Security researchers found credit card numbers and phishing campaigns being openly traded online.