Europol and German prosecutors disrupt 'crime-as-a-service' fake trading platform network: 7 arrested, 100+ servers seized
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 05/11/2026 00:04; os links antigos trazem para cá.
Fontes: infosecurity-magazine.com ↗ darkreading.com ↗ cyberscoop.com ↗ helpnetsecurity.com ↗ bleepingcomputer.com ↗
Europol, Eurojust and German prosecutors in Itzehoe (helpnetsecurity.com) disrupted an international investment fraud network that supplied fake trading websites to scam call centres, with victims in up to 50 countries. On the action day of 3 November 2026, authorities arrested seven suspects, including call centre managers, searched 17 locations and seized more than 100 servers plus cash and other evidence (bleepingcomputer.com, helpnetsecurity.com, cyberscoop.com, infosecurity-magazine.com). The infrastructure was traced to a company based in Cyprus and Israel that allegedly sold the platforms as a service. Its suspected clients ran call centres in Albania, Kosovo and North Macedonia. The probe began in 2022 after a German couple could not withdraw funds from an online trading platform. Suspects are to be surrendered or extradited to Germany for prosecution. Police said they are not claiming to have fully dismantled the network (infosecurity-magazine.com). Investigators estimate losses above €4 million (about $4.5 million) (infosecurity-magazine.com). Darkreading.com reported that details on losses, victims and arrests were still limited in its initial coverage.
Detalhes técnicos
- Lure and fraud flow: Deceptive ads and affiliate marketing steered victims to fake cryptocurrency, forex and stock trading platforms (cyberscoop.com, helpnetsecurity.com). The ads promised high-return, no-risk investments (infosecurity-magazine.com). Victims' personal data was stolen and sold or handed to call-centre operators (bleepingcomputer.com, infosecurity-magazine.com). Operators posing as brokers showed fabricated profits and applied psychological pressure and social engineering to extract larger transfers. When victims tried to withdraw, operators stalled and then cut off contact (cyberscoop.com).
- Service model: The Cyprus/Israel-based provider supplied ready-made fraudulent platforms, and per cyberscoop.com also call-centre infrastructure. This lowered the technical barrier for multiple fraud groups (darkreading.com).
- Operation stages (helpnetsecurity.com, infosecurity-magazine.com):
- A first action day on 6 September 2022 included searches in Belgium and Latvia and led to two arrests and evidence seizure (infosecurity-magazine.com).
- Analysis of that evidence identified seven network members, including call centre managers.
- A second action day on 13 May 2025 brought eight simultaneous searches in Albania, Cyprus and Israel, one arrest in Cyprus, and the seizure of devices, documents and cash, which led investigators to the scam-website supplier (infosecurity-magazine.com).
- On the final action day, 3 November 2026, 17 locations were searched, including a call centre in Kosovo, several scam websites were shut down, and 100+ servers were seized.
- Coordination: Eurojust set up two joint investigation teams and coordinated judicial action. Europol deployed digital forensics experts to Albania and Kosovo (helpnetsecurity.com). Infosecurity-magazine.com lists cooperation among Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia.
- Context: Bleepingcomputer.com places this takedown in a series of European operations. These include a 2022 network stealing at least €3 million monthly, call-centre takedowns in 2023 and 2024, 2025 actions in Spain involving over €460 million laundered, and a €50 million fraud ring dismantled by Austrian and Albanian authorities in April 2025. Infosecurity-magazine.com adds an €89 million ring dismantled in 2023 and a €15 million operation disrupted in 2021. It also cites the FBI reporting investment fraud as the highest-grossing cybercrime type in 2025, with nearly $8.7 billion.
Remediação
No technical mitigations or IOCs were published. The seven suspects were arrested for surrender or extradition to Germany (helpnetsecurity.com, cyberscoop.com, infosecurity-magazine.com). Victims who have lost funds to such platforms should report to national law enforcement; the sources give no specific victim guidance.
Relatos divergentes
- Financial losses: At least €4 million (helpnetsecurity.com) versus at least $4.5 million (cyberscoop.com). Infosecurity-magazine.com, the most recent source, gives both as one estimate (over €4 million, or $4.5 million), so the two figures most likely reflect currency conversion. Bleepingcomputer.com gives no figure.
- Search scope: Searches at 17 locations (helpnetsecurity.com, infosecurity-magazine.com) versus across 17 countries (cyberscoop.com). The location-based figure is backed by two sources, including the more recent one, and is the more likely.
- Participating countries: Bleepingcomputer.com lists Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia. Helpnetsecurity.com adds Israel. Infosecurity-magazine.com, the most recent source, lists the same seven countries including Israel and does not mention Poland. Cyberscoop.com lists Israel and also Poland; Poland's role is not confirmed elsewhere. Infosecurity-magazine.com also names Belgium and Latvia only as sites of the 2022 searches.
- Arrest timing: Bleepingcomputer.com and cyberscoop.com describe two arrests in 2022 followed by seven suspects in the expanded action. Helpnetsecurity.com says seven were arrested over multiple action days. Infosecurity-magazine.com, the most recent source, says two were arrested in 2022, one in Cyprus in May 2025, and seven suspects were arrested in the November 2026 action for extradition to Germany. It also says seven network members were identified in 2022. Whether the earlier arrests are included in the seven is not fully clear. Cyberscoop.com describes the searches as taking place on Tuesday, 3 November.
- Extent of takedown: Earlier coverage framed the operation as a dismantling of the network. Infosecurity-magazine.com reports that police do not claim to have fully dismantled it, so this later account is the more cautious one.
Linha do tempo
-
Police Seize 100+ Servers in Four-Year International Investment Fraud Takedown
ler a análise desta fonte ocultar
German-led law enforcement, coordinated by the Itzehoe Public Prosecutor's Office and Europol, conducted an action day on November 3, 2026 against a company believed to host fraudulent investment websites used in a long-running scam scheme. Authorities seized over 100 servers, shut down several scam websites, arrested seven suspects for extradition to Germany, searched 17 locations, and seized evidence and assets. The scheme lured victims via deceptive ads promising high-return, no-risk investments, then handed victim data to criminal call centers in Albania, Kosovo, and North Macedonia, where scammers posing as brokers used social engineering to extract funds before cutting contact. Investigators estimate losses exceeding €4m ($4.5m) across potential victims in up to 50 countries.
Technical Details
The operation involved cooperation between Albania, Cyprus, Finland, Germany, Israel, Kosovo, and North Macedonia. The case originated in 2022 from a German couple's complaint about being unable to withdraw funds. Prior action days occurred on September 6, 2022 (searches in Belgium and Latvia, two arrests, identification of seven network members including call center managers) and May 13, 2025 (eight simultaneous searches in Albania, Cyprus, and Israel, one arrest in Cyprus, seizure of devices, documents, and cash). Police note they are not claiming to have fully dismantled the network. The FBI reported investment fraud as the highest-grossing cybercrime type in 2025, generating nearly $8.7bn, with other notable European schemes including an €89m ring dismantled in 2023 and a €15m operation disrupted in 2021.
-
German Police Dismantle Crime-as-a-Service Provider Behind Fake Investment Trading Platforms
ler a análise desta fonte ocultar
German law enforcement led a multinational investigation that uncovered an alleged crime-as-a-service operation supplying fraudulent trading platforms used by investment scam operators to defraud victims. The service reportedly provided ready-made infrastructure that lowered the technical barrier for running fake investment schemes, enabling multiple fraud groups to target victims across borders. Details on the scale of financial losses, number of victims, and arrests remain limited in initial reporting.
-
Europol Dismantles Investment Fraud Network Spanning 50 Countries, Arrests Seven
ler a análise desta fonte ocultar
Europol announced the takedown of a large-scale investment fraud operation that allegedly impacted victims in more than 50 countries, causing estimated losses of at least $4.5 million. Coordinated searches across 17 countries on Tuesday led to the arrest of seven suspects and the seizure of over 100 servers. The scheme was run by a company allegedly operated from Cyprus and Israel, which provided trading platforms and call-center infrastructure to cybercrime groups. Call centers linked to the operation were located in Albania, Kosovo, and North Macedonia.
Technical Details
The operation used affiliate marketing and online advertisements to funnel potential victims to fraudulent cryptocurrency, forex, and stock trading platforms. Purchased victim data from these ads was used by call-center operators to contact targets directly. Victims were shown fabricated profits and subjected to psychological pressure to invest additional funds; when they attempted withdrawals, operators used delaying tactics before eventually cutting off contact entirely, leaving victims unable to recover their money. The investigation originated from a 2022 tip by a German couple unable to withdraw funds, leading to two initial arrests that year and further evidence that enabled this week's expanded takedown.
Remediation
The seven suspects arrested face extradition to Germany for prosecution. The joint investigation was supported by law enforcement in Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia, and Poland.
-
Europol-led Operation Dismantles €4M Investment Fraud Network, 7 Arrested, 100+ Servers Seized
ler a análise desta fonte ocultar
A coordinated law enforcement operation led by German prosecutors in Itzehoe, supported by Europol and Eurojust, dismantled an international investment fraud network believed to have targeted victims in at least 50 countries with losses exceeding €4 million. The investigation began in 2022 after a German couple reported being unable to withdraw profits from an online trading platform. Over multiple action days, police arrested seven suspects, including call centre managers, and seized over 100 servers along with cash and other evidence across 17 locations, including a call centre in Kosovo.
The scheme used fake cryptocurrency, forex and stock trading platforms to lure victims with promises of high returns, showing inflated fake profits to build trust before pressuring victims into investing larger sums. Investigators traced the infrastructure to a Cyprus- and Israel-based company allegedly providing "crime-as-a-service" by supplying fraudulent scam websites to criminal groups, whose suspected clients operating fraudulent call centres were located in Albania, Kosovo and North Macedonia.
Technical Details
The operation unfolded in stages: a first action day resulted in two arrests and evidence seizure; analysis of that evidence identified seven additional suspects, including call centre managers; a second action day led to more arrests and seizure of evidence and cash, which in turn led investigators to the Cyprus/Israel-based scam-website supplier. On the final action day, authorities searched 17 locations and seized more than 100 servers. Eurojust established two joint investigation teams and coordinated judicial action, while Europol deployed digital forensics experts to Albania and Kosovo. Participating countries included Germany, Cyprus, Finland, Albania, Israel, Kosovo and North Macedonia.
Remediation
The seven suspects were arrested for surrender or extradition to Germany to face prosecution.
-
European Police Seize 100+ Servers, Arrest 7 in Investment Scam 'Crime-as-a-Service' Takedown
ler a análise desta fonte ocultar
Europol and Eurojust coordinated a law enforcement action involving Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia that led to the arrest of seven suspects and the seizure of over 100 servers tied to a company providing fraudulent trading websites to criminal gangs as a 'crime-as-a-service' model. The four-year investigation began in 2022 after a German couple reported being unable to withdraw funds from an online trading platform, eventually linking the operation to call centers defrauding victims in at least 50 countries. The scheme used deceptive ads to lure victims to fake investment platforms, stole their personal data, and sold it to call center operators who used fabricated profits and psychological pressure to extract larger transfers before cutting off contact.
Technical Details
The alleged service provider operated out of Cyprus and Israel, supplying fraudulent trading platforms to clients running call centers in Albania, Kosovo, and North Macedonia. An initial 2022 action day resulted in two arrests and evidence seizure, and further Europol-supported analysis identified seven additional suspects, including suspected call center managers. This takedown follows a pattern of similar operations dismantled across Europe, including a 2022 network stealing at least €3 million monthly, 2023 and 2024 call center takedowns, and 2025 actions in Spain involving over €460 million laundered and a €50 million fraud ring dismantled by Austrian and Albanian authorities in April 2025.