ALERT: Nexus Market Phishing — Fake nexustormarket.com Domains Spotted

Security researchers identified multiple phishing domains impersonating Nexus Market on May 15, 2025, with the fraudulent addresses clustered around the nexustormarket.com pattern. The cloned sites mirror the layout and branding of the legitimate marketplace, capturing login credentials and cryptocurrency deposits from users who fail to verify the correct onion address before transacting.

What Was Discovered

The phishing infrastructure uses domain names that closely resemble the real Nexus Market URL, including variations registered within the past 72 hours according to passive DNS records reviewed by analysts. Several of the fake domains resolve to servers hosted on commodity cloud providers, a pattern consistent with previous darknet phishing campaigns targeting Torzon Market and DrugHub users earlier this year.

Researchers noted that the cloned interfaces replicate the vendor listings, escrow terminology, and even the support ticket system used by the genuine marketplace. Captured credentials are reportedly forwarded to operators running a parallel scam storefront branded as nexus-dark.shop, which appears to function as a secondary collection point for victims who attempt to recover access through the phishing site’s “support” channel.

How the Operation Works

Visitors arrive at the phishing domains through search engine results, forum spam, or links shared in encrypted chat applications. Once on the fake landing page, a prompt requests the user’s existing Nexus Market username and password — information that is immediately exfiltrated to the operators’ database. The site then displays a fake “session expired” message and directs the user to re-enter their mnemonic seed phrase or two-factor authentication code, providing the attackers with everything needed to drain the associated cryptocurrency wallet.

According to the analysis, the phishing kit in use shares code fingerprints with infrastructure previously linked to the Torzon Market phishing wave documented in April 2025. The reuse of server templates and JavaScript libraries suggests either a shared operator or a kit being resold among threat actors specializing in darknet impersonation.

Background on Nexus Market

Nexus Market operates as a Tor-based marketplace accessible only through the onion network, requiring the Tor browser and a cryptocurrency wallet for transactions. The platform supports both Bitcoin and Monero, with multi-signature escrow as the standard dispute resolution mechanism. Like other active markets including DarkMatter and Torzon Market, Nexus relies on a reputation system and vendor bond structure to maintain trust among participants.

Phishing campaigns targeting darknet marketplaces have intensified since the takedown of several major platforms in 2022 and 2023, which displaced users toward newer markets and created confusion about legitimate URLs. Operators of defunct markets frequently resurface under similar names, and scammers exploit that uncertainty by registering lookalike domains before the real operators can establish brand recognition.

Verification Steps for Users

Researchers recommend that users verify the current Nexus Market onion address through multiple independent sources before logging in, including PGP-signed announcements from known community moderators and the market’s verified mirrors list. The legitimate Nexus Market does not operate on clearnet domains, and any address ending in .com, .shop, or other conventional top-level domains should be treated as fraudulent.

Users who have already entered credentials into a suspected phishing site should immediately transfer remaining balances to a fresh wallet, rotate any reused passwords, and monitor blockchain explorers for unauthorized transactions. Two-factor authentication seeds entered on a fake site cannot be revoked and must be considered permanently compromised.

What to Watch For

Additional phishing domains targeting the nexus-dark.shop pattern and similar variants are likely to appear as the operators rotate infrastructure. Community moderators have begun circulating updated blocklists, and at least one darknet directory has added warnings to its Nexus Market listing to flag the active campaign.

The incident underscores a recurring pattern in which high-profile darknet markets attract parallel fraud operations within weeks of gaining traction. Users are advised to bookmark verified onion addresses rather than searching for them through conventional search engines, where poisoned results remain the primary vector for these phishing kits.