EN PT-BR
← Voltar ao feed
medium financial services cryptocurrency retail consumers

Russian-language traffer teams AtlasCore, PolyFucked and Magnetic Team sell AI-assisted fake Polymarket and Kalshi scam kits

2 fonte(s) · 2 atualização(ões) · publicado 28/10/2026 21:00 · coletado há 2 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 31/10/2026 00:01; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ recordedfuture.com ↗

Insikt Group (recordedfuture.com) reports that since spring 2026 several Russian-language "traffer" teams have moved their affiliate-fraud infrastructure toward fake prediction markets that impersonate Polymarket and Kalshi. Three teams, AtlasCore, PolyFucked and Magnetic Team (service "PredictON"), sell turnkey scam sites, admin panels, crypto payment rails, victim-management tooling and promotional playbooks, with affiliate revenue shares of 60–80%. AtlasCore's Telegram deposits channel claims about $10.97 million (exactly $10,971,989.72, mostly in Bitcoin, according to gbhackers.com) between 2 May and 18 September 2026. PolyFucked advertises about $2.4 million in quarterly turnover. Both figures are self-reported by the actors and unverified. Insikt Group attributed more than 100 domains and subdomains to the three teams. The platforms use forced-loss controls, fabricated trading activity, artificial withdrawal blocks and fees, and KYC flows that harvest card data, ID documents and selfies. AI is used across the whole operation, including synthetic influencers, generated logos and LLM-driven victim support. gbhackers.com says the surge coincides with a reported compromise at Polymarket itself that strained user trust. That claim appears only in that source and is not corroborated by the Recorded Future material.

Detalhes técnicos

  • AtlasCore: forum posts by "AtlasCore"/"AtlasCorp" appeared in May 2026 (recordedfuture.com). The panel is at atlascore-panel[.]net, with polymarket. and casino. sub-panels and a docs subdomain. Shared scam domains include prdct[.]cc, event-x[.]cc, predicate[.]cc, predicate[.]club and predictum[.]app.
  • AtlasCore's victim-facing JavaScript labels users "mamont" (mammoth). It exposes a global and per-victim win-chance setting (0 = always lose, 100 = always win) and imports data from the public Polymarket API. It includes WithdrawErrorModal, WithdrawModal and MamontWithdrawErrorBlock, plus withdrawal-error templates, custom fees and fake starting balances (gbhackers.com).
  • AtlasCore support automation uses NanoGPT keys with GPT-4o or Claude Sonnet 4 for victim replies. Cheaper models (GPT-4o Mini, Gemini 2.0 Flash, DeepSeek Chat) translate messages into Russian, with fallback to a secondary provider when a model refuses (recordedfuture.com).
  • PolyFucked: advertised by "after_day", previously linked to After Change OTC/mixer and After Drainer. The panel is at polyfucker[.]space. Shared domains are preds[.]co and resolve[.]bet, linked to forutsagt[.]bet (81[.]90[.]17[.]100) and kiro-cheap[.]pro. It claims smart-contract automated payouts and 180+ geographies. A fake "Profile Wallet" ETH address falsely presents preds[.]co as an official Polymarket mirror.
  • Magnetic Team: advertises 3,000+ simulated traders (bots) across 5,000+ markets. It offers configurable withdrawal-blocking pretexts and pools of up to 20,000 deposit wallets per blockchain, with exposed private keys for sweeping funds (gbhackers.com). A "withdrawal funnel" chains fake refusal reasons: identity verification, AML review, VIP upgrade fees and withdrawal taxes. A "Boost" module forces losses after consecutive wins.
  • The Magnetic Team panel code shows signs of LLM-assisted development, such as heavy English commenting and a "TEAM_V2_DESIGN.md" reference. Insikt Group describes this as style-based inference, not confirmed attribution (gbhackers.com).
  • Fake KYC pages harvest card numbers, CVVs, ID documents and selfies.
  • Distribution relies on Instagram Reels, Threads and YouTube Shorts. Operators use mobile proxies (luxproxy[.]cc, proxy-store[.]cc, proxy-seller[.]com), SIM-free US-configured devices and VPNs. They strip metadata so platforms do not label content as AI-generated (recordedfuture.com).
  • Manuals cover building synthetic influencers and generating logos with Gemini, Nano Banana or ChatGPT (gbhackers.com).

Remediação

  • Block and monitor the domains and IPs listed in the Recorded Future research. Hunt for WebSocket connections to polymarket[.]atlascore-panel[.]net (recordedfuture.com).
  • Watch for Instagram Reels and influencer accounts promoting trading links, and warn users about deposits to prediction-market sites promoted through them.
  • Users should use only official prediction-market domains and verify URLs before depositing. They should treat unexpected withdrawal fees or "tax" demands as fraud indicators and never submit ID documents or card data to unverified trading sites (gbhackers.com).
  • Insikt Group expects prediction-market fraud to become a reusable vertical, with domains rotating while the tooling persists (gbhackers.com).

Linha do tempo

  1. gbhackers.com ↗ · pub. 30/10/2026 08:46 · coletado 30/10 10:00

    Russian-language scam-as-a-service kits impersonate Polymarket and Kalshi; AtlasCore claims $11M in victim deposits

    ler a análise desta fonte

    Recorded Future's Insikt Group has tracked three Russian-language "traffer" teams — AtlasCore, PolyFucked and Magnetic Team — selling turnkey fake prediction-market platforms that impersonate Polymarket and Kalshi. Since spring 2026 the teams have supplied affiliates with cloned trading sites, admin panels, crypto payment rails, bot-driven fake liquidity and support services, with affiliate payouts of 60–80%. AtlasCore's Telegram "Deposits" channel logged roughly $10,971,989.72 between 2 May and 18 September 2026, mostly in Bitcoin, while PolyFucked claims about $2.4 million in quarterly turnover; these figures are self-reported by the actors and unverified. Insikt Group linked more than 100 domains and subdomains to the three teams. The surge coincides with a reported compromise at Polymarket itself that strained user trust.

    Technical Details

    The admin panels give operators full control over outcomes: AtlasCore's code exposes a win-chance setting where 0 means "always lose" and 100 "always win", plus withdrawal-error templates, custom fees and fake starting balances; victims are labelled "mamont" (mammoth). Magnetic Team implements a "withdrawal funnel" chaining fake refusal reasons — identity verification, AML review, VIP upgrade fees and withdrawal taxes — and a "Boost" module that forces losses after consecutive wins. It advertises over 3,000 bots across 5,000+ markets to simulate trading activity and generates pools of up to 20,000 deposit wallets per blockchain with exposed private keys for sweeping funds. Fake KYC pages harvest card numbers, CVVs, ID documents and selfies. All three teams use AI-assisted victim support, with AtlasCore recommending GPT-4o or Claude Sonnet 4 for chat replies and cheaper models to translate victim messages into Russian; manuals cover building synthetic influencers, stripping metadata to evade Instagram AI labels, and generating logos with Gemini, Nano Banana or ChatGPT. Magnetic Team's panel code shows signs of LLM-assisted development (heavy English commenting, a "TEAM_V2_DESIGN.md" reference), which Insikt Group describes as style-based inference rather than confirmed attribution.

    Remediation

    Use only official prediction-market domains and verify URLs before depositing; treat unexpected withdrawal fees or "tax" demands as fraud indicators. Never submit ID documents or card data to unverified trading sites. Security teams should block and monitor the domains and IPs listed in the Recorded Future research and watch for Instagram Reels and influencer accounts promoting trading links. Insikt Group expects prediction-market fraud to become a reusable vertical, with domains rotating while the tooling persists.

  2. recordedfuture.com ↗ · pub. 28/10/2026 21:00 · coletado 29/10 15:00 primeiro registro

    Russian-language traffer teams AtlasCore, PolyFucked and Magnetic Team run AI-assisted fake prediction-market scams

    ler a análise desta fonte

    Insikt Group reports that since spring 2026 multiple Russian-language traffer teams have pivoted affiliate-fraud infrastructure toward fake prediction markets imitating Polymarket and Kalshi. Three teams — AtlasCore, PolyFucked and Magnetic Team (service "PredictON") — sell turnkey scam websites, admin panels, crypto payment rails, victim-management tooling and promotional playbooks, with affiliate revenue shares of 60–80%. AtlasCore's Telegram "Депозиты" channel claims roughly $10.97 million in deposits between 2 May and 18 September 2026, while PolyFucked advertises ~$2.4 million in quarterly turnover; both figures are threat-actor self-reported and unverified. The platforms embed forced-loss controls, fabricated trading activity, artificial withdrawal blocks/fees, and KYC flows that harvest card data, identity documents and selfies. AI is used across the kill chain: synthetic influencer personas for Instagram Reels, AI-generated logos, and LLM-driven victim support. Over 100 domains and subdomains were attributed to the three teams.

    Technical Details

    • AtlasCore: forum posts by "AtlasCore"/"AtlasCorp" (May 2026); panel at atlascore-panel[.]net with sub-panels polymarket./casino. and docs subdomain. Shared scam domains include prdct[.]cc, event-x[.]cc, predicate[.]cc, predicate[.]club, predictum[.]app. Victim-facing JavaScript labels users "mamont" (mammoth), exposes global/per-victim win-chance (0 = always lose, 100 = always win), imports data from the public Polymarket API, and includes WithdrawErrorModal, WithdrawModal, MamontWithdrawErrorBlock. Support automation uses NanoGPT keys with GPT-4o or Claude Sonnet 4 for victim replies and cheaper models (GPT-4o Mini, Gemini 2.0 Flash, DeepSeek Chat) for Russian translation, with fallback to a secondary provider on refusal.
    • PolyFucked: advertised by "after_day" (previously linked to After Change OTC/mixer and After Drainer); panel at polyfucker[.]space; shared domains preds[.]co, resolve[.]bet, linked to forutsagt[.]bet (81[.]90[.]17[.]100) and kiro-cheap[.]pro. Claims smart-contract automated payouts and 180+ geographies; a fake "Profile Wallet" ETH address falsely presents preds[.]co as an official Polymarket mirror.
    • Magnetic Team: 3,000+ simulated traders across 5,000+ markets, configurable withdrawal-blocking pretexts, forced-loss controls, and pools of up to 20,000 deposit wallets per blockchain; code shows likely AI-assisted development.
    • Distribution relies on Instagram/Threads/YouTube Shorts with mobile proxies (luxproxy[.]cc, proxy-store[.]cc, proxy-seller[.]com), SIM-free US-configured devices, VPNs, and stripping metadata so platforms do not label content as AI-generated.

    Remediation

    Block and monitor the listed domains and IPs, hunt for WebSocket connections to polymarket[.]atlascore-panel[.]net, and alert users that deposits to prediction-market sites promoted via Instagram Reels or synthetic influencers are likely fraudulent. Treat requests for card CVV plus identity documents and selfies on trading sites as a strong fraud indicator.