Dutch Police Arrest Leader of 700-Person Investment Scam Network That Stole Over €100 Million Monthly
Police in the Netherlands have detained the alleged leader of an international investment fraud network that operated like a large corporation with more than 700 employees working in approximately 20 offices across multiple countries. The organization is believed to have stolen over 100 million euros per month by posing as financial consultants and convincing victims to transfer funds to fake trading platforms.
The main suspect, a 46-year-old dual Israeli-Polish citizen, was arrested on May 26 at a Polish airport while arriving from Dubai. He was extradited to the Netherlands and remanded in custody for at least 14 days. Authorities describe him as a key figure responsible for the technical infrastructure of the scam and note that he was previously known as a hacker targeted for breaching foreign government systems.
The fraudulent network functioned as a structured company since at least 2021, with one central division overseeing multiple offices. Separate teams focused on specific countries to identify and contact potential victims by phone and online. Employees used the titles of financial consultants and account managers, initially encouraging small investments that appeared profitable on rigged platforms before pressuring victims to deposit much larger amounts, often in cryptocurrency.
In the Netherlands, police have linked the scheme to around 550 complaints involving nearly 25 million euros in losses, with most victims losing more than 10,000 euros. Belgium has recorded approximately 200 additional reports. The total number of victims worldwide is estimated in the tens of thousands. Some victims described devastating personal impacts, including one man who could no longer afford food for his family and another who began contemplating suicide after losing all savings.
Further arrests took place in July. Two Dutch nationals aged 45 and 34, along with a 34-year-old Belgian citizen, were detained in Cyprus. A 25-year-old suspect was arrested in Belgium, and a 44-year-old Dutch national was taken into custody in Athens. Belgian authorities had previously detained five additional employees of the scam centers.
Investigators used financial records, IP addresses, and seized equipment to locate offices and identify suspects. Technology companies hosting the network’s infrastructure assisted in disabling key components, while Europol shared intelligence with multiple countries. Police continue to search for assets that can be frozen or confiscated and warn that victims may face secondary scams from fake “recovery” companies promising to return funds in exchange for upfront payments.
Related articles
Fake GTA and Ghost Casino Apps Flood Google Play Early Access with Scam Promises
Unscrupulous developers are exploiting Google Play's Early Access program to distribute applications that make false promises of earnings through fake games and casino experiences. These apps lack public ratings and reviews, preventing disappointed users from warning others before installation. Bitdefender reports that the scheme is heavily promoted via advertisements on TikTok, Facebook, and other social networks, often featuring deepfakes of actors, athletes, and celebrities to build credibility. Users are lured with offers of PayPal payments, cryptocurrency, gift cards, and casino jackpots, but the apps deliberately slow progress near withdrawal thresholds. After installation, the software displays generous virtual winnings that never translate into real payouts. The campaign relies on aggressive advertising and misleading interfaces to maximize installations before users realize the fraud.
BI.ZONE Mail Security 3.0 Enhances Detection of Password-Protected Archives and Spam Variants
BI.ZONE has released Mail Security 3.0, introducing new mechanisms to detect email threats and improved tools for administrators. The updated system now assigns additional risk scores to password-protected archives when their contents cannot be unpacked, without automatically classifying the archive itself as malicious. It also compares message texts to identify near-identical emails used in spam campaigns where attackers slightly alter wording to evade filters. Administrators can now incorporate SPF and DKIM verification results into delivery rules to better distinguish legitimate senders from impersonators. According to BI.ZONE statistics, phishing accounted for 90 percent of illegitimate email traffic in the first half of 2026. Additional protections include CAPTCHA challenges after repeated failed login attempts on administrative accounts. The release also adds bulk management of rules, improved logging with a side panel for message details, a new Events section, and Syslog export to external SIEM systems.
F6 and MAX Neutralize Over 2,550 External Phishing and Scam Resources in Two-Month Operation
F6 and the MAX messenger have jointly blocked more than 2,550 malicious external websites used for phishing, scams, and other forms of online fraud. The effort relied on the F6 Digital Risk Protection platform, which continuously scans for fake authentication pages and fraudulent resources targeting users. Monitoring took place during July and August 2026, after which experts from both organizations arranged for the sites to be taken down. The action focused exclusively on external resources and did not involve any malicious content hosted inside the MAX messenger itself. F6 Digital Risk Protection head Stanislav Goncharov noted that regular takedowns can reduce attacker activity over time, yet users must still verify website addresses manually before entering credentials or payment data.
Trezor Warns of Email Provider Breach Used in Targeted Phishing Campaign Against Hardware Wallet Users
Trezor has disclosed that attackers compromised an external email provider and leveraged it to send phishing messages that appeared to originate from the company. The emails carried the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and falsely claimed a hardware flaw in STM32 microcontrollers that would reduce entropy and allow seed phrase reconstruction. No such CVE exists, and the campaign followed classic social-engineering patterns of urgency and brand impersonation aimed at stealing recovery phrases. Trezor has since disabled the malicious domain and continues investigating how the provider was accessed. Similar messages may have reached users of BitBox, suggesting possible compromise of shared service providers across the hardware wallet ecosystem. The incident underscores the difficulty of detecting phishing when it originates from legitimate third-party infrastructure.