Hackers Exploit Open Banking for Credential Testing and Phishing

• •Hackers exploited open-banking services to test stolen bank logins for free.
• •Phishing campaigns used legitimate platforms to lend credibility to scams.
• •Group-IB improved fraud detection but did not disclose the affected platform.

Hackers have been using open-banking services to test stolen bank logins without incurring verification costs. According to a report by Group-IB, these criminals exploited a spend-management platform to validate stolen credentials while simultaneously distributing phishing messages. The attackers used legitimate financial services to link bank accounts, allowing them to access account balances and transaction histories. This method enabled them to confirm the validity of stolen logins without initiating payments. Group-IB noted that the platform's systems were abused to send phishing emails impersonating Poshmark, leading to the collection of sensitive personal information. The report highlights a significant monitoring gap in fraud detection, as fraudulent activities can occur before any money is moved. Group-IB has since improved its fraud detection capabilities, reducing the time to block suspicious accounts significantly. However, the exact platform involved and the total losses remain undisclosed.