Loading story…
Ukrainian cyberpolice, working with U.S. law enforcement, identified an 18-year-old suspect from Odesa as a key operator in an international cybercrime scheme that targeted customers of a California-based online retailer. Investigators said the operation used info-stealing malware to harvest browser session data and account credentials, leading to the compromise of roughly 28,000 to 30,000 customer accounts during 2024 and 2025.
Authorities said at least 5,800 of the stolen accounts were used to place unauthorized orders worth about $721,000, causing more than $250,000 in losses including chargebacks. The stolen data was allegedly processed and sold through online platforms, specialized resources, and Telegram channels or bots, while the suspect is believed to have managed infrastructure used to process and monetize the data. Ukrainian investigators searched two residences linked to the suspect and seized phones, computers, bank cards, storage media, server logs, account credentials, and cryptocurrency exchange information; officials have not named the retailer, the malware family, or any hacker group, and no arrest was announced.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Ukrainian cyberpolice identified an 18-year-old from Odesa as a central operator in the infostealer campaign and searched two residences linked to him. Investigators seized devices, bank cards, storage media, server logs, credentials, and cryptocurrency exchange information.
U.S. authorities notified Ukrainian investigators that hackers operating from Ukraine might be involved in attacks against American e-commerce platforms. This alert prompted the Ukrainian investigation into the scheme.
Using at least 5,800 compromised customer accounts, the operators made unauthorized purchases worth about $721,000. Authorities said the scheme caused more than $250,000 in losses, including chargebacks.
Between 2024 and 2025, an infostealer-based operation targeted customers of a California online retailer, stealing browser sessions and account credentials. Investigators said nearly 28,000 to 30,000 customer accounts were compromised during the campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcecyberpolice.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian authorities detained three suspects in Lviv accused of stealing more than **610,000 Roblox accounts** and reselling them for cryptocurrency through Russian websites and closed online communities. Investigators said the group targeted Ukrainian and foreign players, focusing on accounts with valuable digital items, rare equipment, and large **Robux** balances, including at least **357 high-value elite accounts**. Police estimate the operation generated roughly **10 million hryvnias**—about **$225,000 to $227,000**. According to investigators, a 19-year-old Ukrainian organized the scheme, built an account-compromise system, and recruited accomplices through gaming forums. The group allegedly spread **information-stealing malware** disguised as game-enhancement tools or free in-game bonus software, harvesting credentials and other sensitive data from victims’ devices between October 2025 and January 2026. During **10 searches** in western Ukraine, police seized digital devices, bank cards, notes, cash, and other evidence; the suspects were placed in pretrial detention and could face up to **15 years in prison** as forensic work continues to identify additional victims and accomplices.
Jun 29, 2026
U.S. authorities sentenced **Oleksandr Didenko**, a Ukrainian national, to **five years in prison** for running a scheme that provided **stolen U.S. identities** to North Korean IT workers so they could fraudulently obtain remote jobs at U.S. companies. He pleaded guilty in **November 2025** to charges including **aggravated identity theft** and **wire fraud conspiracy**, and was also ordered to forfeit **more than $1.4 million** (including seized cash and cryptocurrency). Prosecutors and the FBI described the activity as both a fraud operation and a national security threat, alleging it helped fund the North Korean regime. Court records say Didenko stole identities and sold “proxy” identities/accounts via **UpWorkSell / `upworksell.com`** (seized by the U.S. Justice Department), creating thousands of fraudulent accounts across freelance job platforms and related services. The operation supported North Korean workers in securing roles at **40 U.S. companies** and relied on **“laptop farms”** and other infrastructure to make activity appear U.S.-based; Didenko facilitated at least **871 proxy identities** and helped coordinate multiple laptop-farm locations (including in **Virginia, Tennessee, and California**, with additional locations reported elsewhere). One laptop-farm operator cited in reporting was **Christina Marie Chapman** in Arizona, who allegedly hosted systems from her home and was separately charged/arrested in connection with the broader scheme.
Jun 29, 2026
Ukrainian authorities dismantled **94 fraudulent call centers** in a nationwide operation involving the National Police of Ukraine, the Cyber Police Department, the Security Service of Ukraine, the Prosecutor General’s Office, and German law enforcement. Investigators carried out **more than 400 searches**—reported as **411 raids**—and formally identified **26 suspects** tied to schemes that targeted victims through fake banking, investment, and law-enforcement impersonation scams. According to investigators, operators persuaded victims to hand over money, disclose banking access, or install remote-access software, while some operations also marketed bogus medical products. Police seized large quantities of computer equipment, phones, SIM cards, bank cards, cash, vehicles, gold, and tools used to access cryptocurrency wallets, and authorities are now conducting forensic analysis to identify victims, calculate losses, and build cases against organizers, money mules, and laundering networks.
Aug 16, 2026