Loading story…
Dutch police arrested a 21-year-old man from Dordrecht suspected of selling access to JokerOTP, a phishing automation tool used to intercept one-time passwords (OTPs) and bypass multi-factor authentication. Authorities said the suspect marketed the service via Telegram and was found in possession of license keys used to provide other criminals access to the bot.
JokerOTP is described as a phishing-as-a-service capability that can automatically call victims, impersonate legitimate security alerts, and trick targets into entering OTPs; reporting also indicates it could be configured to capture additional sensitive data such as PINs, payment card data, and social security numbers, and target users of services including PayPal, Venmo, Coinbase, Amazon, and Apple. The arrest is the third tied to the JokerOTP operation, following the earlier arrests of the alleged developer (April 2025) and a co-developer (August 2025); UK law enforcement previously assessed the tool was used 28,000+ times across 13 countries and linked to at least $10 million in losses.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Investigators said they had identified dozens of suspected JokerOTP buyers in the Netherlands and expected additional prosecutions as the investigation continues. The announcement accompanied the latest arrest in the case.
Dutch police arrested a 21-year-old man from Dordrecht suspected of distributing JokerOTP via Telegram and possessing license keys for the tool. Authorities said he is the third person arrested in the case.
Authorities arrested a co-developer of JokerOTP in a follow-on action later in 2025, identified in reporting as occurring in August 2025. This marked the second arrest tied to the operation.
After a three-year joint investigation by Dutch and U.K. authorities, police dismantled the JokerOTP phishing-as-a-service operation in April 2025. The platform's developer was arrested as part of the takedown.
Over a two-year period, JokerOTP was allegedly used more than 28,000 times in 13 countries to capture one-time passwords through automated social-engineering calls, causing at least $10 million in losses. The tool enabled account takeovers and fraud by helping attackers bypass multi-factor authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch authorities reported two separate but related forms of **financial cyber-enabled fraud**. In one case, three Dutch men in their twenties were sentenced to prison terms of three to seven years for running a large-scale phishing and **bank helpdesk fraud** operation that stole hundreds of thousands of euros. Prosecutors said the group used stolen victim data, phishing emails, fake banking sites, follow-up phone calls, cash-out teams at ATMs, mule accounts, and card collection teams to drain accounts, with the lead suspect allegedly coordinating around 100 callers and operating from luxury apartments in Rotterdam. In a separate Dutch court case, a 34-year-old Amsterdam man was prosecuted for allegedly helping open dozens of **ABN AMRO** bank accounts in other peoples’ names by bypassing facial verification during remote onboarding. According to the court and prosecutors, the scheme involved replacing ID document photos with the suspect’s image and altering selfies so they matched the victim documents closely enough to defeat the bank’s face-scan checks. The activity was detected by the bank in spring 2025, and investigators reportedly found victim IDs and linked email accounts on the suspect’s phone, indicating a deliberate effort to abuse digital identity verification for account creation and likely downstream fraud.
Jun 29, 2026
Dutch police said they dismantled an international investment fraud operation that allegedly used fake cryptocurrency trading platforms and bogus financial advisers to steal from victims worldwide. Investigators said the network had operated since at least 2021 through roughly 20 to 24 call centers in multiple countries, with more than 700 staff persuading targets to invest and then showing fictitious profits to induce additional payments. Authorities linked at least 550 fraud reports and about **$28.6 million** in reported losses to the group, while estimating victims in the Netherlands alone lost nearly **€25 million** and that tens of thousands of people may have been affected globally. Authorities made multiple arrests across several countries and identified a 46-year-old Israeli-Polish suspect as a central figure in the scheme. The suspect, described as a well-known hacker, was arrested in Poland on May 26 and extradited to the Netherlands; investigators allege he played a key technical and organizational role in helping the group conceal identities, mask call-center locations, and evade law enforcement. Dutch investigators said they traced IP addresses, financial routes, and other digital evidence to map the organization’s infrastructure, and believe the operation at one point generated more than **€100 million per month**.
Jul 18, 2026
Dutch police said their investigation into the cyberattack on telecom provider **Odido** found indications that Dutch nationals may have helped carry out the breach, which exposed personal data belonging to more than **6 million customers**. Investigators from Team High Tech Crime and the Public Prosecution Service said a Dutch-speaking man allegedly impersonated an Odido IT employee in a call to customer service shortly before the February intrusion, suggesting the attackers used **social engineering** and phishing to gain access. Authorities said the attackers accessed a compromised customer contact system used by Odido, downloaded customer records, and later distributed the stolen data publicly. Police have already taken multiple servers linked to the hacker group offline and are appealing for information from the public and people in cybercrime circles, while warning that the investigation is expected to continue for several more months.
Jul 15, 2026