Metaparasites & the Dark Web: Scammers Turn on Their Own

Sophos research unveiled at Black Hat Europe details a thriving subeconomy of fraud on the cybercrime underground, aimed at Dark Web forum users.

Cybercriminals are often seen as parasites, feeding off a wide swath of victims of every size and stripe. But as it turns out, theyve become targets in their own right, with a host of bottom-feeding metaparasites flocking to Dark Web marketplaces to find their own set of marks.
Its a phenomenon that has the happy side effect of exposing a rich vein of threat intelligence to researchers, including contact and location details of cybercriminals.
Sophos senior threat researcher Matt Wixey took to the stage at Black Hat Europe 2022 to discuss the metaparasite ecosystem, in a session entitled
Scammers Who Scam Scammers, Hackers Who Hack Hackers
. According to research he did with fellow researcher Angela Gunn, the
underground economy
is riddled with a wide variety of fraudsters, who successfully extract millions of dollars per year from their fellow cybercriminals.
The pair examined 12 months of data across three Dark Web forums (Russian-speaking Exploit and XSS, and English-speaking Breach Forums), and uncovered thousands of successful scam efforts.
Its pretty rich pickings, Wixey said. Scammers scammed users of these forums out of about $2.5 million US dollars over the course of 12 months. The amounts per scam can be as little as $2 on up to the low six figures.
The tactics vary, but one of the most common — and the most crude — is a gambit known as the rip and run. This refers to one of two rip variants: A buyer receives goods (an exploit, sensitive data, valid credentials, credit-card numbers, etc.) but doesnt pay for them; or, a seller is paid and never delivers whats been promised. The run portion refers to the scammer disappearing from the marketplace and refusing to answer any enquiries. Consider it a Dark Web version of the dine-and-dash.
There are also plenty of scammers hawking fake goods — such as nonexistent crypto accounts, macro builders that build nothing nefarious, fake data, or databases that are either already publicly available or have previously been leaked.
Some of these can get creative, Wixey explained.
We found a service claiming to be able to bind an .EXE text to a PDF, so that when the victim clicked on the PDF, it would load while in the background, the .EXE would run silently, he said. What the scammer actually did was just sent them back a document with a PDF icon, which wasnt actually a PDF nor did it contain an .EXE. They were hoping that the buyer didnt really know what theyre asking for or how to check it.
Also common are scams where a seller offers legitimate goods that arent quite of the quality that has been advertised — like credit card data claiming to be 30% valid, when in reality only 10% of the cards work. Or the databases are real but being advertised as exclusive while the seller is actually reselling them to multiple takers.
In some cases, fraudsters work in tandem in more of a long-con fashion, he added. Sites tend to be exclusive, which foments a degree of intrinsic trust that they can play upon, according to Wixey.
One will build a rapport with a target and offer to provide a service; theyll then say that they actually know someone else who can do this work much better, whos an expert on the subject, Wixey explained. They will often point them to a
fake forum
that a second person works and operates, which requires some sort of deposit or registration fee. The victim pays the registration fee, and then both scammers just disappear.
The activity has an adverse effect on the use of Dark Web forums — acting as an effective tax on criminal marketplaces, making it more expensive and more dangerous for everyone else, Wixey noted. As such, ironically, many markets are implementing security measures to help curb the tide of fraud.
Forums face several challenges when it comes to putting in safeguards: Theres no recourse to law enforcement or regulatory authorities for one; and its a semianonymous culture, making it difficult to track culprits. So, the anti-fraud controls that have been put in place tend to focus on tracking the activity and issuing warnings.
For instance, some sites offer plug-ins that will check a URL to make sure it links to a verified cybercrime forum, not a fake site where users are defrauded via a bogus joining fee. Others might run a blacklist of confirmed scammer tools and user names. And most have a dedicated arbitration process, where users can file a scam report.
If youve been scammed by another user on the forum, you go to one of these arbitration rooms and you start a new thread and you supply some information, according to Wixey. That may consist of the username and contact details of the alleged scammer, proof of purchase or wallet transfer details, and as many details of the scam — including screenshots and chat logs — as possible.
A moderator reviews the report, they ask for more information as its needed, and they will then tag the accused person and give them somewhere between 12 and 72 hours to respond, depending on the forum, Wixey said. The accused might make restitution, but thats pretty rare. What more commonly happens is that the scammer will dispute the report and claim its due to a misunderstanding of the terms of the sale.
Some just dont respond, and in that case, theyre either temporarily or permanently banned.
Another security option for forum users is the use of a guarantor — a site-verified resource that acts as an escrow account. The money to be exchanged is parked there until the goods or services are confirmed as being legitimate. However, guarantors themselves are often impersonated by fraudsters.
While the research offers a view into the inner workings of an interesting subsliver of the Dark Web world, Wixey also noted that the arbitration process in particular gives researchers a fantastic source of
threat intelligence
.
Forums demand proof when a scam is alleged, and that includes things like screenshots and chat logs — and victims are typically only too happy to oblige, he explained. A minority of them redact that evidence or restrict it, so its only visible to a moderator, but most dont. They will post unredacted screenshots and chat logs, which often contain a treasure trove of cryptocurrency addresses, transaction IDs, email addresses, IP addresses, victim names, source code, and other information. And thats in contrast to most other areas of criminal marketplaces where OpSec is normally pretty good.
Some scam reports also include full screenshots of a persons desktop, including date, time, the weather, the language, and the applications — offering breadcrumbs to location.
In other words, normal precautions go out the window. A Sophos analysis of the most recent 250 scam reports on the three forums found that almost 40% of them included some kind of screenshot; only 8% restricted access to evidence or offered to submit it privately.
In general, scam reports can be useful both for technical intelligence and for strategic intelligence, Wixey concluded.
The big takeaway here is that threat actors dont seem to be immune to deception, social engineering or fraud, he added. In fact, they seem to be as vulnerable as anyone else. Which is kind of interesting because these are exactly the kinds of techniques that theyre using against other users.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Metaparasites & the Dark Web: Scammers Turn on Their Own