Dutch Police Arrest Leader of 700-Person Investment Scam Network That Stole Over €100 Million Monthly
Police in the Netherlands have detained the alleged leader of an international investment fraud network that operated like a large corporation with more than 700 employees working in approximately 20 offices across multiple countries. The organization is believed to have stolen over 100 million euros per month by posing as financial consultants and convincing victims to transfer funds to fake trading platforms.
The main suspect, a 46-year-old dual Israeli-Polish citizen, was arrested on May 26 at a Polish airport while arriving from Dubai. He was extradited to the Netherlands and remanded in custody for at least 14 days. Authorities describe him as a key figure responsible for the technical infrastructure of the scam and note that he was previously known as a hacker targeted for breaching foreign government systems.
The fraudulent network functioned as a structured company since at least 2021, with one central division overseeing multiple offices. Separate teams focused on specific countries to identify and contact potential victims by phone and online. Employees used the titles of financial consultants and account managers, initially encouraging small investments that appeared profitable on rigged platforms before pressuring victims to deposit much larger amounts, often in cryptocurrency.
In the Netherlands, police have linked the scheme to around 550 complaints involving nearly 25 million euros in losses, with most victims losing more than 10,000 euros. Belgium has recorded approximately 200 additional reports. The total number of victims worldwide is estimated in the tens of thousands. Some victims described devastating personal impacts, including one man who could no longer afford food for his family and another who began contemplating suicide after losing all savings.
Further arrests took place in July. Two Dutch nationals aged 45 and 34, along with a 34-year-old Belgian citizen, were detained in Cyprus. A 25-year-old suspect was arrested in Belgium, and a 44-year-old Dutch national was taken into custody in Athens. Belgian authorities had previously detained five additional employees of the scam centers.
Investigators used financial records, IP addresses, and seized equipment to locate offices and identify suspects. Technology companies hosting the network’s infrastructure assisted in disabling key components, while Europol shared intelligence with multiple countries. Police continue to search for assets that can be frozen or confiscated and warn that victims may face secondary scams from fake “recovery” companies promising to return funds in exchange for upfront payments.
Related articles
Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure
StackWorks has published the fourth installment in its investigative series on Aroshka Cloud, detailing how the cloud storage provider accused the studio of orchestrating a DDoS attack shortly after the third part appeared. The service published five posts claiming technical evidence linked StackWorks to the attack, including IP traces from Moscow, Ufa, and Stavropol, while asserting that its SOC 24/7 team mitigated a 3.5 Gbit/s assault within seconds. StackWorks responded with a pre-trial claim demanding removal of the posts and a public retraction, which Aroshka Cloud rejected within seven minutes. Analysis of the provider’s own Kwork job postings reveals requests for template-based support staff, a five-VDS server pool, and later up to eight NVIDIA H200 GPUs with InfiniBand, contradicting public statements about multi-country data centers and round-the-clock security engineers. Further inconsistencies include mismatched time zones in email headers, inflated user statistics, and reliance on the BeDrive script rather than custom development. The investigation continues with plans to involve law enforcement regarding suspicious visitor logs.
Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums
An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.
Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.