Threads: The New Marketplace for Stolen Financial Data

An audacious fraud campaign has emerged on the social network Threads, where perpetrators openly sell stolen user financial data on the platform. SpyCloud researcher Kayla Cardona reported coming across such posts while simply scrolling through her feed. These posts contain cardholders’ names, card numbers, CVV codes, PINs, addresses, passwords, and other personal information, all of which can be used for fraud and cyberattacks.

“These records constitute a complete toolkit for cybercriminal activities, including phishing, fraud, and identity theft,” Cardona observed.

Meta has confirmed awareness of these violations and is working to address them; however, researchers note that the scale of the problem continues to grow. Experts at SpyCloud have identified at least 15 accounts with over 12,000 followers, actively disseminating financial and personal data.

Another security specialist, Aurora Johnson, added that she encountered similar listings on Instagram, suggesting that Meta’s algorithms are inadvertently promoting this type of content. “These accounts have existed for months, and Meta could have implemented automated tools to detect such posts,” Johnson emphasized.

Criminals also use surveys on Threads to verify the validity of stolen cards, determining which cards are successfully accepted. Some posts redirect users to Telegram, where complete data sets are sold for amounts ranging from $3.5 to $65. Yet, following the recent arrest of Telegram’s founder, Pavel Durov, in France and increased efforts to crack down on criminal activities on the platform, fraudsters have begun migrating to Threads and other sites.

This shift highlights Telegram’s declining prominence within criminal circles, as perpetrators actively seek alternative platforms. While certain services tighten their control, others are becoming new venues for fraudsters. Combating data leaks demands not only advanced technology but also constant vigilance—without it, the boundaries between security and threat will continue to blur.