Darknet markets expand with COVID‑19 goods and fraud services

The COVID‑19 pandemic has spurred a surge in illicit activity on darknet marketplaces, where vendors now list protective equipment, unverified medicines and fraud‑as‑a‑service offerings [1]. Researchers tracking roughly 60 such markets warn that these products carry significant health, legal and financial dangers for unsuspecting buyers [1].

Key takeaways

• Darknet vendors have added COVID‑19 masks, gowns, test kits and sanitiser to their inventories [1].
• Some sellers claim to offer genuine treatments like Remdesivir, while others list unproven drugs such as hydroxychloroquine [1].
• Fraud services—including stolen personal data and fake benefit‑application kits—are marketed to exploit pandemic relief programs [1].
• Access to these sites requires the Tor network, which routes traffic through multiple encrypted nodes and hides .onion addresses [2].
• Payments are typically made with Bitcoin to preserve anonymity, complicating law‑enforcement tracking [2].

Pandemic‑driven product categories on the darknet

Researchers from Georgia State University’s Evidence‑Based Cybersecurity Research Group observed three dominant COVID‑19‑related offerings emerging on darknet markets since late February [1]. The first category comprises personal protective equipment (PPE). Vendors list face masks, protective gowns, thermometers and hand sanitiser, but rarely disclose sources, leaving buyers unable to verify quality. One monitored vendor even posted a video of large boxes of masks, raising suspicion that the stock could include used or repackaged items—a practice authorities in Thailand have linked to an operation that washed and re‑boxed used masks for resale [1].

The second category involves pharmaceuticals and medical devices. Listings include both approved treatments such as Remdesivir and controversial drugs like hydroxychloroquine, as well as claims of “COVID‑19 antidotes” and even ventilators [1]. Because the true manufacturers and ingredient compositions are unknown, purchasing these products poses serious health risks, including potential side effects from counterfeit or contaminated medicines [1].

The third category is “DIY fraud” services. Vendors advertise tools to create fake websites, provide stolen personal information, and assist with fraudulent unemployment or loan applications [1]. Such schemes can lead to identity theft, loss of future benefits and damage to credit scores for victims, while also straining government relief programs [1].

How the darknet operates and why it attracts illicit trade

The darknet is a hidden layer of the internet accessed through the Tor network, which encrypts data and routes it through multiple volunteer nodes to conceal both user and server locations [2]. Websites on Tor use the .onion domain and are listed in community‑maintained directories such as the Hidden Wiki or search tools like Torch [2]. While Tor can be used for legitimate privacy‑preserving purposes, its anonymity also enables the sale of illegal goods, from drugs to weapons [2].