Global Phishing Network Preying on 480,000 Victims Dismantled

In a historic first, Europol and Ameripol have dismantled an international criminal network that targeted over 480,000 victims worldwide through a phishing platform primarily aimed at unlocking stolen or lost mobile phones. The operation, which took place between September 10 and 17, 2024, spanned Spain and multiple Latin American countries, leading to 17 arrests and the seizure of 921 items.

This unprecedented collaboration between Europol's European Cybercrime Centre (EC3) and Ameripol's Specialised Cybercrime Centre brought together law enforcement agencies from Spain, Argentina, Chile, Colombia, Ecuador, and Peru. Together, they dismantled a phishing-as-a-service platform that had been in operation for over five years, offering criminals a method to unlock stolen phones.

How the phishing scam worked

The criminal operation was orchestrated by an Argentinian national who had been running the phishing platform since 2018. This individual, who was arrested during the action week, created a phishing service that allowed criminals — referred to as “unlockers” — to illegally regain access to stolen or lost phones by tricking legitimate owners into providing access credentials.

Victims, many of whom were Spanish-speaking nationals from Europe, North America, and South America, attempted to recover their phones but were phished in the process, resulting in the exposure of their personal and financial information.

The phishing platform was highly sophisticated, offering additional services like phishing via SMS, email, and phone calls, all at extra costs. Over 2,000 criminals registered on the platform during its operation, unlocking more than 1.2 million stolen mobile phones. Europol and its partners identified and shut down the platform as part of a larger effort to combat mobile phone-related cybercrime.

Impact of the phishing campaign

With 483,000 victims worldwide, the network's reach was vast, and its operations affected citizens across several continents. Many victims, lured by urgent and official-looking phishing messages, unknowingly provided their credentials, allowing criminals to bypass the security measures of lost or stolen phones.

The phishing messages typically imitated legitimate communications from service providers, urging recipients to take immediate action. Once users complied, the criminals took control of their phones, unlocking them for resale or further illegal use.

In addition to the arrests, law enforcement officials conducted 28 searches across multiple countries, seizing mobile phones, electronic devices, vehicles, and weapons. The seizure of these items is expected to significantly disrupt the activities of the criminal network, which had been thriving for several years.

Protecting from phishing scams

Phishing remains a common tactic used by cybercriminals, often involving emails or messages that mimic legitimate companies or service providers. These fraudulent communications are designed to trick recipients into revealing personal, financial, or security information. To protect yourself from phishing attacks, consider the following tips:

• Use antivirus software and internet security suites on all devices and update them regularly.
• Keep operating systems and security software up-to-date.
• Create unique, strong passwords for all online accounts and change them regularly.
• Be cautious of emails or messages that seem urgent, include attachments, or ask you to click on suspicious links.
• If in doubt, do not provide any personal or financial information through email or message replies.