Carding Bot

A carding bot is used by adversaries to illegally validate stolen credit or debit card details without the permission of the payment card owner.

Show Techniques

Hide Techniques

Resource Development 3 Tactics

Payment Detail Acquisition

• Data Dumps
• Malware
• Person in the Middle
• Social Engineering

Infrastructure Acquisition

• Botnet
• Command & Control
• Proxies
• Supply Chain Compromise

Tool Development

• Development of Tools
• Testing of Tools
• Campaign Reuse

Reconnaissance 2 Tactics

Specific Target

• Technical Reconnaissance

Loose Target

• Technical Reconnaissance

Defence Bypass 4 Tactics

Mitigation Bypass

• CAPTCHA Farm
• Automated CAPTCHA Bypass
• MFA Bypass
• Token Bypass
• Cookie Abuse
• Credential Pinning

Human Emulation

• User Agent Spoofing
• Device Fingerprint Emulation

Proxying

• Botnet
• User Agent Spoofing
• IP Rotation

Smokescreening

• Volumetric Traffic Disguise
• Target Diversification

Attack Execution 3 Tactics

Payment Detail Abuse

• Credit/Debit Card Abuse

Fake Interaction

• Overlay Attack

Stock Purchase

• Automated Purchase

Actions on the Objective 1 Tactics

Exfiltration

• Payment Detail Dumping
• Automated Advertisement of Stock

Post-Attack 1 Tactics

Sale

• Information Brokerage
• Automated Sale
• Manual Sale