Loading story…
U.S. federal court in Boston sentenced Matthew Abiodun Akande, a 37-year-old Nigerian national living in Mexico, to eight years in prison for a multi-year scheme that compromised Massachusetts tax preparation firms and used stolen taxpayer data to file fraudulent U.S. tax returns. Prosecutors said Akande and co-conspirators used phishing emails posing as prospective clients to trick employees into installing remote access trojan (RAT) malware, including Warzone RAT, enabling theft of clients’ personally identifiable information (PII) and subsequent tax-refund fraud.
Court records and DOJ statements said the group filed 1,000+ fraudulent returns seeking over $8.1 million in refunds and obtained more than $1.3 million; Akande was also ordered to pay $1,393,230 in restitution. Akande was arrested at Heathrow Airport in October 2024, extradited to the U.S. in March 2025, and later pleaded guilty to 33 counts including conspiracy to obtain unauthorized access to protected computers, wire fraud, theft of government money, and aggravated identity theft; proceeds were routed to U.S. bank accounts and partially transferred onward, including to recipients in Mexico.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
In February 2026, a U.S. federal court in Boston sentenced Akande to eight years in prison and three years of supervised release for his role in the scheme. The court also ordered him to pay about $1.39 million in restitution.
In April 2025, Akande pleaded guilty to 33 counts stemming from the July 2022 indictment over the hacking of tax firms and fraudulent tax refund scheme.
Akande was extradited to the United States on March 5, 2025, to face charges related to the multi-year computer intrusion and tax fraud operation.
Akande was arrested at London Heathrow Airport in October 2024 in connection with the U.S. case involving intrusions into tax preparation firms and fraudulent tax refund claims.
A federal grand jury indicted Akande in July 2022 on charges including conspiracy, wire fraud, unauthorized access, theft of government funds, aggravated identity theft, and money laundering-related offenses tied to the tax refund fraud scheme.
Between about June 2016 and June 2021, Matthew A. Akande and co-conspirators targeted Massachusetts tax preparation firms with phishing emails that delivered remote access trojans, including Warzone RAT, to steal taxpayer data. The stolen information was used to file more than 1,000 fraudulent tax returns seeking over $8.1 million, with more than $1.3 million in refunds obtained.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. courts sentenced two Nigerian nationals for separate fraud operations that targeted victims through **business email compromise**, romance scams, and wire fraud. James Junior Aliyu received **90 months** in prison for his role in an international scheme that compromised business and personal email accounts, sent spoofed messages to reroute legitimate wire transfers, and stole about **$6 million** from victims since at least 2017. Prosecutors said Aliyu was arrested in Johannesburg in 2022, extradited to the United States, ordered to forfeit **$1.2 million** and pay **$2.4 million** in restitution, and is expected to be removed from the country after serving his sentence; co-conspirators Kosi Goodness Simon-Ebo and Henry Onyedikachi Echefu also pleaded guilty. In a separate case, Saheed Sunday Owolabi was sentenced to **15 years** in federal prison after prosecutors showed he used fake online identities to run romance scams, steal money and personal information, and launder proceeds through victim bank accounts. Authorities said the operation moved more than **$1.5 million** to Nigeria and included a real-estate wire fraud in which forged emails redirected home-sale funds to accounts controlled by the conspirators. Trial evidence included chat logs showing Owolabi unknowingly attempted to scam another fraudster, helping establish his central role in a scheme that U.S. officials said caused substantial financial hardship to victims across the country.
Jun 29, 2026
U.S. authorities sentenced **Oleksandr Didenko**, a Ukrainian national, to **five years in prison** for running a scheme that provided **stolen U.S. identities** to North Korean IT workers so they could fraudulently obtain remote jobs at U.S. companies. He pleaded guilty in **November 2025** to charges including **aggravated identity theft** and **wire fraud conspiracy**, and was also ordered to forfeit **more than $1.4 million** (including seized cash and cryptocurrency). Prosecutors and the FBI described the activity as both a fraud operation and a national security threat, alleging it helped fund the North Korean regime. Court records say Didenko stole identities and sold “proxy” identities/accounts via **UpWorkSell / `upworksell.com`** (seized by the U.S. Justice Department), creating thousands of fraudulent accounts across freelance job platforms and related services. The operation supported North Korean workers in securing roles at **40 U.S. companies** and relied on **“laptop farms”** and other infrastructure to make activity appear U.S.-based; Didenko facilitated at least **871 proxy identities** and helped coordinate multiple laptop-farm locations (including in **Virginia, Tennessee, and California**, with additional locations reported elsewhere). One laptop-farm operator cited in reporting was **Christina Marie Chapman** in Arizona, who allegedly hosted systems from her home and was separately charged/arrested in connection with the broader scheme.
Jun 29, 2026
U.S. authorities secured guilty pleas in two separate cyber-enabled criminal cases: a Ghana-based fraud ring that stole more than **$100 million** via **business email compromise (BEC)** and romance scams, and a **Phobos** ransomware administrator tied to a global extortion operation. The cases highlight parallel monetization paths—social engineering and payment redirection in BEC/romance schemes versus data encryption and extortion in ransomware-as-a-service (RaaS)—and both involve international arrests/extraditions to the United States. In the fraud case, **Derrick Van Yeboah** (40) pleaded guilty to conspiracy to commit wire fraud and agreed to pay **over $10 million** in restitution for his role in a Ghana-based operation that targeted U.S. victims from 2016 to May 2023, using spoofed emails to impersonate customers/employees and laundering proceeds through U.S. intermediaries before sending funds to coordinators in West Africa. Separately, **Evgenii Ptitsyn** (43) pleaded guilty to wire fraud conspiracy for helping develop, sell, distribute, and operate the **Phobos** ransomware platform, which the U.S. DoJ says hit **1,000+** entities and extorted **$16+ million**; he was arrested in South Korea in 2024, extradited to the U.S., and faces up to **20 years** in prison, with sentencing scheduled for July 15.
Jun 29, 2026