Loading story…
U.S. authorities extradited 26-year-old Algerian national Abdellah Belmili from Spain and charged him in the Western District of New York with conspiracy to commit bank fraud for allegedly operating the cybercrime marketplaces market0day.com and spoxy.us. Prosecutors said the platforms sold phishing kits targeting major U.S. financial institutions, compromised email server access, financial credentials, and bulk SMS services used in mass phishing campaigns, with transactions processed in Bitcoin. Investigators said undercover purchases in December 2020 included a JPMorgan Chase phishing kit and access to a compromised email server.
According to court allegations, Belmili, also known as "SPOX," "Spox," and Dila Belmili, created about 595 phishing kits and helped defraud multiple U.S. and U.K. financial institutions, affecting roughly 5,600 victims worldwide. Authorities linked him to the operation through embedded identifiers in phishing kit source code, social media and Google records, and Binance transaction data, and said about $900,000 moved through an account he controlled between January 2020 and January 2023. Prosecutors also alleged he secretly inserted backdoors into phishing kits sold to other criminals so he could continue harvesting victim data after the kits were resold; he is now in U.S. custody and faces up to 30 years in prison if convicted.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities seized a cloud computing account linked to Cambodia-based Huione Guarantee, also known as Haowang Guarantee, which they said facilitated cybercrime, money laundering, and scam operations through Telegram channels and escrow services. The reference describes this as a separate enforcement action from the Belmili extradition case.
U.S. authorities extradited Abdellah Belmili from Spain to the United States and charged him in the Western District of New York with conspiracy to commit bank fraud over his alleged operation of Market0Day and Spoxy.
Authorities say the flow of approximately $900,000 in deposits tied to the alleged conspiracy continued through January 2023, marking the end of the period cited in court filings.
Prosecutors allege that Belmili later launched Spoxy, a marketplace offering bulk SMS services used for mass phishing and related campaigns.
According to the Justice Department, Abdellah Belmili administered the cybercrime marketplace Market0Day in late 2020, where phishing kits and other fraud-enabling tools were sold.
Prosecutors allege that approximately $900,000 in deposits flowed to an account controlled by Abdellah Belmili between January 2020 and January 2023 as part of the alleged fraud conspiracy tied to Market0Day and Spoxy.
After being extradited to the United States, Abdellah Belmili made an initial appearance in Buffalo and was detained pending further proceedings in the bank fraud conspiracy case.
In December 2020, investigators reportedly purchased a JPMorgan Chase phishing kit and access to a compromised email server from Market0Day as part of the investigation into Belmili's alleged operation.
The FBI began investigating Abdellah Belmili in September 2020 after receiving a tip from a confidential source about the alleged cybercrime operation tied to Market0Day and Spoxy.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcesecurityweek.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Jordanian national, **Feras Khalil Ahmad Albashiti** (aliases including **“r1z,” “Feras/Firas Bashiti”**), pleaded guilty in U.S. federal court to **fraud and related activity in connection with access devices** for acting as an **initial access broker** who sold unauthorized access to victim networks. Prosecutors said Albashiti used the **Russian-language cybercrime forum XSS** (XSS.is / XSS.pro) and, in May 2023, sold an undercover law enforcement officer unauthorized access to the networks of **at least 50 companies** in exchange for cryptocurrency; the charge carries a maximum penalty of **10 years in prison** and significant fines, with sentencing scheduled for **May 2026**. Court reporting adds that Albashiti’s dealings with an undercover FBI agent included selling a **cracked penetration-testing tool**, then offering access to dozens of companies via **two firewall exploitation methods** for about **$5,000**, and later marketing an **“EDR killer”** capability; the FBI paid **$15,000** for a version of malware described in filings as “novel” and effective at disabling multiple EDR products. Investigators attributed an IP address linked to Albashiti to activity associated with a **June 2023 ransomware attack** against a U.S. manufacturing firm that reportedly caused roughly **$50 million** in damage, and they tied the “r1z” account to Albashiti via an email address also used in a prior U.S. visa application; he was residing in **Tbilisi, Georgia**, and was **extradited to the U.S. in July 2024** before reaching a plea deal.
Jun 29, 2026
Tyler Robert Buchanan, a 24-year-old British national from Dundee, Scotland, pleaded guilty in U.S. federal court in California to **conspiracy to commit wire fraud** and **aggravated identity theft** for his role in Scattered Spider’s large-scale social-engineering operation. Prosecutors said Buchanan and co-conspirators ran SMS phishing campaigns from September 2021 to April 2023 that impersonated corporate IT help desks and labor providers, used fake login pages and stolen credentials, and carried out SIM swapping to breach companies and individuals. The Justice Department said the scheme stole at least **$8 million in virtual currency** from U.S. victims across telecommunications, technology, cloud communications, outsourcing, gaming, and cryptocurrency sectors. Investigators tied Buchanan to the 2022 **0ktapus** campaign, which used fake Okta login pages to compromise more than 130 organizations, including **Twilio** and **Cloudflare**, and enabled downstream attacks affecting other major brands. Authorities said stolen credentials were funneled into a Telegram channel administered by Buchanan and an associate, and searches of his residence in Scotland uncovered victim company files, personal data, and roughly 20 devices. Buchanan was arrested in Palma de Mallorca by Spanish authorities, extradited to the United States, and has been in federal custody since April 2025; he now faces up to 22 years in prison, underscoring continued law-enforcement pressure on the loosely organized Scattered Spider group, an offshoot of **The Com**.
Jun 29, 2026
U.S. prosecutors have charged 19-year-old dual U.S.-Estonian citizen Peter Stokes, allegedly a member of the **Scattered Spider** cybercrime group who used the alias `Bouquet`, after his arrest in Finland on April 10. According to reports citing court records, Stokes was detained while allegedly attempting to board a flight to Tokyo and now faces wire fraud, conspiracy, and computer intrusion charges in a sealed six-count complaint, with U.S. authorities seeking his extradition to Chicago. Investigators allege he took part in at least four intrusions, including a 2023 breach of an online communications platform and other attacks carried out while he was still a teenager. The complaint links Stokes to Scattered Spider operations that relied on help-desk social engineering, credential resets, MFA fatigue, and SMS phishing to gain access to major corporate environments. One 2025 intrusion described in the filings allegedly targeted a multibillion-dollar luxury retailer, where attackers obtained administrator access, claimed to have stolen **100 GB** of data, and issued an **$8 million** extortion demand, causing more than **$2 million** in losses. The case adds to broader law-enforcement pressure on the financially motivated group, also tracked as **Octo Tempest**, which has been tied to intrusions affecting MGM Resorts, Caesars, Twilio, Reddit, Riot Games, Mailchimp, DoorDash, Harrods, Marks & Spencer, WestJet, and Jaguar Land Rover.
Jul 3, 2026