Your personal documents could be circulating in private Telegram groups without your knowledge. Passports, official credentials, video selfies and even recordings that you once thought were safe are now being offered to the highest bidder. Behind this threat is a network of cybercriminals linked to Russian forums, which has developed an automated bot in Telegram capable of selling Mexican identities as if they were online products. Just type the word “Mexico” to access a list with scanned passports, INE IDs and combinations including face photos and facial verification videos.
This operation is neither local nor casual. It is an expanding online store of fake identities, fueled by camera hacking, personal data theft and the growing digital identity black market.
Prices range from $4 to $15, depending on the package. The most expensive one includes everything needed to impersonate someone else: photos of the document on both sides, a selfie and a video of the face. This complete combo is designed to fool the verification systems used by banks, exchange houses, cryptocurrency apps and other financial services.
Now, it doesn't always mean that they directly hacked the user's camera. Many of these videos and documents could have come from previous leaks, fake apps that mimic verification processes, or simply from people who unknowingly sent their information to fraudulent platforms. Sometimes, the mistake was trusting the wrong place.
Read more: The 10 Best Telegram Chat Groups and Channels on the Dark Web
The operation is not limited to Telegram. They also have a website, ppshopping.online, that functions as a backup in case they get shut down by the bots. From there you can access the main bot, contact the supposed administrator, get “support” and use other tools they offer to facilitate illegal purchases.
The domain was registered on March 26, 2025 through REG.RU, a popular provider among the Russian-speaking community. Although the site is currently hosted on Amazon Web Services servers in San Jose, California, everything indicates that behind it there are people with a lot of experience hiding their tracks: from the DNS to the infrastructure used, everything points to operators skilled in hiding and moving their digital assets quickly.
On May 13, an advertisement appeared on XSS, one of the most popular Russian forums among hacker communities. In it, a user identified as PAYPALSHOP offered more than 8,000 stolen or forged documents of people from different countries.
The list includes identities from Mexico, Colombia, India, Brazil, Ecuador and the United Kingdom, among others. The most alarming thing is that not only single documents are sold, but also “packages per person”, that is, several files linked to the same identity. This allows whoever buys them to completely impersonate someone else on banking platforms, cryptocurrency platforms or any other service that requires digital verification.
Read more: INE, SAT, and Banks: Data Sold for $5,000 on Hacker Forums
Although Mexican documents are not in the majority, the fact that they are there says a lot: our personal data is already circulating unchecked in illegal markets. According to the bot, at least 31 active records include passport or INE, selfie and facial video of Mexican citizens. That's not just anything: it's enough material for someone to impersonate you on any digital platform.
And what can they do with it? Everything. Open bank accounts, move money, buy cryptocurrencies, make transfers abroad and even pass identity filters in official procedures. It's an open invitation to fraud, and the worst thing is that it's all set up with almost business-like efficiency.
This bot doesn't rely on intermediaries. It has direct purchase buttons, responds instantly and even offers “real-time support”. Plus, it has back-up channels in case you go down. Everything points to a well-organized, automated and clearly commercial operation.
The channel that supports the bot, called PAYPAL SHOP NEWS, has already surpassed 1,100 subscribers. A few weeks ago it had just over 300, but the number has climbed fast. That means more and more people are accessing and buying stolen data.
And the promotion doesn't just stay on Telegram. On their website, they openly invite visitors to bookmark it for future “updates.” In short, they are preparing to continue selling identities even if they are blocked. This network is not only global, it is growing and evolving.