What Is STYX Market? The Financial-Fraud Marketplace Explained

STYX Market is a dark web marketplace built for one purpose: financial crime. Documented by the threat-intelligence firm Resecurity in 2023, it specializes in money laundering, identity theft, and fraud, selling stolen bank logins, card data, cash-out services, fake IDs, banking malware, and the tools criminals use to bypass two-factor authentication. It is not a general contraband bazaar; it is a purpose-built "fraud-as-a-service" platform. This guide explains what STYX Market is, everything it sells, how its operating model works, where it sits in the wider fraud economy, and, most importantly, how banks, businesses, and individuals can defend against it.

Updated: August 2026. A defensive, threat-intelligence and law-enforcement overview for security teams, financial institutions, and consumers. It contains no marketplace addresses, login pages, or access instructions, and does not endorse or assist any illegal activity.

The quick answer

Here is the whole picture in one table; the rest of this guide expands each row.

The one line to remember: STYX Market packages financial crime as a product, from the stolen credential to the laundered cash.

What is STYX Market?

STYX Market is a specialized dark web marketplace focused on the money side of cybercrime. Where a market like BriansClub sold raw card data and Russian Market sells infostealer logs, STYX bundles the full financial-fraud toolkit: the stolen accounts, the malware and bots to abuse them, the fake documents to defeat identity checks, and the cash-out and laundering services to turn the proceeds into clean money. It was uncovered and named by Resecurity, whose April 2023 report remains the authoritative account.

It belongs to the ecosystem we map in our top dark web marketplaces roundup, and like other hidden services it operates over anonymity networks, explained in dark web vs darknet vs Tor. What sets STYX apart is its focus: it is a one-stop shop for financial fraud, organized like a real e-commerce platform.

Is STYX the same as River Styx Market? A quick disambiguation

Because searches for "Styx Market" collide with a real business, it is worth stating plainly: the two are unrelated.

If your search was about photos, reviews, or opening hours, you want the Ohio grocery store, not this. Everything below concerns the criminal marketplace only.

A short history of STYX Market

STYX did not appear overnight. Resecurity's analysts traced its development through the underground before it opened its doors.

The timing was favorable to STYX's positioning. It launched as older fraud and credential markets were being disrupted or retired, giving it room to market itself as a specialized platform for financial crime.

What STYX Market sells: the full catalog

STYX's inventory reads like a menu for every stage of a fraud operation. Here is the master list, grouped by function.

No single category is unique to STYX; what is notable is the completeness. A buyer can source a stolen login, a bot to break its 2FA, a fake ID to pass a verification check, and a laundering service to move the proceeds, all in one place. The next sections break down the clusters that matter most for defenders.

Stolen financial data and accounts

The raw material of the market is compromised financial access.

This kind of data can originate upstream in infostealer infections, phishing, payment-card theft, and breaches, which is why STYX is best understood as a monetization layer sitting on top of the wider infostealer economy. Logs sold on credential markets such as Russian Market can feed the same downstream fraud ecosystem, although public reporting does not establish that every STYX listing originates there. For how this stolen data is priced across the underground, see our dark web data pricing breakdown.

Fraud tools and services

Beyond data, STYX sells the instruments that make the data usable.

• OTP bots and 2FA/SMS bypass automate the theft of one-time passcodes, the single biggest obstacle between a stolen password and a drained account.
• Banking malware and trojans hijack sessions, inject fake login overlays, and intercept credentials on victim devices.
• DDoS-for-hire provides denial-of-service attacks, sometimes as extortion, sometimes as a distraction during fraud.
• SIM cards support SIM-swap and phone-verification fraud, undermining SMS-based security.

The presence of these tools is what elevates STYX from a data shop to a fraud platform. It does not just sell you a stolen identity; it sells you the means to weaponize it.

How OTP bots defeat two-factor authentication

Of everything STYX sells, OTP-bypass tooling is especially important for defenders to understand because it targets a major control organizations rely on: two-factor authentication.

The mechanism, documented by researchers including Kaspersky and others, is social engineering wrapped in automation. It works like this:

1. The attacker already has your username and password, typically from an infostealer log or phishing.
2. They enter your credentials on the real site, which triggers a legitimate one-time passcode to your phone.
3. A rented bot immediately calls you, posing as your bank's fraud or security desk, and asks you to confirm the code it just sent.
4. You read the real code aloud; the bot relays it to the attacker in seconds, who completes the login.

A parallel technique, adversary-in-the-middle (AiTM) phishing, uses a proxy page to capture both the password and the live session token in real time. Either way, the SMS or voice one-time passcode, once considered strong, becomes a speed bump. These bots are sold like legitimate software, with pricing tiers, support channels, and refund policies for failed attempts. The defensive answer is not a better OTP; it is phishing-resistant authentication, covered in the defense sections below.

Money laundering and cash-out

The final stage of any fraud is turning stolen value into spendable money, and laundering is one of STYX's specialities.

Money mules are the human infrastructure of this stage. Criminals recruit people, often through fake job offers or romance scams, to receive and forward illicit funds, obscuring the path back to the fraud. Law-enforcement and financial-crime agencies routinely warn about mule recruitment through fake jobs, romance scams, and other social-engineering schemes, while instant payment rails can make stolen funds harder to stop once they begin moving. Understanding this stage matters because it is where fraud becomes traceable, and therefore where a lot of detection and law enforcement focuses.

How STYX Market operates: the fraud-as-a-service model

STYX is notable less for what it sells than for how professionally it sells it. Resecurity documented an operating model that mirrors legitimate e-commerce.

• Built-in escrow. An escrow module brokers deals between buyers and sellers, holding funds until both sides perform, the same trust mechanism legitimate marketplaces use, repurposed for crime. Reporting indicates the escrow supports very high-value single transactions.
• Trusted Sellers. A curated section highlights vendors vetted by the administrators, a reputation system that reassures buyers in a market full of scammers.
• Telegram and bots. Actors are connected through Telegram contacts and automated bots, partly as a vetting and security measure; some listings are deliberately terse.
• Cryptocurrency payments. The market accepts a range of cryptocurrencies, giving it pseudonymous settlement.
• Vetted membership. Access is gated by verification, keeping out casual browsers and researchers.

This is the real story of STYX: the platformization of fraud. It applies the conveniences of modern commerce, escrow, reviews, support, curation, to crime, lowering the skill barrier so that buyers without technical ability can still commit sophisticated fraud.

Fraud-as-a-service: why the model matters

The "as-a-service" shift is the reason markets like STYX are dangerous out of proportion to their size. In the old model, a fraudster needed technical skill to steal data, write malware, and launder money. STYX unbundles those steps and sells each as a service, so the buyer only needs money and intent.

The consequence for defenders is scale: the pool of people capable of attacking your customers expands from skilled criminals to anyone with a crypto balance. This is the same dynamic driving ransomware-as-a-service, applied to financial fraud.

Where STYX fits in the fraud supply chain

STYX does not operate alone; it is one link in a chain that starts with a malware infection and ends with laundered cash.

1. Harvest. Infostealer malware collects credentials, cookies, and card data from infected devices.
2. Wholesale. Log markets like Russian Market sell those raw logs in bulk.
3. Tooling and monetization. STYX supplies the OTP bots, banking malware, fake IDs, and stolen accounts needed to exploit them.
4. Cash-out. STYX's laundering and cash-out services convert the proceeds into clean money.

Seeing the whole chain is what makes defense possible: you can break it at the harvest stage (stop the infostealer), at the exploitation stage (defeat the OTP bot with phishing-resistant MFA), or at the cash-out stage (fraud and mule detection). STYX is strongest in the middle and end of that chain, which is exactly where financial institutions and their customers feel it.

STYX Market vs other fraud markets

STYX is best understood by contrast with the markets it succeeded and sits beside.

We track the takedowns of the older markets in dark web marketplace takedowns. STYX represents the current stage of this evolution: not a single-product shop, but a full-service financial-crime platform.

Is STYX Market real or fake?

This is a common search, and the honest answer has two parts.

First, STYX is a real, functioning marketplace, not a fictional bogeyman. Resecurity's research documented a live platform with real vendors, escrow, and services. So "is it real" is, unfortunately, yes.

Second, and more important, that does not make it safe to touch:

• Its core offerings facilitate criminal activity. Buying or using stolen credentials, card data, forged identities, laundering services, or fraud tooling can violate criminal law. Exact offenses and penalties vary by jurisdiction.
• Dark markets are high-fraud environments. Buyers are frequently scammed by other criminals, and markets routinely exit-scam, vanishing with user funds, as the Abacus market did in 2025.
• "Login" and "real or fake" curiosity leads to traps. Fake mirrors and "verified link" directories that impersonate the market are overwhelmingly phishing and malware aimed at would-be visitors.
• Casual access is not research. Legitimate threat-intelligence firms may examine criminal platforms using controlled, authorized research methods, but that is very different from visiting a marketplace out of curiosity or attempting to transact.

So the safe answer to "real or fake" is: real enough to hurt you, and not worth going near.

Who is at risk from STYX Market

The harm from a market like STYX lands on several groups at once.

The common thread is that STYX turns a security failure somewhere upstream, a phished employee, an infected customer device, a weak authentication flow, into direct financial loss. That is why defense has to span the whole chain.

How to defend against STYX-driven fraud: consumers

You cannot shut down STYX, but you can make its products fail against you.

• Use phishing-resistant MFA (passkeys or FIDO2 security keys) wherever offered; these cannot be relayed by an OTP bot because they are bound to the real site.
• Never share a one-time code with an unsolicited caller. Banks and payment providers routinely warn customers not to disclose verification codes; an unexpected caller asking for one should be treated as a fraud attempt.
• Be alert to money-mule recruitment. Any "job" or relationship that asks you to receive and forward money is laundering; it is a crime even if you are duped.
• Freeze your credit and enable transaction alerts, and review statements promptly.
• Report identity theft and fraud through official channels like the FTC's IdentityTheft.gov, your bank, and the FBI IC3, never through any underground service.

How to defend against STYX-driven fraud: banks and enterprises

For financial institutions and any business handling accounts or payments, the goal is to neutralize the tools STYX sells.

Regulators increasingly require stronger authentication in defined contexts. PCI DSS and NYDFS both include MFA requirements for covered access scenarios, although they do not universally mandate FIDO2 or passkeys. Phishing-resistant MFA is the stronger defensive choice where it is practical. When an incident does occur, a tested incident response plan determines how much damage it causes.

Warning signs of STYX-style fraud in progress

Because the tools STYX sells follow predictable patterns, the attacks they power leave recognizable signs. Knowing them helps both individuals and fraud teams catch an attack mid-flight.

For individuals, treat these as immediate red flags:

• An unexpected call about "fraud" right after you get a login code. The sequence, code arrives, then someone calls asking you to confirm it, is the OTP-bot script almost verbatim.
• Pressure and urgency. Real banks give you time; scam callers manufacture panic so you act before thinking.
• A "job" or contact that involves receiving and forwarding money. That is mule recruitment, regardless of how legitimate it looks.
• Login alerts, password-reset emails, or small "test" charges you did not initiate. These often precede a full account takeover.

For fraud and security teams, the telltale patterns are different:

The point is not to memorize a criminal script but to instrument for its footprints. Detection at any one of these moments can stop the fraud before the cash-out stage, which is the hardest to reverse.

A fraud-readiness checklist for financial institutions

For banks, fintechs, and any business that moves money, resilience against a market like STYX comes down to a repeatable set of controls. Use this as a starting checklist.

Each unanswered question is an opening the fraud-as-a-service economy is built to exploit. The institutions that fare best treat this as continuous validation, not an annual box-check.

Why this matters for security teams

STYX Market is a snapshot of where cybercrime is heading: specialized, productized, and low-barrier. The attacker draining your customer's account may have no technical skill at all; they simply assembled a fraud from parts bought on a platform. Defending against that means assuming your credentials are already for sale somewhere and asking whether your controls survive the tools that abuse them. Our dark web statistics roundup shows how much stolen financial data circulates and how quickly.

That reality is why testing has to model a real, well-equipped fraudster, not a hypothetical one. DeepStrike's penetration testing is manual-first and adversary-realistic: our team probes the authentication and payment paths that OTP bots, stolen accounts, and banking malware target, validates whether your MFA and fraud controls actually hold, and delivers the concrete fixes before your customers' data funds someone's cash-out. For US-based organizations, see our US penetration testing services.

FAQ

What is STYX Market on the dark web?

STYX Market is a dark web marketplace specializing in financial fraud, money laundering, and identity theft. Discovered by Resecurity in 2023, it sells stolen bank logins and card data, fake IDs, SIM cards, banking malware, DDoS-for-hire, 2FA-bypass tools, and cash-out and laundering services, essentially a full toolkit for financial crime.

Is STYX Market the same as River Styx Market?

No. This article is about the dark web financial-fraud marketplace named STYX. River Styx Market is an unrelated, legitimate grocery store in River Styx, Ohio. If you were searching for the store's hours, photos, or reviews, that is a different business with no connection to cybercrime.

What does STYX Market sell?

STYX sells stolen financial data (card data, bank logins), compromised crypto and e-commerce accounts, fake and stolen ID documents, SIM cards, banking malware, DDoS-for-hire, OTP bots that bypass two-factor authentication, and money-laundering and cash-out services that convert stolen funds into clean money.

When did STYX Market launch and who discovered it?

STYX opened on January 19, 2023, after Resecurity analysts had observed mentions of the project during 2022. Resecurity published the defining report on the marketplace in April 2023, which remains the authoritative source for its structure and offerings.

Is STYX Market real or fake?

STYX is a real, functioning marketplace, not a myth. But that does not make it safe: everything on it is criminal, dark markets frequently scam their own buyers or exit-scam entirely, and fake mirrors are phishing traps. Legitimate researchers study it through controlled methods, never by casually accessing it.

How do OTP bots on markets like STYX bypass 2FA?

OTP bots exploit the human step in SMS or voice two-factor authentication. The attacker uses stolen credentials to trigger a real code, then a bot calls the victim posing as their bank and asks them to confirm it. The victim reads the code aloud, and the bot relays it to the attacker instantly.

How do criminals launder money through markets like STYX?

STYX offers cash-out shops that move stolen funds through PayPal and Apple Pay business accounts with merchant terminals, plus dedicated laundering services from around $15,000. Money mules, people recruited to receive and forward funds, break the trail, and cryptocurrency layering adds further distance from the original fraud.

How can I protect myself from the fraud STYX enables?

Use phishing-resistant MFA like passkeys, never read a one-time code to anyone who calls you, and refuse any arrangement that asks you to move money for others. Freeze your credit, enable transaction alerts, and report fraud through your bank and the FTC, not through any underground service.

Is STYX Market still active in 2026?

As of this writing, STYX is reported to remain active as a specialized financial-crime marketplace, with no confirmed law-enforcement takedown in credible reporting. That said, dark web markets are volatile, they change domains, get seized, or exit-scam without warning, so any external claim about its live status should be treated cautiously.