Loading story…
A Russian-operated darknet marketplace, run by the group Karma Fullz, is trafficking in the identities of former U.S. visa holders who have since left the country. These synthetic identities, which include Social Security numbers, clean credit histories, and tax records, are being sold on a Telegram-based platform that exploits gaps in U.S. tracking of departed visa holders. The marketplace offers three tiers of identity packages, with the most valuable being aged ex-patriot identities priced at over $1,000 due to their rich credit histories and higher fraud success rates.
Fraudsters are using these identities to open new bank accounts, apply for credit cards, claim fraudulent tax refunds, and access public benefits, all while appearing as legitimate users within U.S. financial systems. Financial institutions often fail to detect these reactivated identities due to a lack of effective monitoring for such activity, according to experts at SentiLink. The operation highlights a significant vulnerability in U.S. fraud risk management and underscores the need for improved detection mechanisms for synthetic identity fraud.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting published in December 2025 described how Karma Fullz enhanced the credibility of these identities with Experian account setups, aged email addresses, and public-record registrations, making detection harder for financial institutions. The coverage also highlighted gaps in tracking departed visa holders and calls from experts such as SentiLink's David Maimon for more targeted fraud-detection measures.
Data from former immigrants from countries including Ukraine, Lithuania, and China was used in fraudulent U.S. financial and benefits applications, including bank accounts, credit cards, tax refunds, and public benefits. The reporting says such misuse was observed as recently as July 2025.
A Russian-operated darknet marketplace run by the Karma Fullz group was established in September 2024 to sell synthetic identities built from data belonging to former U.S. visa holders who had returned to their home countries. The market operated via Telegram and offered multiple tiers of identity packages, including higher-value aged identities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US authorities charged Zahid Hasan, a Bangladeshi national, with operating a network of illegal online marketplaces that sold digital templates for fake US government-issued identity documents, including passports, social security cards, and Montana driver’s licenses. These marketplaces, such as TechTreek and EGiftCardStoreBD, enabled cybercriminals worldwide to purchase high-quality digital templates for as little as $9.37 to $14.05, which could then be used to create fraudulent accounts at banks, social media platforms, and cryptocurrency exchanges. Over four years, Hasan allegedly received more than $2.9 million in cryptocurrency from over 1,400 customers globally. The US Department of Justice also announced the seizure of several domains associated with these operations as part of the crackdown. The investigation culminated in a nine-count federal indictment against Hasan, who faces charges including transfer of false identification documents, false use of a passport, and social security fraud. The FBI and its partners coordinated the seizure of multiple domains used in the scheme, highlighting the international scope of the operation and the growing threat posed by digital identity document templates in facilitating cybercrime. The case underscores the increasing use of online platforms and cryptocurrencies in the global trade of fraudulent identity materials, and the ongoing efforts by law enforcement to disrupt these networks.
Jul 12, 2026
A new bipartisan House bill, the **Stop Identity Fraud and Identity Theft Act**, would put the US Treasury Department in a central coordinating role to reduce identity theft and identity-related fraud by strengthening digital identity infrastructure. The proposal would authorize Treasury to run a grant program for states to develop **secure digital versions of driver’s licenses and other IDs** aligned with **NIST** standards, with stated goals including improved privacy protections, resilience against **AI deepfakes**, and stronger integrity controls for Treasury-administered benefit programs. Separately, federal prosecutors charged two Connecticut men with running a multi-year identity-fraud operation that allegedly stole roughly **$3 million** from **FanDuel** and other online gambling platforms by creating thousands of accounts using the stolen identities of about **3,000 victims**. Investigators allege the defendants sourced PII from **darknet markets** and **Telegram**, used background-check services (e.g., *TruthFinder* and *BeenVerified*) to pass identity verification prompts, tracked victim data in a `Tracker.xlsx` spreadsheet, and monetized the fraud by exploiting new-user promotions and moving winnings through stored-value cards into bank and investment accounts.
Jun 29, 2026
A Ukrainian national, **Yurii Nazarenko** (aliases including “John Wick”), pleaded guilty in U.S. federal court to operating *OnlyFake*, a subscription-based, **AI-powered fake ID** service that generated and sold more than **10,000** counterfeit identification images. Prosecutors said the service produced realistic digital versions of U.S. driver’s licenses (all 50 states), U.S. passports/passport cards, Social Security cards, and IDs for dozens of other countries, with options to customize personal details and output style (e.g., scan vs. tabletop photo). Authorities assessed the primary criminal use as bypassing **KYC** controls at banks and cryptocurrency exchanges; undercover FBI purchases (paid in cryptocurrency) reportedly obtained fake New York IDs, U.S. passports, and a Social Security card, and the site offered bulk packages (up to 1,000 documents) at discounted rates. Separately, researchers alleged an unknown actor used Anthropic’s **Claude** chatbot via Spanish-language prompts to support attacks against **Mexican government agencies**, including identifying vulnerabilities, generating exploit scripts, and automating data theft. According to Gambit Security’s research (as reported by Bloomberg and relayed by DataBreaches.net), the activity ran for about a month starting in December and resulted in the theft of roughly **150 GB** of data, including documents tied to **taxpayer and voter information**, government employee credentials, and civil registry files. While both cases highlight AI’s role in enabling cybercrime and fraud, they describe **different actors and incidents** rather than a single unified event.
Jun 29, 2026