Comparitech does not condone or encourage malicious hacking or employing malicious hackers.
Comparitech researchers collected more than 100 listings from 12 hacking services to find out how much these mostly illegal services cost, and which seem to be in highest demand. Many of the websites we examined have similar a la carte menus for various black hat services on offer.
Although prices give customers an idea of how much a service will cost, the truth is that most jobs are negotiated directly with clients. The complexity, duration, risk, and scope of a job determines the final price.
That being said, the listings reveal some interesting trends:
- Personal attacks—e.g. defamation, legal sabotage, and financial disruption—were the most expensive services listed on average, followed by changing school grades
- Social media account hacking was the most commonly listed service
- All of the services we looked at require payment up front. Some but not all of the hacking service websites we examined promised a refund for unsuccessful jobs.
- Most hacking services set realistic expectations in that they only take jobs they reasonably believe they can accomplish. One group notes on its website, “In about 5-7% of cases, hacking is impossible.”
Many hackers say they can complete jobs within 24 hours, but more advanced jobs might take days or weeks. The websites for the hacking services we look at usually instruct prospective customers to get in contact by encrypted email or secure chat app.
Below is a brief description and average price of the most common hacking services offered.
Website hacking
Average price: $394
This category consists of attacks on websites and other services hosted on the web. One group promised it could “hack any website,” gaining access to either the underlying web server or the website’s administrative panel. Another says it can steal databases and administrative credentials. Besides websites, online game servers and other internet infrastructure can be targeted.
See also: How to fix hacked websites
DDoS
Average price: $26 per hour*
Distributed denial-of-service attacks entail flooding a target, such as a web server, with junk requests so that it cannot serve legitimate users. This attack usually employs a botnet—a large group of compromised computers that can be weaponized from a single command and control center. Dispersing the junk requests among many devices makes them harder to block.
DDoS-as-a-service has become a popular business model. Hackers charge hourly or even monthly rates to maintain attacks for as long as the customer wants. Some charge more to attack sites with DDoS protection like Cloudflare. *Prices also vary according to how much bandwidth is needed to carry out the attack, so it can fluctuate a lot.
See also: How to prevent a DDOS attack
Social media account hacking
Average price: $230
The most common type of listing we found, hackers offer to hijack or spy on social media accounts on various platforms. WhatsApp was specifically mentioned the most. We also found listings for Facebook, Twitter, Instagram, Skype, Telegram, TikTok, Snapchat, and reddit.
The exact service varies by which platform you want to target. Credential theft and account hijacking, which gives the buyer full access to the victim’s account, is common for Facebook and Twitter. But for WhatsApp, the goal was more likely to be spying on messages, taking screenshots, and pulling backups.
The groups aren’t specific about how they hack social media accounts, but they do mention using both malware and social engineering. That indicates that the hackers must first trick victims into clicking a malicious link or attachment. The victim must take some action in order for hackers to succeed.
Custom malware
Average price: $318
Customers can request custom malware, ranging from keyloggers to botnets to ransomware. One seller promises its malware to be fully undetectable.
Changing school grades
Average price: $526
Believe it or not, this is one of the most common services offered by many of the hacking services we examined. It’s also one of the most expensive.
Customers can pay hackers to hack into their school system and change their grades and attendance record. The service is offered to both grade schools and universities.
Alternatively, some services promise to steal the answers to upcoming exams.
Personal attacks
Average price: $551
The hacker will personally attack the client’s target through various means, including financial sabotage, causing legal trouble, or public defamation. One disturbing tactic listed by a hacker is to frame the victim as a consumer of child pornography.
A few hacking services offer “scammer revenge” or “fraud tracking” services. The listings suggest the hackers will either track down the scammer and hand their personal info to the customer, or the hackers themselves can make life difficult for the scammer.
Location tracking
Average price: $195
Hackers offer to track a person’s location, usually by monitoring the IP address of their mobile device. Others might use open-source intelligence to assist in locating the target.
Computer and phone hacking
Average price: $343
This involves breaking into business or personal devices to steal information, plant malware, or take some other malicious action. One group offers to use remote administration tools to break into target devices over the internet. All operating systems are on offer: Windows, MacOS, Linux, Android, iOS, BlackBerry, and Windows Phone.
Email hacking
Average price: $241
Email hacking usually consists of stealing the account holder’s password. The hackers can either hand over the password to the customer, or break into the email account themselves to steal data and information. They might also set up email forwarding so the customer receives a copy of all the victim’s emails.
See also: 10 Best Email Protection Solutions
Debt or credit
Average price: $257
A few groups claim they can boost customers’ credit scores or clear their debt. They may charge a flat sum or a percentage of the customers’ savings. One group claims it can remove customers’ names from blacklists of loan defaulters.
Other services of note
Here are some interesting one-off hacker services that didn’t fit into the above categories:
- Bitcoin wallet recovery – In the event of a lost password, the hacker will help the client restore access to a bitcoin wallet.
- COVID-19 vaccine hospital database hacking – the hacker will break into a hospital’s COVID-19 vaccine database, presumably to either spy on vaccine recipients’ data or add their own name to the database.
- Post removal – the hacker promises to delete any post from social networks.
- Black hat SEO – the hacker will change search engine results to boost or lower a site’s rankings. (Author’s note: I was surprised we didn’t see more of these).
- Security audits – the hacker will audit the security of your website or other web-hosted service
Methodology
Comparitech researchers pulled listings from 12 hacking service websites on the dark web in September 2021. For ethical reasons, we will not list those websites or their URLs here. In total, we collected 121 listings, which included prices and descriptions of the service offered. We grouped these listings into the categories listed above.
Many services give a price range instead of a specific price. In those instances, we used the lowest listed price in our analysis.
Prices are often listed in Bitcoin. We converted those figures to US dollars using the exchange rate of the day that the price was recorded.
Comparitech does not condone or encourage malicious hacking or employing malicious hackers.
How do people pay for hackers on the dark web?
The large majority of dark web transactions are made using cryptocurrency like Bitcoin. This is the case whether you’re paying for a hacking service, or a product.
Bitcoin can change hands anonymously, meaning that both the buyer and the seller can protect their identities. To facilitate a Bitcoin transaction, you will need to use a Bitcoin wallet. Before sending any funds, always be certain that the seller is legitimate and that you’re not being scammed, as unfortunately, this is all too common on the dark web.