Tajin Group has bought and sold at least 100 Telegram usernames, along with multiple anonymous virtual phone numbers, through the Fragment marketplace. No SIM cards, no fixed identity, and several handles that can hang off a single account. It is a small detail in a long report, and it is the one that explains why this kind of fraud is getting harder to follow.
Recorded Future's Insikt Group has published a profile of Tajin Group, a Chinese-speaking crew that sells phishing, payment card theft and money laundering services as a third-party vendor on Telegram-based guarantee marketplaces. The name translates roughly as "stepping on gold".
Escrow made the dark web optional
Guarantee marketplaces are escrow platforms that live on Telegram and hold funds between criminal buyers and sellers. Insikt Group notes they have grown into a viable alternative to Chinese-language dark web markets since Huione Guarantee's model gained prominence around 2021, and that each platform typically carries hundreds to thousands of third-party vendors. The effect is a force multiplier: recruitment, resource sharing and crowdsourced information in one place, including for crimes that require somebody physically present.
Tajin Group operated on Dabai Guarantee from May 2025 to April 2026, then pivoted to Xinbi Guarantee around May 2026. Insikt Group treats that move as a finding in itself, because it shows third-party vendors do not necessarily stay loyal to a single platform. The marketplaces enforce a rule that a vendor may only use one of them at a time, and Tajin observed it, ceasing activity on Dabai before opening on Xinbi. Criminal marketplaces with etiquette, and vendors who keep to it, is a more organised picture than the phrase "underground forum" suggests.
Card testing with a named venue
The group's actual trade is phishing, carding, payment fraud and laundering, aimed principally at mainland Chinese citizens and Chinese banks. Insikt Group reports it has listed Bank Identification Numbers for payment cards from twelve countries, and that it conducts extensive testing involving payment cards belonging to multiple countries on the financial platforms CCAvenue and Geidea.
It also advertises for partners, and the shopping list is specific. Tajin Group seeks direct payment channels that accept UnionPay, VISA, Mastercard, JCB and Apple Pay, access to 2D and 3D payment gateways, and routes through UAE dirhams and electronic gift cards. Alongside that, the group has aired its own difficulties on the marketplace, including intense competition and trust issues with previous payment card suppliers. That kind of material only exists because these platforms are semi-public.
Two things a fraud team can use
The report is intelligence rather than a patch, but it hands defenders two concrete things. The first is a venue. CCAvenue and Geidea are named as the platforms where this group tests cards, which is somewhere specific to look rather than a general warning. The second is a caveat about attribution: when a vendor's Telegram account rides on a rented virtual number and a rotating username bought from a broker, a phone number is no longer a reliable thread to pull.
Insikt Group's wider assessment is about incentive rather than this one crew. Tajin is a single vendor among many, and the potential gains in the global payment industry are likely to encourage other groups on these marketplaces to replicate its tactics, techniques and procedures on a global scale. The exposure lands on banks, fund transfer service providers, cryptocurrency exchanges and individuals vulnerable to scam and fraud campaigns.
It matches a shift we covered earlier this month, when fraud shops scattered onto Telegram after a run of takedowns. Our China country profile tracks the state-linked half of this picture. The guarantee marketplaces are the other half, and they are neither hidden nor especially hard to join.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.