The US has seized a cybercriminal site called “PopeyeTools” for selling stolen credit card information and hacking tools.
The Justice Department also unsealed charges against three suspects for running the site, which has been around since 2016 and sold the personal information of at least 227,000 individuals.
Instead of being hosted on the dark web, PopeyeTools was available on the open internet at popeyetools.com and other domains. According to federal investigators, it operated as a marketplace “dedicated to selling sensitive financial data and other illicit goods and tools of cybercrime to thousands of users around the world, including users associated with ransomware activity.”
This included selling people’s bank account details, credit card information, and debit card numbers. “For instance, the ‘Live Fullz’ section offered unauthorized payment card data and PII [personally identifiable information] for cards that were marketed as ‘live’— i.e., could be used to conduct fraudulent transactions—at a price of approximately $30 per card,” the DOJ says.
The site also promises to refund scammers who bought stolen credit card information that no longer worked. In return, PopeyeTools generated at least $1.7 million in revenue from users, who had to create an account to access the site.
Two of the charged suspects, 25-year-old Abdul Ghaffar and 35-year-old Abdul Sami, reside in Pakistan. The other suspect, 37-year-old Javed Mirza, is believed to be in Afghanistan.
Recommended by Our Editors
According to a court document, the FBI’s Buffalo cybercrimes task force has been investigating the site since 2018. Investigators began to tie the suspects to PopeyeTools after FBI agents discovered one of the domains was registered to Sami’s apparent Gmail address. Using law enforcement requests, investigators then gained access to online accounts the suspects were using to help them host the site.
The Justice Department didn’t respond to a request for comment about the whereabouts of the three suspects and whether they’ve been arrested. In the meantime, the FBI has placed a banner on popeyetools.com that says law enforcement has taken over the site. The US has also seized $283,000 from a cryptocurrency account that belonged to Sami.
Like What You’re Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
