Inside Tajin Group’s Phishing and Money Laundering Network

Immediate Actions

Key Takeaways

• Tajin Group deposited 208,848 USDT on Xinbi Guarantee, indicating large-scale operations.
• Group purchased 100+ Telegram usernames and anonymous numbers via Fragment Market for OPSEC.
• Two TON wallet addresses linked to Tajin Group have funds frozen and labeled SCAM.
• Group impersonates legitimate UAE businesses on CCAvenue to mask money laundering activities.
• Banned BIN prefixes from 12 countries indicate cards with 3D Secure enforcement are avoided.

Attack Chain

1. Initial Access: Phishing campaigns and social engineering target mainland Chinese citizens for payment card theft
2. Credential Theft: Stolen card details obtained via phishing, malware, and purchases from other threat actors
3. Financial Fraud: Stolen cards processed through CCAvenue, Geidea, and N-Genius payment gateway links
4. Money Laundering: Proceeds laundered via Selfridges gift cards, Chow Tai Fook jewelry, and USDT conversion
5. OPSEC: Anonymous virtual numbers and Telegram usernames purchased via Fragment Market on TON blockchain

Affected Systems

• CCAvenue UAE payment gateway
• Geidea UAE payment platform
• N-Genius payment platform
• Selfridges eGift card system
• Chinese bank customers (ICBC, BOC, CCB, ABC)
• Telegram users in 35+ countries

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Payment gateway transaction logs
• Bank fraud detection alerts
• Telegram channel monitoring feeds
• TON blockchain transaction records
• Merchant account registration logs
• Card authorization decline logs

Key Behavioral Indicators

• Multiple payment links from same merchant account in short timeframe
• Small randomized transaction amounts with decimal points
• Rapid sequential transactions from same card across gateways
• Telegram accounts using +888 anonymous numbers
• Merchant names impersonating legitimate UAE businesses
• Transactions to Chow Tai Fook with stolen Chinese bank cards

Control Gaps

• Traditional fraud detection may miss small randomized transactions below threshold
• Legitimate payment platform abuse bypasses network-based detection
• Anonymous virtual numbers complicate attribution and tracking
• Cross-border transactions across 35+ countries fragment detection

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Implement velocity checks for sequential transactions from same card.
• Flag transactions with randomized small amounts below 20,000 AED.
• Monitor merchant accounts for unusual payment link generation patterns.
• Cross-reference merchant names against legitimate business registries.

User Protection

• Alert Chinese bank customers on unauthorized transactions under 50,000 RMB.
• Monitor for unauthorized card binding to airline and e-commerce apps.
• Flag transactions to Chow Tai Fook Hong Kong from compromised cards.
• Block suspicious payment links delivered via Telegram channels.

Security Awareness

• Educate users about phishing scams involving facial scan verification.
• Warn about social engineering using airline app registration schemes.

MITRE ATT&CK Mapping

Plain-Language Summary

A criminal group called Tajin Group steals payment card information through phishing and uses it to buy jewelry and gift cards or transfer money through payment platforms. They operate on Telegram channels designed for Chinese-speaking criminals and use anonymous phone numbers that cannot be traced to real people. Banks, payment processors, and individuals in over 35 countries are affected. Financial institutions should monitor for suspicious transactions through the identified payment gateways and merchant accounts.

Additional IOCs

• Urls:
  • hxxps://payments[.]geidea[.]ae/payByLink/SUNWORLDWorkshopEquipmentMachinerySpareParts/y00-ij6-6f3-w11 - Geidea payment link for fraudulent card processing
  • hxxps://payments[.]geidea[.]ae/payByLink/SUNWORLDWorkshopEquipmentMachinerySpareParts/ntb-3i6-wjp-wts - Geidea payment link for fraudulent card processing
  • hxxps://payments[.]geidea[.]ae/payByLink/SUNWORLDWorkshopEquipmentMachinerySpareParts/q01-lfa-r5x-hiq - Geidea payment link for fraudulent card processing
  • hxxps://payments[.]geidea[.]ae/payByLink/SUNWORLDWorkshopEquipmentMachinerySpareParts/35a-2ku-ftz-0za - Geidea payment link for fraudulent card processing
  • hxxps://payments[.]geidea[.]ae/payByLink/SUNWORLDWorkshopEquipmentMachinerySpareParts/b7k-08r-rz5-nds - Geidea payment link for fraudulent card processing
• Other:
  • @tjjt66 - Tajin Group admin Telegram handle
  • @xb8848 - Xinbi Guarantee channel for Tajin Group
  • @tjjt_gx - Tajin money laundering channel on Telegram
  • @jingwaikakou - Telegram username purchased by Tajin Group
  • @tjjtyw - Telegram username purchased by Tajin Group
  • @tjjt_yewu - Telegram username purchased by Tajin Group
  • @dbtm898 - Dabai Guarantee channel for Tajin Group
  • +888 0353 0246 - Anonymous Fragment Market phone number for Tajin admin
  • +888 0351 5862 - Anonymous Fragment Market phone number linked to Tajin
  • MOON ENTERPRISE TRADING LLC - Fake merchant name on CCAvenue UAE
  • SUNWEL ENTERPRISE TRADING LLC - Fake merchant name on CCAvenue UAE