Rising Credential Abuse in Vulnerable Sectors of the Digital Economy

A Help Net Security article cites a report by bot defense firm Kasada, which sheds light on ALTSRUS, a fast-scaling fraud syndicate exploiting the digital economy’s most vulnerable sectors. Targeting Electronic Benefit Transfer (EBT) accounts, prescription services, and consumer rewards programs, ALTSRUS represents a troubling evolution in credential abuse that affects enterprises and the financially disadvantaged individuals who depend on these systems for essential services.

Kasada’s threat intelligence team dubs the group the “Reverse Robin Hood” for its strategy of siphoning value from low-income victims. The syndicate has effectively industrialized credential stuffing, monetizing stolen credentials at a staggering pace. In Q1 2025 alone, ALTSRUS sold over 220,000 compromised accounts, a 2,852% surge from the previous year,  demonstrating both the scalability and adaptability of its operation. Its campaigns now stretch across 13 industries, underscoring the broad reach of today’s organized fraud.

Perhaps most alarming is ALTSRUS’s infiltration of healthcare. The group resells pharmacy accounts, including access to 17 prescription types, many tied to serious health conditions like chronic pain and mental illness. This commodification of critical medications directly impacts legitimate patients, denying them timely access to care and complicating pharmacy security protocols.

For cybersecurity professionals, the automation and sharing of credential abuse tools are accelerating. Organizations must strengthen their ability to detect repeatable fraud patterns early, before attackers become entrenched. As credential abuse becomes more distributed and difficult to trace, proactive defense strategies are no longer optional.