Cybercrime Report 2026 / Evidence explorer

Explore the Work Behind Cybercrime Offers.

Compare selected offers, examine the claims they make and see what recruitment posts ask people to contribute. Each example links to the report’s edited public evidence. These are ways to read advertised arrangements, not a map of a real criminal network.

Who does what?Claims and evidence Human contributions

Brandefense Research Team · 1 November 2026 · Selected public examples

01Roles and responsibilities

Who Does What?

These twelve selected records describe different advertised relationships. Use the filters to compare the work offered, the recipient’s part and the conditions. They were chosen for clear contrasts, not randomly sampled. A role label does not identify a person, team or completed deal.

12 of 12 selected
examples shown

Fraud 4/4Infostealers 6/6Stolen Accounts 2/2

Relationship

Chapter

Search these examples

12 of 12 selected examples shown. Search runs within these edited examples. No personal information is needed.

Download all 12 role examples (CSV)All 12 records, whatever the filters show · CSV · 5.7 KB

Fraud / Software optionsFR-O003

Access and Source Are Separate Options

One suite is advertised through recurring access and a separate source-code purchase.

Inspect the division of work

What the offer provides or seeks: Recurring suite access or a source-code package.
The recipient’s part: The buyer chooses between the advertised options.
Rights, support and conditions: Source ownership, redistribution rights and support duration are unspecified.
What remains unknown: The record does not prove that the suite works.

Inspect edited evidence FR-O003

Fraud / Software optionsFR-O004

A Binary, Source and Later Support

A package separates source code, a one-device executable and later support charges.

Inspect the division of work

What the offer provides or seeks: Separate source and binary packages, with setup help advertised.
The recipient’s part: The post lists requirements for running the package.
Rights, support and conditions: Two months of support are included; later support is billed separately.
What remains unknown: Delivery and bypass claims were not tested.

Inspect edited evidence FR-O004

Fraud / Hosted serviceFR-O007

Browsers Run With the Provider

A dashboard advertises provider-hosted browsers, included templates and separately billed messaging.

Inspect the division of work

What the offer provides or seeks: Hosted browsers and an advertised template library.
The recipient’s part: Customers are told they need not manage those servers.
Rights, support and conditions: Messaging is billed per segment; its segment price is unstated.
What remains unknown: No trial delivery, template count or function was verified.

Inspect edited evidence FR-O007

Fraud / Partner requestsFR-O009

Design and Hosting With a Share Option

A service offers kit design and hosting under ownership or proceeds-sharing wording.

Inspect the division of work

What the offer provides or seeks: Design, hosting, support and updates are advertised.
The recipient’s part: The offer presents ownership or a share of proceeds as options.
Rights, support and conditions: The ownership scope and commission percentage are not defined.
What remains unknown: No participant income, agreement or successful theft is established.

Inspect edited evidence FR-O009

Infostealers / Access transferIS-O005

Access Can Pass to Another Buyer

A premium feature advertises onward sale of machine access together with logs.

Inspect the division of work

What the offer provides or seeks: The licensee is offered a right to sell access onward.
The recipient’s part: The third buyer is said to need no subscription.
Rights, support and conditions: The stated permission belongs to this product; it is not a rule for other panels.
What remains unknown: The transfer mechanism, payment and working access were not tested.

Inspect edited evidence IS-O005

Infostealers / Worker rolesIS-O007

Worker Roles Inside a Panel

A Team tier advertises sub-accounts, worker roles, log access and separate statistics.

Inspect the division of work

What the offer provides or seeks: Different functions assigned to accounts inside the product.
The recipient’s part: Use is subject to stated restrictions. Roles are not observed employees.
Rights, support and conditions: Service problems have remedy promises; prohibited uses have ban-without-refund terms.
What remains unknown: The exact object of the resale restriction is unclear; no remedy or enforcement was tested.

Inspect edited evidence IS-O007

Infostealers / Partner requestsIS-O010

Traffic Seeks a Panel

A short post says its author has traffic and seeks a stealer-panel owner.

Inspect the division of work

What the offer provides or seeks: Traffic is the contribution the author claims to have.
The recipient’s part: A panel owner is the requested counterpart.
Rights, support and conditions: No split, price or volume is stated.
What remains unknown: The fragment does not establish a partnership, delivered traffic or a working panel.

Inspect edited evidence IS-O010

Infostealers / Partner requestsIS-O011

A Proposed Team, Not a Running Service

A project plan seeks traffic and content partners and describes other proposed jobs.

Inspect the division of work

What the offer provides or seeks: A proposed division between traffic, content and other work.
The recipient’s part: Release is conditional on the project becoming stable; donations are requested.
Rights, support and conditions: No participant revenue split or payment term is stated.
What remains unknown: The record is a plan, not evidence of a live team or service.

Inspect edited evidence IS-O011

Infostealers / Log supplyIS-O018

Log Access Bundles Processing Tools

Longer subscription tiers advertise tools for sorting and searching alongside log products.

Inspect the division of work

What the offer provides or seeks: Access to log products with processing tools in higher tiers.
The recipient’s part: Access periods for tools and data have to be read separately.
Rights, support and conditions: The post states source claims for different product lines.
What remains unknown: Log origin, volume, tool contents and delivery were not tested.

Inspect edited evidence IS-O018

Infostealers / Log supplyIS-O028

Raw Logs With No-Refund Wording

A cloud FAQ describes unchecked, unfiltered logs and a no-refund policy.

Inspect the division of work

What the offer provides or seeks: A log subscription and a checker on request are advertised.
The recipient’s part: The FAQ says the supplied logs are not checked or filtered.
Rights, support and conditions: The seller states no refunds; that does not establish actual dispute handling.
What remains unknown: Origin, checking and refund practice were not tested.

Inspect edited evidence IS-O028

Stolen Accounts / Data requestsSC-O011

An Account-Data Intake Request

A buy-side sheet specifies account material and batch-related rates.

Inspect the division of work

What the offer provides or seeks: A requester states what it says it will pay for submitted files.
The recipient’s part: Files are requested with account names, passwords, and cookies or a two-factor secret.
Rights, support and conditions: The sheet includes a submission deadline.
What remains unknown: The accounts’ origin, supplied material and actual payment are unknown.

Inspect edited evidence SC-O011

Stolen Accounts / Data requestsSC-O013

Samples Are Said to Go to an End Buyer

A buy-side post places itself between suppliers and an end buyer.

Inspect the division of work

What the offer provides or seeks: A stated intake request with a buyer-check condition.
The recipient’s part: The post says samples go to a buyer for checking.
Rights, support and conditions: Further intake is promised if the checks pass.
What remains unknown: The buyer, checking result, intake volume and payment are unverified.

Inspect edited evidence SC-O013

Selection and comparison method

Selection uses the existing edited Fraud, Infostealer and Stolen Accounts catalogues. The same four questions were applied to each record. Missing wording is marked unspecified; it is not evidence that a feature is absent. No purchase, seller contact or capability test was performed.

Read the four-offer work and control analysis

Its original four-case comparison is separate from this twelve-record selection.

02Advertised wording

What Does the Claim Establish?

Six examples separate a label from the evidence behind it. Open each card to inspect the recorded wording, the limit and its meaning. One example is a two-sided forum dispute; it is not treated as a seller’s offer or an independent performance test.

Source type · Sale claim XT-E002

0-Day

Recorded wordingA post offers a claimed kernel exploit by copy.

What the record contains

The record contains a sale claim, but no kernel version, CVE or proof.

What it cannot establish

Existence, undisclosed status, delivery and payment were not tested.

Why the distinction matters

The label alone cannot establish an exploit or an early-warning lead.

Inspect edited evidence XT-E002

03Account participation

What Are People Asked to Contribute?

A recruitment amount can describe a deposit, a promised commission or a payment per account or day. These are different commitments. The six selected examples below compare what is requested and what is promised, without turning the amounts into wages, revenue or losses.

Example Requested contributionPromised compensationEntry or work conditionWhat remains unknown

FR-O027

Deposit and Commission

Inspect edited evidence FR-O027

Requested contributionAn account arrangement framed around gaming funds.

Promised compensationA commission is promised.

Entry or work conditionA stated deposit and daily settlement are advertised.

What remains unknownThe commission base, actual settlement and participant payment were not verified.

FR-O028

Corporate-Account Recruitment

Inspect edited evidence FR-O028

Requested contributionCorporate-account providers are sought.

Promised compensationAgent benefits are advertised without an exact commission rate.

Entry or work conditionA deposit is an advertised entry condition.

What remains unknownFull participant obligations, payment and transaction volume are not established.

FR-O030

Work Starts With a Deposit

Inspect edited evidence FR-O030

Requested contributionSavings-account providers are sought.

Promised compensationHigh commissions are promised without a named rate.

Entry or work conditionThe post says work starts with an initial deposit.

What remains unknownThe commission base, legitimacy and actual account activity are unverified.

FR-O031

Percentage-Based Compensation

Inspect edited evidence FR-O031

Requested contributionAccount providers with stated account-class and limit requirements are sought.

Promised compensationA percentage commission is promised.

Entry or work conditionThe percentage calculation base is unspecified.

What remains unknownThe promise is not observed earnings or an account sale price.

FR-O032

Account Rental and Expenses

Inspect edited evidence FR-O032

Requested contributionAn account-rental arrangement for a stated betting operation.

Promised compensationPayment per account and travel, meals and accommodation are promised.

Entry or work conditionNo rental duration is stated.

What remains unknownNo travel, payment or use of an account was verified.

FR-O035

An In-Person Withdrawal Task

Inspect edited evidence FR-O035

Requested contributionPeople are recruited for in-person bank cash withdrawals.

Promised compensationA fixed daily payment is promised.

Entry or work conditionThe post specifies bank-relationship requirements.

What remains unknownNo participant, withdrawal, payment or campaign revenue is established.

The deposit examples make an entry condition visible while leaving compensation partly open. The commission example leaves its calculation base unstated. Together, these records show why an amount needs its contractual role before it can be interpreted.

The rental example promises participant expenses without giving a rental duration. The withdrawal example names an in-person task and a daily-payment promise. These requests describe different contributions; they cannot be joined into one participant’s journey.

These are selected advertised conditions, not actual employment outcomes. The comparison does not establish that a person accepted, travelled, paid a deposit or received money. An account-specific conclusion needs its own authorized evidence.

Read the account-participation investigation Read how a recruitment pitch repeats across records

Take it back to your team

Connect the Evidence to a Conversation.

The employee poster collection now includes short fictional practice situations, discussion questions and facilitator sheets. The research examples supply context; the exercises are not observed incidents or tested training results.

Open the poster discussion kit →

Pause Before You Approve

A Familiar Name Is Not Proof

Your Account Is More Than a Password