Financial Fraud

MonsterCloud owner Zohar Pinhasi was charged in the Eastern District of New York with wire fraud for allegedly billing clients over $19M for 'proprietary' ransomware decryption while secretly paying the attackers over $8M for the keys. The '$11M markup' headline is a derived figure.

OFAC sanctioned a Tren de Aragua ATM jackpotting network on September 30, 2026 — eight facilitators, two Mexican firms and seven TRON addresses — tied to $40.73M in reported US losses. Alleged malware engineer 'Prometheus' was arrested and arraigned in Nebraska two days later.

Two former US airmen got 111 and 78 months for a BEC and card-fraud scheme that diverted $1.68M and $720K wires. The docket shows conspiracy pleas, overlapping restitution and a pending appeal; 15 victims and $2.4M are not DOJ figures.

Microsoft's Digital Crimes Unit seized 50 sites and 150+ domains behind EvilTokens, a cybercrime-as-a-service platform pairing device-code phishing with an AI chatbot for inbox analysis and BEC targeting. It hit 12,000+ inboxes across 10,000+ orgs. The AI did the targeting, not the intrusion.

Bitget lost an initially-reported $351.6M — later revised to ~$387.5M — after attackers compromised a wallet-infrastructure backend, spoofed transaction data and pushed forged transfers through its own authorization workflow. Private-key theft was ruled out; Bitget suspects North Korea.

A $16M forfeiture filing this week named five convicted Scattered Spider defendants. The court docket shows two of them — reported this month as "still facing charges" — were sentenced months ago, and that Elbadawy's own "October 2025 guilty plea" was, on the public record, a not-guilty plea.

Cybernews found an exposed server revealing a two-year operation that brute-forced weak credentials on end-of-life PPTP/L2TP VPN devices to build an 87,000-IP residential proxy network, resold to platforms including VPN Pure, using a jailbroken Claude Code to automate the hunt.

Zimperium disclosed RatHat, an Android banking trojan that sends a live map of the victim's screen to a generative AI assistant to navigate the device, abuses Wireless Debugging for shell access, and reinstalls itself after removal — attributed to likely China-based operators.

A Russian national extradited from Cyprus faces trial over a 2016–17 campaign that used 225 fake accounts on a Santa Clara freelance platform to send Excel macros dropping the TeamViewer-abusing TVRAT. The unsealed indictment gives numbers the press release rounded away.

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

LockBit, BlackSuit and Play didn't run their own servers. They rented them from a company in St Petersburg that answered no abuse reports and no takedown requests, and billed like any other host.

Nobody was hacked. A Chinese CDN company bought the polyfill.io domain, and every site that had ever pasted the script tag started serving whatever the new owner wanted. Four months later it was redirecting phones to betting scams.

India's cybercrime agency identified a wave of fraudsters using Google Firebase to host phishing pages and collect stolen banking credentials from millions of users.

The ALPHV/BlackCat ransomware group compromised Change Healthcare, the largest US healthcare claims clearinghouse, causing a nationwide outage of pharmacy, medical claims, and payment processing affecting hundreds of thousands of providers, pharmacies, and patients — the most significant cyberattack on US healthcare infrastructure to date.