Loading story…
Tajin Group, a Chinese-speaking cybercriminal vendor, has conducted phishing, payment-card theft, carding, financial fraud, and money laundering through Chinese-language Telegram guarantee marketplaces. The group operated on Dabai Guarantee from May 2025 to April 2026 before migrating to Xinbi Guarantee around May 2026, apparently observing marketplace rules limiting vendors to a single platform. On Xinbi, it claimed a 208,848 USDT vendor deposit—substantially above typical vendor deposits—indicating a potentially significant operation.
The group used stolen card data, payment links, and merchant accounts tied to CCAvenue UAE, Geidea UAE, N-Genius, and Selfridges eGift cards to test cards, process unauthorized transactions, and launder proceeds. It primarily targeted mainland Chinese citizens and Chinese banks while recruiting international partners with payment-gateway access and sourcing cards across multiple countries. Operators also bought and sold more than 100 Telegram usernames and anonymous virtual phone numbers via Fragment Market, improving anonymity and complicating attribution.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
After operating on Dabai Guarantee through April 2026, Tajin Group pivoted to Xinbi Guarantee around May 2026. On Xinbi, it claimed a 208,848 USDT vendor deposit, substantially above deposits reportedly typical for vendors on such marketplaces.
Tajin Group announced it would stop accepting certain overseas card-processing orders, citing stricter overseas restrictions, channel conflicts, and uncertainty over prior card use.
Tajin Group's @dbtm898 Dabai Guarantee channel became inactive, preceding the group's transition to another guarantee marketplace.
Tajin Group acquired the collectible anonymous Telegram phone number +888 0353 0246 through Fragment Market for 1,899 Toncoins.
Tajin Group acquired the Telegram username @tjjt_gx through Fragment Market for 88 Toncoins.
Tajin Group operated as a third-party vendor on the Chinese-language Telegram guarantee marketplace Dabai Guarantee beginning in May 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain intelligence firm **Elliptic** reported that the Telegram-based guarantee/escrow marketplace **Tudou Guarantee** has effectively stopped processing transactions in its public Telegram groups after rapidly scaling into a major hub for cyber-enabled fraud. Elliptic estimates Tudou Guarantee processed **more than $12 billion** in transactions, ranking it as the **third-largest illicit marketplace** observed, while noting that some associated services (e.g., gambling operations) may still be active—leaving open whether this is an initial step toward a full shutdown or a pivot away from fraud-related activity. Tudou Guarantee expanded after Telegram actions against similar Telegram-based marketplaces, including **HuiOne Guarantee** and **Xinbi Guarantee**, which—along with Tudou—collectively facilitated **tens of billions of dollars in USDT** flows tied to scam ecosystems. Reporting indicates Tudou hosted vendors selling stolen personal data, money-laundering services, scam infrastructure (fraudulent investment platforms and phishing sites), and tooling that supports impersonation and social engineering (e.g., face swapping, AI voice cloning, and deepfake-enabled video-call deception). Separate context cited in coverage links the broader scam-marketplace ecosystem to enforcement pressure and sanctions activity, including actions targeting Cambodia-linked scam operations and associated entities.
Jun 29, 2026
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026
Researchers and incident responders reported that the **Smishing Triad** is pairing large-scale SMS phishing with **NFC relay** fraud to monetize stolen payment cards. In Slovakia, attackers impersonated health insurer **VšZP** in fraudulent text messages that led victims to phishing domains including `informacie-poistenca[.]com` and `obnovypoistenca[.]com`, where they were prompted to submit personal data, card details, and one-time passwords. CSIRT.SK said the malicious infrastructure was identified in February 2025 and linked the campaign to reusable phishing kits and hosting associated with other suspicious domains. The stolen card data is then reportedly provisioned into **Apple Pay** or **Google Pay** wallets and used in a cash-out method known as **Ghost Tap**, which relays NFC payment transactions to enable fraudulent contactless purchases. ThreatFabric described Ghost Tap as an emerging tactic in which criminals combine wallet provisioning, relay tooling, and malware such as **ZNFC** to bypass the need for a physical card. Investigators also cited Chinese-language traces and Telegram activity tied to the alias **`wangduoyu8`**, reinforcing attribution links between the phishing operations and the broader China-linked smishing ecosystem.
Jul 24, 2026