Report: Bypass 2FA Requirement and Reporter Blacklist
updated: 2026-06-18
version: 1

Phishing-as-a-Service Platform EvilProxy Bypasses Two-Factor Authentication
type: Case
break id: C0413
stix type: report
summary: EvilProxy is a phishing-as-a-service platform that uses reverse proxy and cookie injection techniques to proxy victims' sessions after they complete two-factor authentication, thereby bypassing MFA. The platform has been used to target employees of multiple Fortune 500 companies and steal account access.
case category: news_report
incident time: 2022-11
keywords: EvilProxy
keywords: phishing-as-a-service
keywords: reverse proxy
keywords: cookie injection
keywords: MFA bypass
keywords: Fortune 500
keywords: account takeover
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: Phishing-as-a-Service (PhaaS) Platform
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related threat actors: Malicious Hackers
related threat actors: Account Takeover Groups
citation: Bypassing Two-Factor Authentication! Phishing-as-a-Service Platform EvilProxy Arrives - Tencent Cloud Developer Community...
updated: 2026-06-18
version: 1

Google Disrupts Large-Scale Phishing Campaign: Session Cookie Theft Bypasses MFA
type: Case
break id: C0414
stix type: report
summary: Google's Threat Analysis Group disclosed that a group of Russian-speaking hackers has been sending phishing emails to distribute malware and steal browser session cookies since late 2019. Even with multi-factor authentication enabled, attackers can hijack accounts using the stolen session cookies, bypassing MFA protection.
case category: news_report
incident time: 2021-10
keywords: Google Threat Analysis Group
keywords: large-scale phishing
keywords: session cookie theft
keywords: bypass MFA
keywords: Russian-speaking hackers
keywords: malware
keywords: account hijacking
keywords: multi-factor authentication bypass
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: Phishing Kits
related attack tools: Infostealers
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: MFA Bombing and Session Hijacking Tool
related threat actors: Malicious Hackers
related threat actors: Account Takeover Groups
citation: US Treasury Secretary Says Ransomware Threatens Economy, Google Warns 2 Billion Chrome Users |...
updated: 2026-06-18
version: 1

Session Hijacking 2.0: The Latest Attack Bypassing MFA
type: Case
break id: C0415
stix type: report
summary: According to a Microsoft security report, 147,000 token replay attacks were detected in 2023, a 111% year-over-year increase. Attackers steal and replay user session tokens to bypass previously satisfied multi-factor authentication requirements and gain access to organizational resources. The frequency of such attacks is now on par with password-based attacks.
case category: news_report
incident time: 2024-09
keywords: session hijacking
keywords: token replay attack
keywords: MFA bypass
keywords: session token theft
keywords: Microsoft security report
keywords: authentication bypass
keywords: token replay
keywords: identity security
related risks: Multi-Factor Authentication (MFA) Bypass
related risks: Session Token Replay
related attack tools: MFA Bombing and Session Hijacking Tool
citation: Session Hijacking 2.0 — The Latest Way That Attackers are Bypassing MFA
updated: 2026-06-18
version: 1

Microsoft 365 MFA Bypass Incident
type: Case
break id: C0416
stix type: report
summary: An attacker successfully logged into a corporate Microsoft 365 account using only single-factor authentication, despite security defaults being enabled. The user had set up the Microsoft Authenticator app for MFA, but sign-in logs showed the attacker bypassed multi-factor authentication. This case discusses common MFA bypass methods such as MFA fatigue attacks, token theft, and adversary-in-the-mi
case category: security_incident
incident time: 2024-05
keywords: Microsoft 365 MFA bypass
keywords: Microsoft Authenticator
keywords: token theft
keywords: adversary-in-the-middle attack
keywords: MFA fatigue attack
keywords: single-factor authentication
keywords: security defaults bypass
keywords: cloud account takeover
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: MFA Bombing and Session Hijacking Tool
related attack tools: Phishing Kits
related attack tools: Infostealers
related threat actors: Account Takeover Groups
citation: How Did a Hacker Bypass Our Multi-Factor? - Microsoft Q&A
updated: 2026-06-18
version: 1

2FA Bypass Attack Using MitM Phishing Kits
type: Case
break id: C0417
stix type: report
summary: In February 2022, security researchers discovered multiple websites using man-in-the-middle (MitM) phishing kits capable of intercepting two-factor authentication (2FA) security codes, allowing cybercriminals to bypass this verification step and take over user accounts.
case category: security_incident
incident time: 2022-02
keywords: MitM phishing kit
keywords: 2FA bypass
keywords: two-factor authentication interception
keywords: MFA bypass
keywords: account takeover
keywords: phishing toolkit
keywords: man-in-the-middle attack
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: Phishing Kits
related threat actors: Account Takeover Groups
citation: Tycoon 2FA Phishing Kit Sparks a Session Hijacking Storm
citation: Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit
updated: 2026-06-18
version: 1

Research on MFA Bypass Attack Techniques
type: Case
break id: C0418
stix type: report
summary: A study on multi-factor authentication uncovers various MFA bypass methods, including exploit-based attacks, man-in-the-middle attacks, data theft, and weaknesses in one-time password distribution. The research identifies brute-forcing tokens as a common attack vector for bypassing MFA.
case category: academic_research
keywords: MFA bypass
keywords: multi-factor authentication
keywords: brute force token
keywords: man-in-the-middle attack
keywords: OTP weakness
keywords: data theft
keywords: authentication bypass
keywords: cybersecurity
related risks: Multi-Factor Authentication (MFA) Bypass
citation: Beyond Passwords: The Essence and Impact of Multi-Factor Authentication in Cybersecurity
updated: 2026-06-18
version: 1

A Survey of MFA Bypass Attack Techniques
type: Case
break id: C0419
stix type: report
summary: An academic study on multi-factor authentication reveals weaknesses in MFA systems and discusses common bypass vectors, such as brute-forcing tokens. Once an attacker obtains a username and password, they may attempt to brute-force time-based one-time codes to circumvent MFA protection.
case category: academic_research
keywords: MFA bypass
keywords: brute-force token
keywords: OTP brute force
keywords: authentication flaw
keywords: MFA weakness
keywords: token cracking
keywords: dynamic verification code
keywords: MFA attack vector
related risks: Multi-Factor Authentication (MFA) Bypass
related attack tools: Password Dictionaries/Rainbow Tables
citation: On Data Protection Using Multi-Factor Authentication
updated: 2026-06-18
version: 1

Selling Ticket-Snatching Tools Is Illegal! Suspect Arrested!
type: Case
break id: C0420
stix type: report
summary: In October 2024, Taiyuan police cracked a case involving illegal ticket-snatching tools. The suspect, Miao, sold plug-in programs via short-video platforms for prices ranging from 268 to 888 yuan. These tools could tamper with the 'passcode' of ticketing platforms, providing users—including numerous fans and scalpers—with early access to official ticket sales channels. Miao illegally profited over
case category: criminal_verdict
incident time: 2024-10
keywords: ticket-snatching plug-in
keywords: illegal ticket tools
keywords: Miao
keywords: Taiyuan police
keywords: short-video platform
keywords: passcode tampering
keywords: scalpers
keywords: ticketing system
keywords: account aggregation
related risks: Third-Party Account Aggregation
related attack tools: Flash Sale Tools
related threat actors: Scalpers
citation: Selling ticket-snatching tools is illegal! Suspect arrested!
updated: 2026-06-18
version: 1

Guangdong Criminal Gang Built Illegal Payment Aggregation Platforms to Provide Settlement Services for Overseas Online Gambling
type: Case
break id: C0421
stix type: report
summary: Starting June 2023, a criminal gang led by Li constructed multiple illegal payment aggregation platforms integrating third-party payment functions. They colluded with e-commerce shops, card sellers, and virtual currency dealers to provide end-to-end illegal fund settlement services for overseas online gambling platforms by guiding gamblers to purchase overpriced prepaid cards. In September 2024, t
case category: criminal_verdict
incident time: 2026-04
keywords: illegal payment aggregation
keywords: fund settlement
keywords: overseas online gambling
keywords: prepaid card cash-out
keywords: virtual currency dealers
keywords: illegal business operations crime
keywords: third-party payment aggregation
keywords: e-commerce shop money laundering
keywords: Ministry of Public Security crackdown
related risks: Third-Party Account Aggregation
related attack tools: Score-Running Platforms
related attack tools: Card Vending Platforms
related threat actors: Money Laundering Gangs
related threat actors: Online Gambling Gangs
related threat actors: Cryptocurrency Fraud Syndicate
citation: MPS Announces Economic Crime Crackdown Results Including the Guangdong Illegal Payment Settlement Case
citation: Guangdong Crime Gang Provided Settlement Services for Overseas Online Gambling Platforms, Over 190 Arrested
updated: 2026-06-18
version: 1

Zhejiang Tailong Bank's Aggregate Payment App 'TaiHuiShou' Flagged for Unauthorized Personal Data Collection
type: Case
break id: C0422
stix type: report
summary: On November 30, 2023, the Ministry of Industry and Information Technology (MIIT) named 22 apps violating user rights, including Zhejiang Tailong Commercial Bank's aggregate payment app 'TaiHuiShou' for unauthorized collection of personal information and excessive permission requests. The app provides merchants with aggregated payment services integrating multiple payment methods. Tailong Bank resp
case category: administrative_enforcement
incident time: 2023-11
keywords: TaiHuiShou
keywords: Zhejiang Tailong Commercial Bank
keywords: unauthorized personal data collection
keywords: MIIT notification
keywords: app user rights violation
keywords: aggregate payment
keywords: excessive permission requests
keywords: app delisting
related risks: Third-Party Account Aggregation
citation: MIIT Notice on Apps and SDKs Infringing User Rights, 2023 Batch 8
updated: 2026-06-18
version: 1

Black-market gang used 'scan QR code to get free eggs' to trick users into scanning and logging in for account theft
type: Case
break id: C0423
stix type: report
summary: In December 2025, a black-market gang organized offline promoters to lure users into scanning QR codes under the pretense of receiving free eggs. Through technical means, they stole user accounts, which were then used for selling, posting illegal information, or stealing virtual assets. Five suspects in the gang have been formally detained by police.
case category: criminal_verdict
incident time: 2025-12
keywords: QR code scam
keywords: free eggs scam
keywords: account takeover
keywords: credential theft
keywords: virtual asset theft
keywords: offline promotion fraud
keywords: scan to login hijack
keywords: black-market gang
related risks: QR Code Login Fraud
related attack tools: Malicious QR Code Generators
related threat actors: Criminal Organizations
citation: Scan QR Code for Eggs? Beware of 'Scan to Steal Account' by Cybercriminal Gangs
citation: Douyin Cracks Down on Account-Theft Black-Market Operations and Warns Users to Protect Account Information
updated: 2026-06-18
version: 1

QRLJacking: Session Hijacking via QR Code Login Exploitation
type: Case
break id: C0424
stix type: report
summary: QRLJacking is a social engineering attack vector that affects applications relying on QR code login. Attackers trick victims into scanning an attacker-controlled QR code, leading to session hijacking and unauthorized account access.
case category: security_incident
keywords: QRLJacking
keywords: QR code login hijacking
keywords: scan to login
keywords: session hijacking
keywords: social engineering
keywords: OWASP
keywords: account takeover
related risks: QR Code Login Fraud
related attack tools: Malicious QR Code Generators
citation: Qrljacking - OWASP Foundation
updated: 2026-06-18
version: 1

OWASP/QRLJacking: QR Code Login Hijacking Attack Framework
type: Case
break id: C0425
stix type: report
summary: QRLJacking is a simple yet highly impactful social engineering attack where the victim scans an attacker's QR code, resulting in session hijacking. This attack affects all applications that rely on 'scan-to-login' functionality as a secure authentication method.
case category: vulnerability_advisory
keywords: QRLJacking
keywords: QR code login hijacking
keywords: scan-to-login
keywords: session hijacking
keywords: social engineering
keywords: OWASP
keywords: GitHub
related risks: QR Code Login Fraud
related attack tools: Malicious QR Code Generators
citation: GitHub - OWASP/QRLJacking: QRLJacking or Quick Response Code Login ...
updated: 2026-06-18
version: 1

QR Code Phishing Study: An Empirical Investigation of Phishing Attacks via QR Codes
type: Case
break id: C0426
stix type: report
summary: Researchers conducted a real-world QR code phishing campaign on a research campus, testing two distinct QR code variants to assess whether leveraging QR codes is a viable attack vector for phishing.
case category: academic_research
keywords: QR code phishing
keywords: quishing
keywords: phishing attack vector
keywords: login QR code fraud
keywords: social engineering
keywords: real-world phishing test
keywords: arXiv
keywords: QR code security
related risks: QR Code Login Fraud
related attack tools: Malicious QR Code Generators
citation: Hooked: A Real-World Study on QR Code Phishing - arXiv.org
updated: 2026-06-18
version: 1

Impact Analysis and Simulation of QR Code Phishing Attacks Using QRLJacker
type: Case
break id: C0427
stix type: report
summary: This study examines how cybercriminals hijack legitimate QR codes for login authentication, including the use of fraudulent QR codes on parking meters, and conducts attack simulations.
case category: academic_research
keywords: QRLJacker
keywords: QR code phishing
keywords: quishing
keywords: login authentication hijacking
keywords: parking meter fraud
keywords: attack simulation
keywords: IEEE
related risks: QR Code Login Fraud
related attack tools: Malicious QR Code Generators
citation: Impact Analysis and Attack Simulation on Quishing (QR Code Phishing) Using QRLJacker
updated: 2026-06-18
version: 1

Bilibili Streamer Destroys Viewer's Account Over Expired Membership
type: Case
break id: C0428
stix type: report
summary: In March 2026, Bilibili streamer 'Qingyu' destroyed all rare virtual items on a fan's account after the fan's paid membership status lapsed while logged in via QR code scan. The incident highlights the potential damage when others gain account access through scan-based login mechanisms.
case category: news_report
incident time: 2026-03
keywords: Bilibili
keywords: streamer
keywords: Qingyu
keywords: account destruction
keywords: QR code login
keywords: virtual property
keywords: livestream
keywords: account access
related risks: QR Code Login Fraud
related threat actors: Malicious Users
citation: Bilibili Streamer's Latest Scandal Angers All Netizens
updated: 2026-06-18
version: 1

Xiangtan Police Dismantle Cyber-Enabled Mafia-Like Groups Extorting via Negative Public Opinion
type: Case
break id: C0429
stix type: report
summary: In September 2023, during the 'Summer Action' campaign, Xiangtan police dismantled a cyber-enabled mafia-like group led by Pan and another led by Zhang for extortion through negative public opinion and malicious complaints, arresting 13 suspects and solving 18 cases, effectively curbing the spread of organized crime into cyberspace.
case category: criminal_verdict
incident time: 2023-09
keywords: Xiangtan police
keywords: cyber mafia
keywords: negative public opinion extortion
keywords: malicious complaint extortion
keywords: Pan
keywords: Zhang
keywords: Summer Action
keywords: extortion syndicate
related risks: Negative Public Opinion
related threat actors: Criminal Organizations
citation: Xiangtan police achieve results in regular anti-gang and anti-crime operations
citation: 67 Suspects Arrested, 78 Criminal Cases Solved in Xiangtan Police's Regular Anti-Gang Operations
updated: 2026-06-24
version: 1

China's Ministry of Public Security Deploys Crackdown on Cyber-Enabled Mafia-Like Crimes Including Negative Public Opinion Extortion
type: Case
break id: C0430
stix type: report
summary: In February 2023, the Ministry of Public Security held a video conference to advance the crackdown on cyber-enabled mafia-like crimes, focusing on offenses such as sextortion, online predatory lending, soft-violence debt collection, malicious claims, negative public opinion extortion, and paid internet trolls, aiming to curb the rising trend of such cases.
case category: security_incident
incident time: 2023-02
keywords: Ministry of Public Security
keywords: negative public opinion extortion
keywords: cyber-enabled mafia-like crimes
keywords: paid internet trolls
keywords: soft-violence debt collection
keywords: malicious claims
keywords: online predatory lending
keywords: sextortion
keywords: video conference deployment
related risks: Negative Public Opinion
related threat actors: Astroturfing Networks
citation: Nude Chat Extortion, Soft Violence Debt Collection... Ministry of Public Security Strikes Hard!
citation: MPS and eight other departments launch special campaign against online organized crime
updated: 2026-06-18
version: 1

Gang Sentenced for Extortion After Fabricating Negative Publicity to Demand Deletion Fees
type: Case
break id: C0431
stix type: report
summary: In February 2026, a criminal gang posted negative articles targeting companies to create public opinion pressure, then demanded protection fees and cooperation fees in exchange for deleting the content. Through online harassment, they extorted over 1.8 million yuan from businesses, and multiple individuals involved were convicted and sentenced.
case category: criminal_verdict
incident time: 2026-02
keywords: negative articles
keywords: public opinion pressure
keywords: deletion fees
keywords: extortion
keywords: online harassment
keywords: protection fees
keywords: cooperation fees
keywords: corporate victims
keywords: sentencing
related risks: Negative Public Opinion
related attack tools: Auto-Posting Bots
related threat actors: Astroturfing Networks
citation: Hubei Procuratorate Reports Prosecution of Online Extortion Against Enterprises
updated: 2026-06-18
version: 1

College Student Fabricated False Information Causing Online Public Sentiment, Received Criticism and Education
type: Case
break id: C0432
stix type: report
summary: In September 2021, a college student Huang (under 18) in Nanchang, Jiangxi, fabricated messages in a WeChat group claiming 'these people are having sex' as a prank. The content spread online and triggered negative public sentiment. Public security authorities issued criticism and education, and ordered guardians to impose stricter discipline.
case category: administrative_enforcement
incident time: 2021-09
keywords: fabricated information
keywords: online public sentiment
keywords: criticism education
keywords: WeChat group
keywords: minor student
keywords: Jiangxi
keywords: college student
keywords: guardian discipline
related risks: Negative Public Opinion
citation: Nanchang County Police Notice on Fabricated Campus Rumor
updated: 2026-06-18
version: 1

Supreme People's Procuratorate Releases Typical Cases on Punishing News Blackmail and Fake News Crimes
type: Case
break id: C0433
stix type: report
summary: In December 2024, the Supreme People's Procuratorate released typical cases on punishing news blackmail and fake news crimes. Procuratorial organs, in handling cases, proposed adding criminal suspects to public security authorities and severely cracked down on extortion through fabricating and spreading false negative information.
case category: criminal_verdict
incident time: 2024-12
keywords: Supreme People's Procuratorate
keywords: news blackmail
keywords: fake news
keywords: extortion
keywords: false negative information
keywords: additional criminal suspects
keywords: typical cases
keywords: procuratorial organs
keywords: online public opinion
related risks: Negative Public Opinion
related threat actors: Astroturfing Networks
citation: Supreme People's Procuratorate Releases Typical Cases of Punishing News Extortion and Fake News Crimes
citation: Supreme People’s Procuratorate releases typical cases on punishing news extortion and fake news crimes
updated: 2026-06-18
version: 1

Yantai Police Dismantle Online Water Army Defaming Huawei and Li Auto, 12 Arrested
type: Case
break id: C0434
stix type: report
summary: In December 2025, Yantai police announced the conclusion of a four-month operation that successfully dismantled an online water army gang engaged in hyping and defaming brands such as Xiaomi, Huawei, and Li Auto. A total of 12 suspects were apprehended for manufacturing and spreading negative information that damaged the brands' reputations.
case category: criminal_verdict
incident time: 2025-12
keywords: online water army
keywords: commercial defamation
keywords: Yantai police
keywords: Huawei
keywords: Li Auto
keywords: Xiaomi
keywords: brand reputation attack
keywords: negative information dissemination
keywords: cyber black market
related risks: Negative Public Opinion
related threat actors: Astroturfing Networks
citation: Yantai Police Crack Down on Online Troll Ring Targeting New Energy Vehicle Brands
updated: 2026-06-18
version: 1

FraudBlocker Identifies and Blocks a Coordinated Carding Attack
type: Case
break id: C0435
stix type: report
summary: FraudBlocker documented a coordinated carding attack targeting its platform. Attackers attempted to use multiple stolen credit card credentials to complete transactions, aiming to verify which cards were still active. The attack primarily targeted small e-commerce platforms with high transaction volumes and fewer security measures, screening for valid cards through batch testing.
case category: security_incident
keywords: FraudBlocker
keywords: carding attack
keywords: coordinated attack
keywords: stolen credit cards
keywords: card testing
keywords: e-commerce
keywords: transaction fraud
keywords: payment security
keywords: fraud detection
related risks: Carding Attack
related threat actors: Payment Fraud Groups
citation: How We Identified and Blocked a Coordinated Carding Attack
updated: 2026-06-18
version: 1

PayPal Warns of Surge in Carding Attacks Driving Global Losses
type: Case
break id: C0436
stix type: report
summary: PayPal's official merchant security article cites industry data showing that carding attacks increased by 134% year over year in 2022. Attackers purchase stolen credit card information from the dark web or obtain it through phishing, then use automated scripts to launch numerous small-value transaction attempts on merchant websites to validate the card credentials. Successfully verified cards are subsequently used to purchase high-value goods or resold
case category: news_report
incident time: 2025-01
keywords: PayPal carding attack
keywords: carding attack growth 2022
keywords: stolen credit card validation
keywords: automated script transaction testing
keywords: dark web card reselling
keywords: merchant website card testing
keywords: ecommerce payment fraud
related risks: Carding Attack
related attack tools: Automation Scripts
related attack tools: Dark Web
related attack tools: Phishing Kits
related threat actors: Data Brokers
related threat actors: Payment Fraud Groups
citation: How To Help Protect Your Business Against Carding Attacks - PayPal
updated: 2026-06-18
version: 1

Indusface Exposes the Verification and Monetization Chain of Card Cracking Attacks
type: Case
break id: C0437
stix type: report
summary: Indusface analysis reveals that in card cracking attacks, attackers use bots to conduct numerous small transactions across multiple e-commerce and payment platforms to verify stolen credit card data. Successfully validated card details are then compiled into lists and sold at higher prices on the dark web to other cybercriminals, or used to purchase high-value goods and gift cards.
case category: news_report
keywords: card cracking attack
keywords: credit card verification
keywords: dark web carding
keywords: bot-driven transaction testing
keywords: e-commerce payment fraud
keywords: stolen credit card data
keywords: card monetization
keywords: Indusface
related risks: Carding Attack
related attack tools: Automation Scripts
related attack tools: Dark Web
related attack tools: Payment Fraud Automation Tool
related threat actors: Payment Fraud Groups
related threat actors: Data Brokers
citation: Carding Attacks: What Is It and How to Prevent Carding Fraud?
updated: 2026-06-18
version: 1

US Jewelry Retailer Hit by Carding Attack, Facing Payment Gateway Blacklist Risk
type: Case
break id: C0438
stix type: report
summary: A US jewelry retailer suffered a sustained carding attack where attackers used multiple browser-simulated bots to attempt purchases with stolen or fake credit card details and randomly generated email addresses. Although the orders were unsuccessful, the high volume of fraudulent transactions put the merchant at risk of being blacklisted by its third-party payment provider, potentially leading to
case category: security_incident
keywords: carding attack
keywords: jewelry retailer
keywords: payment gateway blacklist
keywords: Indusface
keywords: AppTrana
keywords: credit card fraud
keywords: bot simulation
keywords: third-party payment
keywords: fake transactions
related risks: Carding Attack
related attack tools: Headless Browsers
related attack tools: Automation Scripts
related attack tools: Payment Fraud Automation Tool
related threat actors: Payment Fraud Groups
citation: Mitigating Carding for a US-Based Jewellery Company - Indusface
updated: 2026-06-18
version: 1

BigCommerce Merchant Hit by Unstoppable Persistent Carding Attack
type: Case
break id: C0439
stix type: report
summary: A merchant on the BigCommerce platform faced a sustained carding attack where attackers used stolen credit card details to perform bulk validation on their store. Both the merchant and the platform reported difficulty in effectively stopping the attack, resulting in a high volume of fraudulent order attempts and payment verification requests that severely disrupted normal business operations.
case category: security_incident
keywords: BigCommerce
keywords: carding attack
keywords: stolen credit cards
keywords: fake orders
keywords: payment verification
keywords: ecommerce platform
related risks: Carding Attack
related attack tools: Credential Stuffing Tools
related threat actors: Data Brokers
related threat actors: Payment Fraud Groups
citation: Carding Attack on BigCommerce - Unable to Stop Due to Platform ...
updated: 2026-06-18
version: 1

Analysis of Emerging Credential Stuffing Attacks Involving AI Agents
type: Case
break id: C0440
stix type: report
summary: A HUMAN Security research article observed early evidence of suspected AI-agent-assisted carding behavior in real web traffic as AI-agent traffic surged. The traffic showed characteristics of automated payment-card validation and testing, suggesting that carding attacks may be evolving through agentic AI traffic rather than relying only on traditional scripts.
case category: news_report
keywords: AI agents
keywords: credential stuffing
keywords: credit card fraud
keywords: automated attacks
keywords: HUMAN Security
keywords: fraud detection
keywords: AI agent simulation
keywords: payment security
keywords: behavioral bypass
related risks: Carding Attack
related attack tools: LLM Automated Attack Tools
related attack tools: Payment Fraud Automation Tool
related threat actors: AI Fraud Gangs
related threat actors: Payment Fraud Groups
citation: AI Agents and Fraud: Early Evidence of Carding Behavior in the Wild
updated: 2026-06-18
version: 1

Global Credit Card Fraud Losses Continue to Climb
type: Case
break id: C0441
stix type: report
summary: Card cracking fraud has driven global losses from approximately $18 billion in 2014 to over $32 billion in 2022. Attackers purchase leaked card number lists from darknet markets and use automated tools to brute-force expiration dates and CVV security codes in order to obtain valid payment card credentials.
case category: academic_research
incident time: 2022
keywords: card cracking
keywords: CVV brute-forcing
keywords: darknet card lists
keywords: payment card fraud
keywords: automated enumeration
keywords: fingerprint
keywords: fraud losses
related risks: Card Cracking
related attack tools: Dark Web
related attack tools: Payment Fraud Automation Tool
related threat actors: Payment Fraud Groups
citation: Card Fraud Losses Worldwide in 2022
citation: Tutorial: Credit Card Cracking Explained — and How to Prevent It
updated: 2026-06-18
version: 1

F5 Defends Against Gift Card Cracking Attacks
type: Case
break id: C0442
stix type: report
summary: A luxury brand faced automated gift card cracking attacks, with attackers brute-forcing balance inquiries and checkout balance applications at 100 times the frequency of legitimate customers. After deploying F5 Distributed Cloud Bot Defense, the attacks ceased, and 98.5% of gift card balance inquiry traffic was identified as automated requests.
case category: news_report
keywords: gift card cracking
keywords: brute force enumeration
keywords: F5 Distributed Cloud Bot Defense
keywords: automated attacks
keywords: payment card cracking
keywords: balance inquiry
keywords: bot attack
related risks: Card Cracking
related attack tools: Automation Scripts
related attack tools: API Automated Abuse Tools
related threat actors: Freebie Hunters
citation: Prevent Gift Card Cracking: Brute Force Enumeration - F5
updated: 2026-06-18
version: 1

Enumeration Attack Definition and Payment Card Cracking Mechanism
type: Case
break id: C0443
stix type: report
summary: An enumeration attack, also known as card testing or card cracking, occurs when fraudsters use automated scripts or bots to submit numerous small-value transactions to merchant payment gateways. By systematically altering combinations of card numbers, expiration dates, or CVV codes, they cycle through thousands of permutations to identify valid payment card details, which are then used for larger
case category: academic_research
keywords: enumeration attack
keywords: card cracking
keywords: card testing
keywords: CVV brute force
keywords: payment gateway
keywords: automated scripts
keywords: darknet carding
keywords: BIN attack
related risks: Card Cracking
related attack tools: Automation Scripts
related attack tools: Payment Fraud Automation Tool
related attack tools: Dark Web
related threat actors: Payment Fraud Groups
citation: Enumeration Attack: Security Dictionary, Terms & Definitions - Greip ...
updated: 2026-06-18
version: 1

OWASP Defines Payment Card Cracking as an Automated Threat
type: Case
break id: C0444
stix type: report
summary: OWASP classifies payment card cracking (OAT-010) as a brute-force attack targeting application payment card flows, aiming to identify missing start dates, expiry dates, and/or card security codes (CSC), also known as CVN2, CVC, CV2, or CID.
case category: academic_research
keywords: OWASP
keywords: OAT-010
keywords: payment card cracking
keywords: card cracking
keywords: automated threat
keywords: brute-force attack
keywords: CSC
keywords: CVV
keywords: web application security
related risks: Card Cracking
citation: OAT-010 Card Cracking - OWASP Foundation
updated: 2026-06-18
version: 1

Newcastle University Discloses a Distributed Guessing Attack Against Online Card Payments
type: Case
break id: C0445
stix type: report
summary: In 2016, Newcastle University researchers disclosed the Distributed Guessing Attack. The research showed that attackers could spread guesses across many merchant websites and exploit inconsistent validation fields and weak cross-site failure correlation to enumerate payment card numbers, expiry dates, and CVVs. Visa later identified enumeration, brute force, BIN testing, and card stuffing as account-testing risks in the payment ecosystem.
case category: academic_research
incident time: 2016-12
keywords: credit card brute-force
keywords: BIN enumeration
keywords: payment card cracking
keywords: Luhn algorithm
keywords: CVV enumeration
keywords: distributed enumeration
keywords: PAN enumeration
keywords: payment infrastructure
related risks: Card Cracking
related attack tools: Payment Fraud Automation Tool
related attack tools: Password Dictionaries/Rainbow Tables
related attack tools: API Enumeration and Authorization Testing Tool
related threat actors: Payment Fraud Groups
citation: How cyber thieves can hack your credit card in seconds
citation: Does the Online Card Payment Landscape Unwittingly Facilitate Fraud?
citation: Visa Guidance to Guard Against Enumeration Attacks and Account Testing Schemes
updated: 2026-06-18
version: 1

800,000 Jin of Eggs Vanished Over 4 Years: A Theft Case Exposes Blind Spots in Fundamental Analysis
type: Case
break id: C0446
stix type: report
summary: Six employees of Hunan Xiangjia Animal Husbandry misappropriated over 800,000 jin of company eggs over nearly four years by altering outbound shipment quantities and falsifying data, involving over 4 million yuan. The stolen eggs remained listed as 'in stock' in ledgers, causing the company's publicly reported inventory data to be persistently inflated and seriously misleading market supply-demand
case category: criminal_verdict
incident time: 2026-06
keywords: Xiangjia Animal Husbandry
keywords: occupational misappropriation
keywords: egg inventory
keywords: fictitious inventory
keywords: outbound data tampering
keywords: false reporting
keywords: inventory management fraud
keywords: listed company
keywords: supply chain fraud
related risks: Fake Inventory
related threat actors: Malicious Insiders
citation: Shimen County Court Sentences Six in Egg Embezzlement Case
updated: 2026-06-18
version: 1

Exposed: Top 100 Counterfeit Livestream Sales
type: Case
break id: C0447
stix type: report
summary: The Market Supervision Administration of Changshu, Jiangsu, investigated a livestream sales fraud case. The host displayed counterfeit products bearing trademarks such as 'Gucci' and 'Adidas' during the livestream, selling them as 'overstock tail goods'. After customers placed orders, the livestream backend immediately removed the counterfeit product links, constituting a deceptive practice of usi
case category: administrative_enforcement
incident time: 2020-08
keywords: livestream counterfeit goods
keywords: Gucci trademark infringement
keywords: Adidas fake products
keywords: overstock tail goods scam
keywords: fake inventory inducement
keywords: Changshu market supervision
keywords: trademark infringement livestream
related risks: Fake Inventory
related threat actors: Piracy/Infringement Gangs
citation: Exposed: Top 100 Fake Products in Live-Streaming Sales
updated: 2026-06-18
version: 1

Guizhou Bainian Yuanzhi Liquor Falsified Inventory Tax Evasion Case
type: Case
break id: C0448
stix type: report
summary: Guizhou Bainian Yuanzhi Liquor Co., Ltd. concealed income by fabricating inventory records and conducting low-price sales through affiliated enterprises, resulting in a cumulative underpayment of taxes totaling 8.6983 million yuan. The company used false inventory to disguise its actual operating conditions for tax evasion purposes.
case category: administrative_enforcement
incident time: 2025-08
keywords: Guizhou Bainian Yuanzhi Liquor
keywords: falsified inventory
keywords: tax evasion
keywords: concealed income
keywords: affiliated enterprise
keywords: low-price sales
keywords: tax audit
keywords: tax violation
keywords: Guizhou taxation bureau
related risks: Fake Inventory
citation: Guizhou Tax Authorities Just Announced Investigation Details of 3 Tax-Related Illegal Cases!
updated: 2026-06-18
version: 1

Thailand Seizes Counterfeit Goods Across Cross-Border and Online Channels
type: Case
break id: C0449
stix type: report
summary: An official enforcement report from Thailand's Department of Intellectual Property said that in the first half of fiscal year 2026, Thai IP enforcement agencies targeted counterfeit goods across physical markets, online channels, warehouses, and cross-border customs checkpoints. Authorities handled 332 intellectual-property infringement cases, seized more than 1.3 million infringing items, and estimated economic damage at about 2.3 billion Thai baht. The case illustrates how counterfeit goods circulating through cross-border and online sales channels create platform governance, product authenticity, and supply-chain compliance risks.
case category: administrative_enforcement
incident time: 2026-04
keywords: Thailand
keywords: counterfeit goods
keywords: intellectual property enforcement
keywords: cross-border checkpoints
keywords: online sales channels
keywords: customs seizure
keywords: official enforcement report
related risks: Fake Inventory
related threat actors: Piracy/Infringement Gangs
citation: DIP Reveals First-Half Fiscal 2026 IP Enforcement Results
updated: 2026-06-18
version: 1

Guangzhou Police Bust New Credit Card Fraud Ring: Cards Cloned in 125 Seconds
type: Case
break id: C0450
stix type: report
summary: In June 2024, Guangzhou police arrested 12 suspects across Hainan, Fujian, Jiangxi, and other regions, dismantling a new credit card fraud syndicate integrating card re-encoding, fraudulent transactions, and disposal of stolen goods. The gang could clone a bank card and execute unauthorized transactions within just 125 seconds, with the potential fraud amount exceeding 1 billion yuan. The case was
case category: criminal_verdict
incident time: 2024-06
keywords: credit card fraud
keywords: card cloning
keywords: unauthorized transaction
keywords: Guangzhou police
keywords: card re-encoding
keywords: UnionPay
keywords: disposal of stolen goods
keywords: 125 seconds
related risks: Stolen Card Fraud
related threat actors: Bank Card Dealers
citation: Guangzhou Police Dismantle Credit Card Reissuance and Fraud Ring
updated: 2026-06-18
version: 1

Zhoukou Suspects Coercively Processed for Stealing Store Alipay Funds
type: Case
break id: C0451
stix type: report
summary: The Zhoukou Public Security Bureau reported that Jinhai Road Police Station of the Chuanhui branch received a report from a local resident surnamed Li that more than 3,000 yuan in his Alipay account had been stolen. Police traced the fund flow, identified two suspects, and arrested Tian and Li at an internet cafe in Chuanhui District on February 4, 2021. The two admitted that after being introduced by a neighbor to work in Li's store, they took advantage of Li's absence to transfer more than 3,000 yuan from the store's Alipay account to one suspect's girlfriend's account for spending. Both suspects were placed under coercive measures.
case category: criminal_verdict
incident time: 2021-02
keywords: Alipay theft
keywords: store Alipay account
keywords: Zhoukou Public Security Bureau
keywords: Chuanhui branch
keywords: Jinhai Road police station
keywords: Tian
keywords: Li
keywords: larceny
keywords: coercive measures
keywords: mobile payment security
keywords: fund transfer
related risks: Stolen Card Fraud
related threat actors: Malicious Users
citation: Safe Guarding | Detained for Stealing Another Person's Alipay Funds to Support a Girlfriend - Zhoukou Public Security Bureau
updated: 2026-06-26
version: 1

China's Supreme Court Rules Banks Must Compensate for Unauthorized Card Transactions
type: Case
break id: C0452
stix type: report
summary: In May 2021, China's Supreme People's Court issued a judicial interpretation on bank-card civil disputes, clarifying liability rules for counterfeit-card and online unauthorized transactions. Where cardholders claim that transactions were not made by them and seek repayment, penalties, and damages from the issuing bank, courts should support the claim according to law; the bank's liability may be reduced if it proves cardholder fault.
case category: news_report
incident time: 2021-05
keywords: unauthorized bank card transactions
keywords: Supreme People's Court ruling
keywords: bank liability card fraud
keywords: counterfeit card fraud
keywords: online payment fraud
keywords: issuing bank compensation
keywords: cardholder protection China
keywords: judicial interpretation bank fraud
related risks: Stolen Card Fraud
citation: Provisions of the Supreme People's Court on Several Issues Concerning the Trial of Bank Card Civil Dispute Cases
citation: Head of the SPC Second Civil Division answers press questions on the bank-card civil dispute judicial interpretation
updated: 2026-06-18
version: 1

Man Sentenced to 5 Years for Impersonating Bank Staff and Cashing Out ¥75,000 with Stolen Credit Card
type: Case
break id: C0453
stix type: report
summary: In April 2018, a man surnamed Chen from Ding’an, Hainan, exploited his role delivering credit cards to impersonate a bank employee, tricked the cardholder into revealing a verification code, activated the card, and then used a POS terminal to fraudulently cash out ¥75,000 to repay his own loans. In September 2022, the Hainan Second Intermediate People’s Court upheld the first-instance verdict, con
case category: criminal_verdict
incident time: 2018-04
keywords: credit card fraud
keywords: POS cash-out
keywords: impersonating bank staff
keywords: verification code theft
keywords: Hainan Second Intermediate People’s Court
keywords: Article 196
keywords: stolen credit card
keywords: criminal verdict
related risks: Stolen Card Fraud
citation: Man Sentenced to Five Years for Fraudulently Activating and Cashing Out Another Person's Credit Card
updated: 2026-06-18
version: 1

Bank Card Stolen and Drained — Gaochang Police Crack the Case, Recover Assets, and Return ¥34,000 in Losses
type: Case
break id: C0454
stix type: report
summary: In June 2024, a resident surnamed Ka in Gaochang District, Xinjiang, reported that ¥34,000 had been stolen from his bank account. Investigation revealed that suspect Ai had repeatedly transferred funds from Ka's account to unfamiliar accounts between May and June 2024 via Tenpay-QQ transfers and QQ red packets. Police arrested Ai on July 2, recovering and returning all losses to the victim.
case category: criminal_verdict
incident time: 2024-06
keywords: bank card theft
keywords: Tenpay
keywords: QQ transfer
keywords: QQ red packet
keywords: Gaochang police
keywords: asset recovery
keywords: unauthorized transaction
keywords: electronic fund transfer fraud
related risks: Stolen Card Fraud
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: [Summer Public Security Campaign] Bank card stolen and drained! Gaochang police solve the case and recover 34,000 yuan
updated: 2026-06-18
version: 1

Cracking Down on Bank Card Crimes: Ministry of Public Security Releases Eight Typical Cases
type: Case
break id: C0455
stix type: report
summary: In April 2023, the Economic Investigation Division of Beijing Chaoyang Sub-Bureau initiated investigations into three credit card fraud cases. Through in-depth analysis, a total of 35 credit card fraud cases with identical modus operandi were linked. Three waves of coordinated arrests were carried out targeting cash-out mule groups, phishing and fraudulent card use rings, and accessory-providing c
case category: criminal_verdict
incident time: 2023-04
keywords: credit card fraud
keywords: card theft
keywords: phishing card fraud
keywords: cash-out mules
keywords: bank card crime
keywords: Ministry of Public Security
keywords: Beijing Chaoyang economic investigation
keywords: coordinated arrests
related risks: Stolen Card Fraud
related attack tools: Phishing Kits
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: Public security authorities make notable progress against bank card crimes; Ministry of Public Security releases eight typical cases
citation: Severely crack down on bank card-related crimes! Ministry of Public Security releases 8 typical cases
updated: 2026-06-24
version: 1

Zhaolian Finance’s Third-Party Collector Used Unregistered SIM Cards for Harassment
type: Case
break id: C0456
stix type: report
summary: Hongzhi Company, a third-party collection agency working with Zhaolian Finance, had its collector Zhao confess to using unregistered SIM cards to send threatening text messages to debtors and their contacts, falsely claiming that overdue payments would damage their credit records.
case category: news_report
incident time: 2022-02
keywords: Zhaolian Finance
keywords: Hongzhi Company
keywords: debt collection
keywords: unregistered SIM cards
keywords: harassment
keywords: text message threats
keywords: credit records
keywords: third-party collection
related risks: Stolen Card Payment
related attack tools: Black SIM Cards
related threat actors: Risky Third-Party Partners
citation: Behind Zhaolian Finance's 2.9 million yuan fine: Partner company's collection commissions reportedly as high as 50%, excessive 'incentives'...
updated: 2026-06-18
version: 1

Shenzhen Futian Police Crack Down on Fraud-Linked Illicit SIM Supply Chain
type: Case
break id: C0457
stix type: report
summary: In August 2021, a Shenzhen Public Security press conference reported that Futian police had focused on clues involving fraud-linked illicit mobile SIM cards and launched three special Operation Broken Stream actions within about a month. Police carried out full-chain crackdowns on criminal groups that acquired and resold illicit SIM cards for telecom fraud, arresting 81 suspects and seizing nearly 40,000 illicit SIM cards, GOIP devices, fake identity documents, and related materials used to supply overseas fraud dens.
case category: criminal_verdict
incident time: 2021-08
keywords: illicit SIM cards
keywords: Operation Broken Stream
keywords: GOIP devices
keywords: SIM card trafficking
keywords: Shenzhen Futian police
keywords: telecom fraud black market
keywords: full-chain crackdown
keywords: underground SIM workshops
related risks: Stolen Card Payment
related attack tools: Black SIM Cards
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Telecom Fraud Gangs
citation: Telecom Fraud Reports and Filings Both Decline: Shenzhen Public Security Holds Press Conference
updated: 2026-06-18
version: 1

China's First Case Against a Telecom Operator for Upstream Telecom Fraud: Yuante Company Provided "Black SIM Cards"
type: Case
break id: C0458
stix type: report
summary: In 2019, Yunnan police investigated a telecom fraud case and discovered that the criminal group used "black SIM cards" provided by the virtual network operator Yuante (Beijing) Communication Technology Co., Ltd. The company was aware that its agent, Yafeida Company, was illegally selling large quantities of phone cards for criminal activities, yet it failed to intervene and continued to supply the
case category: criminal_verdict
incident time: 2021-04
keywords: Yuante Communication
keywords: virtual network operator
keywords: black SIM cards
keywords: refusing to fulfill information network security management obligations
keywords: Yafeida Company
keywords: upstream telecom fraud
keywords: black card payment
keywords: Yunnan police
related risks: Stolen Card Payment
related attack tools: Black SIM Cards
related threat actors: Telecom Fraud Gangs
citation: National First Ruling: Cutting Off the Back-End Enablers of Telecom Fraud
updated: 2026-06-18
version: 1

MPS Reports “Clean Net” Operation Results: Over 30 Million Illicit SIMs Seized in Three Years
type: Case
break id: C0459
stix type: report
summary: On August 10, 2023, Sun Jinfeng, Political Commissar of the Ministry of Public Security’s Cybersecurity Bureau, reported that since 2020, public security agencies have solved 36,000 cases involving personal information infringement, apprehended 64,000 suspects, and seized over 30 million illicit SIM cards and more than 300 million fraudulent online accounts. These cards and accounts are frequently
case category: administrative_enforcement
incident time: 2023-08
keywords: Clean Net Operation
keywords: Ministry of Public Security
keywords: illicit SIM cards
keywords: personal information infringement
keywords: fraudulent online accounts
keywords: underground cybercrime
keywords: Sun Jinfeng
keywords: black card payment
related risks: Stolen Card Payment
related attack tools: Black SIM Cards
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Account Dealers
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
citation: Ministry of Public Security press conference on measures and results against crimes infringing citizens' personal information
citation: 214 centrally managed enterprise personnel voluntarily surrender in first half of year; Wuxi offers up to 5 million yuan housing subsidies for high-level talent...
updated: 2026-06-24
version: 1

Man Uses Fake Transfer Screenshots to Scam Over 21,000 Yuan, Arrested Same Day
type: Case
break id: C0460
stix type: report
summary: On November 10, 2024, a man in Lhasa used fake transfer screenshots at a gold shop, claiming interbank transfer delays, to defraud the store of gold jewelry worth 21,000 yuan. Police apprehended him the same day and discovered he had committed two prior offenses at a mobile phone shop using the same method.
case category: criminal_verdict
incident time: 2024-11
keywords: fake transfer screenshot
keywords: interbank transfer delay
keywords: gold shop fraud
keywords: Lhasa
keywords: Zhou
keywords: Li
keywords: transfer scam
keywords: same-day arrest
related risks: Transfer Fraud
related threat actors: Malicious Users
citation: Lhasa Police Report Fake Transfer Screenshot Fraud Case
updated: 2026-06-18
version: 1

Guangzhou Liwan Police Crack Fake Transfer Screenshot Delivery Fraud Case
type: Case
break id: C0461
stix type: report
summary: The Guangzhou Public Security Bureau reported that Liwan police cracked a fraud case involving fake transfer screenshots used to induce delivery. A merchant surnamed Chen received clothing orders from two apparent customers on a social platform, and the customers sent transfer vouchers before asking her to ship the goods, but the payments never arrived. Police analysis found that both customers were the same suspect, Zhang. Starting with the second transaction, Zhang colluded with his younger brother and a friend, used photo editing software to alter recipient information in transfer screenshots, and deceived Chen into shipping goods. From November 2022 until the case was uncovered, Zhang used two platform accounts to defraud more than 210,000 yuan in goods. Zhang and others were placed under coercive measures.
case category: criminal_verdict
incident time: 2023-08
keywords: fake transfer screenshot
keywords: photo editing software
keywords: fake payment proof
keywords: delivery fraud
keywords: clothing wholesale
keywords: Guangzhou Liwan police
keywords: Zhanqian police station
keywords: Zhang
keywords: fraud
keywords: transfer fraud
keywords: 210,000 yuan
related risks: Transfer Fraud
related threat actors: Payment Fraud Groups
citation: Fake Transfer for Delivery Fraud: Guangzhou Liwan Police Crack a Fraud Case - Guangzhou Public Security Bureau
updated: 2026-06-26
version: 1

Nanchang Xihu Court Fake Transfer Screenshot Fraud Case
type: Case
break id: C0462
stix type: report
summary: The Nanchang Xihu District People's Court reported that it concluded a fraud case involving forged transfer screenshots. On September 20, 2022, Zhou claimed he wanted to buy a used car, created a fake 40,000 yuan WeChat transfer screenshot for the seller Wei, and used an alleged payment error and delayed arrival as a pretext to obtain use of the vehicle. On October 28, 2022, Zhou attempted the same method to defraud a supermarket of eighteen bottles of Jiannanchun liquor, but failed. On November 4, Zhou claimed he wanted to buy liquor and cigarettes, then created a fake 22,000 yuan Bank of Communications transfer screenshot to obtain the goods. The court found Zhou guilty of fraud and sentenced him to four years and three months in prison and a 51,000 yuan fine.
case category: criminal_verdict
incident time: 2023-03
keywords: fake transfer screenshot
keywords: fraudulent payment screenshot
keywords: fraud
keywords: Zhou
keywords: Nanchang Xihu District People's Court
keywords: used car fraud
keywords: liquor and cigarette fraud
keywords: WeChat transfer screenshot
keywords: bank transfer screenshot
keywords: criminal judgment
related risks: Transfer Fraud
related threat actors: Telecom Fraud Gangs
citation: Man Sentenced to Four Years and Three Months for Defrauding Property with Fake Transfer Screenshots - Nanchang Xihu District People's Court
updated: 2026-06-26
version: 1

Man Arrested for Scamming with Fake Transfer Records
type: Case
break id: C0463
stix type: report
summary: In January 2025, a man surnamed Fang in Hong'an County used software to fabricate transfer screenshots under the guise of membership top-ups, deceiving a foot therapy shop saleswoman surnamed Tang and defrauding her of 12,000 yuan in cash. The suspect Fang has been subjected to compulsory criminal measures.
case category: criminal_verdict
incident time: 2025-02
keywords: fake transfer records
keywords: transfer fraud
keywords: software-generated screenshots
keywords: foot therapy shop
keywords: cash fraud
keywords: compulsory criminal measures
keywords: Hong'an County
keywords: Fang
related risks: Transfer Fraud
related attack tools: AI Deepfake Tools
related threat actors: Payment Fraud Groups
citation: Man arrested for fraud using fake transfer records!_Huanggang Public Security Bureau
updated: 2026-06-18
version: 1

Man Detained in Mao County, Sichuan for Defrauding Over 20,000 Yuan Using Fake Transfer Screenshots
type: Case
break id: C0464
stix type: report
summary: In February 2024, a man surnamed Yu in Mao County, Sichuan, repeatedly used delayed mobile banking transfers as a pretext and fabricated fake transaction screenshots to defraud multiple victims, involving a total amount of over 20,000 yuan. Yu has been placed under criminal detention.
case category: criminal_verdict
incident time: 2024-02
keywords: fake transfer screenshots
keywords: delayed transfer scam
keywords: mobile banking fraud
keywords: Mao County
keywords: criminal detention
keywords: Yu
keywords: transfer fraud
related risks: Transfer Fraud
related threat actors: Telecom Fraud Gangs
citation: Mao County man defrauds more than 20,000 yuan with fake transfer screenshots; police remind the public not to trust screenshots alone
citation: Man detained in Mao County, Sichuan for defrauding over 20,000 yuan with fake transfer screenshots
updated: 2026-06-18
version: 1

Woman Sentenced for Repeated Fraud Using Fake Transfer Records
type: Case
break id: C0465
stix type: report
summary: Between 2020 and 2021, a woman surnamed Ma defrauded online stores by using fabricated Alipay transfer screenshots to order cosmetics and other goods, including over 4,000 yuan worth of cosmetics from a victim surnamed Wan. Ma was convicted and sentenced for fraud.
case category: criminal_verdict
incident time: 2022-12
keywords: fake Alipay transfer screenshot
keywords: fraud conviction
keywords: online store fraud
keywords: cosmetics scam
keywords: transfer fraud
keywords: Ma fraud case
related risks: Transfer Fraud
related threat actors: Malicious Users
citation: Woman sentenced for repeated fraud using fake transfer records in 'empty-handed scheme'
updated: 2026-06-18
version: 1

Photo-Editing Trickery: Man in Qinzhou Scams Pawnshops Three Times with Fake Transfer Screenshots
type: Case
break id: C0466
stix type: report
summary: In March 2024, a man surnamed Lin in Qinzhou used photo-editing software to alter the amounts and times on transfer screenshots, deceiving pawnshops and other merchants into trusting the fake payment records. He succeeded in scamming them three times in a row.
case category: criminal_verdict
incident time: 2024-03
keywords: fake screenshot scam
keywords: photo-editing fraud
keywords: transfer fraud
keywords: forged transfer receipt
keywords: pawnshop fraud
keywords: Qinzhou
keywords: fake payment proof
keywords: digital receipt tampering
related risks: Transfer Fraud
related threat actors: Malicious Users
citation: Case Explanation: Why Did the 'Fake Screenshot' Scam Keep Working? The Truth Was Simple
updated: 2026-06-18
version: 1

Earn Thousands a Day Just by Transferring Money? Beware of Becoming a Money Laundering Accomplice
type: Case
break id: C0467
stix type: report
summary: In October 2023, defendant Zhang Moumou saw an online advertisement promising daily earnings of thousands of yuan and contacted the advertiser. He organized cardholder Wu Moumou to use a bank card in Shangshui County to receive and withdraw a total of 90,000 yuan in fraud proceeds from three victims, including Ma Moumou. Zhang Moumou surrendered to authorities and returned all illicit funds before
case category: criminal_verdict
incident time: 2023-10
keywords: concealing criminal proceeds
keywords: money laundering
keywords: transfer fraud
keywords: Shangshui County
keywords: bank card receipt
keywords: illicit fund transfer
keywords: voluntary surrender
keywords: Zhang Moumou
keywords: Wu Moumou
related risks: Transfer Fraud
related threat actors: Money Laundering Gangs
citation: Earn thousands daily helping transfer money? Beware of becoming a money laundering accomplice! - Shangshui County Court Website
updated: 2026-06-18
version: 1

Beijing Fraud Case: Victim Transfers Nearly One Million Yuan, Gets a 'Surprise' 24 Hours Later
type: Case
break id: C0468
stix type: report
summary: In December 2024, an accountant surnamed Xiao at a company in Beijing's Tongzhou district was deceived into transferring 985,000 yuan by a suspect impersonating company leadership. The fraudster created a group chat posing as the executive to induce the transfer. Tongzhou police successfully froze the payment within 24 hours and returned the full amount of the defrauded funds.
case category: news_report
incident time: 2024-12
keywords: impersonation scam
keywords: CEO fraud
keywords: business email compromise
keywords: emergency fund freeze
keywords: payment interception
keywords: Tongzhou police
keywords: fund recovery
keywords: 985,000 yuan
related risks: Transfer Fraud
related threat actors: Telecom Fraud Gangs
citation: Beijing bizarre case: Transfer nearly a million yuan to scammers, gets a 'surprise' 24 hours later
updated: 2026-06-18
version: 1

Ctrip Supplier Illegally Redeemed Miles for Tickets, Leaving Passenger Under Investigation
type: Case
break id: C0469
stix type: report
summary: In January 2016, a traveler who booked a flight through Ctrip was investigated by police while boarding in Tokyo after the ticket was found invalid. The supplier had improperly redeemed someone else's airline miles to issue the ticket and resold it, exposing regulatory gaps in how ticket agents exploit mileage resale for profit.
case category: news_report
incident time: 2016-01
keywords: Ctrip
keywords: airline miles redemption
keywords: ticket agent
keywords: mileage resale
keywords: invalid ticket
keywords: boarding investigation
keywords: supplier violation
keywords: travel booking
related risks: Points Redemption Reselling
related threat actors: Scalpers
citation: Passenger buys 'fake ticket' on Ctrip, investigation reveals regulatory gaps in mileage resale | Jiemian News
updated: 2026-06-18
version: 1

Former Employee Sentenced for Stealing Mall Points and Cashing Out
type: Case
break id: C0470
stix type: report
summary: Between November 2021 and February 2022, a former employee surnamed Diao at a shopping mall in Jing’an District, Shanghai, exploited administrator privileges to repeatedly infiltrate the system and fraudulently inflate nearly 3.7 million loyalty points. The points were redeemed for goods and resold on online platforms, causing the mall a loss of approximately RMB 36,000. Diao was detained and conv
case category: criminal_verdict
incident time: 2022-02
keywords: loyalty points cash-out
keywords: former employee
keywords: administrator privileges
keywords: mall points
keywords: theft conviction
keywords: system tampering
keywords: online resale
keywords: Shanghai Jing’an
related risks: Points Redemption Reselling
related threat actors: Malicious Insiders
citation: Jing'an District Government: Former Employee Sentenced for Stealing Nearly 3.7 Million Mall Points
updated: 2026-06-18
version: 1

Former Employee Sentenced to 16 Months for Stealing 3.7 Million Loyalty Points
type: Case
break id: C0471
stix type: report
summary: Between November 2021 and February 2022, a former employee of a shopping mall in Jing'an District, Shanghai, repeatedly infiltrated the mall to steal nearly 3.7 million loyalty points using retained account credentials and knowledge of the points management system. The points were redeemed for goods and discount vouchers, which were then resold on online platforms for profit. The court convicted t
case category: criminal_verdict
incident time: 2022-08
keywords: loyalty points theft
keywords: points cashing
keywords: former employee theft
keywords: theft conviction
keywords: account credential misuse
keywords: online resale
keywords: Jing'an Shanghai
related risks: Points Redemption Reselling
related risks: Illegal Points Cash-Out
related threat actors: Malicious Insiders
citation: Jing'an District Government: Former Employee Sentenced to One Year and Four Months for Stealing Mall Points
updated: 2026-06-18
version: 1

Group Defrauded Tmall of 700 Million Birthday Points and Cashed Out Over 6 Million Yuan, Prosecuted
type: Case
break id: C0472
stix type: report
summary: Between October and November 2015, Lu Di, Yan Tian, and six other individuals exploited Tmall's birthday double-points rule by orchestrating fraudulent transactions through six controlled online stores. They fraudulently obtained over 700 million points, then redeemed the points as payment deductions for purchases to convert them into cash, resulting in illicit gains of approximately 6.71 million
case category: criminal_verdict
incident time: 2016-09
keywords: Tmall points
keywords: birthday double points
keywords: fictitious transactions
keywords: points cash-out
keywords: fraud indictment
keywords: Chongchuan District Procuratorate
keywords: Lu Di
keywords: Yan Tian
keywords: store control
keywords: points redemption
related risks: Points Redemption Reselling
related threat actors: Freebie Hunters
citation: Defrauding Tmall of 700 million points worth 6 million yuan, 8 charged with fraud by Nantong prosecutors_Yangtze River Delta Politics and Business...
citation: Tmall Defrauded of Nearly RMB 7 Million: Chongchuan Prosecutors Expose False-Transaction Cash-Out Scheme
updated: 2026-06-18
version: 1

Criminal Ring Profits Millions Annually by Flipping Credit Card Points via POS Machines
type: Case
break id: C0473
stix type: report
summary: Around 2015, a criminal ring used POS machines to rack up credit card points, then redeemed them for gift cards such as Walmart vouchers and resold them at near face value for cash. By operating at high volume, the scheme generated annual profits in the tens of millions of yuan, an act authorities say constitutes illegal profiteering through point redemption.
case category: news_report
incident time: 2015-02
keywords: POS machine
keywords: credit card points
keywords: point redemption
keywords: Walmart gift card
keywords: cash-out
keywords: illegal profiteering
keywords: criminal ring
keywords: card-not-present fraud
related risks: Points Redemption Reselling
related threat actors: Freebie Hunters
citation: Criminal gang uses POS machines to swipe credit card points for resale, earning tens of millions annually
updated: 2026-06-18
version: 1

Scalpers Emerge: Large Certificates of Deposit and Credit Card Points Become Resale Business
type: Case
break id: C0474
stix type: report
summary: An investigation by Beijing Business Daily reveals that financial scalpers have infiltrated the credit card points cash-out sector. Intermediaries use low-priced items on second-hand platforms to attract traffic, enticing cardholders to redeem points for virtual goods like shopping cards. The intermediaries then collect the cards and vouchers, convert them into cash settlements, and charge service
case category: news_report
incident time: 2026-06
keywords: credit card points cash-out
keywords: financial scalpers
keywords: points redemption
keywords: second-hand platform traffic diversion
keywords: virtual goods recycling
keywords: information leakage
keywords: illegal points resale
keywords: banking app login risk
related risks: Points Redemption Reselling
related risks: Illegal Points Cash-Out
related threat actors: Scalpers
citation: 'Scalpers' emerge! Large deposit certificates and credit card points become 'resale' business_Tencent News
updated: 2026-06-18
version: 1

Fans Steal Air Miles from Actor Wu Lei and Other Celebrities
type: Case
break id: C0475
stix type: report
summary: In September 2020, a fan of actor Wu Lei was exposed for binding the star's airline membership account since 2017, adding themselves and friends as authorized users, and redeeming 230,000 miles for flight tickets. Subsequently, other celebrities like Jiang Yingrong and Li Chen also discovered unauthorized mileage redemptions. The airline launched an investigation, and police have intervened in sim
case category: news_report
incident time: 2020-09
keywords: airline miles theft
keywords: celebrity mileage fraud
keywords: account takeover
keywords: unauthorized redemption
keywords: Wu Lei
keywords: Jiang Yingrong
keywords: Li Chen
keywords: China Southern Airlines
keywords: frequent flyer fraud
related risks: Points Theft
related threat actors: Freebie Hunters
citation: Wu Lei and other celebrities' airline miles stolen by fans, possibly forming an industry chain_Sina News
updated: 2026-06-18
version: 1

Shanghai Yangpu Procuratorate Handled a Virtual-Number Scheme Defrauding E-Commerce New-User Coupons and Referral Rewards
type: Case
break id: C0476
stix type: report
summary: In June 2021, the Supreme People's Procuratorate disclosed a case handled by the Shanghai Yangpu District People's Procuratorate in which virtual phone numbers were used to defraud an e-commerce platform of new-user coupons and referral rewards. From January to June 2019, delivery riders Liu, Tan and others bought virtual phone numbers, registered them as new users on Platform A, claimed new-user coupons, placed orders and resold goods for cash, or repeatedly used referral links to register and complete first orders to obtain rewards. Liu and Tan respectively defrauded the platform of more than 90,000 yuan and more than 70,000 yuan in coupons and rewards. In December 2020, Yangpu prosecutors charged 12 people with fraud, and the court sentenced the defendants to prison terms ranging from three years and six months to three months of detention.
case category: criminal_verdict
incident time: 2020-12
keywords: virtual phone numbers
keywords: new-user coupons
keywords: referral rewards
keywords: Yangpu District procuratorate
keywords: Liu
keywords: Tan
keywords: couponing task group
keywords: bulk registration
keywords: fraud offense
keywords: coupon abuse
related risks: Virtual Number Registration
related risks: Malicious Benefit Abuse
related risks: Subsidy Fraud
related attack tools: Black SIM Cards
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
related threat actors: Telecom Fraud Gangs
citation: Targeting Telecom and Online Fraud: Criminals Exploit Loopholes in the E-Commerce Economy
updated: 2026-06-26
version: 1

Foshan Man’s Credit Card Compromised Abroad After Clicking Fake Bank Points Redemption Link
type: Case
break id: C0477
stix type: report
summary: A Foshan resident, Mr. Chen, received a text message from a number starting with '95***' claiming his bank credit card points were about to expire. After clicking the attached 'points redemption' link and entering his card number, expiry date, and CVV code, his card was subsequently used for unauthorized overseas transactions. The case illustrates a typical phishing scheme using fake points redemp
case category: news_report
incident time: 2026-05
keywords: points redemption scam
keywords: phishing SMS
keywords: credit card fraud overseas
keywords: CVV code theft
keywords: fake bank link
keywords: bank points phishing
keywords: telecom fraud
keywords: cross-border payment fraud
keywords: personal data leak
related risks: Points Theft
related attack tools: Phishing Kits
related threat actors: Telecom Fraud Gangs
citation: Risk alert delivered to your door: Beware of 'points redemption' phishing links, protect your property_Tencent News
updated: 2026-06-18
version: 1

SPD Bank Mastercard Cardholders Hit by Overseas Fraud, Receive Point Compensation
type: Case
break id: C0478
stix type: report
summary: In September 2025, multiple SPD Bank Mastercard 'Priceless World Card' users reported unauthorized overseas transactions. The bank offered some affected customers compensation including reward points, transaction refunds, and fee waivers. Industry analysts suspect the fraud stemmed from a data breach at an e-commerce or payment platform, where card numbers, expiration dates, and CVV codes were har
case category: news_report
incident time: 2025-09
keywords: SPD Bank
keywords: Mastercard
keywords: credit card fraud
keywords: overseas unauthorized transaction
keywords: point compensation
keywords: data breach
keywords: offline transaction
keywords: CVV code
keywords: Priceless World Card
related risks: Points Theft
citation: Why is 'contactless' credit card fraud so hard to stop? - Tencent News
updated: 2026-06-18
version: 1

Sichuan Mianyang Police Dismantle Cross-Province Mobile Points Redemption Fraud Ring
type: Case
break id: C0479
stix type: report
summary: The Fucheng branch of the Mianyang Public Security Bureau in Sichuan cracked a telecom fraud case spanning Sichuan, Fujian, and Hebei that used 'mobile consumption points redemption' as a lure. Police arrested 164 suspects and seized more than 400 computers, eight vehicles, and 178 mobile phones. The group operated under the cover of legally registered technology companies, recruited large numbers of callers, and used text messages and phone calls to induce mobile users to redeem account points as part of the fraud scheme.
case category: criminal_verdict
incident time: 2021-07
keywords: mobile points redemption
keywords: telecom fraud
keywords: points theft
keywords: cross-province crime
keywords: Mianyang police
keywords: Zhang Mouyun
keywords: electronic points
keywords: online fraud ring
related risks: Points Theft
related threat actors: Telecom Fraud Gangs
citation: 164 arrested: Sichuan Mianyang police crack major cross-province telecom fraud case
updated: 2026-06-18
version: 1

MPS Criminal Investigation Bureau Warns Against 'Points Expiration' Scams
type: Case
break id: C0480
stix type: report
summary: In June 2025, China's Ministry of Public Security Criminal Investigation Bureau issued 20 anti-fraud keywords, listing 'points expiration' as a common scam tactic. Fraudsters typically lure victims by claiming points are about to expire, tricking them into clicking phishing links to carry out fraud. Authorities urge the public not to trust unofficial notices about points expiration and to verify t
case category: security_incident
incident time: 2025-06
keywords: points expiration scam
keywords: phishing links
keywords: telecom fraud
keywords: MPS Criminal Investigation Bureau
keywords: anti-fraud keywords
keywords: points theft
keywords: fraud prevention
related risks: Points Theft
related attack tools: Phishing Kits
related threat actors: Telecom Fraud Gangs
citation: Public Security Authorities Release 20 Anti-Fraud Keywords
citation: [Anti-fraud Awareness] Remember these 20 anti-fraud keywords to easily decode telecom fraud schemes
updated: 2026-06-18
version: 1

NPC Deputy Proposes Mandatory Facial Recognition Login for Adult Gamers
type: Case
break id: C0481
stix type: report
summary: During the 2022 Two Sessions, CPPCC National Committee member Yu Xinwei highlighted that many minors still bypass anti-addiction systems through identity fraud. Reasons include children tricking parents into facial scans under the guise of studying, and illegal groups renting accounts or offering proxy facial recognition services. She proposed mandatory facial recognition login for adult users to
case category: news_report
incident time: 2022-03
keywords: facial recognition login
keywords: online gaming
keywords: anti-addiction system
keywords: minor identity fraud
keywords: proxy facial recognition
keywords: Two Sessions proposal
keywords: Yu Xinwei
keywords: CPPCC National Committee member
keywords: account renting
keywords: game addiction prevention
related risks: Minor Age Verification Bypass
citation: Multiple NPC deputies acknowledge effectiveness of gaming anti-addiction policy, focus turns to closing loopholes
updated: 2026-06-18
version: 1

Game Fined 100,000 Yuan for Failing to Integrate Real-Name Authentication System
type: Case
break id: C0482
stix type: report
summary: In July 2021, a technology company's game on Apple iOS did not connect to the national electronic identity authentication system for minors. Minors using iPads for online classes could download the game and make in-app purchases without real-name verification. Law enforcement issued a warning, confiscated illegal gains, and imposed a 100,000 yuan fine under the Law on the Protection of Minors.
case category: administrative_enforcement
incident time: 2021-07
keywords: Law on the Protection of Minors
keywords: game real-name authentication
keywords: Apple iOS
keywords: electronic identity authentication system
keywords: anti-addiction
keywords: administrative penalty
keywords: 100,000 yuan fine
keywords: online game
related risks: Minor Age Verification Bypass
citation: Province may introduce new policies for gaming overseas expansion; company fined 100,000 for failing to implement anti-addiction measures | Weekly roundup
citation: Shanghai Issues First Penalty Against an Online Game Company for Implementing the Revised Law on the Protection of Minors
updated: 2026-06-18
version: 1

15-Year-Old Boy Uses Mother's Identity to Top Up Games
type: Case
break id: C0483
stix type: report
summary: In October 2024, a 15-year-old middle school student surnamed Xu bypassed an online game's anti-addiction system by registering and logging in with his mother's identity information, then secretly used her WeChat account to top up nearly 5,000 yuan. After his mother discovered the charges, she sued for a full refund. The court ultimately ordered the platform to return only a portion of the funds.
case category: news_report
incident time: 2024-10
keywords: minor game top-up
keywords: identity misuse
keywords: anti-addiction system bypass
keywords: real-name verification evasion
keywords: WeChat Pay
keywords: refund dispute
keywords: parental lawsuit
keywords: platform liability
related risks: Minor Age Verification Bypass
related threat actors: Malicious Users
citation: Boy repeatedly uses mother's identity to top up games, parents sue platform for refund
updated: 2026-06-18
version: 1

Minors Bypass Game Real-Name Verification via Purchased QQ Accounts
type: Case
break id: C0484
stix type: report
summary: In October 2023, China Consumer Daily published an assessment report on minor protection in 20 mobile games. In its Honor of Kings test, researchers found that when logging in with a QQ account purchased online, the game directly reused the adult identity information of the original account holder and skipped registration-stage real-name verification. The case shows how account rental or resale can weaken anti-addiction systems' ability to identify the real user.
case category: security_incident
incident time: 2023-10
keywords: QQ account purchase
keywords: bypass real-name verification
keywords: game anti-addiction system
keywords: minor identity recognition
keywords: Tencent game loophole
related risks: Minor Age Verification Bypass
related threat actors: Account Dealers
related threat actors: Malicious Users
citation: Assessment report on minor protection in 20 mobile games
updated: 2026-06-25
version: 1

Game Company Ordered to Pay 800,000 Yuan for Selling Bilibili Game Accounts and SMS-Code Services to Bypass Anti-Addiction Controls
type: Case
break id: C0485
stix type: report
summary: In April 2026, the Ningbo Intermediate People's Court concluded an unfair competition dispute. A game company sold more than twenty popular Bilibili-server game accounts on an e-commerce platform and provided buyers with virtual phone numbers and an SMS-code receiving platform, helping minors bypass Bilibili's real-name authentication and anti-addiction system. The court held that the conduct constituted unfair competition and ordered the company to compensate Bilibili's operator 800,000 yuan for economic losses and reasonable enforcement expenses. The first-instance judgment has taken effect.
case category: administrative_enforcement
incident time: 2026-05
keywords: Bilibili game accounts
keywords: anti-addiction bypass
keywords: minor protection circumvention
keywords: virtual phone verification
keywords: SMS-code receiving platform
keywords: unfair competition gaming
keywords: real-name authentication evasion
related risks: Minor Age Verification Bypass
related attack tools: SMS Verification Code Platform
related attack tools: Account Rental Platforms
related threat actors: Account Dealers
related threat actors: Malicious Merchants
citation: Selling game accounts at scale and helping minors bypass anti-addiction controls
updated: 2026-06-18
version: 1

Virtual ID Number Generators Found Online Can Bypass Anti-Addiction Systems
type: Case
break id: C0486
stix type: report
summary: Investigations reveal that so-called 'virtual ID number generators' have been circulating online, claiming to randomly generate adult ID numbers for bypassing real-name verification in online game anti-addiction systems. In earlier years, some players used such tools to create fake identity information and circumvent real-name registration and anti-addiction restrictions.
case category: news_report
incident time: 2021-10
keywords: virtual ID number generator
keywords: bypass anti-addiction system
keywords: real-name verification
keywords: online gaming
keywords: minor protection
keywords: fake identity information
keywords: adult ID number generation
keywords: anti-addiction bypass
related risks: Minor Age Verification Bypass
related threat actors: Malicious Users
citation: ID number generation sites still online! Beware of various 'anti-addiction bypass tutorial' scams - Tencent News
updated: 2026-06-18
version: 1

Illegal Services Offer 'Face Recognition Bypass' to Help Minors Evade Game Authentication
type: Case
break id: C0487
stix type: report
summary: A black market service has emerged online offering to bypass face recognition checks for minors, allowing them to circumvent age verification in online games. Perpetrators use purchased personal information and ID photos to create dynamic facial videos, claiming minors can log in without real-name authentication.
case category: news_report
incident time: 2021-06
keywords: face recognition bypass
keywords: minors bypass game authentication
keywords: dynamic facial video
keywords: personal information leakage
keywords: anti-addiction system
keywords: online gaming black market
keywords: real-name authentication evasion
related risks: Minor Age Verification Bypass
related attack tools: AI Deepfake Tools
related threat actors: Criminal Organizations
citation: ...offering 'proxy face recognition' services, claiming no real-name registration needed to log into games - Tencent News
updated: 2026-06-18
version: 1

Crackdown on Underground Syndicate Renting and Selling Accounts and Providing Proxy Face-Scanning for Minors
type: Case
break id: C0488
stix type: report
summary: Following the strict anti-addiction notice issued by the National Press and Publication Administration in August 2021, an underground syndicate continued to illegally rent and sell game accounts to minors and offer proxy face-scanning services, helping them bypass real-name verification and facial recognition in the anti-addiction system. The group was targeted by police.
case category: criminal_verdict
incident time: 2022-01
keywords: minor game accounts
keywords: account renting
keywords: proxy face-scanning
keywords: anti-addiction bypass
keywords: real-name verification
keywords: facial recognition evasion
keywords: underground industry
keywords: game account trading
related risks: Minor Age Verification Bypass
related attack tools: Account Rental Platforms
related threat actors: Account Dealers
citation: Supreme People's Procuratorate: Selling Face-Unlocked Game Accounts to Minors May Constitute a Crime
updated: 2026-06-18
version: 1

The 'Kuai a Da Ti' AI CAPTCHA-solving Platform Case
type: Case
break id: C0489
stix type: report
summary: In 2017, during the '1·03' cybercrime operation in Shaoxing, Zhejiang, suspects Li Qi, Yang Kequn, and others built the 'Kuai a Da Ti' platform, which provided automated image CAPTCHA recognition services for credential-stuffing attackers, achieving a recognition accuracy rate of over 95% and bypassing internet companies' CAPTCHA security systems. The platform integrated with credential-stuffing t
case category: criminal_verdict
incident time: 2017-12
keywords: Kuai a Da Ti
keywords: AI CAPTCHA solving
keywords: CAPTCHA bypass
keywords: credential stuffing
keywords: image CAPTCHA recognition
keywords: cybercrime gang
keywords: personal information harvesting
keywords: Shaoxing
related risks: CAPTCHA Bypass
related attack tools: Image CAPTCHA Recognition Tools
related attack tools: Credential Stuffing Tools
related threat actors: Criminal Organizations
citation: Case | Fraud uses AI, 82 arrested in cyber 'black market' special operation | Crime | Yu | Fraud...
citation: Shaoxing Police Crack the Largest Data-Theft Black-Market Company Case in Local History
updated: 2026-06-18
version: 1

Chen Used Crawler Software to Help Scalpers Grab Damai Tickets Instantly
type: Case
break id: C0490
stix type: report
summary: In a ticket scalping case described by a judge from Beijing Tongzhou Court, Chen, a so-called technical scalper, used crawler software he wrote to help clients grab tickets on the Damai platform instantly. He made more than 120,000 yuan in illegal gains and seriously disrupted normal ticket purchasing order. Chen was convicted of providing programs or tools for intruding into or illegally controlling computer information systems, and was sentenced to three years in prison with a four-year suspension and a 20,000-yuan fine.
case category: criminal_verdict
incident time: 2023-07
keywords: ticket scalping crawler
keywords: Damai.cn bot
keywords: instant ticket grabbing
keywords: scalping software
keywords: technical scalper
keywords: illegal ticket reselling
keywords: automated ticket purchasing
related risks: CAPTCHA Bypass
related attack tools: Web Scraping Tools
related attack tools: Image CAPTCHA Recognition Tools
related threat actors: Scraping Gangs
citation: Police Crack Down on Ticket Scalpers as Beijing Tongzhou Court Explains Their Profit Model
updated: 2026-06-18
version: 1

Wu and Li Convicted for Bypassing Security Measures to Scrape Data
type: Case
break id: C0491
stix type: report
summary: Between 2019 and 2020, Wu and Li bypassed security protections on Beijing 58 Information Technology's website to scrape property listings and user phone numbers. They sold the data through Chongqing Hezhi Network Technology, earning over 1 million yuan in illegal proceeds before being apprehended on June 3, 2021.
case category: criminal_verdict
incident time: 2021-06
keywords: web scraping
keywords: circumventing security measures
keywords: CAPTCHA bypass
keywords: data scraping
keywords: personal information infringement
keywords: unauthorized computer system access
keywords: Beijing 58 Information Technology
keywords: Chongqing Hezhi Network Technology
keywords: property listings
keywords: user phone numbers
related risks: CAPTCHA Bypass
related attack tools: Web Scraping Tools
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Scraping Gangs
citation: Cracking security measures, scraping data, profiting over 1 million: two sentenced to five years and four years eight months respectively...
updated: 2026-06-18
version: 1

Guangdong Shantou Chen Moucai Used AI to Bypass Douyin Facial Recognition Case
type: Case
break id: C0492
stix type: report
summary: In May 2023, Shantou police discovered that suspect Chen Moucai and others purchased citizens' personal information and used overseas AI facial technology software to create videos from facial images, bypassing Douyin's facial recognition system to illegally register a large number of real-name verified accounts. This case was listed among the top ten typical cases of the Ministry of Public Securi
case category: criminal_verdict
incident time: 2023-05
keywords: AI face swap
keywords: facial recognition bypass
keywords: Douyin real-name verification
keywords: personal information
keywords: cybercrime
keywords: Chen Moucai
keywords: Ministry of Public Security typical cases
keywords: facial video synthesis
related risks: CAPTCHA Bypass
related attack tools: AI Deepfake Tools
related threat actors: AI Tool Abusers
related threat actors: AI Fraud Gangs
citation: [People's Public Security Daily] Ministry of Public Security publishes ten typical hacker crime cases
citation: China Daily reports ten typical hacker crime cases published by the MPS
updated: 2026-06-24
version: 2

Anhui Hefei Police Crack Province's First Facial Recognition Crime Case
type: Case
break id: C0493
stix type: report
summary: In 2021, Hefei police in Anhui dismantled a criminal gang that used AI to forge dynamic facial videos, arresting eight suspects. The group bypassed identity verification steps such as mobile SIM registration by simulating facial recognition technology, providing technical support to underground industrial chains. This was the first facial recognition crime case in Anhui Province.
case category: criminal_verdict
incident time: 2021-10
keywords: AI forged face
keywords: dynamic video bypass
keywords: SIM registration
keywords: facial recognition crime
keywords: deepfake
keywords: identity verification bypass
keywords: underground industry
keywords: Hefei Anhui
related risks: CAPTCHA Bypass
related risks: Digital Human Deepfake
related attack tools: AI Deepfake Tools
related threat actors: Criminal Organizations
citation: Anhui police crack province's first case involving facial recognition fraud
updated: 2026-06-18
version: 1

Modern Image CAPTCHA Security and Underground CAPTCHA-Solving Services
type: Case
break id: C0494
stix type: report
summary: This research paper classifies current image CAPTCHAs into selection-based, slider-based, and click-based types, proposes attack frameworks for each category, and systematically evaluates attack effectiveness against 10 real-world image CAPTCHAs from providers such as Tencent, Google, and 12306. It also identifies 152 underground CAPTCHA-solving services, revealing the scale and business ecosystem
case category: academic_research
incident time: 2019-03
keywords: image CAPTCHA
keywords: CAPTCHA security
keywords: CAPTCHA-solving services
keywords: underground market
keywords: human verification bypass
keywords: Tencent CAPTCHA
keywords: Google reCAPTCHA
keywords: 12306 CAPTCHA
keywords: attack framework
related risks: CAPTCHA Bypass
related attack tools: CAPTCHA Solving Platform
related attack tools: Image CAPTCHA Recognition Tools
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Criminal Organizations
citation: Towards understanding the security of modern image captchas and underground captcha-solving services
updated: 2026-06-18
version: 1

Bank of Communications depositor loses ¥400,000 after face recognition bypassed
type: Case
break id: C0495
stix type: report
summary: In 2021, fraudsters used a Trojan virus to intercept SMS messages and leveraged fake facial videos to bypass the Bank of Communications app's liveness detection. They succeeded in passing face recognition verification six times, resetting the password and raising the transfer limit, ultimately stealing over ¥400,000 from depositor Chu Feng. The IP address indicated the operations originated from T
case category: security_incident
incident time: 2021
keywords: face recognition bypass
keywords: liveness detection bypass
keywords: Bank of Communications app
keywords: Trojan virus SMS interception
keywords: fake facial video attack
keywords: bank transfer limit increase
keywords: account takeover fraud
keywords: mobile banking security
related risks: Facial Recognition Bypass
related attack tools: Trojan Virus
related attack tools: AI Deepfake Tools
related threat actors: Telecom Fraud Gangs
citation: 'Face scan' causes trouble, Bank of Communications user loses 400,000 in deposits
updated: 2026-06-18
version: 1

Bank of Communications Depositor Li Hong Loses Nearly 430,000 Yuan to Fake Facial Recognition Theft
type: Case
break id: C0496
stix type: report
summary: In a case heard by the Beijing Fengtai District People's Court, plaintiff Li Hong was induced by fraudsters to download a malicious app and enable screen sharing, through which her facial video and bank card details were captured. The fraudsters used the fake facial video to bypass six facial recognition checks on the Bank of Communications app, stealing nearly 430,000 yuan from her account.
case category: criminal_verdict
incident time: 2022-08
keywords: facial recognition bypass
keywords: Bank of Communications
keywords: screen sharing
keywords: malicious app
keywords: fake facial video
keywords: unauthorized fund transfer
keywords: Li Hong
keywords: Beijing Fengtai District People's Court
related risks: Facial Recognition Bypass
related attack tools: AI Deepfake Tools
related attack tools: Fake Apps
related threat actors: AI Fraud Gangs
citation: Banks unable to distinguish real from fake faces, frequent cases of depositor fund theft
updated: 2026-06-18
version: 1

Jiangsu Police Uncover Face-Swap Software Scam for Unblocking WeChat Accounts
type: Case
break id: C0497
stix type: report
summary: In October 2021, Jiangsu police dismantled a criminal gang that used face-swap software to bypass WeChat’s facial recognition authentication. The suspects converted static photos into dynamic videos using multiple mobile apps, forged facial videos to successfully unblock over ten thousand WeChat accounts previously restricted for policy violations, and assisted fraud rings in using these accounts
case category: criminal_verdict
incident time: 2021-10
keywords: face-swap software
keywords: facial recognition bypass
keywords: WeChat account unblocking
keywords: dynamic video generation
keywords: static photo forgery
keywords: account fraud
keywords: Jiangsu police
keywords: Nantong Rugao public security
keywords: cyber underground economy
related risks: Facial Recognition Bypass
related attack tools: AI Deepfake Tools
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
citation: Face-swap app unblocks tens of thousands of accounts for fraud, can facial recognition serve as definitive verification? - Tencent News
citation: Cyber Police Explain How Blocked Fraud-Linked Accounts Were “Revived”
updated: 2026-06-18
version: 1

Video Injection Attack Detection: Countering Virtual Camera Bypass in Remote Biometric Systems
type: Case
break id: C0498
stix type: report
summary: Academic research reveals that attackers leverage deepfake technology and virtual camera software to inject pre-recorded or synthetic video streams directly into the identity authentication pipeline, bypassing the physical camera interface to deceive facial recognition systems. The study proposes a machine learning-based virtual camera detection method that analyzes session metadata to identify su
case category: academic_research
keywords: video injection attack
keywords: virtual camera bypass
keywords: deepfake
keywords: facial recognition bypass
keywords: remote biometrics
keywords: machine learning detection
keywords: session metadata
keywords: authentication pipeline
keywords: injection attack detection
related risks: Facial Recognition Bypass
related attack tools: AI Deepfake Tools
related attack tools: Digital Human Generation Tools
related threat actors: AI Fraud Gangs
citation: Catching video injection attacks in remote biometric systems - arXiv
updated: 2026-06-18
version: 1

Exploiting Ordering Loophole via Proxy Purchasing to Illegally Profit Over One Million Yuan
type: Case
break id: C0499
stix type: report
summary: Starting May 2024, suspect Wang discovered a vulnerability in a fast-food company's mini-program that allowed coupon codes to be converted into product redemption codes. Wang opened an online store, listed virtual goods under the guise of proxy ordering and coupon codes, and provided buyers with electronic redemption codes to complete orders below the store's selling price. Wang also wrote script software to automate order services and illegally profited more than 900,000 yuan before the case was uncovered. Another suspect, Li, used a similar method to illegally profit more than 120,000 yuan. Both were approved for arrest on suspicion of illegally obtaining computer information system data.
case category: criminal_verdict
incident time: 2024-05
keywords: proxy purchasing
keywords: coupon code exploit
keywords: illegal profit
keywords: mini-program vulnerability
keywords: electronic redemption code
keywords: illegally obtaining computer information system data
keywords: fast-food company
keywords: script automation
keywords: Xuhui District Procuratorate
keywords: cyber underground industry
related risks: Proxy Login / Proxy Order Placement
related attack tools: Automation Scripts
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
related threat actors: Malicious Users
citation: Coupons became a cash machine: the coupon exploiters who made over one million yuan were caught
updated: 2026-06-18
version: 1

Buying 'Proxy Ordering' Discounts May Constitute Aiding a Crime: Two Individuals Exploited Ordering Loopholes to Illegally Profit Over One Million Yuan
type: Case
break id: C0500
stix type: report
summary: Starting May 2024, suspect Wang exploited a vulnerability in a fast-food chain's mini-program to convert freely obtained coupons into product redemption codes. He listed these codes as virtual goods online under the guise of proxy ordering or coupon codes and provided electronic redemption codes to buyers to complete orders. Wang wrote automated script software to handle order services and illegally profited more than 900,000 yuan. Another suspect, Li, used the same method to illegally profit more than 120,000 yuan. Both were approved for arrest by the Xuhui District Procuratorate on suspicion of illegally obtaining computer information system data.
case category: criminal_verdict
incident time: 2024-05
keywords: proxy ordering
keywords: coupon code
keywords: illegal profit
keywords: mini-program vulnerability
keywords: script auto-delivery
keywords: illegally obtaining computer information system data
keywords: Xuhui District Procuratorate
keywords: fast-food chain
keywords: virtual goods
keywords: electronic redemption code
related risks: Proxy Login / Proxy Order Placement
related attack tools: Automation Scripts
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Freebie Hunters
citation: Coupons became a cash machine: the coupon exploiters who made over one million yuan were caught
updated: 2026-06-18
version: 1

Underground Proxy Ordering Rings Exploit Leaked Payment Card Data for Purchases
type: Case
break id: C0501
stix type: report
summary: A proxy ordering scheme requires buyers to log into the fraud ring's e-commerce platform account, which must have at least five prior order records and a minimum single-order value of 3,000 Mexican pesos. The buyer pays 60% of the total order value to the ring, which then binds stolen payment card information to the account to complete the transaction. The group sources leaked credit and debit car
case category: news_report
incident time: 2025-06
keywords: proxy ordering
keywords: underground fraud ring
keywords: payment card data leak
keywords: dark web carding
keywords: e-commerce platform fraud
keywords: credit card theft
keywords: Mexican peso
keywords: account binding
keywords: arbitrage fraud
related risks: Proxy Login / Proxy Order Placement
related attack tools: Dark Web
related threat actors: Data Brokers
related threat actors: Payment Fraud Groups
citation: 'Proxy ordering' black market invades global e-commerce: deep dive into new arbitrage and fraud techniques - Platform...
updated: 2026-06-18
version: 1

Ride-hailing black market uses virtual numbers to register or hijack accounts for low-price proxy ordering
type: Case
break id: C0502
stix type: report
summary: Black market operators use virtual phone numbers to register or hijack ride-hailing platform accounts, placing low-price proxy orders for passengers and profiting from the fare difference. This scheme relies on fake device environments or stolen credentials to bypass platform risk controls, representing a typical proxy ordering fraud operation.
case category: news_report
incident time: 2023-12
keywords: ride-hailing
keywords: virtual phone number
keywords: account hijacking
keywords: proxy ordering
keywords: risk control bypass
keywords: fake device environment
keywords: account registration
keywords: low-price order
keywords: fare arbitrage
keywords: black market
related risks: Proxy Login / Proxy Order Placement
related attack tools: Black SIM Cards
related attack tools: SMS Verification Code Platform
related attack tools: Account Rental Platforms
related threat actors: Freebie Hunters
related threat actors: Account Dealers
related threat actors: Criminal Organizations
citation: Ride-hailing fake orders may constitute crime, a battle against black market forces unfolds - Shanghai Observer
updated: 2026-06-18
version: 1

College Students' National Subsidy Quotas Targeted by Scalpers, Mass Proxy Ordering to Exploit Platform Discounts
type: Case
break id: C0503
stix type: report
summary: Scalpers specializing in bulk purchasing are exploiting e-commerce platform subsidies and consumer vouchers by recruiting individuals to place proxy orders, circumventing one-time-per-account limits. These scalpers recruit online and on campuses to place orders, then resell the goods to physical stores for profit. This activity extends to national subsidies and provincial consumer funds, represent
case category: news_report
incident time: 2025-06
keywords: national subsidy
keywords: consumer vouchers
keywords: scalpers
keywords: proxy ordering
keywords: arbitrage
keywords: e-commerce platform
keywords: bulk purchasing
keywords: account restrictions
keywords: college students
keywords: platform discounts
related risks: Proxy Login / Proxy Order Placement
related threat actors: Scalpers
citation: College students' 'national subsidy' quotas targeted by scalpers... | E-commerce platform | Proxy purchasing | National subsidy |...
updated: 2026-06-18
version: 1

Tianjin Police Dismantle Virtual Device Operation Aiding Overseas Telecom Fraud Ring
type: Case
break id: C0504
stix type: report
summary: In May 2022, Tianjin police acted on a tip-off and uncovered suspects in Xiqing District who were setting up virtual devices to assist an overseas criminal syndicate in committing telecom fraud. The operation represents a typical case of using virtual equipment for communication fraud, providing technical support to downstream crimes.
case category: criminal_verdict
incident time: 2022-05
keywords: pseudo base station
keywords: GOIP device
keywords: telecom fraud
keywords: aiding information network criminal activities
keywords: Tianjin police
keywords: overseas criminal syndicate
keywords: communication fraud
keywords: technical support
related risks: Virtual Device Identification Bypass
related attack tools: Modem Pool
related threat actors: Telecom Fraud Gangs
citation: Running a 'pseudo base station' won't get you far! Tianjin police dismantle group aiding overseas telecom fraud - Crime...
citation: Running a 'Pseudo Base Station'? This Criminal Gang Was Dismantled
updated: 2026-06-18
version: 1

AI-Based Detection of SIM Box Bypass Fraud
type: Case
break id: C0505
stix type: report
summary: A 2017 academic paper highlights that telecom operators suffer heavy losses from SIM box bypass fraud, where fraudsters use SIM box devices to disguise international calls as local traffic and avoid settlement fees. The study proposes applying AI algorithms to mine operator data and identify SIM cards used for bypassing international calls.
case category: academic_research
incident time: 2017-11
keywords: SIM box
keywords: bypass fraud
keywords: AI detection
keywords: machine learning
keywords: telecom operators
keywords: international call routing
keywords: SIM card
keywords: fraud detection
keywords: arXiv
related risks: Virtual Device Identification Bypass
related attack tools: Modem Pool
citation: Bypass fraud detection: Artificial intelligence approach
updated: 2026-06-18
version: 1

How Fraudsters Mask Their Traces in International Bypass Fraud
type: Case
break id: C0506
stix type: report
summary: A 2024 academic study investigates how fraudsters conceal their tracks in international communication bypass fraud. The research extracts carrier network topologies and analyzes how fraudsters use emulators and other techniques to evade detection.
case category: academic_research
incident time: 2024-05
keywords: international bypass fraud
keywords: fraudster trace masking
keywords: carrier network topology
keywords: emulator evasion
keywords: virtual device identification bypass
keywords: OpenCellID
keywords: telecom fraud
keywords: ACM CCS
keywords: network topology analysis
related risks: Virtual Device Identification Bypass
related attack tools: Mobile Phone Emulator
related attack tools: Virtual Machine
citation: Battle of Wits: To What Extent Can Fraudsters Disguise Their Tracks in International bypass Fraud?
updated: 2026-06-18
version: 1

Waydroid Emulator Detection Bypass Feature Request
type: Case
break id: C0507
stix type: report
summary: In 2021, a user submitted a feature request on GitHub to the Waydroid project, exploring methods to make the Android emulator indistinguishable from regular everyday devices in terms of device characteristics, effectively achieving emulator detection bypass.
case category: vulnerability_advisory
incident time: 2021-01
keywords: Waydroid
keywords: emulator detection bypass
keywords: Android emulator
keywords: virtual device identification
keywords: device fingerprinting
keywords: anti-detection
keywords: GitHub Issue
related risks: Virtual Device Identification Bypass
related attack tools: Mobile Phone Emulator
related attack tools: Virtual Machine
citation: FEATURE: bypass emulator detection · Issue #198 - GitHub
updated: 2026-06-18
version: 1

A Test Case for Bypassing Emulator Detection Using Frida and Termux
type: Case
break id: C0508
stix type: report
summary: This project provides a test case that examines methods for bypassing emulator detection on Android using Frida and Termux, and observes how applications react to JavaScript injection.
case category: security_incident
keywords: Frida
keywords: Termux
keywords: emulator detection bypass
keywords: Android
keywords: JavaScript injection
keywords: EmulatorDetectionByPass
keywords: dynamic instrumentation
keywords: virtual device identification
keywords: mobile security testing
related risks: Virtual Device Identification Bypass
related attack tools: Debugging Tools
citation: EmulatorDetectionByPass/README.md at main · Ms-dev3 ... - GitHub
updated: 2026-06-18
version: 1

Five Suspects Charged with Developing and Selling Software to Bypass Bank Biometrics
type: Case
break id: C0509
stix type: report
summary: On June 6, 2026, Hanoi police dismantled a group and arrested five individuals for creating, purchasing, and selling malware capable of bypassing biometric systems at multiple credit institutions, leading to the theft of funds from customer bank accounts. Police warned that the risks of personal data and bank account leaks must not be overlooked.
case category: criminal_verdict
incident time: 2026-06
keywords: malware
keywords: biometric bypass
keywords: bank account theft
keywords: Hanoi police
keywords: credit institutions
keywords: cybersecurity
keywords: Vietnam
keywords: financial fraud
related risks: Risk Device Identification Bypass
related attack tools: Trojan Virus
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Malware Developers
related threat actors: Telecom Fraud Gangs
citation: Vietnam Government News: Group Making Malware to Bypass Bank Biometrics Dismantled
updated: 2026-06-18
version: 1

Bypassing Facial Recognition: How Should Financial Institutions Defend Against New Types of Telecom Fraud from the Black Market?
type: Case
break id: C0510
stix type: report
summary: On July 19, 2022, it was reported that black market actors used synthetic live faces to bypass the verification and review process of financial institutions to commit telecom fraud. The case revealed that criminals located in Thailand reset passwords through compromised devices and successfully passed facial recognition verification, transferring customer funds. On the device side, risk tags such
case category: news_report
incident time: 2022-07
keywords: synthetic live face
keywords: facial recognition bypass
keywords: telecom fraud
keywords: device tampering
keywords: IMEI
keywords: VPN
keywords: financial institution risk control
keywords: black market
keywords: Tongdun Technology
related risks: Risk Device Identification Bypass
related attack tools: AI Deepfake Tools
related attack tools: Device Spoofing Tools
related attack tools: Risk IP Addresses
related attack tools: Virtual Machine
related threat actors: Telecom Fraud Gangs
related threat actors: Criminal Organizations
related threat actors: Cross-border Criminal Organizations
citation: Penetrating facial recognition: How should financial institutions combat new black market fraud?
updated: 2026-06-18
version: 1

National Cybersecurity Alert Warns of AI-Powered CAPTCHA Bypass Attacks
type: Case
break id: C0511
stix type: report
summary: On January 17, 2025, authorities reported that during the 2024 National Day holiday, a scalper gang used automated software to illegally snatch approximately 10,000 tickets from a scenic spot booking platform in Yangshuo, Guilin. The tool leveraged a high-accuracy image recognition model to automatically solve graphic-based verification challenges, bypassing the CAPTCHA component.
case category: security_incident
incident time: 2025-01
keywords: AI CAPTCHA bypass
keywords: image recognition model
keywords: graphic verification bypass
keywords: automated ticket scalping
keywords: CAPTCHA solving bot
keywords: Yangshuo ticket scalping
keywords: booking platform abuse
keywords: risk device identification bypass
related risks: Risk Device Identification Bypass
related attack tools: Image CAPTCHA Recognition Tools
related attack tools: Malicious AI Applications
related threat actors: Scalpers
citation: Warning notice on new criminal methods using artificial intelligence to bypass graphic verification mechanisms
citation: National Cybersecurity Notification Center warns of new crime: using AI to bypass graphic verification mechanisms
updated: 2026-06-24
version: 1

Reverse Engineering API Encryption and Decryption Analysis
type: Case
break id: C0512
stix type: report
summary: During analysis of a foreign website, the core API was found to return encrypted strings. By setting browser breakpoints, the API request was intercepted and the decryption method was traced. Analysis of the JavaScript code confirmed the use of AES encryption. A large language model was then used to assist in analyzing and reconstructing the encryption and decryption algorithms, successfully decry
case category: academic_research
incident time: 2024-10
keywords: API reverse engineering
keywords: AES decryption
keywords: browser breakpoint debugging
keywords: CryptoJS
keywords: JavaScript reverse engineering
keywords: HTTP request interception
keywords: LLM-assisted analysis
keywords: encryption algorithm reconstruction
related risks: HTTP Request Analysis
related attack tools: Debugging Tools
related attack tools: Packet Capture Tools
related attack tools: Decompilation Tools
related attack tools: LLM Automated Attack Tools
citation: iOSSignatureAnalysis: iOS App Signature and Interface Analysis Example - GitHub
updated: 2026-06-18
version: 1

Android Reverse Engineering – Packet Capture Analysis and Tooling Overview
type: Case
break id: C0513
stix type: report
summary: During the reverse engineering of an Android application, the developer captured login request packets and identified encrypted username and password fields. By analyzing the encryption algorithm, the credentials were successfully decrypted and used to simulate a login. Packet capture helps locate critical sections within encrypted or obfuscated code, providing leads for further reverse engineerin
case category: academic_research
incident time: 2025-04
keywords: Android reverse engineering
keywords: packet capture
keywords: encryption algorithm analysis
keywords: simulated login
keywords: HTTP request inspection
keywords: mobile app reversing
keywords: traffic interception
keywords: obfuscated code analysis
related risks: HTTP Request Analysis
related attack tools: Packet Capture Tools
citation: A Collection of Android Reverse Engineering Tools / Awesome Android Reverse Tools - GitHub
updated: 2026-06-18
version: 1

HTTPS Interception Weakens TLS Security
type: Case
break id: C0514
stix type: report
summary: CISA issued an alert warning that HTTPS inspection products work by intercepting HTTPS traffic and performing man-in-the-middle attacks. During this process, sensitive client data may be transmitted to malicious parties posing as the target server. Many HTTPS inspection products fail to properly validate the server certificate chain and do not communicate errors to the user, thereby weakening the
case category: vulnerability_advisory
incident time: 2017-03
keywords: HTTPS interception
keywords: TLS security
keywords: man-in-the-middle attack
keywords: certificate validation
keywords: CISA alert
keywords: traffic inspection
keywords: end-to-end encryption
keywords: server certificate chain
related risks: HTTP Request Analysis
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
citation: HTTPS Interception Weakens TLS Security - CISA
updated: 2026-06-18
version: 1

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
type: Case
break id: C0515
stix type: report
summary: Microsoft Threat Intelligence assesses that attackers compromised SOHO routers to perform DNS hijacking, potentially enabling large-scale adversary-in-the-middle (AiTM) attacks. Such operations may involve active network traffic interception, consistent with techniques used to analyze HTTP/HTTPS requests through man-in-the-middle methods.
case category: news_report
incident time: 2026-04
keywords: SOHO router
keywords: DNS hijacking
keywords: adversary-in-the-middle
keywords: AiTM
keywords: Microsoft Threat Intelligence
keywords: network traffic interception
keywords: HTTP/HTTPS analysis
keywords: router compromise
related risks: HTTP Request Analysis
related attack tools: AiTM Adversary-in-the-Middle Attack Tool
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Malicious Hackers
citation: SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
updated: 2026-06-18
version: 1

Java Decompilation Offensive and Defensive Practices: Exposing Code Leakage Risks and 5 Core Protection Techniques
type: Case
break id: C0516
stix type: report
summary: The article highlights that due to the highly standardized structure of Java .class files, attackers can easily reconstruct source code logic using decompilation tools like JD-GUI and CFR, leading to the leakage of core algorithms, business processes, and sensitive configuration information such as hardcoded keys and database connection strings. It demonstrates the process of using the CFR decompi
case category: news_report
incident time: 2025-10
keywords: Java decompilation
keywords: CFR
keywords: JD-GUI
keywords: Java bytecode
keywords: code leakage
keywords: Procyon
keywords: hardcoded keys
keywords: reverse engineering
keywords: application security
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
citation: Java Source Code Protection - Preventing Code Decompilation - Beijing SenseShield
updated: 2026-06-18
version: 1

iOS App Hardening Whitepaper: IPA Encryption, Decompilation Defense, and Source-less Obfuscation
type: Case
break id: C0517
stix type: report
summary: The article reveals that in jailbroken environments with widespread decompilation tools, attackers can rapidly parse symbol tables, method names, and logic structures from IPA files using class-dump or IDA Pro, exposing core algorithms, payment flows, and encryption protocols. An unprotected IPA is nearly equivalent to open-source code. It introduces defense solutions like Ipa Guard that apply sym
case category: academic_research
incident time: 2025-10
keywords: iOS app hardening
keywords: IPA encryption
keywords: decompilation defense
keywords: symbol obfuscation
keywords: Ipa Guard
keywords: class-dump
keywords: IDA Pro
keywords: jailbreak detection
keywords: binary perturbation
keywords: source-less obfuscation
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
related attack tools: Debugging Tools
citation: What to Do If an IPA Is Decompiled? The Full Process of Hardening Without Source Code
updated: 2026-06-18
version: 1

Hands-on Frida Reverse Engineering: Bypassing Android App License Verification Step by Step
type: Case
break id: C0518
stix type: report
summary: Using a sample Android app called "PremiumTool," this article demonstrates how to locate and bypass its local license verification logic with Frida dynamic hooking. Static analysis with Jadx-GUI reveals a plain string comparison inside the LicenseManager class, allowing an attacker to hook the method and force it to always return true, thereby unlocking the pro features.
case category: academic_research
incident time: 2026-02
keywords: Frida
keywords: Android reverse engineering
keywords: dynamic hooking
keywords: Jadx-GUI
keywords: license verification bypass
keywords: LicenseManager
keywords: local validation
keywords: app tampering
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
related attack tools: Debugging Tools
citation: First Encounter with Frida - Java Layer Hooking in Android Reverse Engineering
updated: 2026-06-18
version: 1

Claude Code Source Code Leak: An In-Depth Analysis of Community Reverse Engineering Techniques
type: Case
break id: C0519
stix type: report
summary: The article discusses how the community reverse-engineered Anthropic's Claude Code product through decompilation, reconstructing a clearly modular source code structure. Although it is a decompilation artifact, the code exhibits good modularity with distinct boundaries between functional modules and a clear separation of type definitions and implementations. The article also notes that most jurisd
case category: news_report
incident time: 2026-04
keywords: Claude Code
keywords: Anthropic
keywords: reverse engineering
keywords: source code leak
keywords: Source Map
keywords: DMCA
keywords: copyright infringement
keywords: decompilation
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
related threat actors: Piracy/Infringement Gangs
citation: GitHub DMCA: Anthropic Notice
citation: Claude Code Source Code Leak: A Public Lesson in AI Engineering Worth Hundreds of Millions
updated: 2026-06-18
version: 1

C# Decompilation-Based Software Cracking Method
type: Case
break id: C0520
stix type: report
summary: The article details a method for reverse engineering software written in C# by using decompilation tools. The process involves restoring the source code with a decompiler, analyzing the code to locate the license verification logic, and then modifying the decompiled code to bypass authorization checks.
case category: news_report
incident time: 2020-07
keywords: C# decompilation
keywords: reverse engineering
keywords: software cracking
keywords: license verification bypass
keywords: code modification
keywords: decompiler tools
keywords: authorization bypass
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
citation: C# Decompilation Software Cracking Method - Linybo2008 - Blog Park
updated: 2026-06-18
version: 1

Hacker Reverse-Engineered Software to Control 180,000 Cameras for Voyeurism, Profited 800,000 Yuan, Sentenced to 5 Years
type: Case
break id: C0521
stix type: report
summary: In April 2018, the defendant surnamed Wu used reverse-engineering software to obtain a database of usernames and passwords for a specific brand of cameras. He built an app to infiltrate and control over 180,000 cameras, charging membership fees to provide real-time surveillance footage and earning more than 800,000 yuan. The court sentenced him to 5 years in prison for the crime of illegally contr
case category: criminal_verdict
incident time: 2018-04
keywords: reverse engineering
keywords: camera vulnerability
keywords: unauthorized camera access
keywords: illegal control of computer systems
keywords: app-based intrusion
keywords: credential database
keywords: live feed voyeurism
keywords: Wu case
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
related attack tools: System/Application Vulnerability Exploitation Tools
related attack tools: Fake Apps
related threat actors: Malicious Hackers
citation: More than 180,000 cameras went out of control: the black market behind voyeurism
citation: Hacker decompiles software to control 180,000 cameras for peeping, earns 800,000 yuan, sentenced to 5 years
updated: 2026-06-24
version: 2

Changsha Semiconductor Executive Sentenced for Downloading Core Technical Materials and Infringing Trade Secrets
type: Case
break id: C0522
stix type: report
summary: The Yuelu District People's Court of Changsha reported that Huang, head of the analog RF department and chief technology officer of a Changsha semiconductor company, falsely claimed he needed to test permission management and obtained a subordinate's high-privilege account. From April to September 2022, Huang used his own and the borrowed account 23 times to download large volumes of core technical files from company servers without authorization, copied them to private storage devices, and then encrypted, compressed, deleted, and renamed files to conceal the conduct. Expert evaluation found that some of the technical information was non-public trade secret information, with a reasonable license fee assessed at 1.81 million yuan. The court convicted Huang of trade secret infringement and sentenced him to ten months in prison plus a fine.
case category: criminal_verdict
keywords: core technical materials
keywords: technical material misappropriation
keywords: trade secret infringement
keywords: privileged account abuse
keywords: VPN repository
keywords: R&D server
keywords: trade secret crime
keywords: reasonable license fee
related risks: Application Reverse Engineering
related threat actors: Malicious Insiders
related threat actors: Piracy/Infringement Gangs
citation: Company executive sentenced for downloading core technical materials
updated: 2026-06-18
version: 1

Guangdong Communications Administration Penalizes Apps Violating Personal Information Protection Rules
type: Case
break id: C0523
stix type: report
summary: In November 2020, the Guangdong Communications Administration issued a notice identifying 88 apps with security risks such as decompilation and plaintext password storage. The flagged apps included Sunflower Insurance and Quark, with their Java code decompilation risks explicitly noted. The operating enterprises were ordered to rectify the issues or faced administrative penalties.
case category: administrative_enforcement
incident time: 2020-11
keywords: Guangdong Communications Administration
keywords: app violation notice
keywords: personal information protection
keywords: decompilation
keywords: plaintext password storage
keywords: Sunflower Insurance
keywords: Quark
keywords: Java code decompilation
keywords: mobile app security
keywords: administrative rectification order
related risks: Application Reverse Engineering
related attack tools: Decompilation Tools
citation: Guangdong Communications Administration app supervision notice (October 2020)
citation: 88 problematic apps reported by Guangdong authorities! - The Paper
updated: 2026-06-24
version: 1

CCTV Exposes a Free Smartband Cash-on-Delivery Scam
type: Case
break id: C0524
stix type: report
summary: On October 9, 2018, CCTV's Focus Interview aired 'Fake Smartbands, Real Fraud'. The program reported that users who scanned a QR code and reposted messages promising a free branded smartband were drawn into a carefully designed cash-on-delivery scam. Police found that Gu registered Harbin Zinuo Trading Co., Ltd. to run the fraud, involving 658 suspects and more than 80 million yuan.
case category: criminal_verdict
incident time: 2018-09
keywords: free smartband scam
keywords: COD fraud
keywords: inflated shipping fees
keywords: telecom fraud
keywords: Three Squirrels impersonation
keywords: Huawei smartband
keywords: Zinuo company
keywords: Harbin police
keywords: micro-business fraud
keywords: low-price high-postage
related risks: Low Price, High Shipping
related threat actors: Telecom Fraud Gangs
citation: Focus Interview 20181009: Fake Smartbands, Real Fraud
updated: 2026-06-18
version: 1

Fujian Electromechanical Company Inspection Reveals Inflated Transport Costs for Civil Explosive Products
type: Case
break id: C0525
stix type: report
summary: In August 2022, the Fujian Provincial Party Committee inspection team reported multiple issues at Fujian Electromechanical (Holding) Co., Ltd. Among them, its subsidiary Haixia Chemical Company was cited for irregularities in bidding and significantly inflated transport costs for civil explosive products, suspected of involving benefit transfer. The company subsequently formed a verification team
case category: administrative_enforcement
incident time: 2022-08
keywords: civil explosive product transport
keywords: inflated transport costs
keywords: benefit transfer
keywords: irregular bidding
keywords: inspection rectification
keywords: Haixia Chemical
keywords: Fujian Electromechanical
related risks: Low Price, High Shipping
citation: Fujian Discipline Inspection Commission: Fujian Electromechanical Inspection Rectification Progress Notice
updated: 2026-06-18
version: 1

Shanghai Lawyer Shares Dispute Over Including Prepaid Postage in Turnover for Illegal Business Operations Case
type: Case
break id: C0526
stix type: report
summary: In September 2025, lawyer Shao Shiwei published an article sharing a case where he defended a client against charges of illegal business operations. The client was investigated for selling overseas audiovisual products without a license, with sales exceeding 700,000 yuan. During the defense, the lawyer argued that the turnover included prepaid postage and packaging costs borne by the client for bu
case category: news_report
incident time: 2025-09
keywords: illegal business operations defense
keywords: prepaid postage deduction
keywords: turnover calculation dispute
keywords: overseas audiovisual products
keywords: unlicensed sales
keywords: Shao Shiwei lawyer
keywords: Shanghai Fazhi Bao
related risks: Low Price, High Shipping
citation: Lawyer Shao Shiwei: Real case of illegal business crime, lawyer successfully defends for innocence - Shanghai Rule of Law Daily
updated: 2026-06-18
version: 1

Douyin Removes Abnormally Low-Price Presale Stores
type: Case
break id: C0527
stix type: report
summary: In January 2021, Douyin E-commerce published a governance notice on removing stores using abnormally low-price presales. Platform review found that some merchants used presale settings to sell goods far below cost and generate large volumes of orders, leading to non-delivery and goods not matching descriptions. The platform said these practices seriously harmed consumer experience and disrupted operating order, and it imposed store removal, guarantee-deposit deductions, and frozen withdrawal measures under its agreements and merchant violation rules.
case category: administrative_enforcement
incident time: 2021-01
keywords: Douyin e-commerce
keywords: merchant removal
keywords: low-price presale
keywords: shipping insurance arbitrage
keywords: extended presale period
keywords: low price high shipping
keywords: consumer protection
keywords: platform governance
related risks: Low Price, High Shipping
related threat actors: Malicious Merchants
citation: Governance notice on removing abnormally low-price stores
citation: These low-price merchants are in danger, Douyin removes 1,000 stores
updated: 2026-06-18
version: 1

Freight Forwarders Lure Shippers with Low Rates, Then Demand High Ransom Fees Before Vanishing with Funds
type: Case
break id: C0528
stix type: report
summary: A new type of fraud has emerged in the international freight forwarding industry, where companies attract shippers with significantly below-market freight rates. Once the cargo arrives at the destination port, they demand exorbitant release fees under various pretexts and refuse to release the goods. Some forwarders disappear with the collected freight charges entirely, leaving shippers at risk of
case category: news_report
incident time: 2024-09
keywords: freight forwarder
keywords: low-ball freight rate
keywords: cargo ransom
keywords: destination port
keywords: absconding with funds
keywords: shipper
keywords: logistics scam
keywords: freight fraud
related risks: Low Price, High Shipping
related threat actors: Scalpers
citation: Scalpers scam freight forwarders on shipping fees, courier scammed out of tens of thousands, freight forwarders use low prices to extort cargo release
updated: 2026-06-18
version: 1

Xi'an Man's Contact Info Maliciously Disclosed and Harassed After Traffic Accident
type: Case
break id: C0529
stix type: report
summary: After an electric bike collision in Xi'an, Mr. He was continuously harassed by the other party, Chen Wei, during the accident investigation. Chen not only repeatedly called and sent abusive text messages demanding compensation but also maliciously posted He's phone number in multiple WeChat groups with fake recruitment ads, causing He to receive a flood of harassing calls from job seekers.
case category: news_report
incident time: 2022-07
keywords: malicious disclosure of contact info
keywords: phone harassment
keywords: fake recruitment ads
keywords: electric bike accident
keywords: Xi'an
keywords: Chanba Branch
keywords: Xinjiamiao Police Station
keywords: privacy leak
keywords: harassing calls
related risks: Malicious User Harassment
citation: Man harassed after other party in accident maliciously discloses contact info, frequent harassment! - NetEase Subscription
updated: 2026-06-18
version: 1

Shandong Man Sentenced for Repeatedly Insulting and Threatening Cousin Over Wife Harassment
type: Case
break id: C0530
stix type: report
summary: A man from Cao County, Shandong, named Xu Mouchuang, discovered his cousin Xu Mouzhan had an inappropriate relationship with his wife. Starting in 2019, he repeatedly insulted the cousin in WeChat groups, shouted abuse outside his home, made incessant harassing phone calls and text threats, and even threw bricks and bottles at the house. Despite the provocation, his persistent harassment was deeme
case category: criminal_verdict
incident time: 2024-05
keywords: picking quarrels and provoking trouble
keywords: malicious harassment
keywords: insults and threats
keywords: WeChat group abuse
keywords: phone and text harassment
keywords: throwing bricks
keywords: Cao County court
keywords: criminal verdict
keywords: remanded for retrial
keywords: Xu Mouchuang
related risks: Malicious User Harassment
citation: Shandong man repeatedly insults and threatens cousin's wife over 'sexual harassment', sentenced, second trial sent back for retrial
updated: 2026-06-18
version: 1

Controlling Malicious Call Software Constituted the Crime of Disrupting Computer Information Systems
type: Case
break id: C0531
stix type: report
summary: Starting in 2017, a co-defendant developed software including Yunhu, Guajabao, and a points wallet to operate an internet-based malicious calling platform. Tan and Chen bought second-hand mobile phones with Guajabao installed, used them to call designated numbers on command, and sold the resulting points for profit, causing more than 50 wireless mobile phones to stop functioning normally. The Baiyun District court found both defendants guilty of disrupting computer information systems, imposed suspended sentences, and ordered confiscation of illegal proceeds.
case category: criminal_verdict
incident time: 2017-12
keywords: malicious calling
keywords: call bombing
keywords: Yunhu
keywords: Guajabao
keywords: points wallet
keywords: mobile communication network
keywords: disrupting computer information systems
keywords: wireless mobile phones
related risks: Malicious User Harassment
related attack tools: SMS Verification Code Platform
related threat actors: Malicious Merchants
citation: Controlling Malicious Call Software Constituted the Crime of Disrupting Computer Information Systems
updated: 2026-06-18
version: 1

China Construction Bank Credit Card Holders Frequently Targeted by Third-Party Debt Collection Agencies
type: Case
break id: C0532
stix type: report
summary: A May 2024 report highlights that consumer finance companies engaged in overdue loan collection have resorted to improper tactics such as violence, threats, intimidation, and harassment. CCB credit card holders are frequently subjected to aggressive harassment by third-party collection agencies.
case category: news_report
incident time: 2024-05
keywords: CCB
keywords: credit card debt collection
keywords: third-party collection agencies
keywords: aggressive collection tactics
keywords: harassment calls
keywords: consumer finance
keywords: overdue loans
keywords: personal data leakage
keywords: regulatory complaints
related risks: Malicious User Harassment
related threat actors: Anti-Collection Gangs
citation: Behind frequent third-party collection harassment for CCB credit card users - Sina News
updated: 2026-06-18
version: 1

315 Special Report Exposes Virtual Operators Illegally Selling SIM Cards Used for Malicious Harassment
type: Case
break id: C0533
stix type: report
summary: From 2023 to 2025, regulators in multiple regions investigated cases of virtual operators illegally selling SIM cards. Some operators relaxed real-name verification, allowing phone cards to be obtained without the user being physically present, and even sold unregistered 'black cards' in bulk. These unverified SIM cards were used by criminals for telecom fraud, online gambling, malicious harassmen
case category: news_report
incident time: 2023
keywords: virtual network operators
keywords: illegal SIM card sales
keywords: real-name registration loopholes
keywords: black market SIM cards
keywords: telecom fraud SIM cards
keywords: malicious harassment calls
keywords: 315 consumer rights report
keywords: Chinese telecom regulation
related risks: Malicious User Harassment
related attack tools: Black SIM Cards
related threat actors: SIM Card Dealers (Phone Numbers)
related threat actors: Telecom Fraud Gangs
citation: 315 Special: Wrong deductions, phone purchase pitfalls? Save these complaint channels now - Tencent News
updated: 2026-06-18
version: 1

Taobao Says Paying to Delete Negative Reviews Will Lead to Immediate Store Closure
type: Case
break id: C0534
stix type: report
summary: In November 2012, media reported that police in Chongqing High-tech Zone uncovered a fraud case involving an illegal website that offered to delete negative reviews for Taobao sellers. Scammers falsely claimed they could remove bad reviews through technical means. Taobao stated that any online store found maliciously deleting negative reviews would be shut down immediately.
case category: news_report
incident time: 2012-11
keywords: Taobao
keywords: delete negative reviews
keywords: store closure
keywords: Chongqing High-tech Zone police
keywords: e-commerce platform governance
keywords: review manipulation
keywords: malicious harassment
keywords: seller fraud
related risks: Malicious User Harassment
related threat actors: Malicious Merchants
related threat actors: Malicious Users
citation: Taobao says paying to delete negative reviews will lead to store closure - People's Daily Online
updated: 2026-06-18
version: 1

Man Repeatedly Requests Refund-Only for Online Purchases, Maliciously Places Over 2,700 Orders Against 900+ Merchants
type: Case
break id: C0535
stix type: report
summary: Chen maliciously placed more than 2,700 orders against over 900 merchants on an e-commerce platform, using refund mechanisms and platform rules to pressure merchants into paying settlement fees. The order flow exceeded 10.3 million yuan. After prosecution by the Jiangyin People's Procuratorate, the court convicted Chen of disrupting production and business operations and sentenced him to one year and six months in prison.
case category: criminal_verdict
incident time: 2026-04
keywords: malicious ordering
keywords: refund-only
keywords: e-commerce platforms
keywords: crime of disrupting production and business operations
keywords: Jiangyin People's Procuratorate
keywords: batch refunds
keywords: settlement fee
keywords: fixed-term imprisonment
keywords: merchant malicious claims
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: Man Sentenced for Malicious Orders and Extortion Against More Than 900 Online Stores
updated: 2026-06-18
version: 1

AI-Faked Rotten Fruit Images Used to Abuse Refund-Only Claims
type: Case
break id: C0536
stix type: report
summary: From October 2025 to January 2026, Tan exploited refund-only rules on online shopping platforms by buying Golden Pillow durians and cherries on Taobao and Douyin. To avoid automated detection as a malicious refund requester, Tan bought multiple real-name Taobao accounts through an overseas encrypted messaging app and used different payment accounts. After receiving intact fruit, Tan used AI image-generation tools to create realistic photos of rotten durians and cherries, submitted refund-only claims, and resold the intact fruit through Xianyu and WeChat Moments. After prosecution by Hengshan County Procuratorate in Hunan, the court convicted Tan of fraud and sentenced Tan to one year in prison with a 5,000 yuan fine.
case category: criminal_verdict
incident time: 2026-06
keywords: refund-only
keywords: fabricated spoilage images
keywords: online fruit purchase
keywords: fraud conviction
keywords: Tan Mouwen
keywords: Taobao
keywords: Douyin
keywords: unlawful possession
keywords: batch refunds
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: Man Sentenced to One Year for Using AI-Faked Rotten Fruit Images to Abuse Refund-Only Claims
updated: 2026-06-25
version: 1

Man Sentenced for 2,700+ Malicious Orders Abusing Refund-Only Rules to Disrupt Online Stores
type: Case
break id: C0537
stix type: report
summary: In August 2023, after an online daily-necessities seller rejected Chen's refund-only request, Chen used complaints, bulk orders across affiliated stores, and immediate 'not received' refund-only claims after shipment to pressure merchants into paying settlement fees. According to Jiangsu Procuratorate Online, over three years Chen placed more than 2,700 malicious orders against over 900 online stores, generating more than 10.3 million yuan in transaction flows and causing over 62,000 yuan in direct economic losses. The court sentenced Chen to one year and six months in prison for disrupting business operations.
case category: criminal_verdict
incident time: 2026-06
keywords: malicious refund
keywords: refund-only fraud
keywords: malicious ordering
keywords: disrupting business operations
keywords: e-commerce platform
keywords: online store operations
keywords: complaint abuse
keywords: platform rule loophole
keywords: criminal sentence
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: The business behind 'refund-only' abuse
updated: 2026-06-18
version: 1

Man Sentenced for Malicious Order Cancellations Causing Over 540,000 Yuan in Losses
type: Case
break id: C0538
stix type: report
summary: A man surnamed Wu was sentenced to eight months in prison for repeatedly placing bulk orders on a company's Pinduoduo store and immediately requesting refunds to exact personal revenge, causing service fee losses totaling over 540,000 yuan.
case category: criminal_verdict
incident time: 2024-09
keywords: malicious order cancellation
keywords: Pinduoduo
keywords: batch refunds
keywords: revenge ordering
keywords: e-commerce platform
keywords: Shenzhen
keywords: criminal verdict
keywords: service fee loss
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: Malicious order cancellations worth 540,000 yuan out of spite, defendant sentenced for sabotaging production and operation
updated: 2026-06-18
version: 1

Beijing Woman Detained for Repeatedly Swapping Used Clothes in Online Purchase Refund Scam
type: Case
break id: C0539
stix type: report
summary: In June 2026, CCTV's News Live Room reported that a woman in Beijing fraudulently obtained refunds by buying clothes online and returning used garments in their place. The report said she was criminally detained for maliciously swapping returned goods, with more than 90 items of clothing left behind and over 20,000 yuan involved.
case category: criminal_verdict
incident time: 2026-06
keywords: refund fraud
keywords: product swapping
keywords: online shopping
keywords: e-commerce platform
keywords: criminal detention
keywords: Beijing
keywords: fraud offense
keywords: bulk returns
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: CCTV News Live Room: Beijing woman detained for swapping used clothes in refund fraud, with more than 90 items and over 20,000 yuan involved
updated: 2026-06-18
version: 1

What 225 'Abnormal' Return-and-Refund Successes Reveal
type: Case
break id: C0540
stix type: report
summary: A consumer in Shandong used multiple accounts to order high-value goods and then return swapped-in low-value items, completing 225 abnormal return-and-refund operations within half a year, causing direct merchant losses exceeding 50,000 yuan and triggering a police investigation.
case category: news_report
incident time: 2025-12
keywords: abnormal returns
keywords: product swapping
keywords: batch refunds
keywords: e-commerce platform
keywords: return fraud
keywords: consumer rights
keywords: Shandong police
keywords: multiple accounts
keywords: high-value goods
keywords: low-value items
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: 225 'abnormal' returns and refunds succeed, what problems does this expose? - Fuxin City, Liaoning Province
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0541
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: abusive returns
keywords: product swapping
keywords: fraud
keywords: bulk refunds
keywords: e-commerce platform
keywords: used clothing substitution
keywords: criminal detention
keywords: Beijing
keywords: refund fraud
keywords: online shopping scam
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0542
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: malicious refunds
keywords: address forgery
keywords: product switching
keywords: fraud charges
keywords: e-commerce platforms
keywords: return fraud
keywords: Beijing
keywords: bulk refunds
related risks: Bulk Refunds
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0543
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: return fraud
keywords: swap refund
keywords: online shopping fraud
keywords: refund scam
keywords: used clothes swap
keywords: fraud offense
keywords: criminal detention
keywords: e-commerce platform
keywords: Shi
keywords: Beijing
related risks: Return Fraud
related risks: Malicious Returns
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0544
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: product switch fraud
keywords: malicious returns
keywords: refund fraud
keywords: e-commerce platform
keywords: return scam
keywords: criminal detention
keywords: switched goods refund
related risks: Return Fraud
related risks: Malicious Returns
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0545
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: return fraud clothing swap
keywords: malicious return detention
keywords: e-commerce return scam
keywords: fake return refund scheme
keywords: clothing swap fraud
keywords: multiple account abuse
keywords: vacant address delivery fraud
keywords: criminal detention return fraud
related risks: Return Fraud
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Makeup Artist Detained After 1,036 Swapped Returns Totaling ¥890,000
type: Case
break id: C0546
stix type: report
summary: A makeup artist was placed under criminal detention for systematically exploiting return processes through product swapping, carrying out 1,036 fraudulent returns with a total involved amount of 890,000 yuan.
case category: criminal_verdict
keywords: makeup artist
keywords: swapped returns
keywords: return fraud
keywords: e-commerce returns
keywords: Beijing
keywords: criminal detention
keywords: systematic fraud
keywords: product swapping
related risks: Return Fraud
related threat actors: Malicious Users
citation: Makeup Artist Swapped and Returned Items 1,036 Times Involving 890,000 Yuan, Detained
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0547
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: package swap fraud
keywords: return fraud
keywords: fake address returns
keywords: courier return scam
keywords: refund fraud
keywords: e-commerce return abuse
keywords: Beijing fraud case
keywords: criminal detention fraud
related risks: Return Fraud
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0548
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: return fraud
keywords: swapping old clothes
keywords: online shopping fraud
keywords: return scam
keywords: platform-advanced refund
keywords: e-commerce fraud
keywords: criminal detention
keywords: return abuse
keywords: item swapping
related risks: Return Fraud
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

Ping An Beijing Discloses Woman Detained for Return-Policy Clothing Swap Fraud
type: Case
break id: C0549
stix type: report
summary: CCTV.com republished a Ping An Beijing notice about a Beijing woman, Shi, who exploited e-commerce return rules such as seven-day no-reason returns, refused-delivery returns, and refunds without returns. She used vacant apartments as delivery addresses and courier services to move packages, swapped newly purchased clothes with old or dirty clothes, and then applied for refunds. Police found that Shi ordered more than 100 pieces of clothing from three online stores and kept more than 90 swapped items in this incident, involving more than 20,000 yuan. From 2022 to 2026, she also repeatedly registered new accounts and used the same method to maliciously seek refunds. Shi was criminally detained by police on suspicion of fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: malicious swap-and-return
keywords: zero-dollar purchase
keywords: e-commerce platform
keywords: refund fraud
keywords: criminal detention
keywords: return fraud
keywords: Beijing
keywords: product substitution scam
related risks: Return Fraud
related threat actors: Malicious Users
citation: Online shopping became zero-yuan shopping? The scheme ended in detention
updated: 2026-06-18
version: 1

ChaPanda, Wallace, and Other Brands Hit by Empty Delivery Package Incidents
type: Case
break id: C0550
stix type: report
summary: In May 2024, netizens reported receiving empty packages in some food delivery orders involving brands such as ChaPanda, Wallace, Zhu Xiaoxiao Snail Noodles, and Niu Yue Bao. The businesses subsequently apologized and offered compensation; ChaPanda dismissed the involved employees and donated 1 million yuan, while Wallace provided 10x compensation for affected orders and disciplined the responsible
case category: news_report
incident time: 2024-05
keywords: empty delivery packages
keywords: ChaPanda
keywords: Wallace
keywords: Zhu Xiaoxiao Snail Noodles
keywords: Niu Yue Bao
keywords: food delivery incident
keywords: brand apology
keywords: consumer compensation
related risks: Return Fraud
citation: Tesla Rescinds Offers to Fresh Graduates, Interests Over Responsibility; Chabaidao and Others Send Empty Takeout Packages, Suspected of Consumer Fraud...
updated: 2026-06-18
version: 1

Shanghai Changning Procuratorate Handled an Online Store Click-Farming Case Defrauding Platform Subsidies
type: Case
break id: C0551
stix type: report
summary: In June 2021, the Supreme People's Procuratorate disclosed a false transaction case handled by the Shanghai Changning District People's Procuratorate in which an online store defrauded an e-commerce platform of subsidies. Fang operated a digital flagship store on the platform and, during the platform's major subsidy campaign, colluded with customer service employee Wang, joined click-farming WeChat groups, instructed more than ten click workers to place fake orders in the store, and used empty parcels to disguise the transactions. After the orders were completed, the store fraudulently obtained more than 5.1 million yuan in platform subsidies. In December 2020, the Changning prosecutors charged Fang and others with fraud; the court sentenced Fang to six years in prison and a 300,000 yuan fine, and Wang and seven click workers were also convicted.
case category: criminal_verdict
incident time: 2020-12
keywords: click-farming subsidy fraud
keywords: platform subsidy campaign
keywords: Changning District procuratorate
keywords: Fang
keywords: Wang
keywords: click workers
keywords: empty parcels
keywords: fake transactions
keywords: e-commerce platform subsidies
keywords: more than 5.1 million yuan
related risks: Subsidy Fraud
related risks: Order Brushing
related threat actors: Malicious Merchants
related threat actors: Telecom Fraud Gangs
citation: Targeting Telecom and Online Fraud: Criminals Exploit Loopholes in the E-Commerce Economy
updated: 2026-06-26
version: 1

Exploiting 'Instant Refund' Policy to Swap Counterfeits for Authentic Goods for Profit
type: Case
break id: C0552
stix type: report
summary: Starting January 2021, the defendant Xiaoming ordered branded sneakers and down jackets on an e-commerce platform, then exploited its 'Instant Refund' policy by returning cheap substitutes purchased elsewhere to obtain refunds while selling the authentic items on another online store, defrauding over 890,000 yuan.
case category: criminal_verdict
incident time: 2021-01
keywords: instant refund fraud
keywords: return fraud scheme
keywords: swap counterfeit for authentic
keywords: e-commerce return abuse
keywords: online shopping fraud
keywords: refund policy exploitation
keywords: sneaker return scam
keywords: down jacket refund fraud
keywords: Xiaoming fraud case
keywords: 890,000 yuan e-commerce scam
related risks: Flash Return Arbitrage
related threat actors: Freebie Hunters
citation: 'Couponing' Can Also Be Illegal! Highlights of Online Shopping Dispute Cases on 'Double 12'
citation: Defendant Sentenced to Three Years for Buying Genuine Goods and Returning Counterfeits Fraud of Over RMB 890,000 on an E-Commerce Platform
updated: 2026-06-18
version: 1

Buyer Exploits 'Refund-Only' Loophole in Repeated 'Wool-Pulling' Incident
type: Case
break id: C0553
stix type: report
summary: A merchant, Mr. Cheng, encountered a buyer who maliciously exploited the 'refund-only' rule twice. The buyer first uploaded a photo on one platform to successfully request a refund-only, then used the same photo on another platform to apply for another refund-only, repeatedly obtaining both the goods and refunds.
case category: news_report
keywords: refund-only
keywords: wool-pulling
keywords: malicious refund
keywords: refund arbitrage
keywords: e-commerce platform
keywords: durian
keywords: Mr. Cheng
keywords: loophole exploitation
related risks: Flash Return Arbitrage
related threat actors: Freebie Hunters
citation: ...190 Yuan Frozen Durian 'Refund Only' Dispute: Determined Merchant Seeks Justice Not for Money, Calls for Anti-'Couponing' Measures...
updated: 2026-06-18
version: 1

Pinduoduo Billion-Yuan Subsidy Coupon Exploit Incident
type: Case
break id: C0554
stix type: report
summary: In the early hours of January 20, 2019, Pinduoduo experienced a critical technical flaw that allowed users to claim 100-yuan no-threshold coupons. Black-market groups exploited the vulnerability by using automated scripts to mass-acquire coupons and then immediately initiating refunds on orders to extract the coupon value, causing substantial financial losses for the platform.
case category: security_incident
incident time: 2019-01
keywords: Pinduoduo
keywords: coupon vulnerability
keywords: no-threshold coupon
keywords: automated claiming
keywords: refund arbitrage
keywords: flash refund exploit
keywords: black-market syndicate
keywords: platform loss
related risks: Flash Return Arbitrage
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related attack tools: System/Application Vulnerability Exploitation Tools
related threat actors: Freebie Hunters
related threat actors: Criminal Organizations
citation: A Brief History of Billion-Yuan Subsidies: How a Marketing Product Reshaped Pinduoduo
citation: Pinduoduo Coupon Bug Causes Major Losses; Legal Experts Say Coupon Exploitation Is Not Immune From Liability
updated: 2026-06-18
version: 1

Man Sentenced for 2,700+ Fraudulent Refund-Only Claims via Malicious Ordering
type: Case
break id: C0555
stix type: report
summary: Chen maliciously placed more than 2,700 orders against over 900 merchants, then used refunds or complaints to pressure merchants into paying settlement fees. After prosecution by the Jiangyin People's Procuratorate, the court convicted Chen of disrupting production and business operations and sentenced him to one year and six months in prison.
case category: criminal_verdict
incident time: 2026-04
keywords: malicious ordering
keywords: refund-only abuse
keywords: refund abuse
keywords: e-commerce platform
keywords: crime of disrupting production and business operations
keywords: Jiangyin People's Procuratorate
keywords: conviction
keywords: refund policy exploitation
keywords: criminal sentencing
related risks: Flash Return Arbitrage
related threat actors: Malicious Users
citation: Man Sentenced for Malicious Orders and Extortion Against More Than 900 Online Stores
updated: 2026-06-18
version: 1

Corporate Insider Exploits Rebate Loophole via Fake Order Scam
type: Case
break id: C0556
stix type: report
summary: In early 2024, a well-known tire company launched a promotional rebate campaign for retail stores nationwide. Internal personnel exploited loopholes in the mechanism, fraudulently obtaining company rebates by placing fake orders. The Changning District Procuratorate prosecuted three defendants for fraud.
case category: criminal_verdict
incident time: 2024-01
keywords: corporate insider fraud
keywords: rebate loophole exploitation
keywords: fake order scam
keywords: rebate fraud
keywords: tire company rebate abuse
keywords: Changning District Procuratorate
keywords: fraud prosecution
related risks: Flash Return Arbitrage
related threat actors: Malicious Insiders
citation: Case Study | Company 'Mole' Exploited Rebate Loophole, Went on a Fraudulent Ordering Spree...
citation: Company Insiders Exploited a Rebate Loophole Through Fake Orders
updated: 2026-06-18
version: 1

Refunded but Rewarded: A Study on Double-Dipping Attacks Against Cashback Reward Engines
type: Case
break id: C0557
stix type: report
summary: Academic research reveals that a debit card cashback program (Issuer A) never adjusts previously issued rewards after a refund, enabling attackers to exploit this flaw for a double-dipping attack. Another credit card issuer (Issuer B) exhibits a billing cycle timing gap that allows users to redeem rewards before the merchant return window closes, effectively cashing out rewards prior to the refund
case category: academic_research
incident time: 2026-04
keywords: cashback
keywords: double-dipping
keywords: refund loophole
keywords: debit card
keywords: credit card
keywords: reward engine
keywords: flash return arbitrage
keywords: card issuer
keywords: transaction timing gap
keywords: reward clawback
related risks: Flash Return Arbitrage
citation: Refunded but Rewarded: The Double Dip Attack on Cashback Reward Engines
updated: 2026-06-18
version: 1

Shanghai Qingpu Court Hears Online Refund Fraud Case Involving Empty Packages and Free Gifts
type: Case
break id: C0558
stix type: report
summary: In March 2025, China Court reported that the Qingpu District People's Court in Shanghai had concluded a fraud case involving abuse of online shopping return rules. The defendant Xia used the seven-day no-reason return rule to intentionally return only empty packages or free gifts after purchases, obtain full platform refunds, and resell the retained goods for additional profit. To evade platform controls, Xia repeatedly closed and re-registered accounts. Over five months, she fraudulently obtained more than 130,000 yuan in platform refunds. The court found her conduct constituted fraud and sentenced her to two years in prison, suspended for two years, plus an 8,000 yuan fine.
case category: criminal_verdict
incident time: 2025-03
keywords: false returns
keywords: empty package return
keywords: gift-only return
keywords: seven-day no-reason return
keywords: refund fraud
keywords: online shopping return rules
keywords: Qingpu District People's Court
keywords: fraud crime
related risks: Return Fraud
related threat actors: Malicious Users
citation: Shanghai Defendant Sentenced for Defrauding Online Shopping Platform Refunds by Returning Empty Packages or Free Gifts
updated: 2026-06-25
version: 1

Courier Rejects Main Product but Keeps Free Gifts, Profiting 380,000 Yuan and Receiving Prison Sentence
type: Case
break id: C0559
stix type: report
summary: Courier Sun exploited his delivery role by placing fake orders for digital products on an e-commerce platform, rejecting the main products while intercepting and reselling the bundled gifts. Beijing Political and Legal Affairs Network reported that the case involved more than 800 gifts worth over 380,000 yuan. After the Fengtai District Procuratorate brought the prosecution, the court convicted Sun of fraud and sentenced him to two years and ten months in prison, with a fine.
case category: criminal_verdict
incident time: 2025-05
keywords: courier fraud
keywords: reject delivery
keywords: keep free gifts
keywords: return main item keep gift
keywords: unlawful retention
keywords: conviction for fraud
keywords: Beijing Fengtai Court
keywords: e-commerce abuse
keywords: sentencing
related risks: Malicious Refusal of Delivery
related threat actors: Malicious Insiders
citation: Rejected the main product but kept the gift: Beijing courier sentenced
updated: 2026-06-25
version: 1

Supervisor Embezzles 297 Phones via COD Refusal Scheme
type: Case
break id: C0560
stix type: report
summary: An operations supervisor colluded with e-commerce platform insiders to purchase phones using coupons with cash-on-delivery. Upon receiving the phones, he marked orders as 'refused' to defer payment, sold the phones at retail stores for cash, then later changed order status to 'received' and paid the discounted amount, pocketing the coupon difference.
case category: criminal_verdict
incident time: 2024-01
keywords: COD refusal fraud
keywords: coupon arbitrage
keywords: order status manipulation
keywords: internal collusion
keywords: e-commerce platform
keywords: embezzlement
keywords: phone resale
keywords: cash-on-delivery abuse
related risks: Malicious Refusal of Delivery
related threat actors: Malicious Insiders
citation: Marked Logistics Orders as 'Refused' and Secretly Sold Goods for Cash: Company Supervisor Embezzled 297...
citation: Xiangzhou, Xiangyang: Prosecutors Pursue a Logistics Employee for Duty-Related Embezzlement
updated: 2026-06-18
version: 1

Man Sentenced to 3.5 Years for Defrauding Online Merchants by Posing as Consumer
type: Case
break id: C0561
stix type: report
summary: An article by a judge from Beijing No. 1 Intermediate People's Court disclosed that Song bought high-value goods such as laptops and camera lenses online, refused cash-on-delivery packages, and then forged seller identity information to take away the rejected goods. The case involved more than RMB 100,000 in value. The court sentenced Song to three years and six months in prison for fraud and imposed a RMB 40,000 fine.
case category: criminal_verdict
incident time: 2024-11
keywords: malicious delivery refusal
keywords: fraud conviction
keywords: e-commerce platform vulnerability
keywords: refuse delivery
keywords: laptop fraud
keywords: supply chain loss
keywords: illegal possession
keywords: Song
related risks: Malicious Refusal of Delivery
related threat actors: Malicious Users
citation: Posing as Consumer to Defraud Online Merchants: Man Sentenced to 3 Years and 6 Months
updated: 2026-06-18
version: 1

Courier Sentenced to 2 Years 10 Months for Illegally Profiting 380,000 Yuan Through Gift Scam
type: Case
break id: C0562
stix type: report
summary: A courier in Beijing exploited an e-commerce platform vulnerability over two years by refusing delivery of main products while keeping over 800 free gifts, which he then resold for an illegal profit of 380,000 yuan. The court convicted him of fraud and sentenced him to 2 years and 10 months in prison.
case category: criminal_verdict
incident time: 2025-07
keywords: courier fraud
keywords: gift scam
keywords: malicious rejection of delivery
keywords: e-commerce platform vulnerability
keywords: illegal profit
keywords: fraud conviction
keywords: Beijing courier case
related risks: Malicious Refusal of Delivery
related threat actors: Malicious Users
citation: Procuratorate Report: Courier Convicted for Keeping Promotional Gifts After False Orders
updated: 2026-06-18
version: 1

Woman Exploits Pinduoduo Loophole by Refusing Partial Delivery to Claim Full Refund
type: Case
break id: C0563
stix type: report
summary: A woman in Wuhan, Hubei Province, exploited a loophole on the Pinduoduo platform by placing an order with a secondary account and requesting split shipments. After delivery, she refused only one item while taking the other three, then applied for a full refund, illegally retaining the goods and causing financial loss to the merchant.
case category: news_report
incident time: 2024-01
keywords: Pinduoduo
keywords: refuse delivery
keywords: full refund scam
keywords: coupon hunting
keywords: delivery loophole
keywords: merchant protection
keywords: unlawful possession
keywords: Wuhan
related risks: Malicious Refusal of Delivery
related threat actors: Freebie Hunters
citation: ...Merchant Chooses to Sue for Rights Protection | Wuhan | Pinduoduo | Couponing | Hubei Province | Courier
updated: 2026-06-18
version: 1

Exploiting '7-Day No-Reason Return' Policy: Swapping Phones with Dummy Units Leads to Detention
type: Case
break id: C0564
stix type: report
summary: Between September and October 2025, suspect Tao repeatedly purchased mobile phones on e-commerce platforms, replaced the genuine devices with dummy models after unboxing, resealed the packaging, and requested 7-day no-reason returns on the grounds that the packaging was intact. The genuine phones were then resold for cash, involving a total amount of over 30,000 yuan. The court convicted Tao of fraud and sentenced Tao to six months of detention, suspended for six months, with a fine of 5,000 yuan.
case category: criminal_verdict
incident time: 2025-09
keywords: 7-day no-reason return
keywords: malicious return
keywords: dummy phone swap
keywords: fraud conviction
keywords: Tao
keywords: online phone purchase
keywords: return policy abuse
keywords: Jing'an District People's Procuratorate
keywords: suspended sentence
related risks: Malicious Returns
related risks: After-Sales Rights Abuse
related threat actors: Malicious Users
citation: Exploiting '7-Day No-Reason Return' Policy: Unsealed and Swapped Phones, Received Detention
updated: 2026-06-18
version: 1

Guangzhou Liwan Court Tried a 'Buy Genuine, Return Fake' Fraud Case Involving More Than 890,000 Yuan
type: Case
break id: C0565
stix type: report
summary: In July 2022, China Court reported that the Liwan District People's Court in Guangzhou concluded an e-commerce 'buy genuine, return fake' fraud case. Since January 2021, Wang bought Nike, Fila and other branded sports shoes and down jackets on an online shopping platform, exploited the platform's instant refund rules, returned similar goods bought from other websites as if they were the original platform goods, fraudulently obtained more than 890,000 yuan in refunds, and resold the genuine items for profit.
case category: criminal_verdict
incident time: 2021-01
keywords: buy real return fake
keywords: instant refund
keywords: return fraud
keywords: refund fraud
keywords: e-commerce return abuse
keywords: Wang
keywords: Liwan District People's Court
keywords: 890,000 yuan
keywords: sports shoes and down jackets
keywords: malicious returns
keywords: post-sale rights abuse
related risks: Return Fraud
related risks: After-Sales Rights Abuse
related threat actors: Malicious Users
citation: 'Buy Genuine, Return Fake' Fraud of More Than 890,000 Yuan: Defendant Sentenced to Three Years
updated: 2026-06-26
version: 1

476 Orders Refunded Without Return: Woman in Taizhou Exploits Platform Loophole to Scam 250,000 Yuan
type: Case
break id: C0566
stix type: report
summary: In January 2026, a woman in Taizhou exploited a platform vulnerability by requesting refunds without returning goods across 476 orders, defrauding the platform of 250,000 yuan. The case has been filed for suspected fraud.
case category: criminal_verdict
incident time: 2026-01
keywords: refund without return
keywords: coupon scalping
keywords: fraud
keywords: platform loophole
keywords: malicious returns
keywords: Taizhou
keywords: case filing
keywords: refund fraud
related risks: Malicious Returns
related threat actors: Freebie Hunters
citation: 476 Orders 'Refund Without Return': Taizhou Woman Exploited Platform Loophole to 'Coupon' 250,000 Yuan...
updated: 2026-06-18
version: 1

Fengxian Prosecutors Handled a 17-Year-Old's Fake Return Fraud Case Involving More Than 4 Million Yuan
type: Case
break id: C0567
stix type: report
summary: In 2025, the Fengxian District People's Procuratorate in Shanghai disclosed a fake return fraud case. A 17-year-old named Lu rented accounts and forged logistics tracking numbers to exploit return-process loopholes on an e-commerce platform, fraudulently obtaining skincare sets from a cosmetics company with losses of more than 4 million yuan. After prosecution by the Fengxian prosecutors, a court convicted Lu of fraud on July 17, 2025 and sentenced him to six years in prison.
case category: criminal_verdict
incident time: 2025-07
keywords: fake returns
keywords: forged tracking numbers
keywords: Lu
keywords: Fengxian District People's Procuratorate
keywords: refund fraud
keywords: return mechanism loophole
keywords: e-commerce fraud
keywords: minor crime
keywords: online shopping platform
keywords: more than 4 million yuan
related risks: Malicious Returns
related threat actors: Malicious Users
citation: 'Million-Yuan' Return Fraud: 17-Year-Old Sentenced
updated: 2026-06-26
version: 1

Man Sentenced for Repeated Malicious Orders and Refund-Only Claims
type: Case
break id: C0568
stix type: report
summary: The Jiangyin People's Procuratorate disclosed that Chen placed more than 2,700 malicious orders against over 900 online stores over three years and repeatedly abused refund-only platform processes to disrupt merchants' operations. The court sentenced Chen to one year and six months in prison for disrupting production and business operations.
case category: criminal_verdict
incident time: 2025-12
keywords: malicious ordering
keywords: refund-only
keywords: crime of disrupting production and business operations
keywords: e-commerce platform
keywords: malicious returns
keywords: Jiangyin People's Procuratorate
keywords: merchant coercion
keywords: platform rules
keywords: online shopping fraud
related risks: Malicious Returns
related threat actors: Malicious Users
related threat actors: Professional Counterfeit Claimants
citation: Man Maliciously Abused Refund-Only Claims and Disrupted More Than 900 Online Stores, Sentenced
updated: 2026-06-18
version: 1

Shanghai Police Uncover Restaurant Scheme Using Remote IP Spoofing to Fraudulently Obtain Consumer Vouchers and Subsidies
type: Case
break id: C0569
stix type: report
summary: In early November 2024, the Shanghai Public Security Bureau discovered that restaurant owner Guo conspired with store manager Liu and instructed Hu to purchase vouchers online and teach others to modify IP addresses for remote voucher grabbing, fraudulently obtaining government subsidies through fictitious transactions. Guo was criminally detained on November 11. This case illustrates the illegal
case category: criminal_verdict
incident time: 2024-11
keywords: consumer voucher fraud
keywords: subsidy fraud
keywords: remote voucher grabbing
keywords: IP address spoofing
keywords: fictitious transactions
keywords: Shanghai police
keywords: voucher restriction bypass
keywords: criminal detention
related risks: Coupon Restriction Bypass
related attack tools: Risk IP Addresses
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: Shanghai Police Crack Down on Consumer Voucher-Related Crimes
updated: 2026-06-18
version: 1

POS Terminal Voucher Cash-Out Scheme Involving 6.55 Million Yuan Leads to 102 Arrests
type: Case
break id: C0570
stix type: report
summary: On June 13, 2023, regulators strengthened risk controls targeting POS terminal voucher cash-outs and dismantled a case involving 6.55 million yuan in illegally redeemed consumer vouchers, resulting in the arrest of 102 suspects. The case exposed serious loopholes in voucher usage, where offenders used POS terminals to fabricate transactions and convert restricted-use vouchers into cash, bypassing
case category: criminal_verdict
incident time: 2023-06
keywords: POS terminal cash-out
keywords: consumer voucher
keywords: fabricated transactions
keywords: voucher redemption
keywords: 6.55 million yuan
keywords: voucher restriction bypass
keywords: 102 arrests
keywords: risk control gap
related risks: Coupon Restriction Bypass
citation: Full-Chain Crackdown on POS Machine Cash-Out and Loan Fraud
updated: 2026-06-18
version: 1

Supermarket Delivery Driver Sentenced for Abusing 30,000+ Virtual Phone Numbers to Obtain New-User Subsidies and Delivery Fees
type: Case
break id: C0571
stix type: report
summary: A supermarket delivery driver exploited a platform vulnerability by using more than 30,000 virtual phone numbers to mass-register fake new-user accounts, fraudulently obtaining merchant coupons and delivery fees. According to the Zhenjiang District People's Court of Shaoguan, the defendant completed over 30,000 orders from May 2022 to August 2024, obtained more than 410,000 yuan in new-user subsidies and more than 320,000 yuan in delivery fees, and was sentenced to ten years and ten months in prison for fraud.
case category: criminal_verdict
incident time: 2026-06
keywords: coupon fraud
keywords: new-user promotion abuse
keywords: virtual phone numbers
keywords: mass account registration
keywords: platform vulnerability exploitation
keywords: promo code scam
keywords: delivery fee fraud
related risks: Unauthorized Discount Purchase
related attack tools: Bulk Account Registration Tool
related attack tools: SMS Verification Code Platform
related threat actors: Freebie Hunters
citation: Empty-handed profit? Zhenjiang delivery driver sentenced to more than ten years for illegal promotion abuse
updated: 2026-06-18
version: 1

Illicit "Coupon Scalping" Case: Using Cheat Software to Place Low-Price Orders for Profit
type: Case
break id: C0572
stix type: report
summary: Xi'an police cracked an illegal "coupon scalping" case. Starting October 2024, a suspect surnamed Wang developed cheat software, promoted it through group chats, and guided buyers to use the software to place bulk orders on a platform at extremely low prices such as 0.01 yuan or 1.01 yuan, exploiting merchant discounts and subsidies before reselling the goods for profit.
case category: criminal_verdict
incident time: 2025-06
keywords: coupon scalping
keywords: cheat software
keywords: low-price orders
keywords: e-commerce platform
keywords: discount abuse
keywords: bulk ordering
keywords: illicit profit
keywords: Xi'an police
related risks: Unauthorized Discount Purchase
related attack tools: Automation Scripts
related attack tools: Flash Sale Tools
related threat actors: Freebie Hunters
related threat actors: Malware Developers
citation: Cyber Police Crack Down on an Illegal Coupon Arbitrage Case
updated: 2026-06-18
version: 1

Exploiting Loopholes to 'Earn' 1 Million Yuan: Should Security Personnel Take the Blame?
type: Case
break id: C0573
stix type: report
summary: The report indicates that some 'coupon scalpers' exploited vulnerabilities in app clients to conduct fraudulent refund operations, obtaining free vouchers and selling them to others for profit; others exploited shopping platform vulnerabilities to earn return compensation through free returns and exchanges. Such actions are clearly illegal and deceptive, directly causing financial losses to mercha
case category: news_report
incident time: 2023-07
keywords: coupon scalping
keywords: app vulnerability exploitation
keywords: refund fraud
keywords: voucher fraud
keywords: shopping platform loophole
keywords: return compensation scam
keywords: illegal profit
keywords: security accountability
related risks: Unauthorized Discount Purchase
related threat actors: Freebie Hunters
citation: Exploiting loopholes to 'coupon scalp' 1 million yuan: Should security personnel take the blame?_Tencent News
updated: 2026-06-18
version: 1

Woman Exploits Supermarket Loophole for 18 Months of Zero-Dollar Shopping, Defrauds ¥250,000
type: Case
break id: C0574
stix type: report
summary: A woman exploited a loophole in a supermarket's operations, obtaining goods through zero-dollar purchases over a year and a half, with the total amount involved reaching ¥250,000. The act constitutes suspected fraud and has been filed for criminal investigation by the police.
case category: criminal_verdict
incident time: 2026-01
keywords: supermarket loophole
keywords: zero-dollar purchase
keywords: coupon scalping
keywords: fraud conviction
keywords: low-price purchase risk
keywords: criminal filing
keywords: ¥250,000 fraud
related risks: Unauthorized Discount Purchase
related threat actors: Freebie Hunters
citation: Woman exploited supermarket loophole for 'zero-dollar shopping,' scammed 250,000 yuan over 1.5 years, suspected of fraud
updated: 2026-06-18
version: 1

Jiangsu Special Rectification on Fake Reviews and Click Farming Announced
type: Case
break id: C0575
stix type: report
summary: In November 2021, the Jiangsu Provincial Market Supervision Administration reported on a special campaign against fake reviews and click farming, disclosing six cases of unfair competition. The report noted that some merchants used tactics such as cash-for-positive-reviews, hiring fake reviewers, and sending empty packages to fabricate transactions and ratings, misleading consumers and undermining
case category: administrative_enforcement
incident time: 2021-11
keywords: click farming
keywords: fake reviews
keywords: cash-for-positive-reviews
keywords: empty packages
keywords: hired reviewers
keywords: unfair competition
keywords: Jiangsu AMR
keywords: special rectification
related risks: Fake Reviews
related threat actors: Malicious Merchants
related threat actors: Crowdsourced Workers
related threat actors: Astroturfing Networks
citation: Jiangsu strictly investigates the black and gray industry chain behind e-commerce fake reviews and transaction fraud
citation: Jiangsu Provincial Market Supervision Administration reports on 'fake reviews and sales' crackdown; experts: Platforms should improve...
updated: 2026-06-24
version: 1

Eight Individuals Convicted of False Advertising for Organizing Fake Reviews and Sales
type: Case
break id: C0576
stix type: report
summary: In July 2025, the Dunhua City People's Court in Jilin Province concluded a case involving fake reviews and transaction fraud. The defendants, including Xiao Ming, purchased order-brushing software and set up a studio to organize 'brushers' to conduct fake transactions and post fabricated positive reviews for Taobao merchants, accumulating illegal gains of 272,000 yuan. The court convicted all eigh
case category: criminal_verdict
incident time: 2025-07
keywords: fake reviews
keywords: false advertising crime
keywords: order brushing
keywords: fabricated ratings
keywords: Taobao
keywords: brusher
keywords: brushing software
keywords: organized fake transactions
keywords: Dunhua City People's Court
keywords: illegal gains
related risks: Fake Reviews
related attack tools: Automation Scripts
related threat actors: Freebie Hunters
related threat actors: Crowdsourced Workers
related threat actors: Malicious Merchants
citation: Dunhua Court: Eight Defendants Convicted for Fake Reviews and Sham Transactions
updated: 2026-06-18
version: 1

Fuzhou Click Farming Case: Four Convicted of False Advertising
type: Case
break id: C0577
stix type: report
summary: In August 2025, the Taijiang District Court in Fuzhou, Fujian Province, concluded a click farming case involving a food delivery platform. The defendants, led by an individual surnamed Huang, operated a workshop controlling over 150 mobile phones to fabricate orders and positive reviews for merchants. They generated more than 120,000 fake orders with an actual payment amount of 7.13 million yuan,
case category: criminal_verdict
incident time: 2025-08
keywords: click farming
keywords: fake reviews
keywords: false advertising crime
keywords: food delivery platform
keywords: fabricated orders
keywords: Taijiang District Court
keywords: illegal profit
keywords: click farm ring
related risks: Fake Reviews
related attack tools: Mass Control Systems
related attack tools: Cloud Phone
related attack tools: Click Simulation Tools
related attack tools: Ranking Manipulation Tools
related threat actors: Freebie Hunters
related threat actors: Astroturfing Networks
citation: Do Not Fake Five-Star Reviews: The High Criminal Cost
updated: 2026-06-18
version: 1

Luoding Brushing and Click-Farming Case: Organizing Fake Transactions Convicted as Illegal Business Operations
type: Case
break id: C0578
stix type: report
summary: In May 2026, a court in Luoding, Guangdong, concluded a brushing case. Defendants Wang and Kang organized others to conduct fake transactions and post fabricated positive reviews for compression stockings sold by an online store named 'A Certain Health Pharmacy.' A total of 31,316 brushing orders were placed, with each defendant profiting 46,974 yuan. The court sentenced both to one year in prison
case category: criminal_verdict
incident time: 2026-05
keywords: brushing
keywords: fake transactions
keywords: illegal business operations
keywords: online store
keywords: compression stockings
keywords: Luoding
keywords: click-farming
keywords: fabricated reviews
keywords: e-commerce fraud
related risks: Fake Reviews
related threat actors: Astroturfing Networks
citation: Yunfu Intermediate Court: Fake Online Store Transactions Convicted as Illegal Business Operations
updated: 2026-06-18
version: 1

Lianyungang Click Farming Case: Two Convicted of False Advertising
type: Case
break id: C0579
stix type: report
summary: In March 2025, the Lianyungang Lianyun District Court in Jiangsu concluded a click farming case. The defendants, including Chen, provided click farming services for merchants through online platforms, organizing fake transactions and positive reviews. The court convicted two defendants of false advertising, sentencing them to imprisonment and fines.
case category: criminal_verdict
incident time: 2025-03
keywords: click farming
keywords: false advertising crime
keywords: fake reviews
keywords: online click farming
keywords: criminal verdict
keywords: Lianyungang
keywords: e-commerce click farming
related risks: Fake Reviews
related threat actors: Malicious Merchants
related threat actors: Astroturfing Networks
citation: The criminal conduct behind five-star reviews
updated: 2026-06-18
version: 1

Nanjing Medical Aesthetics Clinic Fined for Fake Reviews and Transaction Fraud
type: Case
break id: C0580
stix type: report
summary: In October 2021, the State Administration for Market Regulation reported ten medical aesthetics cases, including Nanjing Xihan Medical Aesthetics Clinic, which hired eight individuals to place fake orders and payments on Dianping without actual consumption, fabricating transactions and reviews to mislead consumers. This constitutes typical fake review and transaction fraud.
case category: administrative_enforcement
incident time: 2021-10
keywords: Nanjing Xihan Medical Aesthetics
keywords: Dianping
keywords: fake reviews
keywords: transaction fraud
keywords: fabricated reviews
keywords: medical aesthetics clinic
keywords: State Administration for Market Regulation
keywords: unfair competition
related risks: Fake Reviews
related threat actors: Malicious Merchants
related threat actors: Astroturfing Networks
citation: 2021 Typical Anti-Unfair Competition Enforcement Cases in Key Fields: Medical Aesthetics
updated: 2026-06-18
version: 1

Sichuan's First Public Interest Litigation Case on Fake Online Reviews
type: Case
break id: C0581
stix type: report
summary: In February 2025, the Chengdu First Railway Transport Court tried the province's first public interest litigation case involving fake reviews. The defendant paid numerous influencers and ordinary users to fabricate consumption data and write fake store reviews on consumer review platforms, severely harming consumer rights. The court ordered a public apology and participation in public welfare acti
case category: criminal_verdict
incident time: 2025-02
keywords: fake reviews litigation
keywords: public interest lawsuit
keywords: Chengdu First Railway Transport Court
keywords: fabricated reviews
keywords: consumer review platforms
keywords: consumer rights
keywords: paid reviewers
keywords: public apology order
related risks: Fake Reviews
related threat actors: Astroturfing Networks
citation: Sichuan High Court: Typical Consumer Rights Protection Cases for March 15
updated: 2026-06-18
version: 1

Consequences of Incorrect Product Category Assignment for JD.com Merchants
type: Case
break id: C0582
stix type: report
summary: JD.com platform rules define incorrect product category assignment as listing items under categories that do not match their actual attributes. Examples include placing cleaning balls or scouring pads under the 'Kitchenware – Tableware – Bowls' category, or listing women's skirts under 'Casual Pants'. The platform enforces delisting of such non-compliant listings, deducting 2 points for minor viol
case category: administrative_enforcement
incident time: 2021-06
keywords: JD.com
keywords: product category misplacement
keywords: category mismatch
keywords: brand misclassification
keywords: product delisting
keywords: point deduction
keywords: API bulk operations
keywords: e-commerce platform rules
keywords: violation handling
related risks: Category / Brand Miscategorization
citation: Merchant Rule Center
updated: 2026-06-18
version: 1

Douyin Store Dropshipping Guide: Key Rules for Category Mismatch Violations
type: Case
break id: C0583
stix type: report
summary: The article explains that in the Douyin store dropshipping model, category mismatch refers to listing products under incorrect categories, such as placing personal care items under automotive supplies. Such violations lead to product bans, a 500-yuan deduction from the deposit per incident, and store removal in severe cases.
case category: news_report
incident time: 2020-12
keywords: Douyin store
keywords: dropshipping model
keywords: category mismatch
keywords: product ban
keywords: deposit deduction
keywords: e-commerce violation
keywords: store removal
related risks: Category / Brand Miscategorization
citation: Xingxing Team | Detailed guide to Douyin store no-inventory projects! Essential knowledge for store operations
updated: 2026-06-18
version: 1

Douyin Store Miscategorization Leads to Tag Confusion and Low Ratings
type: Case
break id: C0584
stix type: report
summary: On Douyin stores, merchants who incorrectly list product categories can cause chaotic store tags, which in turn drag down store ratings. This is a common violation among new sellers, representing a typical case of category misplacement that misleads consumers and disrupts platform order.
case category: news_report
incident time: 2021-11
keywords: Douyin store
keywords: miscategorization
keywords: store tag confusion
keywords: rating drop
keywords: category misplacement
keywords: brand mislabeling
keywords: platform order
related risks: Category / Brand Miscategorization
related threat actors: Malicious Merchants
citation: Douyin E-Commerce Learning Center: Merchant Rules
updated: 2026-06-18
version: 1

Chengdu Internet Court Upheld Platform Penalty Against Merchant Misclassifying Product Category
type: Case
break id: C0585
stix type: report
summary: In March 2024, Zigong Chang'an Net republished consumer-rights protection typical cases issued by the Chengdu Internet Court. Liu operated a store on an e-commerce platform, listed a mole removal cream under the outdoor/fishing equipment category, and masked key product words to evade platform supervision. The platform imposed a 100-point violation score, 20,000 yuan in liquidated damages and a permanent account ban under its rules. After Liu's appeal failed, Liu sued for account reinstatement and damages. The court held that the category misplacement and key-information masking violated platform rules and the principle of good faith, and dismissed all claims.
case category: criminal_verdict
incident time: 2024-03
keywords: Chengdu Internet Court
keywords: category misplacement
keywords: mole removal cream
keywords: outdoor fishing equipment category
keywords: keyword masking
keywords: platform penalty
keywords: permanent account ban
keywords: 20,000 yuan liquidated damages
keywords: e-commerce compliance
keywords: category abuse
related risks: Category / Brand Miscategorization
citation: E-Commerce Platform Sued After Penalizing Non-Compliant Merchant; Court Backs the Platform
updated: 2026-06-26
version: 1

High-Frequency Violation for New Sellers: Category Misplacement
type: Case
break id: C0586
stix type: report
summary: Platforms warn new sellers that misplacing products in incorrect categories to gain unfair exposure is a high-frequency violation and a key enforcement target. Sellers should avoid this pitfall.
case category: news_report
incident time: 2022-04
keywords: category misplacement
keywords: product category violation
keywords: brand misplacement
keywords: new seller violations
keywords: e-commerce platform rules
keywords: product listing compliance
keywords: unfair exposure tactics
related risks: Category / Brand Miscategorization
related threat actors: Malicious Merchants
citation: Common violation types for new merchants: How many have you triggered? | Xiaoti's Growth Diary
updated: 2026-06-18
version: 1

Shangluo Investigates Six Hotels for Suspected Pricing Violations
type: Case
break id: C0587
stix type: report
summary: In March 2025, Shangluo market supervision authorities launched a special campaign targeting accommodation pricing practices and conducted repeated inspections of hotels in the main urban area of Shangzhou. Regulators found problems including failure to clearly mark prices, price fraud, malicious order cancellation, and inconsistent online and offline prices. They ordered three hotels to correct online price information and opened investigations into six hotels suspected of pricing violations.
case category: administrative_enforcement
incident time: 2025-03
keywords: hotel accommodation pricing
keywords: price fraud
keywords: malicious order cancellation
keywords: online offline price inconsistency
keywords: Shangluo market supervision
keywords: hotel pricing violation
keywords: special enforcement campaign
related risks: Price Fraud
citation: Shangluo carries out special accommodation pricing enforcement; six hotels investigated for suspected pricing violations
updated: 2026-06-26
version: 1

Mengyu Aerospace Science Education Base (Hainan Wenchang) Co., Ltd. Price Fraud Case
type: Case
break id: C0588
stix type: report
summary: In 2024, the Wenchang Municipal Market Supervision Bureau investigated Mengyu Aerospace Science Education Base (Hainan Wenchang) Co., Ltd. for selling space launch viewing packages on the Douyin platform using price comparison methods, such as displaying "¥3999 ¥5999," without ever having sold at the higher comparison price or disclosing its basis, constituting price fraud. The company was fined 6
case category: administrative_enforcement
incident time: 2024
keywords: space launch viewing package
keywords: price comparison
keywords: price fraud
keywords: Douyin platform
keywords: Mengyu Aerospace
keywords: Wenchang Market Supervision Bureau
keywords: false discount
keywords: administrative penalty
related risks: Price Fraud
citation: Consumer Protection: Hainan Market Regulator Releases Typical Cases from the Consumer Protection Campaign
citation: Hainan announces 5 typical cases! Seafood restaurant fined for swapping live seafood with dead ones chosen by customers
updated: 2026-06-18
version: 1

Yan'an Yonghui Supermarket Xuanyuan Avenue Branch Price Fraud Case
type: Case
break id: C0589
stix type: report
summary: In April 2022, Shaanxi market regulation authorities investigated a batch of illegal cases, among which Yan'an Yonghui Supermarket Xuanyuan Avenue Branch was fined 100,000 yuan for fabricating original prices and committing price fraud. The case was listed as a typical example in that month's trending legal events.
case category: administrative_enforcement
incident time: 2022-04
keywords: Yonghui Supermarket
keywords: Xuanyuan Avenue branch
keywords: price fraud
keywords: fabricated original price
keywords: Shaanxi market regulation
keywords: administrative penalty
keywords: Yan'an
related risks: Price Fraud
citation: Yan'an Government: 2022 Iron Fist Action Typical Livelihood Enforcement Cases
updated: 2026-06-18
version: 1

Beijing Ximei Medical Aesthetics Clinic Price Fraud Case
type: Case
break id: C0590
stix type: report
summary: In July 2022, the Beijing Municipal Market Supervision Administration investigated Beijing Ximei Medical Aesthetics Clinic for displaying a discounted price of '¥17,940, saved ¥8,060' for 'Juvederm Ultra Plus' hyaluronic acid injections on its Dianping store without indicating the calculation basis for the discount, constituting price fraud. The clinic was fined 60,000 yuan.
case category: administrative_enforcement
incident time: 2022-07
keywords: Beijing Ximei Medical Aesthetics
keywords: price fraud
keywords: Dianping
keywords: Juvederm Ultra Plus
keywords: hyaluronic acid
keywords: discount calculation basis
keywords: Beijing Municipal Market Supervision Administration
keywords: administrative penalty
keywords: medical aesthetics
keywords: price display regulations
related risks: Price Fraud
citation: Beijing Municipal Market Supervision Administration Releases Typical Online Transaction Enforcement Cases
citation: Summary | Ahead of Double 11, multiple regions release typical cases on intellectual property and unfair competition | People's Republic of China...
updated: 2026-06-18
version: 1

Jinjiang Hotel Fined for Fabricated “Strikethrough Price” Fraud
type: Case
break id: C0591
stix type: report
summary: In April 2026, the Quanzhou Market Supervision Administration reported a strikethrough-price enforcement case. A Jinjiang hotel branch promoted two room types with strikethrough prices of 767 yuan and 817 yuan, while actual transaction prices from September 2025 to February 2026 were only 90 to 130 yuan. The regulator found that the hotel had never completed transactions at those strikethrough prices and imposed an administrative penalty on March 3, 2026.
case category: administrative_enforcement
incident time: 2026-03
keywords: strikethrough price
keywords: price fraud
keywords: hotel promotion
keywords: false original price
keywords: fictitious discount
keywords: Jinjiang
keywords: Market Supervision Administration
keywords: consumer protection
related risks: Price Fraud
citation: Do not let strikethrough prices become a numbers game that defrauds consumers
updated: 2026-06-25
version: 1

Guangdong Shantou Hotel Investigated for Listing Prices Far Above Actual Transaction Prices
type: Case
break id: C0592
stix type: report
summary: In February 2026, the Market Supervision Administration of Shantou, Guangdong Province, initiated an investigation into a hotel. Preliminary findings revealed that none of the hotel's room listings had ever been sold at the displayed 'strikethrough price,' and all actual transaction prices were significantly lower than those reference prices. The hotel is suspected of fabricating strikethrough pri
case category: administrative_enforcement
incident time: 2026-02
keywords: strikethrough pricing
keywords: price fraud
keywords: fabricated reference price
keywords: hotel
keywords: Shantou
keywords: Market Supervision Administration
keywords: consumer protection
keywords: e-commerce platform
keywords: transparent pricing
related risks: Price Fraud
related threat actors: Malicious Merchants
citation: Guangdong Shantou hotel's transaction prices far below 'strikethrough prices,' market supervision bureau files investigation_Pengpai Quality...
updated: 2026-06-18
version: 1

Nanjing Hotel Price Fraud Case
type: Case
break id: C0593
stix type: report
summary: In April 2024, the Qinhuai District Market Supervision Administration of Nanjing conducted routine inspections of the hotel industry and identified price fraud at a hotel, which was subsequently penalized according to law. This case was jointly released as one of seven typical cases of pricing violations.
case category: administrative_enforcement
incident time: 2024-04
keywords: hotel price fraud
keywords: Qinhuai District Market Supervision Administration
keywords: Nanjing
keywords: pricing violation
keywords: typical case
keywords: hotel inspection
keywords: price fraud case
related risks: Price Fraud
citation: Joint release! Seven typical cases of price violations
updated: 2026-06-18
version: 1

First Case: Streamer Jailed for Leaking Honor of Kings Skins for Profit
type: Case
break id: C0594
stix type: report
summary: In July 2024, the Chengdu High-tech Zone Court ruled on a copyright infringement case. The defendant, a video blogger surnamed Liu, had repeatedly released unreleased content of the game 'Honor of Kings' since February 2023 to generate advertising revenue. Within four months, Liu posted 33 leaked videos, garnering over 1.78 million likes and illegally obtaining hundreds of thousands of yuan in ad
case category: criminal_verdict
incident time: 2024-07
keywords: Honor of Kings skin leak
keywords: video game content leak
keywords: copyright infringement crime
keywords: criminal copyright infringement China
keywords: Tencent game leak
keywords: Chengdu High-tech Zone Court
keywords: video blogger ad revenue
related risks: Trade Secret Leakage
related threat actors: Piracy/Infringement Gangs
citation: Intellectual-Property Case Dual-Reporting Mechanism Helps Companies Protect Rights Quickly
updated: 2026-06-25
version: 1

Apple Sues Former iOS Engineer Aude Over Leaks of Unreleased Products and Sensitive Information
type: Case
break id: C0595
stix type: report
summary: In March 2024, Apple sued former iOS software engineer Andrew Aude in Santa Clara County Superior Court, alleging that he breached confidentiality obligations by disclosing regulatory compliance strategy, unreleased products, product development policies, hardware characteristics, employee headcount, and other confidential information to journalists and employees of other technology companies. Apple alleged that he deleted Signal communications during its investigation and had been terminated in December 2023.
case category: security_incident
incident time: 2024-03
keywords: Apple trade secret leak
keywords: iOS engineer insider threat
keywords: unreleased product leak
keywords: Wall Street Journal tip
keywords: product development policy disclosure
keywords: employee headcount leak
keywords: civil lawsuit
related risks: Trade Secret Leakage
related risks: RAG Unauthorized Retrieval
related threat actors: Malicious Insiders
citation: Santa Clara County Superior Court Case Information Online
citation: Apple Inc. v. Andrew Aude complaint, Case No. 24CV433319
citation: Apple Inc. v. Andrew Aude Stipulation of Dismissal
updated: 2026-06-26
version: 1

State-Owned Enterprise Employee Coerced into Espionage Abroad, Leaking Classified Information
type: Case
break id: C0596
stix type: report
summary: China's Ministry of State Security disclosed that Li Si, an employee in a critical position at a state-owned enterprise, was targeted and coerced by a spy agency during an overseas inspection due to personal misconduct, resulting in the immediate handover of classified information. The incident highlights the risk of trade secret leakage through personal behavior-related coercion.
case category: security_incident
incident time: 2024-01
keywords: state-owned enterprise employee
keywords: espionage coercion
keywords: classified information leak
keywords: trade secret leakage
keywords: overseas coercion
keywords: Ministry of State Security
keywords: Li Si
keywords: personal misconduct
keywords: honeytrap
related risks: Trade Secret Leakage
related threat actors: Corporate Spies
citation: State-owned enterprise employee seduced abroad, threatened by spy agency into betrayal, handed over classified...
citation: Honeytrap or Prey?
updated: 2026-06-18
version: 1

Lao Gan Ma Trade Secret Theft Case
type: Case
break id: C0597
stix type: report
summary: In May 2016, Lao Gan Ma discovered that a local competitor was producing highly similar products. Investigation confirmed that its core manufacturing technology had been stolen. Police identified former employee Jia, who had access to core processes during employment, joined a rival company after resignation, and disclosed and used the trade secrets to produce and sell similar products, with the i
case category: criminal_verdict
incident time: 2017-05
keywords: Lao Gan Ma trade secret theft
keywords: former employee misappropriation
keywords: food manufacturing process leak
keywords: non-compete violation
keywords: recipe theft investigation
keywords: Guizhou criminal investigation
related risks: Trade Secret Leakage
related threat actors: Malicious Insiders
related threat actors: Competitors
citation: 'Lao Gan Ma' technical info leaked; meticulous investigation identifies suspect_China.com
updated: 2026-06-18
version: 1

Xi'an Police Crack Major Trade Secret Infringement Case
type: Case
break id: C0598
stix type: report
summary: The High-Tech Zone police in Xi'an uncovered a major trade secret infringement case, arresting one suspect with an involved value exceeding 70 million yuan. This is the first trade secret infringement case cracked in Xi'an in the past three years and the highest-value case of its kind in the province in recent years, demonstrating the public security authorities' protection of corporate intellectu
case category: criminal_verdict
incident time: 2023-11
keywords: trade secret infringement
keywords: Xi'an High-Tech Zone police
keywords: trade secret theft
keywords: intellectual property protection
keywords: criminal detention
keywords: electronic data
keywords: major case
related risks: Trade Secret Leakage
citation: Xi'an police crack major trade secret infringement case worth over 70 million yuan | Public Security | Electronics...
citation: Procuratorial Organs' Typical Cases on Intellectual Property Protection
updated: 2026-06-18
version: 1

Luohu's First Self-Money Laundering Case: 8 Million Yuan Fraudulently Obtained and Transferred Multiple Times, Leading to Conviction
type: Case
break id: C0599
stix type: report
summary: Between February and March 2021, Su and Wang defrauded a victim of 8 million yuan using bank drafts without sufficient funds. From March 1 to 3, 2021, Su transferred 7.84 million yuan through borrowed corporate and personal accounts in a series of corporate-to-corporate, corporate-to-personal, and personal-to-personal transactions. A portion of the illicit funds was ultimately used to purchase pro
case category: criminal_verdict
incident time: 2021-03
keywords: self-money laundering
keywords: bill fraud
keywords: corporate account
keywords: fund transfer
keywords: concealing criminal proceeds
keywords: Luohu District
keywords: money laundering offense
keywords: property purchase with illicit funds
related risks: Money Laundering Risk
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: Luohu's first self-money laundering case! After defrauding 8 million yuan, multiple transfers led to sentencing..._Crime_Notes...
citation: Where Did the 8 Million Yuan in Proceeds Go? Shenzhen Luohu Prosecutors Uncover Money Laundering and Recover Over 7.72 Million Yuan
updated: 2026-06-18
version: 1

Shiyan, Hubei Dismantles a 'Running Points Money Laundering' Gang Involving Over 20 Million Yuan
type: Case
break id: C0600
stix type: report
summary: Between April and June 2021, police in Shiyan, Hubei dismantled a seven-member gang that directly provided 'running points money laundering' services for overseas fraud groups. The gang incited dozens of bar employees in Shiyan to provide bank cards and WeChat accounts, recruited unemployed individuals as core members, and exercised unified management. In just two months, the gang used multiple ac
case category: criminal_verdict
incident time: 2021-06
keywords: running points money laundering
keywords: telecom fraud
keywords: bank card
keywords: WeChat account
keywords: Shiyan
keywords: overseas fraud group
keywords: aiding information network crime
keywords: money laundering gang
keywords: fund transfer
related risks: Money Laundering Risk
related attack tools: Score-Running Platforms
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: Hubei Shiyan busts 'money laundering' gang involving over 20 million yuan_Sina Mobile News
updated: 2026-06-18
version: 1

Supreme People's Court Typical Case: Wang and Others Used Virtual Currency to Transfer Telecom Fraud Proceeds
type: Case
break id: C0601
stix type: report
summary: In July 2025, the Supreme People's Court released typical cases on punishing crimes related to assistance for information network crimes. In one case, Wang, Zhang, and Zhao acquired bank cards to receive criminal funds, withdrew cash at several banks in Daqing, Heilongjiang, kept a 10% to 15% commission, and used the remaining funds to buy virtual currency for transfer to their upline. From August 5 to August 14, 2022, the bank cards received more than 400,000 yuan in fraud proceeds from 15 victims. The three defendants were convicted of concealing or disguising criminal proceeds.
case category: criminal_verdict
incident time: 2022-08
keywords: virtual currency laundering
keywords: criminal proceeds transfer
keywords: telecom network fraud
keywords: cryptocurrency
keywords: bank cards
keywords: Daqing cash withdrawals
keywords: concealing criminal proceeds
keywords: Supreme People's Court typical case
keywords: cybercrime funds
related risks: Money Laundering Risk
related attack tools: Score-Running Platforms
related attack tools: Cryptocurrency Mixers
related threat actors: Money Laundering Gangs
related threat actors: Telecom Fraud Gangs
citation: Typical Cases on Punishing Crimes Related to Assistance for Information Network Crimes
updated: 2026-06-18
version: 1

Jincheng Arrests 21 in 380 Million Yuan USDT Money Laundering Case
type: Case
break id: C0602
stix type: report
summary: Since October 2021, Zhou formed a USDT over-the-counter trading group, buying Tether at low prices and selling at higher prices to settle payments between virtual currency and RMB for cybercriminals. From June 2022, Fu Mouyuan, Zhao Moushuai and others recruited money mules and runners, forming a criminal syndicate. The group facilitated payment settlements of over 54.8 million USDT, equivalent to
case category: criminal_verdict
incident time: 2023-07
keywords: USDT money laundering
keywords: Tether OTC trading
keywords: virtual currency settlement
keywords: money mule recruitment
keywords: Qinshui County Public Security Bureau
keywords: payment settlement crime
keywords: 3.8 billion yuan USDT case
keywords: cybercrime payment processing
related risks: Money Laundering Risk
related attack tools: Score-Running Platforms
related threat actors: Money Laundering Gangs
citation: 21 Arrested in Jincheng, Over 380 Million Yuan Involved | Money Laundering | Jincheng City | Cybercrime | Criminal Activity
citation: Police Bust USDT Money Laundering Case Involving 380 Million Yuan and Arrest 21 Suspects
updated: 2026-06-18
version: 1

Large-Scale Money Laundering Gang Conducted Mobile Laundering While Driving, Linked to Over 2,000 Fraud Cases Across 25 Provinces and Cities
type: Case
break id: C0603
stix type: report
summary: In October 2023, Wuhan police dismantled an entire chain of a mobile money laundering gang, arresting 24 suspects across 5 hierarchical levels, seizing 38 POS terminals, and intercepting 770,000 yuan in funds. The gang transferred funds through methods such as card swiping at gold jewelry stores. Further investigation has linked the gang to 2,065 cases across 25 provinces and cities, with verified
case category: criminal_verdict
incident time: 2023-10
keywords: money laundering gang
keywords: POS terminal laundering
keywords: card-swiping cash-out
keywords: telecom fraud fund transfer
keywords: Wuhan police operation
keywords: gold store laundering
keywords: mobile money laundering
related risks: Money Laundering Risk
related threat actors: Money Laundering Gangs
related threat actors: Underground Money Houses
citation: Large-Scale Money Laundering 'Running Points' Gang Operates While Driving, Linked to Over 2,000 Fraud Cases Across 25 Provinces and Cities
citation: People's Daily Online: Wuhan Police Dismantle Cross-Province Money Laundering Gang Involving 300 Million Yuan
updated: 2026-06-18
version: 1

Supreme People's Court Typical Case: Zhu Provided Bank Cards for Paofen Money Laundering and Received Administrative-Criminal Linked Treatment
type: Case
break id: C0604
stix type: report
summary: In July 2025, the Supreme People's Court released typical cases on punishing crimes related to assistance for information network crimes. One case described Zhu, who knowingly provided two bank cards and his identity document to a paofen money laundering group so the cards could be linked to POS terminals, and then helped transfer funds that entered the cards. From May 19 to May 23, 2022, Zhu transferred more than 43,000 yuan in fraud proceeds and more than 700,000 yuan in funds of unclear origin, receiving over 4,100 yuan in compensation. Prosecutors issued a relative non-prosecution decision, and public security authorities imposed administrative detention, a fine, and confiscation of illegal gains.
case category: criminal_verdict
incident time: 2022-05
keywords: paofen money laundering
keywords: two-card crime
keywords: bank card lending
keywords: POS transfer
keywords: telecom fraud fund transfer
keywords: administrative-criminal linkage
keywords: non-prosecution
keywords: administrative penalty
related risks: Money Laundering Risk
related threat actors: Money Laundering Gangs
citation: Typical Cases on Punishing Crimes Related to Assistance for Information Network Crimes
updated: 2026-06-18
version: 1

Beijing Resident's New Mobile Number Logs Directly into Stranger's Cloud Drive Account
type: Case
break id: C0605
stix type: report
summary: A Beijing resident, Mr. Li, found that his newly activated mobile number directly accessed the previous owner's cloud drive account, which contained family photos, work documents, and scanned contracts. Journalist testing confirmed that the new number could log into the previous owner's 3-year-old cloud drive account using only a verification code. Since the new user cannot provide the previous ow
case category: news_report
incident time: 2026-01
keywords: phone number recycling
keywords: second-hand phone number
keywords: cloud drive account takeover
keywords: verification code login
keywords: personal information exposure
keywords: telecom operator
keywords: account unbinding
keywords: previous number owner
related risks: Recycled Phone Number Takeover
citation: Legal Daily Focuses on Hidden Risks of 'Second Number Release': New Numbers Receive Collection Messages, Direct Access Issues...
updated: 2026-06-18
version: 1

User Accidentally Logs into Late Singer Coco Lee's NetEase Cloud Music Account via Recycled Phone Number
type: Case
break id: C0606
stix type: report
summary: In October 2025, a user reported that after registering for NetEase Cloud Music with a newly acquired phone number, they unexpectedly logged into the account of the late singer Coco Lee. NetEase Cloud Music customer service responded that an investigation revealed the incident occurred because the phone number previously bound to the artist's account was reissued by the telecom operator. They have
case category: news_report
incident time: 2025-10
keywords: phone number recycling
keywords: Coco Lee
keywords: NetEase Cloud Music
keywords: account security incident
keywords: telecom operator
keywords: SIM reissue
keywords: privacy leak
keywords: deceased singer
related risks: Recycled Phone Number Takeover
citation: Li Wen's Account Mistakenly Accessed, Official Response: Caused by Carrier's 'Second Number Release' | Mobile Phone - NetEase Subscription
updated: 2026-06-18
version: 1

Anhui Police Warn: Canceling a Mobile Number Is Like Selling Yourself, Sparking Debate
type: Case
break id: C0607
stix type: report
summary: In April 2024, a police officer from Tongling, Anhui, posted an educational video warning that casually discarded mobile numbers can be used by others to log into various apps via SMS verification codes, leading to financial loss and privacy breaches. The video triggered widespread concern over 'number recycling' risks, with many netizens sharing experiences of old numbers being misused or facing
case category: news_report
incident time: 2024-04
keywords: mobile number cancellation
keywords: number recycling
keywords: SMS verification login
keywords: privacy breach
keywords: financial loss
keywords: Tongling police
keywords: telecom operator
keywords: app registration failure
related risks: Recycled Phone Number Takeover
citation: Canceling a Phone Number Equals Selling Yourself Out: Why 'Second Number Release' Is Unsolvable - Tencent News
updated: 2026-06-18
version: 1

User Buys Recycled Phone Number, Receives Debt Collection Messages and Calls for a Year
type: Case
break id: C0608
stix type: report
summary: In May 2022, a user on the C114 forum reported that a newly activated mobile number was a recycled one, and they had been receiving various debt collection messages and calls for over a year without interruption. The number was reissued by the carrier after the previous owner defaulted or canceled the account, making it unusable for the new owner and severely disrupting daily communications.
case category: news_report
incident time: 2022-05
keywords: recycled phone numbers
keywords: second-hand numbers
keywords: debt collection calls
keywords: debt collection SMS
keywords: carrier number recycling
keywords: previous owner debt
keywords: communication harassment
related risks: Recycled Phone Number Takeover
citation: Troubles from Carriers' Second Number Release May Have Outweighed Benefits - Tencent News
updated: 2026-06-18
version: 1

Beijing Youth Daily Tests 21 Apps for Account Re-binding Difficulties, Exposing Gaps in Secondary Number User Rights
type: Case
break id: C0609
stix type: report
summary: In April 2024, Beijing Youth Daily reporters tested the account re-binding processes of 21 mainstream apps and found inconsistent platform standards. Some apps allowed one phone number to bind multiple accounts, preventing secondary number users from registering new ones. Certain apps, including Ele.me and Meituan, also cleared user data during re-binding. The report highlighted that users of recy
case category: news_report
incident time: 2024-04
keywords: secondary phone number
keywords: account re-binding
keywords: app testing
keywords: phone number recycling
keywords: user rights
keywords: Beijing Youth Daily
keywords: account registration
keywords: data clearance
keywords: Ele.me
keywords: Meituan
related risks: Recycled Phone Number Takeover
citation: Where's the Difficulty in Rebinding Apps After 'Second Number Release'? | Beijing Youth Daily | Meituan | Verification Code | Pinduoduo | Account...
updated: 2026-06-18
version: 1

Credit Card Cash-Out Loan to Help in an Emergency Turns IOU into 'Waste Paper'
type: Case
break id: C0610
stix type: report
summary: Wang cashed out 20,000 yuan via credit card and lent it to Fang, who issued an IOU and promised repayment. After Fang defaulted, Wang sued. The court ruled the loan was funded by credit card cash-out, constituting on-lending of financial institution loans, voiding the private lending contract, and ordered Fang to return the principal plus LPR-based fund occupation fees.
case category: criminal_verdict
incident time: 2025-12
keywords: credit card cash-out
keywords: private lending
keywords: void contract
keywords: on-lending
keywords: fund occupation fees
keywords: LPR
keywords: court ruling
keywords: loan dispute
related risks: Credit Card / Loan Cash-Out
citation: Credit Card Cash-Out to Help Friends in Need, IOU Turns into 'Waste Paper'? - Court - Jiangxi Political and Legal Network
updated: 2026-06-18
version: 1

Beijing No. 2 Intermediate Court Reports on Loan Diversion Cases Involving Financial Institutions
type: Case
break id: C0611
stix type: report
summary: The Beijing No. 2 Intermediate People's Court reported that among 118 adjudicated cases of loan diversion from financial institutions, nearly 30% involved credit card cash advances and subsequent re-lending. In one typical case, Liu borrowed money from Wang, who lent over 200,000 yuan obtained through an online lending platform. The court ruled the private lending contract invalid and only support
case category: news_report
incident time: 2025-11
keywords: loan diversion
keywords: re-lending
keywords: credit card cash advance
keywords: invalid private lending contract
keywords: Beijing No. 2 Intermediate Court
keywords: capital occupation loss
keywords: internet lending platform
keywords: Liu
keywords: Wang
related risks: Credit Card / Loan Cash-Out
citation: Credit Card Cash-Out Lent to Friend, Court Rules Contract Invalid | Loan - NetEase Subscription
updated: 2026-06-18
version: 1

Chongqing Police Crack Credit Card Payoff App Cash-Out Scheme
type: Case
break id: C0612
stix type: report
summary: Chongqing police dismantled a case where an app generated fake purchase orders to facilitate malicious credit card cash-outs and repayments. The criminal group profited over 2 million yuan in a short period, with total cash-out amounts reaching 60 billion yuan.
case category: criminal_verdict
incident time: 2024-05
keywords: credit card payoff
keywords: app cash-out
keywords: fake transactions
keywords: Chongqing police
keywords: illegal business
keywords: payment settlement
keywords: cash-out ring
keywords: 60 billion
related risks: Credit Card / Loan Cash-Out
related attack tools: Fake Apps
related threat actors: Payment Fraud Groups
citation: Over 6 Billion Yuan Involved: Chongqing Police Crack Credit Card Repayment App Cash-Out Case
citation: Public Security Authorities Achieve Significant Results in Combating and Preventing Bank Card-Related Crime; Ministry of Public Security Releases 8 Typical Cases
updated: 2026-06-18
version: 1

Why Loaning Funds Obtained Through Credit Card Cash Advances Is Not a Private Lending Arrangement
type: Case
break id: C0613
stix type: report
summary: The Supreme People's Procuratorate disclosed a case where Rui Mou used a POS machine provided by Cui Mou to obtain cash through a credit card cash advance and then lent 23,000 yuan to Cui Mou. This act was determined to be the re-lending of funds obtained by cashing out a financial institution loan and does not constitute a lawful private lending relationship.
case category: criminal_verdict
incident time: 2024-03
keywords: credit card cash advance
keywords: re-lending
keywords: private lending
keywords: Supreme People's Procuratorate
keywords: POS machine cash-out
keywords: Rui Mou
keywords: Cui Mou
keywords: cashing out financial institution loans
related risks: Credit Card / Loan Cash-Out
citation: Why Lending Credit Card Funds Isn't Private Lending - Supreme People's Procuratorate of the People's Republic of China
updated: 2026-06-18
version: 1

Man in His 20s Sentenced for 4.7 Million Yuan Alipay Huabei Cash-Out Scheme
type: Case
break id: C0614
stix type: report
summary: A man in his 20s was sentenced to 2 years and 6 months in prison for using Alipay's Huabei service to conduct cash-out transactions totaling 4.7 million yuan, highlighting the criminal liability for fraudulent cash-outs via consumer credit products.
case category: criminal_verdict
incident time: 2018-01
keywords: Huabei cash-out
keywords: Alipay Huabei fraud
keywords: illegal business operations
keywords: consumer credit abuse
keywords: fake transaction cash-out
keywords: 4.7 million yuan cash-out
keywords: Huabei prison sentence
related risks: Credit Card / Loan Cash-Out
related threat actors: Malicious Users
citation: Post-90s Man Cashes Out 4.7 Million Yuan via 'Huabei', Sentenced to 2 Years and 6 Months, Netizens: I've Done It Too...
citation: China’s First Huabei Cash-Out Case Sentenced, Defendant Gets Two and a Half Years
updated: 2026-06-18
version: 1

Uncovering the Black Market Chain Behind Huabei Cash-Outs
type: Case
break id: C0615
stix type: report
summary: As the year-end approaches, advertisements for Huabei cash-out services have been frequently appearing on social media. Reports reveal that the service fees are exorbitant, with costs approaching those of usury, and severe cases can lead to criminal sentencing. The investigation exposes the illicit cash-out chain built around consumer credit products.
case category: news_report
incident time: 2022-12
keywords: Huabei cash-out
keywords: black market chain
keywords: consumer credit
keywords: cash-out fees
keywords: usury
keywords: lead generation ads
keywords: credit card cash-out
keywords: illegal business
related risks: Credit Card / Loan Cash-Out
citation: Exposing the Black Industry Chain of Huabei Cash-Out: Costs Approach Loan Shark Rates, Severe Cases Can Lead to Prison, Yet It Persists...
updated: 2026-06-18
version: 1

Multiple Banks Prohibit Credit Card Cash-Out for Gold Speculation
type: Case
break id: C0616
stix type: report
summary: In May 2025, Industrial Bank, Bank of Communications, Bank of Jiangsu, Guangfa Bank and other banks issued announcements explicitly banning credit card funds from flowing into investment areas such as gold and stocks. Some investors attempted to arbitrage by cashing out credit cards or diverting consumer loan funds to trade gold, and banks will implement control measures against such violations.
case category: administrative_enforcement
incident time: 2025-05
keywords: credit card cash-out
keywords: gold speculation
keywords: consumer loan misuse
keywords: fund flow control
keywords: Industrial Bank
keywords: Bank of Communications
keywords: Bank of Jiangsu
keywords: Guangfa Bank
keywords: investment restriction
keywords: bank risk control
related risks: Credit Card / Loan Cash-Out
citation: Credit Card Cash-Out for 'Gold Speculation'! Plane's Emergency Exit Opened! Guilin Flowers in Bloom! - Tencent News
citation: Notice on Further Clarifying That Credit Card Credit Funds Must Not Be Used for Gold Investment
updated: 2026-06-18
version: 1

Nearly 10 Billion Yuan Involved: China's First Illegal Cash-Out Case Using Merchant QR Codes Cracked, 21 Arrested
type: Case
break id: C0617
stix type: report
summary: Yangzhou police cracked the nation's first illegal cash-out case using merchant QR codes. Suspects exploited a bank policy waiving handling fees for merchant collection codes, registered numerous merchant QR codes, and conducted repeated fake transactions to swipe cards, obtaining bank cashback rewards and points. The points were redeemed for flight tickets and hotel rooms, then sold online at low
case category: criminal_verdict
incident time: 2021-10
keywords: merchant QR code cash-out
keywords: points arbitrage scheme
keywords: fake transactions
keywords: bank cashback rewards
keywords: credit card cashing
keywords: Yangzhou police
keywords: payment settlement violation
keywords: merchant collection code
related risks: Illegal Points Cash-Out
related risks: Illegal Cash-Out
related threat actors: Payment Fraud Groups
citation: Nearly 10 Billion Yuan Involved! Nation's First Illegal Cash-Out Case Using Merchant QR Codes Cracked, 21 Arrested | Credit Card |...
citation: Nearly 10 Billion Yuan Involved: Yangzhou Jiangdu Police Crack QR Code Cash-Out Case
updated: 2026-06-18
version: 1

Cashier Steals Mall Loyalty Points Worth Over 100,000 Yuan, Sentenced to Three Years
type: Case
break id: C0618
stix type: report
summary: A cashier surnamed Liu at a large supermarket in Xiantao, Hubei, exploited a loophole in the mall's loyalty point system between October 2020 and January 2021. Without any actual purchases, she repeatedly credited points to her own and her family's membership cards, then used the points to shop on the mall's online store, making an illicit profit of approximately 100,000 yuan. The court convicted
case category: criminal_verdict
incident time: 2021-11
keywords: loyalty point theft
keywords: point system loophole
keywords: membership card fraud
keywords: point cashing
keywords: employee theft
keywords: Xiantao Hubei
keywords: theft conviction
keywords: point manipulation
related risks: Illegal Points Cash-Out
related threat actors: Malicious Insiders
citation: Stealing Merchant Points to Profit Over 100,000 Yuan, Sentenced to Three Years - Case Analysis - Xiantao People's Procuratorate, Hubei Province
updated: 2026-06-18
version: 1

Two Individuals Forged 500 Receipts, Used Photo Editing Software to Rack Up Millions of Points for Profit, Shanghai Police: Arrested
type: Case
break id: C0619
stix type: report
summary: Shanghai police uncovered a case of defrauding a shopping mall of loyalty points by forging receipts. Suspects Zhang and Zhou collected discarded customer receipts and used photo editing software to forge nearly 500 dining receipts, totaling millions of yuan. They redeemed these for points via the mall's mini-program, then sold the points on second-hand platforms or used them to pay for others' pa
case category: criminal_verdict
incident time: 2025-08
keywords: receipt forgery
keywords: loyalty points fraud
keywords: photo editing software
keywords: mall points redemption
keywords: dining receipt scam
keywords: parking fee evasion
keywords: second-hand platform resale
keywords: Shanghai police
related risks: Illegal Points Cash-Out
related threat actors: Freebie Hunters
citation: Two Forged 500 Catering Receipts, Used Photo Editing Software to 'Brush' Millions of Points for Profit, Shanghai Police: Already...
updated: 2026-06-18
version: 1

Coupon scalpers cash out government vouchers for over 180,000 yuan, court rules it constitutes fraud
type: Case
break id: C0620
stix type: report
summary: Xu from Jiangsu organized individuals to use third-party software to remotely claim large quantities of Xuchang government e-vouchers, then colluded with two local restaurant operators Ge and Gao to cash them out through fake transactions, defrauding over 180,000 yuan. In December 2022, the court sentenced six defendants to prison terms ranging from two to three years for fraud.
case category: criminal_verdict
incident time: 2023-01
keywords: government consumption vouchers
keywords: cash out
keywords: fraud conviction
keywords: coupon scalping
keywords: fake transactions
keywords: third-party software
keywords: Xuchang
keywords: illegal voucher redemption
related risks: Illegal Points Cash-Out
related attack tools: Bulk Account Registration Tool
related attack tools: Device Spoofing Tools
related attack tools: Mobile Phone Emulator
related attack tools: Cloud Phone
related attack tools: Multi-Instance Tools
related attack tools: Automation Scripts
related attack tools: Click Simulation Tools
related attack tools: Flash Sale Tools
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: 'Wool-Pulling Party' Cashes Out Government Consumption Vouchers, Defrauding Over 180,000 Yuan, Court Rules It as Fraud! - Tencent...
citation: Coupon Scalpers Cashed Out Government Vouchers: Court Rules the Conduct Constitutes Fraud
updated: 2026-06-18
version: 1

China's First Illegal Cash-Out Case Using Merchant QR Codes
type: Case
break id: C0621
stix type: report
summary: Police in Jiangdu, Yangzhou cracked a major illegal business operation, arresting 15 suspects involved in a scheme worth nearly 10 billion yuan. The suspects exploited a bank policy waiving fees for merchant QR codes by registering multiple merchant QR codes and conducting repeated fake transactions to obtain large amounts of bank cashback and reward points. They then profited by selling the redee
case category: criminal_verdict
incident time: 2021-10
keywords: merchant QR code cash-out
keywords: illegal cash-out scheme
keywords: fake transaction
keywords: credit card cash-out
keywords: bank cashback exploitation
keywords: reward points redemption
keywords: illegal business operation
keywords: Jiangdu Yangzhou case
related risks: Illegal Points Cash-Out
related threat actors: Money Laundering Gangs
related threat actors: Criminal Organizations
citation: Yangzhou Jiangdu Cracks Billion-Yuan QR Code Cash-Out Case, 15 Suspects Arrested | Yangzhou City |...
citation: Nearly 10 Billion Yuan Involved: Yangzhou Jiangdu Police Crack QR Code Cash-Out Case
updated: 2026-06-18
version: 1

Man Sentenced for Processing Over 9.25 Million Yuan via Fake Installment Payment Transactions
type: Case
break id: C0622
stix type: report
summary: Between February 2023 and March 2024, the defendant Tong formed a team to set up shell stores, using fake shipments and fabricated transactions to cash out over 9.25 million yuan from online consumer credit funds. He charged approximately a 3% fee, illegally profiting over 40,000 yuan. His actions constituted the crime of illegal business operations, and he was sentenced to one year and three mont
case category: criminal_verdict
incident time: 2026-05
keywords: installment payment cash-out
keywords: fake shipment brushing
keywords: fabricated transactions
keywords: shell stores
keywords: illegal business operations
keywords: online consumer credit fraud
keywords: cash-out service fee
related risks: Illegal Cash-Out
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: Using Installment Payments for Fake Transactions, Man Cashes Out Over 9.25 Million Yuan, Sentenced - Tencent News
citation: Yizheng Procuratorate Case Note: Man Sentenced for Cashing Out Over 9.25 Million Yuan Through Fake Installment Payment Transactions
updated: 2026-06-18
version: 1

Supreme People's Procuratorate Discloses Ningbo Consumer Voucher Subsidy Fraud Administrative Supervision Case
type: Case
break id: C0623
stix type: report
summary: The Supreme People's Procuratorate disclosed that from November 2022 to February 2023, Liu, Mao, and others in Yinzhou, Ningbo provided store payment codes to Yuan and others, who used fake transactions to redeem government consumer vouchers issued through UnionPay QuickPass and fraudulently obtained more than 42,000 yuan in government consumption subsidies. The Yinzhou District Procuratorate prosecuted 15 people including Fan for fraud, made non-prosecution decisions for 33 others including Liu, and then used reverse criminal-administrative linkage to recommend administrative penalties. As of the notice, public security authorities had issued administrative detention decisions against 14 people.
case category: administrative_enforcement
incident time: 2023-04
keywords: consumer voucher fraud
keywords: fake transaction cashing
keywords: government consumer voucher abuse
keywords: voucher redemption scam
keywords: administrative procuratorial supervision
keywords: Yinzhou District Procuratorate
keywords: UnionPay QuickPass
keywords: government subsidy fraud
related risks: Illegal Cash-Out
related threat actors: Malicious Merchants
citation: Consumer vouchers cannot be cashed out: administrative procuratorial supervision prompts authorities to impose penalties
updated: 2026-06-18
version: 1

Shanghai Police Crack Consumer Voucher Fraud Cases Involving Fake Transactions
type: Case
break id: C0624
stix type: report
summary: In December 2024, the Shanghai Public Security Bureau reported that Shanghai police, working with relevant authorities, cracked two criminal cases involving consumer vouchers and arrested 18 suspects. In one case, a local restaurant owner Guo and store manager Liu instructed Hu to publish voucher purchase information online, teach others to modify IP addresses for remote voucher grabbing, acquire large volumes of restaurant vouchers, and use fictitious transactions to defraud consumer subsidies. In another case, Zhang Jiejie and others posted voucher-grabbing tasks on social platforms, organized people to change phone locations with software, and colluded with seven restaurant businesses to redeem vouchers through fake consumption records.
case category: criminal_verdict
incident time: 2024-12
keywords: consumer voucher cash-out
keywords: fake transactions
keywords: subsidy fraud
keywords: Shanghai police
keywords: remote voucher grabbing
keywords: restaurant vouchers
keywords: fictitious transactions
keywords: merchant collusion
related risks: Illegal Cash-Out
related threat actors: Freebie Hunters
related threat actors: Malicious Merchants
citation: Shanghai Police Crack Down on Consumer Voucher-Related Crimes
updated: 2026-06-25
version: 1

Amount Involved Exceeds 6 Billion Yuan! Chongqing Police Crack Credit Card Cash-Out Case Using Repayment App
type: Case
break id: C0625
stix type: report
summary: In May 2024, Chongqing police cracked a case involving the use of the "Youpin Life" app to create orders for fake commodity transactions and maliciously cash out credit cards. The criminal gang charged high fees through this platform, making over 2 million yuan in profit in a short period, with the total amount of credit card cash-outs reaching 6 billion yuan.
case category: criminal_verdict
incident time: 2024-05
keywords: credit card cash-out
keywords: illegal cash-out
keywords: Youpin Life App
keywords: fake commodity transactions
keywords: Chongqing police
keywords: payment settlement
keywords: cash-out platform
keywords: high fees
keywords: malicious cash-out
related risks: Illegal Cash-Out
related attack tools: Fake Apps
related threat actors: Payment Fraud Groups
citation: Over 6 Billion Yuan Involved! Chongqing Police Crack Credit Card Repayment App Cash-Out Case
citation: Public Security Authorities Achieve Significant Results in Combating Bank Card-Related Crime; Ministry of Public Security Releases 8 Typical Cases
updated: 2026-06-18
version: 1

POS Machine Cash-Out and Credit Card Repayment Scheme Leads to Eight-Year Prison Sentence
type: Case
break id: C0626
stix type: report
summary: Defendant Han used POS machines to facilitate cash-outs and repay credit card balances for others, illegally engaging in fund settlement operations and disrupting market order. The Xinmi Court convicted him of illegal business operations and sentenced him to eight years in prison. The case reveals the severe legal consequences of using POS machines for fictitious transactions to extract cash.
case category: criminal_verdict
incident time: 2024-12
keywords: POS machine cash-out
keywords: credit card repayment
keywords: illegal business operations
keywords: fund settlement
keywords: fictitious transactions
keywords: Xinmi Court
keywords: illegal cash-out
keywords: market order disruption
related risks: Illegal Cash-Out
citation: [Case Interpretation] Helping Others with Card Cash-Out and Credit Card Repayment, Sentenced to Eight Years! - Xinmi City Court Net
updated: 2026-06-18
version: 1

Woman Racks Up Over 400,000 Yuan in Debt via Phone Rentals; Police Crack First 'Rent-to-Loan' Illegal Business Case
type: Case
break id: C0627
stix type: report
summary: In July 2024, Shanghai police cracked the first case of illegal lending disguised as 'phone rentals.' Ms. Jiang, through loan intermediary Wu, used multiple mobile apps to obtain funds by renting phones and reselling them for cash, involving illicit transactions exceeding 20 million yuan. Fifteen suspects were arrested.
case category: criminal_verdict
incident time: 2024-07
keywords: rent-to-loan
keywords: phone rental cash-out
keywords: illegal lending
keywords: illegal business operation
keywords: loan intermediary
keywords: Shanghai police
keywords: disguised usury
keywords: phone rental scheme
related risks: Illegal Cash-Out
related threat actors: Malicious Merchants
citation: Disguised as phone rentals, borrowing 140,000 yuan becomes 420,000 yuan: Shanghai police crack the city's first rent-to-loan case
updated: 2026-06-18
version: 1

Criminal Gang Sentenced for Cashing Out Over 200,000 Yuan via Digital RMB Accounts in Four Days
type: Case
break id: C0628
stix type: report
summary: In mid-September 2023, Yuan, Zhang, Kou, and others approached merchants in Shaoxing that supported digital RMB, offering to pay handling fees in exchange for cashing out digital RMB funds through fake transactions. They cashed out over 200,000 yuan in just four days. The gang was sentenced for concealing and disguising criminal proceeds.
case category: criminal_verdict
incident time: 2024-06
keywords: digital RMB
keywords: e-CNY cash out
keywords: fake transactions
keywords: concealing criminal proceeds
keywords: Shaoxing
keywords: illegal cash out
keywords: criminal gang
related risks: Illegal Cash-Out
related threat actors: Money Laundering Gangs
related threat actors: Criminal Organizations
citation: Using Digital RMB Accounts to Cash Out Over 200,000 Yuan in Four Days, Criminal Gang Sentenced
updated: 2026-06-18
version: 1

AliExpress Duplicate Listing Cases and Penalty Rules
type: Case
break id: C0629
stix type: report
summary: AliExpress stipulates that a seller may only list the same product once. Cases show that even if main images differ—such as different angles, packaging status, or colors—listings are deemed duplicate if titles, attributes, and prices are highly similar. Violating listings will be ranked lower in search, and in severe cases, stores may be blocked or accounts frozen.
case category: news_report
incident time: 2017-09
keywords: AliExpress duplicate listing policy
keywords: AliExpress penalty rules
keywords: duplicate product listing detection
keywords: AliExpress store blocking
keywords: account freezing
keywords: search ranking penalty
keywords: cross-border e-commerce listing rules
related risks: Duplicate Product Listings
citation: Case Analysis and Penalty Rules for Duplicate Listings on AliExpress - Hugo Net
updated: 2026-06-18
version: 1

AliExpress Duplicate Listing Determination Standards
type: Case
break id: C0630
stix type: report
summary: AliExpress determines duplicate listings based on the following criteria: identical main images with similar titles and attributes; different main images but highly similar titles, attributes, and prices; listing the same product in more than three different packaging configurations. Products must have clear differences in fields such as title, price, image, and attributes to avoid being flagged a
case category: news_report
incident time: 2021-05
keywords: AliExpress duplicate listing policy
keywords: duplicate product detection
keywords: product main image matching
keywords: title similarity check
keywords: packaging variation rules
keywords: seller platform compliance
related risks: Duplicate Product Listings
citation: What Counts as Duplicate Listings on AliExpress? What Are the Penalties? - Hugo Net
updated: 2026-06-18
version: 1

Tmall Cracks Down on Duplicate Product Listings
type: Case
break id: C0631
stix type: report
summary: Tmall requires merchants selling two or more identical items across their storefronts to retain only the earliest-published listing and remove all duplicates. For merchants operating multiple stores with the same products, they must revoke brand authorizations for duplicate stores and delete the listings. Violators face public warnings, product delisting, and operational restrictions.
case category: administrative_enforcement
incident time: 2024-07
keywords: Tmall duplicate listings
keywords: e-commerce platform rules
keywords: product delisting
keywords: brand authorization revocation
keywords: storefront management
keywords: identical product listings
keywords: violation public notice
related risks: Duplicate Product Listings
citation: Before the state 'cracks down' on e-commerce, Tmall takes the lead_ Tencent News
updated: 2026-06-18
version: 1

Temu Cracks Down on Duplicate Listings
type: Case
break id: C0632
stix type: report
summary: Temu is intensifying enforcement against duplicate product listings. Violations can lead to delisting, temporary bans on new product uploads, long-term caps on active inventory, and even permanent store closure, directly disrupting merchants' normal operations.
case category: news_report
incident time: 2025-10
keywords: Temu
keywords: duplicate listings
keywords: product delisting
keywords: store closure
keywords: cross-border e-commerce
keywords: platform rules
keywords: listing restrictions
keywords: new product ban
related risks: Duplicate Product Listings
related threat actors: Malicious Merchants
citation: Permanent store closure in two days! Temu is cracking down on duplicate listings...
updated: 2026-06-18
version: 1

Taobao Duplicate Listings Caused Store Restriction on Publishing Products
type: Case
break id: C0633
stix type: report
summary: A newly registered Taobao store was restricted from publishing products because another store under the same identity was found to have duplicate listings across multiple stores, triggering associated risk controls that flagged the new store as a security risk immediately after registration.
case category: security_incident
incident time: 2025-09
keywords: Taobao duplicate listings
keywords: store restriction
keywords: associated risk control
keywords: duplicate storefronts
keywords: new store registration
keywords: product publishing restriction
keywords: e-commerce platform rules
related risks: Duplicate Product Listings
related threat actors: Malicious Merchants
citation: What causes newly opened Taobao stores to be restricted from publishing products? _ New store _ Deposit _ Violation
updated: 2026-06-18
version: 1

Penalties for Duplicate Listings on Taobao
type: Case
break id: C0634
stix type: report
summary: Taobao sellers who repeatedly violate duplicate listing rules may face product removal, store-wide delisting, restrictions on publishing new products, limits on product quantity, and category publishing limits. Repeated duplicate listings by the same seller can severely disrupt normal store operations.
case category: news_report
incident time: 2022-05
keywords: Taobao
keywords: duplicate listings
keywords: penalty measures
keywords: store operations
keywords: product removal
keywords: publishing restrictions
keywords: seller violations
related risks: Duplicate Product Listings
citation: Taobao Implementation Rules for Duplicate Listings
updated: 2026-06-18
version: 1

Consequences and Resolution of Duplicate Listings on Taobao
type: Case
break id: C0635
stix type: report
summary: Repeated violations by the same seller involving duplicate product listings can result in item removal, the delisting of all products in the store, and restrictions on publishing new items. This underscores the severe impact of duplicate listings on Taobao store operations.
case category: news_report
incident time: 2021-05
keywords: Taobao
keywords: duplicate listings
keywords: store violations
keywords: item removal
keywords: listing restrictions
keywords: store operations
keywords: e-commerce rules
keywords: seller penalties
related risks: Duplicate Product Listings
citation: Duplicate Listings (Data Manager Page) - Alibaba
updated: 2026-06-18
version: 1

Tmall Tightens Rules on Duplicate Listings with New Fines
type: Case
break id: C0636
stix type: report
summary: On June 30, 2024, Tmall updated its rules against spam-like product information, specifically targeting duplicate listings. The new policy defines identical products and mandates that only the earliest published listing be retained while other identical links are removed. It introduces a penalty structure: for general violations, a fine of 500 yuan per item applies, capped at 3,500 yuan over three
case category: administrative_enforcement
incident time: 2024-07
keywords: Tmall
keywords: duplicate listings
keywords: spam information
keywords: platform rules
keywords: fines
keywords: identical products
keywords: merchant penalties
keywords: e-commerce compliance
related risks: Duplicate Product Listings
citation: Tmall's new rule to crack down on duplicate listings! A major signal! _ Product _ Store _ Information
updated: 2026-06-18
version: 1

Strictest Cross-Border E-Commerce Rule: Duplicate Listings to Lose All Exposure
type: Case
break id: C0637
stix type: report
summary: In May 2025, cross-border e-commerce platforms introduced a new rule stating that products with identical attributes and appearance will be classified as duplicate listings regardless of how they are published. Even the same product with different SKUs may be flagged. Flagged duplicate listings will receive zero exposure, making this the strictest regulation in history.
case category: news_report
incident time: 2025-05
keywords: cross-border e-commerce
keywords: duplicate listings
keywords: platform policy update
keywords: SKU variation
keywords: product exposure ban
keywords: seller compliance
keywords: May 2025 regulation
related risks: Duplicate Product Listings
citation: Breaking! The strictest new regulations are out! Cross-border e-commerce sellers may suffer heavy losses!
updated: 2026-06-18
version: 1

Procurement Splitting to Circumvent Public Bidding
type: Case
break id: C0638
stix type: report
summary: An audit of Entity B's 2022 departmental budget execution found that it split an annual budget of 3 million yuan for office consumables procurement into multiple self-procurement batches, keeping each transaction below the public bidding threshold. The cumulative actual procurement reached 2.78 million yuan, and the purchase prices were higher than comparable products on the e-commerce platform. This was identified as circumventing public bidding by breaking up the whole into parts.
case category: administrative_enforcement
incident time: 2025-03
keywords: organizational procurement
keywords: order splitting
keywords: circumvent bidding
keywords: breaking up the whole into parts
keywords: audit findings
keywords: public bidding threshold
keywords: office consumables
keywords: self-procurement
keywords: e-commerce platform
keywords: above-market pricing
related risks: Order-Splitting Arbitrage
citation: State-owned enterprise procurement exposed 'split-order arbitrage'! Audit team cracks the case with one move
citation: Case Study: Splitting Procurement to Avoid Public Bidding
updated: 2026-06-18
version: 1

Singles' Day Cart-Stuffing Arbitrage Drives High Return Rates for Brands
type: Case
break id: C0639
stix type: report
summary: During the 2025 Singles' Day shopping festival, consumers exploited Taobao's 88VIP 'spend 7000, save 560' discount by adding high-priced items from brands like Ralph Lauren to their carts to meet the threshold, then immediately returning them after payment. This led to inflated GMV figures but minimal actual sales, with women's apparel return rates peaking at 80%-90% and Ralph Lauren hitting a 95%
case category: news_report
incident time: 2025-11
keywords: Singles' Day cart-stuffing
keywords: order splitting arbitrage
keywords: return rate manipulation
keywords: Ralph Lauren returns
keywords: Taobao 88VIP discount
keywords: spend and save promotion abuse
keywords: women's apparel return rate
keywords: GMV inflation
related risks: Order-Splitting Arbitrage
related threat actors: Freebie Hunters
citation: Top 10 reflections on Double 11 2025: Why we no longer believe in the 'lowest price'? _ Tencent News
updated: 2026-06-18
version: 1

Insurance Self-Insurance Policy Arbitrage Case
type: Case
break id: C0640
stix type: report
summary: The insurance industry has seen instances of self-insurance policy arbitrage, where senior agents register fictitious new agents using others' identity documents. They place new policies under these fabricated recruits to earn commissions, bonuses, and newcomer allowances. Some back-office staff also purchase self-insurance policies under fake recruits, creating sham team structures to defraud ins
case category: news_report
incident time: 2022-05
keywords: self-insurance policy arbitrage
keywords: fictitious agent registration
keywords: sham team structure
keywords: newcomer allowance fraud
keywords: insurance commission arbitrage
keywords: policy splitting arbitrage
keywords: ghost agent scheme
related risks: Order-Splitting Arbitrage
related threat actors: Malicious Insiders
citation: Wan Feng: How to eradicate self-insurance policy arbitrage that fleeces insurance companies? _ Tencent News
updated: 2026-06-18
version: 1

Malicious Ordering to Coerce Merchants into Paying Settlement Fees
type: Case
break id: C0641
stix type: report
summary: A man surnamed Chen placed over 2,700 malicious orders targeting more than 900 merchants on an e-commerce platform, generating a transaction volume exceeding 10.3 million yuan. He used tactics such as filing complaints and leaving negative reviews to coerce merchants into paying settlement fees, creating an abnormal refund arbitrage scheme that was ultimately uncovered by police.
case category: criminal_verdict
incident time: 2026-03
keywords: malicious ordering
keywords: settlement fee extortion
keywords: negative review blackmail
keywords: refund arbitrage
keywords: e-commerce platform abuse
keywords: order splitting
keywords: merchant coercion
keywords: complaint manipulation
related risks: Order-Splitting Arbitrage
related threat actors: Professional Negative Reviewers
citation: Man Maliciously Placed Over 2,700 Orders Against More Than 900 Online Stores, Court Sentences Him
updated: 2026-06-25
version: 1

Malicious Refund-Only Abuse Disrupts Online Store Operations and Leads to Sentence
type: Case
break id: C0642
stix type: report
summary: Chen exploited an e-commerce platform refund-only mechanism by repeatedly placing malicious orders, filing false complaints, and demanding settlement fees from more than 900 online stores. He placed over 2,700 malicious orders, generating transaction volume of more than 10.3 million yuan. After prosecution by Jiangyin Procuratorate in Jiangsu, the court convicted Chen of disrupting production and business operations and sentenced him to one year and six months in prison. The case illustrates the criminal risk of abusing platform refund rules to disrupt normal merchant operations.
case category: criminal_verdict
incident time: 2026-03
keywords: refund-only
keywords: crime of disrupting production and business operations
keywords: e-commerce platform
keywords: malicious refunds
keywords: false complaints
keywords: settlement fee
keywords: online store
keywords: refund arbitrage
keywords: Chen
related risks: Order-Splitting Arbitrage
related threat actors: Professional Counterfeit Claimants
related threat actors: Professional Negative Reviewers
updated: 2026-06-25
version: 1