Darknet market phishing follows a consistent playbook. Attackers create a pixel-perfect visual clone of the target marketplace. The login page looks identical — same logo, same layout, same colors. The only difference is the onion address, which is controlled by the attacker.
When a user enters their credentials, the phishing site captures the username and password. Sometimes it forwards the login to the real market to avoid detection, while extracting credentials in the background. The attacker then logs into the real market using the stolen credentials and drains any cryptocurrency balance.
More sophisticated attacks also capture the user's PGP passphrase if they use integrated PGP decryption on the phishing site, allowing the attacker to decrypt any encrypted messages in the account — including shipping addresses for pending orders.