Loading story…
Group-IB reported a fraud operation targeting B2B fintech platforms in France, where criminals created mule accounts to receive and move illicit funds. The activity focused on abusing business onboarding processes, allowing attackers to register accounts that appeared legitimate and could be used as intermediaries in broader financial crime schemes.
The operation highlights how fintech services can be exploited through fraudulent account creation rather than direct system intrusion. By establishing mule accounts on business-focused payment platforms, the actors gained infrastructure for laundering proceeds, obscuring transaction trails, and supporting downstream fraud against financial institutions and their customers.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published a blog post detailing a fraud operation involving mule account creation on B2B fintech platforms in France. No earlier discrete real-world events are described in the provided reference content.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
Spanish authorities arrested 16 people in **Operation Aguas Vivas** for allegedly laundering funds stolen through the **Mekotio** and **Grandoreiro** banking trojans, seizing devices and dismantling a four-tier criminal structure used to receive fraudulent transfers, redistribute money, move funds abroad, and conceal account activity. Investigators said the group obtained more than **€276,470** from compromised accounts and had access to roughly **€3.5 million** more that had not yet been transferred, underscoring how Brazilian banking malware operations had established a significant foothold in Spain. Security researchers reported that the malware activity continued and evolved despite the arrests, with **Mekotio** returning in phishing campaigns that used Spanish-language lures, ZIP archives, obfuscated batch files, fileless PowerShell, and **AutoHotkey** or **AutoIt**-based execution to evade detection and launch the final payload. ESET and Check Point said Latin American banking trojans remain heavily spam-driven, rely on victims interacting with fake banking overlays to steal credentials, and are expanding beyond Brazil into **Spain, Mexico, Portugal, Peru, and other parts of Europe**, with **Grandoreiro**, **Mekotio**, and related families such as **Casbaneiro** showing continued operational growth rather than major changes to core fraud techniques.
Aug 15, 2026
Researchers disclosed a long-running fraud operation that has impersonated major Russian companies since at least 2017, using cloned corporate websites, phishing emails, and cold calls to trick international businesses into paying in advance for nonexistent goods and services. The campaign has primarily targeted B2B trade customers in CIS countries, but the fake sites were also built to reach a wider audience with Russian, English, French, and Arabic content. Attackers posed as firms in sectors including manufacturing, logistics, and banking, then sent forged contracts, invoices, and other business documents containing fraudulent banking details. Investigators linked nearly 100 counterfeit domains to the scheme through shared DNS records, registration patterns, and infrastructure including IP addresses `212.127.73[.]235` and `167.86.100[.]68`. The fraudulent sites copied legitimate company branding and content, and in some cases even reproduced anti-fraud warnings from the real firms to appear credible. Researchers said newer domains increasingly used `.com`, `.org`, and `.net` rather than `.ru`, while stolen funds were routed to shell-company bank accounts. In one documented case, an Azerbaijani company reportedly lost **$150,000** in April 2025 after sending payment to the scammers.
Jul 30, 2026