Seventeen Arrested In International Phishing Takedown Targeting Nearly Half A Million Victims

In a significant operation against cybercrime, Europol announced on Thursday that authorities have disrupted a major phishing campaign, impacting approximately 483,000 victims, predominantly in Spanish-speaking countries. Law enforcement agencies from Spain, Argentina, Chile, Colombia, Ecuador, and Peru coordinated efforts last week, leading to the arrest of 17 individuals and the seizure of over 900 items, including electronic devices, vehicles, and weapons.

The operation targeted a phishing-as-a-service platform known as iServer, which had been under the control of an Argentinian national for the past five years. Europol confirmed that the platform boasted more than 2,000 users, primarily aiding criminals in unlocking stolen mobile phones.

Cybersecurity firm Group-IB, which alerted Europol to the iServer operation in 2022, noted that the platform primarily served Spanish-speaking criminals across North and South America, while also extending its reach into Europe. The service automated the creation of phishing pages that mimicked popular cloud-based mobile platforms, making it easier for low-skilled cybercriminals to harvest user credentials.

According to Group-IB, the phishing attacks specifically aimed to collect data that enabled access to mobile devices, allowing criminals to acquire passwords and unlink devices from their rightful owners. Victims often received SMS messages that appeared to be from Apple, luring them to click on a malicious link, which redirected them to the fraudulent site.

Europol reported that the criminal network successfully unlocked over 1.2 million phones, and with the assistance of its European Cybercrime Centre (EC3) and Ameripol’s Specialised Cybercrime Centre, most victims have now been identified.