Loading story…
U.S. authorities charged Google engineer Michele Spagnuolo with commodities fraud, wire fraud, and money laundering after alleging he used confidential internal Google search-trend data to profit on Polymarket under the username "AlphaRaccoon." Prosecutors said he accessed nonpublic Google information through internal systems and, between October and December 2025, placed roughly $2.75 million in event-based trades tied to outcomes such as the most-searched people on Google, ultimately generating about $1.2 million once the information became public and the markets settled.
The case was announced by the U.S. Attorney's Office for the Southern District of New York, with the CFTC filing a parallel civil complaint and the FBI involved in the investigation. Court filings and reporting say investigators traced multiple cryptocurrency transfers and wallet swaps allegedly used to conceal the source and ownership of proceeds before identifying Spagnuolo through payment records; he was arrested in New York, appeared in Manhattan federal court, and Google said it had placed him on leave while cooperating with law enforcement and treating the conduct as a serious breach of company policy.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
The Commodity Futures Trading Commission sued Michele Spagnuolo civilly over allegations that he used confidential internal Google 'Year in Search' data to place profitable Polymarket bets. The civil action accompanied the criminal case but represents a separate regulatory enforcement step.
Google said Spagnuolo accessed confidential marketing material through an internal employee tool and described the conduct as a serious policy breach. The company said it had placed him on leave and was cooperating with law enforcement.
The U.S. Attorney's Office for the Southern District of New York announced the unsealing of a criminal complaint against Michele Spagnuolo on charges including commodities fraud, wire fraud, and money laundering tied to alleged misuse of confidential Google information for Polymarket trades. The announcement said he was presented before U.S. Magistrate Judge Sarah Netburn in Manhattan federal court.
Boing Boing reported that Michele Spagnuolo was arrested in New York in connection with the alleged scheme. ABC News, as cited in the report, said he posted a $2.25 million bond.
Prosecutors said the charged trading scheme ran through December 4, 2025, marking the end of the period in which Spagnuolo allegedly placed the event-based trades using confidential Google information.
According to prosecutors, Michele Spagnuolo used nonpublic Google search-trend information accessed through internal systems to place Google-related prediction market trades on Polymarket. The alleged trading activity occurred between October 15 and December 4, 2025, with authorities saying he risked about $2.75 million and later earned roughly $1.2 million.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourceboingboing.net
Open sourcecftc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Federal prosecutors in California charged 10 foreign nationals tied to four cryptocurrency market-making firms—**Gotbit, Vortex, Antier, and Contrarian**—for allegedly running wash trading and pump-and-dump schemes that manipulated token prices and trading volume. According to the Justice Department, the FBI and IRS Criminal Investigation carried out an undercover operation in which agents created cryptocurrency tokens and posed as market participants to expose firms allegedly offering illicit services designed to inflate prices and lure retail investors into buying at artificial valuations. Three defendants—**Gleb Gora, Manu Singh, and Vasu Sharma**—were arrested in Singapore and extradited to the United States, where they appeared in federal court in Oakland, while two other defendants, **Antoine Tsao** and **Nemanja Popov**, had already pleaded guilty and been sentenced in related cases. Authorities said the schemes harmed investors in the United States and abroad, seized more than **$1 million** in cryptocurrency, and brought charges of **wire fraud** and **wire fraud conspiracy**, each carrying potential penalties of up to 20 years in prison and a $250,000 fine per count.
Jun 29, 2026
U.S. authorities extradited 26-year-old Algerian national Abdellah Belmili from Spain and charged him in the Western District of New York with conspiracy to commit bank fraud for allegedly operating the cybercrime marketplaces `market0day.com` and `spoxy.us`. Prosecutors said the platforms sold phishing kits targeting major U.S. financial institutions, compromised email server access, financial credentials, and bulk SMS services used in mass phishing campaigns, with transactions processed in Bitcoin. Investigators said undercover purchases in December 2020 included a JPMorgan Chase phishing kit and access to a compromised email server. According to court allegations, Belmili, also known as "SPOX," "Spox," and Dila Belmili, created about 595 phishing kits and helped defraud multiple U.S. and U.K. financial institutions, affecting roughly 5,600 victims worldwide. Authorities linked him to the operation through embedded identifiers in phishing kit source code, social media and Google records, and Binance transaction data, and said about $900,000 moved through an account he controlled between January 2020 and January 2023. Prosecutors also alleged he secretly inserted backdoors into phishing kits sold to other criminals so he could continue harvesting victim data after the kits were resold; he is now in U.S. custody and faces up to 30 years in prison if convicted.
Jun 29, 2026
Google filed a lawsuit in the U.S. District Court for the Southern District of New York against **Outsider Enterprise**, an alleged China-based cybercrime network accused of abusing **Gemini** and other AI tools to build phishing websites and support large-scale smishing campaigns targeting U.S. consumers. Google said the Telegram-based operation functioned as a phishing-as-a-service platform, offering more than 290 prebuilt templates and infrastructure used to impersonate brands and institutions including Google, YouTube, USPS, banks, DMVs, mobile carriers, and E-ZPass in order to steal credentials and payment information. According to Google, the campaign was tied to more than **9,000** fake websites, over **1 million** fraudulent URLs, and roughly **2.5 million** smishing messages sent to Android users during a two-week period in May, while users reported at least **55,000** related spam texts and losses reached millions of dollars across hundreds of thousands of victims. The company said it has disabled abusive accounts and infrastructure, is coordinating disruption efforts with the **FBI Cyber Division** and major U.S. carriers including **AT&T, T-Mobile, and Verizon**, and is pursuing claims under `RICO` and the `Lanham Act` as part of a broader effort to curb AI-enabled scam operations.
Aug 13, 2026