SIM farm
Racks of SIM cards driven by software, so that one operator controls hundreds or thousands of real mobile numbers. Used to receive verification codes, register accounts in bulk and originate messages that arrive as ordinary person to person traffic.
Why it matters to you
Every control that treats a phone number as proof of a person is defeated by hardware. If your onboarding trusts SMS verification as identity, it is trusting that numbers are scarce, and a farm is the argument that they are not. Rate limit on the behaviour, not on the number.
Where we meet it
Numbers are rented by the minute or by the code rather than sold outright, which is why a number that verified an account last week can verify a different one this week for somebody else entirely.
Connected terms
OTP bot
An automated calling service that impersonates a bank or provider to trick victims into reading out their one-time codes. MFA bypass, sold as a subscription.
SIM swap
Moving a victim's phone number onto an attacker's SIM, usually by persuading or paying someone at the carrier. Every code sent to that number now arrives at the attacker instead.
Mobile proxy
Traffic routed through a real mobile network so that it arrives from a carrier-assigned address. Sold by the port or by the gigabyte, usually with a control to force a new address on demand.
Where this term stops being vocabulary
Malveine is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the infrastructure
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Crypto mixer
A service that pools cryptocurrency from many senders and pays out from the pool, so that the link between an incoming and an outgoing transaction is broken. Charged as a percentage, sometimes with a delay bought separately.