Step into the murky, grey market of social media ad account rentals to see one of the newest forms of malicious brand impersonation.
Introduction: The Growing Threat of Social Media Ad Account Rentals
What if someone told you your corporate social media ad account could be rented out on the dark web like a hotel room? Or if you wished to promote something unethical in nature, an ad account is waiting just for you for the cost of a bag of chips? How about a custom ad account made exclusively for you, but the Know Your Customer (KYC) details belong to someone who has no idea it is being used? All of the plausible scenarios mentioned above are part of a malicious ecosystem in which resources are obtained from cybercrime forums to perpetrate criminal activities on the open web and then sell the harvested data on the dark web for future abuse.
In order to do this, the cybercrime group has to anonymously contact one of these shops, set up an account, and get it up and running. However, the people providing the ad accounts offer such great deals (sometimes even better than what legitimate services can offer, not going to lie), that ethical users might also be tempted to indulge in these services, aligning themselves with criminal operations in order to take advantage of the ease of availability and fewer usage restrictions.
At the writing of this article, these social media ad account rental services are becoming a booming trend and a new underground economy.
What Are Social Media Ad Account Rentals and How They Work
Social media ad account rentals, often referred to in the underground economy as “gray market ad services,” refer to the practice of leasing pre-verified social media business accounts to third parties for a fee.
Unlike official advertising accounts that businesses set up and manage themselves, rented accounts are either:
- Compromised: stolen from legitimate users or companies.
- Forged: created with fake identities and fraudulent Know Your Customer (KYC) documents.
- “Aged” accounts: dormant or older accounts with established trust scores, making them less likely to be flagged by automated systems.
Once rented, these accounts are used to launch ad campaigns that bypass platform restrictions, avoid bans, and operate under the guise of legitimacy.
These account creators often assist their buyers with fake KYC verification tools that are capable of generating high quality verification documents and often suggest using them to the buyers. In this case, the researchers at PreCrime Labs identified a domain that offers a service to generate fake documents and verify whether the generated ID is a duplicate or has distinctive similarities to avoid any detections.
Before digging into this subject any further, it is important to note that social media ad account rentals are not the same as influencer collaborations or affiliate account partnerships that brands often do in the marketing world. In influencer partnerships, creators allow brands to temporarily manage ad campaigns or content through their verified profiles, with the influencer’s consent and full transparency. These are legal, contractual, and bound by the platform’s policies.
In contrast, renting ad accounts is malicious by design. The accounts are either stolen, faked with forged documents, or set up solely to be abused. The goal is not brand growth. Instead, the goal is to run fraudulent ads for scams, malware distribution, or policy-violating products. So while the surface-level idea may sound similar, using someone else’s account to run ads, the intent, legality, and impact are completely different. One is a legitimate business arrangement; the other fuels the underground economy.
Related blog: Suspicious Domain Activity in Lead-up to 2026 FIFA World Cup Tournament
Why Social Media Ad Account Rentals Are Becoming Popular
As mentioned above, there are certain benefits for criminals to rent social media ad accounts, some superior to legitimate services, that lead individuals to prefer these over other available options. For example, a forged ad account helps scammers establish a campaign that they can promote on social media while keeping their identity anonymous.
To illustrate, let’s cover a potential scenario. There are times when even an ad account created for legitimate purposes might also have their campaigns scrutinized and restricted during periods with a high frequency of suspicious activity detections. This can even happen in the middle of a campaign, causing obvious issues to the account owner. Also, some ad accounts can also take days to get approved, slowing down a user wanting to get their campaign launched. These situations can be bypassed by paying a nominal service fee.
Other examples might include accounts promoting cryptocurrency coins, fake e-commerce shops built to leverage approaching significant cultural events or seasonal shopping sales, or promotion of third party tools and applications hidden as malware.
These rented accounts are disposable in nature and the next one is arranged at their fingertips in no time, helping them to quickly keep the accounts rotating and the advertisements ongoing.
Inside the Underground Market for Social Media Ad Account Rentals
It all starts with service providers who can be found on various cybercrime platforms such as Telegram, forums, and blackhat SEO-based chat groups. The related discussions are often found under the SEO sections of cybercrime forum markets, where one will quickly realize there are just as many malicious options available as there are legitimate ones.
Scams can get a boost through services like advertising accounts that are tied to clean IP addresses, aged domains, and forged credentials. These services are commonly promoted and coordinated through Telegram groups, Russian or CIS-based bulletproof hosting panels, and southeast asian click-farm networks.
The involvement of offshore service providers and anonymous, privacy-focused payment methods like cryptocurrency adds an additional layer of obfuscation, making attribution, reporting, and takedown efforts significantly more difficult for security teams and platform enforcers.
As most of us are aware, advertising on any of these accounts requires user verification and ownership. However, the development of various tools offered as “add-on” services (for example, hitools[.]pro or accnice[.]com) can help generate forged Know Your Customer (KYC) documentation. Additionally, we have even had a recent case where the rise of generative AI helped criminals in bypassing security verification through forged documents. Underground markets also offer this as a premium service. Certain data leaks also help in acquiring the sensitive documents which can be tweaked as needed to generate as many new accounts as possible.
Now, once these fraudulent KYC files are approved, the ad accounts appear legitimate in the eyes of the platform’s automated systems. This makes them highly valuable on the gray market, since they:
- Allow instant ad approvals with minimal scrutiny.
- Carry higher daily spending limits, enabling large-scale campaigns.
- Provide anonymity to fraudsters, who never need to expose their real identities.
Real-World Examples of Social Media Ad Account Rentals in Fraud
Is this all? Or is there a bigger threat landscape to look at?
After being made aware of all of these underground and linked activities, it’s only natural to wonder why a threat actor would invest the effort and money in fake advertising accounts? The answer is simple. These accounts further act as a getaway to onboard multiple malicious campaigns and help the criminals reach their audience on a massive scale. In other words, a few dollars or a forged passport to buy/verify an ad account can unlock millions in fraudulent revenue.
Malicious actors can run campaigns limited to a specific region, establishing a funnel model, and have the money laundered internally. By acquiring victims through strategic targeting and categorization, criminals can avoid drawing attention and risking detection by building relevant campaigns that circumvent typical pitfalls such as local laws, software bans, etc.
For example, this ad being run by a newly established account is advertising “India’s Premier Gambling Platform”, despite the country’s recent passing of the bill where money-based investment games are banned, citing financial harm.
Related blog: Threat Report – BEC in the Financial Services Sector
Also, when thousands of users see a promoted post from an account that looks legitimate, phishing conversions jump. That harvested data can be used for sophisticated campaigns, or resale on data markets. Ads that promise “freebies” or “urgent offers” are an efficient vector for pushing malicious applications and software. Because the ad is served from a trusted platform, people are much more likely to download.
Some scams use rented ad accounts to drive traffic to affiliate programs or CPC (cost-per-click) schemes. Fraudsters get paid for leads, installs, or signups and then use bots or fake data to claim payouts at massive scale.
Why Social Media Platforms Struggle to Detect and Stop Social Media Ad Account Rentals
Despite critical security implementations, why do ad account providers and buyers still thrive today? There are a few factors that challenge security teams from effectively detecting the various players in these ecosystems. The first one being the sheer scale of new ad accounts being created. Filtering out the malicious accounts is like finding a needle in a haystack. Also, detection of these accounts is time consuming, since existing systems cannot independently verify every single ad campaign or efficiently manage every business verification request. These accounts are able to pass KYC, pay with valid cards, and mimic genuine advertiser behavior, until victims have already been exposed.
For threat actors, back-up alternatives are always ready in case of a takedown. Many accounts even run “benign” ads initially before switching to fraudulent campaigns, helping them stay under the radar. But on the backend, there are a bunch of crypto transactions that are hard to trace and offshore hosting providers shielding websites and services from western law enforcement, which help them remain anonymous.
Scammers move faster than enforcement teams. They can launch, profit, and abandon a campaign within hours or days. By the time a platform detects and bans a malicious ad account, the operation has already shifted to the next rented account.
What Security Teams and Businesses Can Do to Combat Fake Social Media Ad Accounts
As we have seen the limitations faced by organizations and security teams when identifying rented social media ad accounts created for malicious purposes. To get ahead, organizations need to shift toward preemptive security practices. Instead of waiting for abuse, businesses can harden their own ad accounts with multi-factor authentication, continuous monitoring of existing accounts, and automated anomaly detection tuned to flag spend spikes or new campaign creations.
Rather than just monitoring what’s already live, threat intelligence teams should actively track underground forums, Telegram channels, and gray-market sellers where ad accounts, forged KYC templates, and supporting infrastructure are bought and sold. By correlating chatter (e.g., mentions of new KYC generators or bulk account sellers) with external telemetry (like sudden domain registrations or proxy usage), security teams can predict where abuse will appear next and push alerts or takedown requests in advance.
The final line of defense against social media ad account abuse is the end user. Even with platform controls and security teams at work, malicious ads will inevitably slip through. Educating users to think critically before clicking on too-good-to-be-true deals and offers from ad servicing platforms is equally important.
Everyone should keep these things in mind:
- If an ad is offering huge discounts, instant wealth, or “exclusive giveaways,” treat it as a red flag.
- Real businesses feature consistent branding, official contact details, and links to their verified pages. If an ad points to a generic website, has spelling errors, or uses only WhatsApp or Telegram for contact, it’s likely fraudulent.
- Never make payments through direct bank transfers, gift cards, or unverified wallets promoted by an ad. Many times real websites will have a legitimate merchant name.
- Users should be encouraged to report questionable ads directly on the platform. Collective reporting speeds up takedowns.
Conclusion: How Users Can Identify and Report Suspicious Ads
Renting social media ad accounts is no longer just a niche crime. These malicious ad accounts are full-fledged supply chain scams with ecosystems spanning from the open web to the dark web forums. From forged KYC documents to Telegram marketplaces and offshore hosting, every layer of this underground ecosystem is designed to exploit the ads feature. While social media platforms can do more to combat this problem, the responsibility to counter this doesn’t fall on the platforms alone. With vigilance at every level, from the enterprise to the end user, we can collectively disrupt this gray economy before it further reaches victims.
PreCrime™ autonomously predicts, blocks, and preempts malicious campaigns before they impact your business.
