Bayrob

June 2, 2026

AI Summary

5 min read

In 2007, a Symantec malware analyst named Liam O Murchu received a file that felt different from the usual samples crossing his desk. It was a piece of malware that sat silently on a victim's computer until they visited eBay, then it would inject fake information into the browsing session—making fraudulent listings and fake escrow pages appear as if they came from eBay's legitimate URL. Liam named it "Bayrob," because it was robbing eBay customers. What began as a routine analysis would spiral into a decade-long cat-and-mouse game involving the FBI, AOL, and a group of Romanian hackers who built one of the most operationally secure cybercrime operations ever seen.

The Malware That Only Worked for Americans

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

Listen to Audio Summary Open in App

Never miss an episode of Darknet Diaries

Get every new episode summarized in your inbox — free, ~5 minutes to read.

No spam. Unsubscribe anytime.

What you'll learn

1 (00:48) **Introduction to the Bayrob Malware** - Liam O Murchu at Symantec receives a strange malware sample that intercepts eBay connections to defraud customers.
2 (06:15) **The Geofencing Problem** - Liam discovers the malware only activates for American victims, preventing him from fully analyzing it from Ireland.
3 (08:18) **Liam Poses as a Victim** - Liam impersonates the victim, buys a car through the fraudulent eBay auction, and records the entire interaction with the attackers.
4 (10:00) **The Attackers Taunt Liam** - After his blog post, the Bayrob gang starts mocking Liam by putting his name in their command-and-control domains and leaving insulting messages in the malware.
5 (11:16) **Infiltrating the Proxy Chain** - Liam sets up an infected machine to observe the attackers' sophisticated multi-hop proxy network, which uses victim computers to hide their location.
6 (16:31) **A Treasure Trove of Encrypted Data** - Despite capturing the attackers' traffic, almost everything is encrypted, including their Jabber chats and command-and-control communications.
7 (18:11) **The FBI Joins the Hunt** - Liam contacts the FBI, who are already investigating a victim's complaint, but the case moves slowly for years due to jurisdictional and procedural limitations.

+ Full timestamped outline available in the app

Show Notes

It started with a fake car listing on eBay.

What looked like a simple online scam quietly grew, over more than a decade, into one of the most sophisticated cybercrime operations the FBI had ever traced. Custom malware. Opsec off the charts. Fleets of infected computers mining cryptocurrency for someone else. Millions of dollars siphoned from victims who had no idea.

This is the story of Bayrob and the three men from Romanian who were behind it. And the long, strange road that led American investigators to their door.

Sponsors

Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.

This show is sponsored by Meter, the company building networks from the ground up. Meter delivers a complete networking stack - wired, wireless, and cellular - in one solution that’s built for performance and scale. Alongside their partners, Meter designs the hardware, writes the firmware, builds the software, manages deployments, and runs support. Learn more at meter.com.

This show is sponsored by Maze. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information.

Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more.

This episode is sponsored by Chainguard. Chainguard builds container images the right way — minimal, hardened, and built from source every single da