Loading story…
The U.S. Department of Justice announced the seizure of the domain web3adspanels[.]org, which was used as a backend control panel for a sophisticated bank account takeover fraud operation targeting Americans. The criminal group behind the scheme purchased fraudulent advertisements on major search engines such as Google and Bing, which closely mimicked legitimate banking ads. Unsuspecting users who clicked these ads were redirected to counterfeit bank websites, where their login credentials were harvested using malicious code. The attackers then used these credentials to access real bank accounts and steal funds, resulting in at least $14.6 million in confirmed losses and $28 million in attempted thefts from 19 identified victims, including two companies in Georgia.
The seized domain stored thousands of stolen credentials and supported the fraud operation as recently as November 2025. The FBI’s Internet Crime Complaint Center (IC3) has received over 5,100 complaints related to similar bank account takeover schemes since January 2025, with reported losses exceeding $262 million. The takedown of the domain is part of a broader law enforcement effort to disrupt the infrastructure enabling these attacks and prevent further exploitation of stolen credentials.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
On or before December 23, 2025, the U.S. Department of Justice, FBI, and Estonian authorities seized the domain and associated database for web3adspanels.org, which served as a control panel for the bank account takeover scheme. Estonian law enforcement also preserved and collected data from servers hosting the phishing pages.
The seized domain was active as recently as November 2025 and hosted thousands of stolen credentials used in the fraud operation. Its continued operation showed the scheme was still functioning shortly before the takedown.
Investigators linked the operation to at least 19 known victims, including two companies in Georgia, with about $28 million in attempted losses and $14.6 million in confirmed losses. The stolen credentials were stored in a backend system associated with web3adspanels.org.
During 2025, a criminal group used fraudulent advertisements on search engines such as Google and Bing to redirect victims to counterfeit banking websites. Victims' login credentials were harvested and then used to access real bank accounts and steal funds.
Since January 2025, the FBI's Internet Crime Complaint Center has received more than 5,100 complaints tied to similar bank account takeover schemes, with reported losses exceeding $262 million. This broader trend provides context for the web3adspanels.org operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian national and web developer Sergei Anatolyevich Filimonov, 36, was extradited from the Republic of Georgia to the United States on allegations that he helped operate a bank-account takeover and wire-fraud scheme. Prosecutors allege that from November 2023 through October 2025, Filimonov and co-conspirators purchased sponsored-search advertisements, impersonated bank domains, and deployed fraudulent banking login pages to steal customer credentials and facilitate unauthorized wire transfers. The alleged operation maintained infrastructure to retain stolen credentials and gather information used to bypass bank security controls. U.S. authorities linked a December 2025 seizure of `web3adspanels.org` and its stolen-password database to at least 19 U.S. victims, about $28 million in attempted losses, and roughly $14.6 million in confirmed losses; alleged transfers involving two banks in June and November 2024 totaled nearly $6.315 million. Filimonov pleaded not guilty in the Northern District of Georgia on September 4 and remains in custody.
Sep 9, 2026
The FBI has issued a warning about a significant increase in account takeover (ATO) fraud schemes, with cybercriminals impersonating financial institutions to steal money and sensitive information. Since the beginning of the year, over $262 million in losses have been reported from more than 5,100 complaints. Attackers use social engineering tactics—including texts, calls, and emails—to trick victims into revealing login credentials, multi-factor authentication codes, or one-time passcodes. Once access is gained, criminals reset passwords, lock out account owners, and quickly transfer funds, often to cryptocurrency wallets, making recovery difficult. The FBI highlighted that these schemes are becoming more sophisticated, with tactics such as search engine optimization (SEO) poisoning, where fraudulent ads mimic legitimate e-commerce or financial sites to lure victims. The warning comes ahead of the holiday season, a period when such scams typically increase. The agency urges heightened vigilance, especially as cybercriminals exploit fears of fraudulent transactions and use impersonation of both financial institution staff and law enforcement to manipulate victims into providing sensitive account information.
Jun 29, 2026
The U.S. Department of Justice said it seized 39 domains and associated servers linked to a Pakistan-based cybercrime marketplace network allegedly operated by Saim Raza, also known as **HeartSender**. Prosecutors said the sites sold phishing kits, scam pages, email extractors, and other fraud-enabling tools to transnational organized crime groups, with the tooling used largely in **business email compromise** and credential-theft schemes that caused more than **$3 million** in victim losses. The takedown was carried out with the Dutch National Police as part of an international disruption effort targeting infrastructure that had allegedly supported criminal activity since at least 2020. Prior threat intelligence had linked the same ecosystem to the **Manipulaters Team**, a Pakistani group accused of marketing spam and malware tooling under the Saim Raza persona and advertising products as **FUD** to suggest evasion of antivirus and anti-spam defenses. Researchers identified recurring infrastructure patterns across the network, including domains using nameservers from **blazingfast.io** and **cloudflare.com**, registrations through **Internet Domain Service BS Corp.**, hosting on **Netsolutions** and **Cloudflare**, and naming conventions featuring terms such as `fud`, `tool`, `page`, `sender`, and `spam`. Authorities also said the marketplaces offered training materials, including YouTube tutorials, lowering the barrier for less technically skilled fraud actors.
Aug 15, 2026