Hacked PayPal accounts linked to credit and debit cards were for sale on an underground web site for as low as $2.50.
The verified accounts, so called because they were linked to bank accounts used to add funds, were sold with the name, email and state address of the owner, krebsonsecurity reported.
At least one account contained more than $1000 and was for sale for $45.
Other accounts were sold unverified and empty of cash in batches of 100 for 50 cents.
The proprietor of iprofit.su, which has since been closed, said the accounts were stolen in phishing attacks, krebsonsecurity reported.
The site, hosted under the Soviet Union top level domain .su, was linked to several underground carding and spam forums including blackservices.su.
That site, also mirrored on the Belize domain blackservices.bz, had since changed its appearance to masquerade as a clan for video game Call of Duty dubbed BlackServices.
It also locked down its registration process to require users to gain approval via an ICQ account.
.png&h=140&w=231&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
_(1).jpg&h=140&w=231&c=1&s=0)
