Dismantling of GXC Team Cybercrime Syndicate and Arrest of Leader in Spain

Spanish law enforcement successfully dismantled the GXC Team cybercrime syndicate and arrested its 25-year-old Brazilian leader, known as 'GoogleXcoder.' The Guardia Civil led a coordinated operation across multiple Spanish cities, including Cantabria, Valladolid, Zaragoza, Barcelona, Palma de Mallorca, San Fernando, and La Línea de la Concepción, resulting in the seizure of electronic devices, phishing kit source code, client communications, and financial records. GXC Team operated as a crime-as-a-service platform, providing AI-powered phishing kits, Android malware, and voice-scam tools through Telegram and Russian-speaking hacker forums. The group was a major supplier of credential theft tools, particularly in Spain, but also targeted banks, transport, and e-commerce entities in Slovakia, the UK, the US, and Brazil. Their phishing kits replicated the websites of numerous Spanish and international institutions, powering at least 250 phishing sites. The group developed at least nine Android malware strains capable of intercepting SMS and one-time passwords, facilitating account hijacking and fraudulent transactions. GXC Team also offered technical support and campaign customization, positioning itself as a professional and high-yielding crime platform. In late 2023, the group introduced an AI-powered tool for generating fraudulent invoices, which was used in wire fraud and business email compromise (BEC) schemes. This tool, named 'Business Invoice Swapper,' was available for rent starting at $2,000 per week or a one-time fee of $15,000, and required operators to input compromised email credentials and banking information for spoofing. The group promoted its products and services via Telegram channels, including one provocatively named 'Steal everything from grandmothers.' The operation led to the recovery of stolen cryptocurrency and the shutdown of these Telegram channels. According to the FBI, BEC scams like those enabled by GXC Team's tools have caused average losses of over $120,000 per incident, with total damages exceeding $2.4 billion. The dismantling of GXC Team is considered a significant blow to the cybercrime ecosystem in the Spanish-speaking world, disrupting a major supplier of advanced phishing and credential theft tools. The investigation was supported by threat intelligence from firms such as Resecurity and Group-IB, who had been tracking the group's activities and tool development. The arrest of 'GoogleXcoder' and the seizure of infrastructure are expected to have a substantial impact on the availability of crimeware in the region. Law enforcement continues to analyze the seized devices for further leads and to identify additional victims and collaborators. The case highlights the increasing sophistication of cybercrime groups leveraging AI and offering crimeware as a service to a global clientele.