Vietnam-Based Cybercrime Network Enables Fraudulent Account Signups at Scale

A sprawling cybercrime ecosystem rooted in Vietnam has been linked to large-scale fraudulent account registration campaigns targeting service providers and online platforms worldwide.

Researchers traced this activity to an infrastructure cluster internally designated O-UNC-036, which uses disposable email addresses and automated bots to manufacture fake digital identities at an alarming scale.​

Fraudulent online accounts are far more than a digital nuisance. Criminals use them as a gateway to commit financial crimes ranging from spam and phishing to devastating interpersonal scams known as “pig butchering.”

These schemes draw victims into cryptocurrency fraud, romance scams, and sextortion operations, run out of organized criminal compounds in Southeast Asia — particularly near the borders of China, Myanmar, Thailand, and Cambodia.​

Okta analysts identified a flood of suspicious account registrations linked to multiple disposable email domains, which became the critical thread connecting this activity to a broader Vietnam-based fraud marketplace.

Working alongside researchers from the University of Cyprus, the team traced O-UNC-036 to dozens of online storefronts openly trading in hijacked and synthetically created accounts.

Their March 2026 investigation revealed a structured Cybercrime-as-a-Service (CaaS) ecosystem selling fraud tools, session tokens, residential proxies, and anti-detect browsers to anyone willing to pay.​

The financial damage from this operation is serious. In one particularly costly scheme, fraudsters automate the creation of fake accounts to trigger SMS messages to premium-rate phone numbers — a technique known as SMS pumping, or International Revenue Sharing Fraud (IRSF).

Service providers that use SMS to verify new registrations or send MFA security codes are left footing the bill for thousands of artificially generated messages.

The United Nations Office on Drugs and Crime flagged in an April 2025 report that this underground market now features merchants specializing in fraud kits, stolen data, malware, AI-driven tools, and money laundering services used to target victims globally.​

The demand for fake accounts spans major platforms, including LinkedIn, Instagram, Facebook, and TikTok, where bad actors use them to run scams, manipulate reviews, and abuse free trials.

This activity gradually erodes user trust and degrades the experience for legitimate customers across every platform it touches.​

The CaaS Infrastructure Powering the Fraud

At the heart of this ecosystem is a Vietnam-based web design company operating under CMSNT[.]co, which sells website templates marketed toward “online money-making ventures”.

These cookie-cutter templates have been adopted — and in some cases leaked and used without license — by dozens of fraud storefronts selling account products, phone farms, social media engagement inflation services, and anti-detect browsers.​

One site built on these templates is Via17[.]com, which openly sells compromised social media accounts — referred to as “vias” — likely obtained through brute-force attacks or logs collected by infostealer malware.

These logs typically contain login credentials, payment card details, cryptocurrency wallet data, and personal information pulled from infected devices.

Via17[.]com also offers session tokens, which allow continued access to accounts without a password, along with recovery email addresses and two-factor authentication codes.​

Disposable email services are the glue holding this infrastructure together. Platforms like mailclone[.]site and temp-mail[.]io let fraudsters generate email addresses valid for as little as ten minutes — just long enough to receive a verification code and complete a registration.

Via17[.]com alone recommends eleven such services to its buyers, showing just how automated and systematic this fraud pipeline has become.​

Effectively defending against fraudulent signups requires a layered approach. Organizations should deploy dedicated bot detection that challenges suspicious registrations with CAPTCHA and apply tighter rate limits on signup attempts from individual IP addresses.

Blocking known disposable email domains and enforcing email verification for new accounts reduces the number of fake accounts that slip through.

For high-value services, identity proofing with third-party verification providers adds an important layer of protection.

Behavioral analysis tools that flag scripted or high-volume registration patterns help detect attacks in progress, while restricting access from high-risk anonymizers and proxies limits attacker reach before they even hit a registration page.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.