#credentialstuffing

Read Time:4 Minute, 5 Second

Fraudsters have found a clever way to turn open banking infrastructure into a free credential-checking service, and the company footing the bill never even realizes it is paying for the privilege. Researchers at Group-IB say they uncovered the scheme while investigating abuse inside a client’s fraud-protection environment, tracing it to a scam-as-a-service operation known as Classiscam.

The target was a spend-management platform that lets users link their bank accounts and cards through an open-banking aggregator. Criminals exploited two separate features of the platform at once: its trusted notification system, which they hijacked to send convincing phishing emails, and its account-linking process, which they used to silently verify whether stolen financial credentials still worked.

Turning Payment Alerts Into Phishing LuresRather than sending phishing emails directly, the attackers added victims as recipients inside the platform itself and let its own automated notification system do the work. Because the resulting messages came from a real, trusted business service, they carried far more legitimacy than a typical spoofed email. The lures claimed that a sale through the online marketplace Poshmark was stuck pending verification, urging recipients to click through and confirm their details. Poshmark had no involvement in the scheme and was simply impersonated as a believable hook.

The fake verification pages that followed were built to harvest an unusually complete set of personal and financial data, including names, card numbers, phone numbers, email and billing addresses, one-time passcodes, and even current card balances. Some versions pushed further, asking for digital wallet or online banking logins, while a countdown timer added urgency by implying victims had only minutes to claim a payout before it expired.

Free Credential Checking, Billed to Someone ElseThe second half of the scheme is the more novel one. When a user links a bank account through an open-banking aggregator, the service performs a login-based check and can return details like account balance and recent transactions. That is a convenience for legitimate customers, but for a criminal testing a batch of stolen card or bank credentials, it is a ready-made verification oracle that confirms which stolen details are still active and worth selling or draining.

Crucially, the account-linking service typically bills the platform operator for each successful check, not the person initiating it. Group-IB estimates each verification costs between $0.30 and $1.00, and modeled that if just 0.5 to 1 percent of a million yearly link attempts were actually fraudulent testing, the platform could be quietly absorbing between $2,500 and $5,000 a year in fees for a service it never knowingly provided to criminals.

Phishing and credential-checking activity ran in parallel, letting stolen one-time passcodes be used almost immediately during account-linking attempts.

Investigators tied the same device fingerprints to both phishing-sending accounts and credential-testing accounts, with one device identity linked to six of each type in a single day.

Attackers used disposable email addresses alongside a mix of VPNs, data-center IP ranges, proxies, and residential IP addresses to spread activity and avoid simple rate-limiting.

A Blind Spot for Traditional Fraud MonitoringGroup-IB notes that this kind of abuse is easy for fraud teams to miss because it doesn’t look like a conventional loss. There is no unauthorized purchase, no chargeback, and no direct account takeover on the platform’s own books. The victims are often marketplace sellers or cardholders who were never customers of the platform in the first place, and the cost shows up buried in an aggregator invoice rather than as a flagged fraud incident.

That makes detection a matter of watching behavior rather than waiting for losses to appear. Group-IB recommends monitoring three specific moments: account creation, the first outbound messages a new account sends, and the first attempt to link a bank account or card. Red flags include disposable email domains, device or location fingerprints that repeat across supposedly unrelated accounts, unusually fast messaging to unfamiliar recipients, and bank-linking attempts that happen almost immediately after signup.

Lessons for Fintech and Platform Security TeamsBeyond behavioral monitoring, Group-IB suggests practical controls: applying extra verification or rate limits to new and low-trust accounts, scanning outbound links before notification emails are sent, and having finance teams periodically reconcile aggregator billing against expected customer volume to catch anomalous spikes. After Group-IB’s involvement, one affected client reportedly cut its time to block fraudulent accounts from several hours down to under a minute, and stopped more than 230 malicious accounts in a single month.

The case is a reminder that fraud prevention increasingly has to account for infrastructure abuse, not just direct theft. As more fintech products plug into shared open-banking rails, the convenience that benefits legitimate customers can just as easily become a quiet subsidy for the criminals testing someone else’s stolen data.

Read Time:4 Minute, 1 Second

Shoppers who use the ASOS mobile app got an unwelcome surprise on the morning of October 6, 2026, when a push notification appeared on their phones under the blunt heading “ASOS HACKED.” The message was not from ASOS marketing — it was planted by an attacker who had found a way into the retailer’s customer-messaging infrastructure, and it set off a scramble inside the company to figure out exactly what had actually been touched.

A Notification Channel Turned Into a MegaphoneAccording to details that have emerged since the incident, the rogue notification was addressed directly to ASOS’s data protection officer and IT staff, demanding they “engage” with the attackers or risk having stolen data leaked. It included a link to a Telegram channel and asserted that the group had “fully compromised” ASOS’s Snowflake environment, the cloud data platform many large retailers use to warehouse customer and sales information.

ASOS has confirmed that something real did happen, but it has been careful to separate confirmed fact from the attacker’s own claims. The company says it is “investigating unauthorised activity involving third-party platforms that we use to communicate with customers” and that it immediately cut off access to the notification system once the rogue message was spotted. Beyond that, ASOS has only confirmed an “unauthorised customer notification” — not a verified breach of its Snowflake instance.

What Data Might Be Exposed — and What Probably Isn’tASOS has said that basic personal details, such as customer names and contact information, may have been accessed through the compromised notification platform. Importantly, the retailer states it does not believe payment card numbers or account passwords were affected by this particular incident. That is a meaningfully different exposure profile than a full database theft would represent, assuming the assessment holds up under further investigation.

Security researchers who reviewed the incident have urged caution about taking the attacker’s framing at face value. A spokesperson from Check Point told reporters that the group behind the message may simply be trying to pressure and embarrass ASOS into contact, rather than demonstrating genuine access to backend systems. Gaining control of a third-party notification tool does not, by itself, prove an attacker also reached ASOS’s cloud data warehouse, payment systems, or core retail network — those would typically require separate footholds.

Not ASOS’s First Rodeo This YearThis is the second publicly disclosed security incident to hit ASOS in a matter of months. Back in late July 2026, the company confirmed that customer accounts had been accessed using login credentials obtained from outside the company — a classic credential-stuffing attack, where criminals reuse username and password combinations leaked from unrelated breaches to try their luck against other sites. That episode, detected on July 28 and confirmed the next day, reportedly exposed names, addresses, phone numbers, dates of birth, and partial card details such as expiration dates and the last four digits of payment cards.

ASOS responded to the July incident by locking affected accounts, forcing password resets, and blocking or reversing suspicious transactions. There is no confirmed link between that earlier credential-stuffing wave and this month’s notification-platform compromise, but the back-to-back nature of the incidents has put additional scrutiny on the retailer’s third-party vendor relationships and its broader security posture.

Market and Customer FalloutThe financial market reaction was swift: ASOS shares reportedly fell more than 11%, with some intraday trading showing declines approaching 13%, as the news of a public “hacked” notification spread faster than the company’s own clarifications. ASOS has stated its website and app continued operating normally throughout, and it has cybersecurity and business continuity insurance in place with a major global insurer, though it says it is too early to gauge any impact on trading performance.

What Customers Should Do NowSecurity teams and consumers alike should treat this as a reminder that a dramatic-looking notification is not, on its own, proof of a specific type of compromise. ASOS customers are advised to:

Avoid clicking the Telegram link referenced in the rogue notification, and ignore any follow-up messages that try to leverage the incident to request passwords or payment information.

Watch official ASOS channels for verified updates rather than relying on screenshots circulating on social media.

Change their ASOS password if they have reused it anywhere else, and enable unique, strong passwords going forward.

Monitor bank and card statements for unusual activity, even though ASOS says payment data is not believed to be affected.

ASOS says it is working with external specialists and relevant authorities to determine the scope of the incident. Until that investigation concludes, the gap between what attackers claim and what has actually been verified remains the central open question — one that will likely shape how seriously regulators and customers treat the retailer’s next update.