The business of “a la carte” scams: this is how services are sold and rented to deceive Argentines

The phenomenon is part of a broader transformation of cybercrime in Latin Americawhere developers and criminal groups create platforms that offer phishing pages and malware (malicious software) to access to already infected computers and telephone fraud systems with artificial intelligence. Other criminals can rent, buy or use these capabilities without having to develop them from scratch. It is what is known as “Crime as a service.”

This is how he put it Anton DolgalevRussian hacker and researcher at the cybersecurity company Group-IB, who presented this Wednesday at the 22nd edition of the hacker conference Eco party an investigation into what is defined as the industrialization of the Everything-as-a-Service model, or “everything as a service”, within Latin American cybercrime.

His talk was the first after the official opening of this edition of Ekoparty, and it went to a full room.

The work, which studied six categories of criminal services that operate or target different markets in the region, He gave his name and surname to several scams that circulate daily.

In his presentation on the main stage of the Buenos Aires Convention Center, Dolgalev showed how Argentina appeared several times in his research. In the sample analyzed from a platform known as Classiscamthe country represented 14.3% of Latin American operations trackedtied with Chile.

Researchers from the cybersecurity company founded in Russia also detected pages and domains prepared to impersonate locally known services, among them Mercado Libre and Mercado Pago. It is worth clarifying, the presence of these platforms does not imply a vulnerability in their systems, but rather the cost of being very great: criminals they use them as part of the deception because they are well-known and common services for Argentine users.

Dolgalev spoke with Clarion to explain how these scams operate, with a logic that is repeated in other countries, with banks, payment methods, currencies and platforms specific to each market.

One of the platforms studied is called Classiscamwhich offers fraudulent pages prepared for different countries, services and currencies. The scheme allows the work to be divided between those who develop and maintain the infrastructure and those who go out to look for victims.

“One of the schemes described in the talk targets online sellers. A criminal approaches as a supposed buyer and claims to have paid, using a fake receipt or a fraudulent payment link. After the seller is convinced to enter sensitive information on a page presented as part of the transaction,” Dolgalev explained to this medium.

There appears one of the central points of the investigation. The scammer who talks to the victim you don’t need to know how to create the site which he will use to deceive her.

“The person carrying out the scam does not need to develop the page: the platform provides it to them. That division of labor is central. Someone with little technical knowledge can join an existing service, use its tools and share profits with your operators”he explained.

Among other tools, the system uses bot de Telegram that allow you to generate fraudulent pages and select the service you want to imitate and the currency that will appear during the operation. Participants can thus concentrate on finding potential victims and maintaining the conversation with them. Telegram has already been under scrutiny on more than one occasion for facilitating the marketing of personal data and tools for cybercriminals.

“The local link includes well-known marketplace and payment brands, such as Mercado Libre and Mercado Pago. A Telegram bot provides fraudulent pages with options to choose the service to imitate and the currency. “The participants find potential victims and take charge of the conversation,” the researcher added.

The model was not born in Latin America nor is it exclusive to the region and has been exploited for several years: ransomware, a program that steals data to extort its victims, had a golden luster that began in the pandemic and functioned as a prolific crime-as-a-service business. The particularity lies in how these tools are modified to fit the market of each country.

“The underlying business models exist internationally. Sell access, rent malware and operating criminal affiliate schemes are not exclusively Latin American phenomena,” Dolgalev explained. “The regional aspect lies in how these services are developed and adapted to local companies, financial systems and daily transactions,” he added.

The research found examples in different countries. BraZetsu searches computers Brazil information linked to banking operations and business software. Balonx Sistema targets financial institutions mexican through phishing pages adapted to the local market. Classiscam It does the same with services and currencies of different countries, with Argentina at the head.

“Latin America has both developers who offer criminal services and clients who use them. Some build and maintain the infrastructure, others can rent it and operate without advanced technical knowledge,” he summarized.

The scheme increasingly resembles that of a conventional software business, but criminal. There are suppliers, customers, affiliates, permission systems, automated payments and tools receiving new features. One actor develops the infrastructure, another finds victims and another can contribute malware or compromised access.

How could it not be otherwise in 2026, artificial intelligence is also beginning to be part of that offer. Among the cases studied is CallFlow, a telephone fraud in development that combines a language model, voice recognition and synthetic voice, with the capacity to handle up to 30 calls simultaneously.

The possibility of integrating these technologies allows us to automate and scale tasks that previously required human operators working individually.

Argentina also appears from another place. Outside of the investigation presented at Ekoparty, Dolgalev recalled the case of iServera platform phishing whose administrator was Argentine.

The service allowed fake pages to be created to obtain credentials and unlock codes for stolen phones. According to Group-IB, the investigation led to Operation Kaerb in 2024, coordinated by Europol and Ameripol, in which the Argentine administrator of the platform was arrested.

The researchers reported approximately 483,000 victims worldwide. The figure is global and does not correspond to Argentine victims.

For Dolgalev, both cases show both sides of the phenomenon. “Classiscam shows Argentina as a market targeted for criminal services, while iServer offers a documented case of an Argentine administrator who provided that type of service internationally.”

Criminal services that offer fake pages, infrastructure and ready-to-use tools complete a model in which much of the technical work can be bought or rented.

For the fraudster, setting up a cybercriminal operation is increasingly similar to hiring a service.

The talk, to a full room, was a good start to the 22nd edition of Ekoparty, which this year calls for “embracing chaos” based on the new technologies that are shaping the current world, crossed by artificial intelligence.