A phishing page impersonating your brand is the last thing that gets built. By the time it reaches your customers, four or five transactions on the dark web have already made it possible.
When a security team investigates a phishing page impersonating their organization, the page itself is usually what gets the attention: the logo, the login form, the domain close enough to pass a quick glance. The instinct is to treat it as an incident, report it, request a takedown, and move on. What rarely gets examined is the dark web supply chain that produced it: a sequence of commercial transactions, each handled by a different provider and each generating revenue at its own stage, that was already running before the brand impersonation campaign targeting your organization was conceived. The page is one output. The pipeline behind it is what makes the output renewable, and understanding how the stages connect changes where you look for threats and how early you can see them.
How the dark web converts stolen credentials into impersonation campaigns
The pipeline moves through four stages, each operated by a different set of providers, and each creating a detection opportunity for organizations that know where to look.
The first stage is credential theft. Infostealers, a category of malware that includes families like Lumma, RedLine, Vidar, and Stealc, run quietly on hundreds of thousands of machines at any given time, harvesting saved passwords, browser cookies, autofill data, and active session tokens, then transmitting the results to operators who sell the output on underground marketplaces. When Microsoft and international partners disrupted the Lumma Stealer operation in May 2025, they acted against roughly 2,300 malicious domains and identified more than 394,000 infected machines, a significant intervention against a single family that did not meaningfully reduce the credential supply on competing platforms. Researchers flagged a single aggregated dataset in mid-2026 containing 16 billion stolen credentials compiled primarily from infostealer logs, a figure that reflects standing inventory rather than a peak.
The second stage is distribution and pricing. Stolen credentials flow into dark web marketplaces within hours of theft. Russian Market, the dominant credential marketplace in 2026, prices its inventory by what the buyer can extract: banking credentials with an active session command a premium over recycled email logins. The same marketplaces that sell stolen credentials also sell everything else an operator needs for the next stage.
The third stage is campaign assembly. Phishing-as-a-service platforms sell template libraries that replicate specific brands’ login pages, complete with adversary-in-the-middle capabilities that capture session tokens after MFA completes. Fake storefront kits include product catalogs, checkout flows, and payment processing that operators can rotate without rebuilding the site. Social engineering scripts, employee directories, and organizational charts circulate in the same forums, priced for the help desk impersonation campaigns that turn a phone call into a network compromise. An operator assembling a campaign against your brand does not need to build anything from scratch, only a subscription and a target.
The fourth stage is infrastructure and delivery. Underground hosting providers sell servers configured to resist takedown requests, proxy networks that make malicious traffic appear to originate from ordinary residential connections, and aged domains that have been sitting in registrar inventories for years before an operator activates them. In our 2025 detection data, more than 90% of domains used in brand impersonation attacks were older than 90 days, and more than 40% were older than five years, which means the conventional advice to watch for newly registered domains captures less than a tenth of what actually reaches customers. The BogusBazaar investigation showed what this pipeline produces at industrial scale: a franchise running 75,000 fake storefronts across aged domains, with semi-automated deployment and payment infrastructure that could be rotated independently of the sites it served.
Why takedowns alone do not stop the supply chain
The supply chain’s resilience comes not from any single provider’s sophistication but from the separation between them. The kit developer earns from subscriptions regardless of whether any particular campaign succeeds, the credential marketplace earns from transaction volume regardless of how buyers use what they purchase, and the hosting provider earns from uptime regardless of what sits on the servers. No single participant depends on the others surviving, which means disrupting one node imposes a cost that does not cascade through the rest of the chain.
The evidence has been consistent. When a coordinated law enforcement operation seized over 300 Tycoon 2FA domains in March 2026, CrowdStrike observed campaign volumes return to pre-disruption levels within days, because the kit, the subscriber base, and the credential supply were untouched. The Darcula smishing platform absorbed the takedown of more than 25,000 phishing pages while its 600 operator groups continued launching campaigns through the same underlying toolkit. Each disruption mattered on its own terms. Neither affected the pipeline’s ability to produce new campaigns, because the operations were designed from the beginning to treat individual infrastructure as expendable.
This is why treating brand impersonation as a series of incidents to be resolved individually produces a treadmill effect that most security teams recognize but find difficult to articulate in budget conversations. Each takedown addresses one output. The pipeline that generated it has already moved on, assembling the next campaign from the same components, targeting the same brand, through infrastructure that looks different at the domain level but identical at the architectural level.
Three detection layers that match the supply chain
The pipeline’s four-stage structure creates detection opportunities at every level, and each one catches threats that the others miss.
Dark web monitoring operates at the earliest stage. When employee or customer credentials tied to your organization appear in underground markets or breach compilations, forced password resets can close the window before those credentials are tested against your login pages, used to impersonate your employees in help desk calls, or packaged into the targeting data that makes a phishing lure feel personal rather than generic. This layer also surfaces dark web threat intelligence that informs downstream detection: which brands are being discussed as targets, which kits are being updated with new templates, and which credential batches are being priced for sale. The gap between when credentials are stolen and when they are weaponized can stretch for weeks or months, and that gap is the intervention window. Organizations that are not watching for the exposure discover it only after the downstream campaign has already run.
Infrastructure monitoring catches the assembly and delivery stages. Domain registrations incorporating your brand name, phishing kit deployments that replicate your login page, and hosting configurations that match known campaign patterns are all visible before the first phishing message is sent. The signatures are predictable enough to be actionable: day-old domains with Let’s Encrypt certificates, Cloudflare fronting, and brand strings embedded in the hostname recur across the campaigns documented throughout 2025 and 2026, and monitoring for these patterns provides a window to initiate takedowns before the campaign reaches its intended recipients.
Content-based detection at the point of delivery closes the gap that the other two layers leave open. Attacks hosted on five-year-old domains, on legitimate cloud platforms, or behind cloaking that serves a clean page to scanners and a credential harvesting form to mobile visitors do not trigger domain-based alerts and are not visible in dark web monitoring. Detection that examines what is on the page itself, using computer vision and natural language processing to identify impersonation regardless of where it is hosted or how old the domain is, catches the threats that infrastructure-level monitoring was never designed to see.
The Identity Theft Resource Center’s 2025 analysis quantified why the speed across all three layers matters: 54% of individuals who received a breach notification subsequently experienced an increase in targeted phishing, which means the supply chain converts breach data into campaigns faster than most organizations can warn the people affected.
The Bottom Line
The dark web has organized itself into a four-stage supply chain for brand impersonation: credential theft, distribution and pricing, campaign assembly, and infrastructure delivery. Each stage is operated by a different provider, which is why disrupting one does not stop the others. For organizations whose brands are being borrowed in these campaigns, the practical response is to stop treating each phishing page as an isolated incident and start monitoring the pipeline that produces them. That means watching for credential exposure on the dark web before it is weaponized, tracking domain and kit infrastructure as it is assembled, and detecting impersonation at the content level when it reaches surfaces your customers use. Brand protection platforms that operate across all three layers give security teams visibility into the supply chain itself rather than just the output, which is the difference between responding to the last attack and seeing the next one form.
Key Takeaways
A four-stage pipeline where specialized providers each handle one stage: infostealers harvest credentials, marketplaces price and distribute them, kit developers build phishing pages and fake storefronts, and hosting providers deliver the infrastructure on aged domains. An operator with no technical skill can assemble a complete campaign from off-the-shelf components.
Researchers flagged a single dataset containing 16 billion stolen credentials in mid-2026, compiled primarily from infostealer logs. Microsoft’s disruption of Lumma Stealer alone identified 394,000 infected machines and 2,300 malicious domains. Russian Market, the dominant credential marketplace, lists new credentials within hours of theft.
Each stage is operated by a different provider with a different revenue model, and disrupting one does not cascade through the rest. When 300 Tycoon 2FA domains were seized, campaign volumes returned to baseline within days. The Darcula platform absorbed the takedown of 25,000 pages while its 600 operator groups continued launching campaigns.
Dark web monitoring for credential exposure before it is weaponized. Infrastructure monitoring for domain registrations and kit deployments before campaigns launch. Content-based detection at the point of delivery for attacks on aged domains and legitimate platforms that infrastructure monitoring misses.
It is the one component the supply chain borrows but does not build. The credentials make the lures personal. The kits replicate the login experience. The infrastructure makes the fraud look legitimate. The brand’s name is what makes a customer willing to enter their password on a page they have never visited before.
