A source-code vendor is an underground seller who provides malware source code to other criminals. Buyers can copy, rebrand, patch, or extend the code, turning one original tool into many related builds. In cybercrime markets, this is different from selling a finished sample: the code itself becomes a reusable product.
This matters because source-code sales accelerate malware spread and make attribution harder. A single codebase can produce custom variants with different names, features, or distribution channels, which can defeat simple hash-based detection and complicate takedowns. Defenders may see the same family appear across multiple operators or storefronts. To respond, analysts focus on behavior, configuration patterns, and shared components, not just the exact file. Source-code vendors are a key part of the criminal supply chain that helps malware evolve quickly.