Group-IB's Fraud Protection team says Classiscam-linked criminals turned a legitimate spend-management platform into fraud infrastructure rather than a victim. In research published 20 October and titled "The Checker You Pay For", analysts Yuan Huang and Alexander Grabko describe two linked behaviours. From late April 2026 the actors created accounts and used the platform's payment-notification and email rails to send Poshmark-impersonation messages — Poshmark itself was not compromised — whose fake verification pages harvested names, card details, phone numbers, addresses, one-time passcodes, card balances and payment-wallet access. The harvested bank and card credentials were then fed into the platform's open-banking account-linking flow, where a successful link confirmed the credentials were valid and the account funded; because the third-party aggregator billed the platform an estimated US$0.30–1.00 per link, the checking cost the criminals nothing. Shared device identifiers tied the phishing accounts to the card-testing accounts. After Group-IB's engagement, the client's fraudulent-account blocking time fell from several hours to under a minute and more than 230 fraudulent accounts were stopped in May 2026. Why it matters: open-banking linking APIs have become a ready-made, billable credential oracle for fraud crews.

• Source article