Loading story…
Spanish National Police, in collaboration with German authorities and Europol, arrested 34 individuals linked to the Black Axe criminal organization in a coordinated operation across Seville, Madrid, Málaga, and Barcelona. The suspects, primarily of Nigerian origin, are accused of orchestrating large-scale cyber fraud schemes, including business email compromise (BEC), romance scams, and phishing attacks, resulting in nearly €6 million in losses in Spain alone. Authorities seized cash, electronic devices, vehicles, and froze significant sums in bank accounts during the raids, while also uncovering the group's strategy of recruiting vulnerable locals as money mules to launder illicit proceeds.
The Black Axe group, originating from Nigeria and now boasting an estimated 30,000 members worldwide, has been implicated in a range of criminal activities, with cyber-enabled fraud as a major revenue stream. The investigation revealed that the Spanish cell was part of a broader European network, using sophisticated man-in-the-middle (MITM) tactics to intercept and redirect corporate payments. Four main suspects have been placed in pretrial detention, facing charges including aggravated fraud, money laundering, and membership in a criminal organization, while authorities continue to pursue additional leads and potential arrests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Following the arrests, four alleged leaders were kept in custody or placed in pretrial detention. They face charges including aggravated continuous fraud, criminal organization membership, money laundering, document forgery, and obstruction of justice.
During the Spanish operation, investigators froze roughly €119,000 in bank accounts and seized more than €66,000 in cash, with some reports also noting vehicles and electronic devices were confiscated. Authorities attributed about €5.93 million to €6 million in fraud losses to the case.
Spanish authorities, supported by Europol and Germany's Bavarian State Criminal Police Office, carried out coordinated raids in Seville, Madrid, Málaga, and Barcelona and arrested 34 suspects tied to the Black Axe criminal network. The operation focused on disrupting the group's leadership, money-mule infrastructure, and broader European fraud activity.
Before the takedown, Spanish National Police, Germany's Bavarian State Criminal Police Office, and Europol coordinated intelligence sharing, analytical support, and investigative work to map Black Axe's multi-country structure and financial activity. Investigators linked the network to cyber-enabled fraud schemes including business email compromise, phishing, romance scams, and adversary-in-the-middle attacks.
Interpol's October 2022 Operation Jackal led to 75 arrests across 14 countries in an earlier international law-enforcement action against Black Axe-linked criminal activity. This is cited as prior action preceding the Spain-focused case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Swiss authorities arrested 10 suspected members of the Nigerian criminal organisation **Black Axe** in coordinated raids across several cantons, including the group’s alleged Regional Head for Southern Europe. Prosecutors and police in Zurich said the suspects were tied to **romance scams**, other cyber-enabled fraud schemes, and **money laundering** that caused losses of millions of Swiss francs. The Swiss-led investigation was carried out with German law enforcement and supported by **Europol**, which provided intelligence analysis, cross-border coordination, and a data sprint in Madrid to map the group’s structure and links to related cases, including in Spain. Authorities described Black Axe as a highly structured transnational network with global reach and criminal proceeds estimated in the billions of euros, and said the operation aimed to disrupt its distributed model and support asset seizures with assistance from the EU-funded **@ON Network**.
Jun 29, 2026
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
Spanish law enforcement successfully dismantled the GXC Team cybercrime syndicate and arrested its 25-year-old Brazilian leader, known as 'GoogleXcoder.' The Guardia Civil led a coordinated operation across multiple Spanish cities, including Cantabria, Valladolid, Zaragoza, Barcelona, Palma de Mallorca, San Fernando, and La Línea de la Concepción, resulting in the seizure of electronic devices, phishing kit source code, client communications, and financial records. GXC Team operated as a crime-as-a-service platform, providing AI-powered phishing kits, Android malware, and voice-scam tools through Telegram and Russian-speaking hacker forums. The group was a major supplier of credential theft tools, particularly in Spain, but also targeted banks, transport, and e-commerce entities in Slovakia, the UK, the US, and Brazil. Their phishing kits replicated the websites of numerous Spanish and international institutions, powering at least 250 phishing sites. The group developed at least nine Android malware strains capable of intercepting SMS and one-time passwords, facilitating account hijacking and fraudulent transactions. GXC Team also offered technical support and campaign customization, positioning itself as a professional and high-yielding crime platform. In late 2023, the group introduced an AI-powered tool for generating fraudulent invoices, which was used in wire fraud and business email compromise (BEC) schemes. This tool, named 'Business Invoice Swapper,' was available for rent starting at $2,000 per week or a one-time fee of $15,000, and required operators to input compromised email credentials and banking information for spoofing. The group promoted its products and services via Telegram channels, including one provocatively named 'Steal everything from grandmothers.' The operation led to the recovery of stolen cryptocurrency and the shutdown of these Telegram channels. According to the FBI, BEC scams like those enabled by GXC Team's tools have caused average losses of over $120,000 per incident, with total damages exceeding $2.4 billion. The dismantling of GXC Team is considered a significant blow to the cybercrime ecosystem in the Spanish-speaking world, disrupting a major supplier of advanced phishing and credential theft tools. The investigation was supported by threat intelligence from firms such as Resecurity and Group-IB, who had been tracking the group's activities and tool development. The arrest of 'GoogleXcoder' and the seizure of infrastructure are expected to have a substantial impact on the availability of crimeware in the region. Law enforcement continues to analyze the seized devices for further leads and to identify additional victims and collaborators. The case highlights the increasing sophistication of cybercrime groups leveraging AI and offering crimeware as a service to a global clientele.
Jun 29, 2026