Episode
16 February 2021 Official episode · Official transcript
black hat carding cybercrime
The episode documents Cameron Harrison’s progression from making counterfeit IDs to carding, phishing, ATM cash-outs, payment-card theft from small businesses, and participation in the Carder.su criminal marketplace.
Topics: Payment-card fraud and carding, Counterfeit payment cards and magnetic-stripe encoding, Track 1 and Track 2 data, Phishing and credential harvesting, Bulk spam delivery and filter evasion, Compromise of web servers using public exploits, Network and IP-range scanning, Exposed RDP services, Brute-force password guessing with Hydra, Point-of-sale system compromise, RAM scraping and unencrypted payment-card data, ATM cash-out operations, Social engineering of banks, Criminal marketplaces and carding forums, Operational security and use of compromised infrastructure
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Cameron Harrison SAME_AS Kilobit
Cameron Harrison used Kilobit as his online alias and named his computer Kilobit; the episode presents the alias as belonging to him.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“Cam had been careful on Carder.su. He registered as the user Kilobit”
“Cam had named his computer Kilobit and this was the same name he used on the Carder.su forums.”
Cameron Harrison USES Sub7
As a high-school student, Cam used Sub7 to access a classmate’s computer and take his work.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“He used Sub7 which is a Trojan to attack the guy’s computer”
Cameron Harrison USES Counterfeit Library
Cam became a regular on Counterfeit Library and learned how to make fake IDs there.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“He became a regular on Counterfeit Library”
Counterfeit Library RELATED_TO ShadowCrew
Cam described Counterfeit Library as a precursor to ShadowCrew.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“Counterfeit Library was like a precursor to ShadowCrew”
Counterfeit Library RELATED_TO CarderPlanet
Cam described Counterfeit Library as a precursor to CarderPlanet.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“Counterfeit Library was like a precursor to ShadowCrew or CarderPlanet”
Cameron Harrison USES carding
Cam participated in carding, including receiving and cashing out stolen credit-card information.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“I took the $2,000 of the carded Western Union.”
Cameron Harrison USES Western Union
Cam used Western Union to receive transfers funded with stolen credit cards and later to cash out stolen card details.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“Cam would then go down to any Western Union and pick up the cash.”
Cameron Harrison USES MSR
Cam used an MSR magstripe encoder to make IDs and later to write stolen card data onto physical cards.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“I wanted my IDs to scan, so I wanted an MSR.”
Cameron Harrison USES full
Cam obtained and used stolen full-information card records, including CVV, identity, and account details.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“I was able to get my hands on a full.”
“It’s basically a CVV, a card with a CVV; the expiration but also the name, address, phone number”
Cameron Harrison USES eGold
Cam used eGold to send the Kosovo group its share of money from cashing out stolen cards.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“To do this, he used a service called eGold.”
Cameron Harrison USES social engineering
Cam social-engineered banks by posing as cardholders and changing the phone numbers and addresses associated with accounts.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“he figured out ways to social engineer some of the banks connected to the cards”
Cameron Harrison USES ATM cash-out
Cam regularly used counterfeit cards to withdraw stolen money from ATMs.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“From then on, cashing ATMs became a regular part of his routine.”
Cameron Harrison USES dc.exe
Cam bought dc.exe because it formatted card data so it could be written correctly to magstripes.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“They were selling a program and the program was called dc.exe.”
“The software worked; it encoded the track data onto the cards perfectly.”
Cameron Harrison USES phishing
Cam learned and conducted phishing campaigns to steal account and payment information.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“He found someone who would teach him how to phish”
Cameron Harrison USES credential phishing website
Cam hosted a fake PayPal login site that collected victims’ credentials and payment details.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“The link would take them to Cam’s website which looked exactly like PayPal”
Cameron Harrison TARGETS PayPal
Cam’s phishing campaign impersonated PayPal and collected PayPal credentials.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“Cam’s phishing scam was to tell people they needed to update their account details on PayPal.”
Cameron Harrison TARGETS eBay
Cam used stolen PayPal and eBay logins and targeted users with messages related to their eBay auctions.
Explicit Confidence 97% · Jack Rhysider EP 85 Details
“With that, Cam would have their logins to PayPal and eBay.”
Cameron Harrison USES Apache
Cam used publicly known Apache-related exploits to compromise web servers for hosting phishing pages.
Explicit Confidence 96% · Cameron Harrison EP 85 Details
“We’d just find some popular public exploit at the time for Apache or whatever it was”
Cameron Harrison USES DarkMailer
After leaving jail, Cam installed DarkMailer on cyber-café computers and used them to send spam.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“I turned – I had DarkMailer installed on all of them and were blasting out spam.”
Cameron Harrison USES network scanning
Cam scanned IP ranges and local networks to locate systems associated with small businesses and point-of-sale systems.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“now that IP; I’m gonna scan that whole range.”
Cameron Harrison USES Nmap
Cam used Nmap to scan IP ranges for open ports on small-business networks.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“used the Nmap or something to scan and find out what open ports were there.”
Cameron Harrison USES RDP
Cam targeted point-of-sale computers that exposed RDP for remote access.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“one port in particular he was hoping that was open was 3389 RDP.”
Cameron Harrison USES Hydra
Cam used Hydra to brute-force passwords for RDP-accessible point-of-sale computers.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“Hydra tried a bunch of passwords and eventually found one that worked.”
Cameron Harrison USES brute-force password guessing
Cam used brute-force password guessing against RDP-connected cash-register systems.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“he would unleash Hydra on it and try tons of different passwords to try to log in.”
Cameron Harrison USES Memory scraping
Cam searched the RAM of point-of-sale computers for payment-card data matching Luhn’s algorithm.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“set up your rerun, the point of sale software, and a debugger, so that way they can get – scan through the memory address ranges”
Cameron Harrison USES Luhn’s algorithm
Cam used Luhn’s algorithm to identify likely credit-card numbers in memory.
Explicit Confidence 99% · Cameron Harrison EP 85 Details
“look for something to match Luhn’s algorithm. That’s the way to identify a credit card number.”
Cameron Harrison USES Track 2 data
Cam extracted Track 2 data from payment-card information found in memory.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“anything in between that would be your Track 2.”
Cameron Harrison USES Carder.su
Cam used Carder.su under the alias Kilobit and participated in its carding community.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“Cam had been careful on Carder.su. He registered as the user Kilobit”
Carder.su bust INVOLVES Carder.su
The Carder.su bust involved the seizure and examination of a server snapshot containing the site’s user database.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“The feds were able to go through the user database”
Kilobit DISCOVERED_BY Secret Service
The Secret Service had been submitting reports about the Kilobit alias while trying to identify who was behind it.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“The Secret Service in Las Vegas had been submitting reports about the alias, trying to figure out who was behind the name.”
Cameron Harrison MEMBER_OF Kilobit
The episode presents Cameron as the operator behind the Kilobit identity and as a participant in the associated carding operation.
Derived Confidence 86% · Cameron Harrison EP 85 Details
“They know exactly who I was.”
“Cam had named his computer Kilobit and this was the same name he used on the Carder.su forums.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:53:04.756941+00:00