Injection and payload are orthogonal, somebody who can inject scripts just sells that to somebody who has a payload.

At least my Instagram story feed is full of ads where these people find each other. (I mark them all as "scam or illegal" but Instagram removes such ads with a few weeks of delay and never bans their accounts)