Many keys shared in these groups are bought using stolen credit cards (carding) or hijacked from legitimate corporate volume licenses.