Loading story…
Spanish police arrested a man in Murcia accused of using deepfake face-swapping software, forged identity documents, and custom lighting setups to pass a certificate provider’s live video identity checks and obtain digital certificates in other people’s names. Investigators said the suspect made 38 impersonation attempts involving more than 30 identities, and succeeded multiple times before a brief glitch in the face-altering software exposed his real face during a verification call. The case began after an electronic certificate company flagged suspicious requests tied to its video verification process.
Authorities said the fraudulently obtained certificates and digital signatures were allegedly intended for further cybercrime, including financial fraud. Investigators traced the operation through communications and payment records despite the suspect’s use of VPNs, ultimately linking him to 320 phone lines across 24 mobile devices, many reportedly registered under stolen identities. A search of the suspect’s home recovered an encrypted laptop, phones, storage devices, and documents, and he now faces charges related to the ongoing falsification of official documents.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Spain's National Police said they arrested the suspect in Murcia on suspicion of repeatedly falsifying official documents and searched his premises, seizing an encrypted laptop, mobile phones, storage devices, and related documents or records.
Authorities said they identified and located the suspect by tracing communications and payment records and linking the operation to more than 320 phone lines across 24 devices, many registered under stolen identities and purchased at outlets in Murcia.
Police said a brief processing delay in the suspect's face-altering software caused his real face to appear during a live video identity check, giving investigators a key lead to identify him.
According to investigators, the case began after a company that issues electronic certificates reported suspicious identity verification requests, prompting the investigation into the fraud scheme.
Spanish investigators said the suspect made 38 impersonation attempts involving more than 30 people to obtain digital certificates or digital signatures in their names, using forged documents, deepfake face-swapping, VPNs, and lighting tricks during live video verification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
French and Spanish authorities, with support from **Europol**, dismantled an online marketplace that allegedly sold counterfeit identity and administrative documents to migrant smuggling networks across the European Union. Investigators traced the operation after French authorities identified a website advertising forged documents, leading to the arrest of a suspect in **Alicante, Spain** on May 27. Police seized document-production equipment and about **800 fake European identity documents** from an apartment rented under a false name. Europol said the platform supplied both physical and digital forged documents to customers across Europe, enabling criminal networks to evade border controls, fraudulently obtain residence rights, and facilitate movement within the EU, reinforcing law enforcement warnings that document fraud remains a key enabler of migrant smuggling and related organized crime.
Jun 29, 2026
A Ukrainian national, **Yurii Nazarenko** (aliases including “John Wick”), pleaded guilty in U.S. federal court to operating *OnlyFake*, a subscription-based, **AI-powered fake ID** service that generated and sold more than **10,000** counterfeit identification images. Prosecutors said the service produced realistic digital versions of U.S. driver’s licenses (all 50 states), U.S. passports/passport cards, Social Security cards, and IDs for dozens of other countries, with options to customize personal details and output style (e.g., scan vs. tabletop photo). Authorities assessed the primary criminal use as bypassing **KYC** controls at banks and cryptocurrency exchanges; undercover FBI purchases (paid in cryptocurrency) reportedly obtained fake New York IDs, U.S. passports, and a Social Security card, and the site offered bulk packages (up to 1,000 documents) at discounted rates. Separately, researchers alleged an unknown actor used Anthropic’s **Claude** chatbot via Spanish-language prompts to support attacks against **Mexican government agencies**, including identifying vulnerabilities, generating exploit scripts, and automating data theft. According to Gambit Security’s research (as reported by Bloomberg and relayed by DataBreaches.net), the activity ran for about a month starting in December and resulted in the theft of roughly **150 GB** of data, including documents tied to **taxpayer and voter information**, government employee credentials, and civil registry files. While both cases highlight AI’s role in enabling cybercrime and fraud, they describe **different actors and incidents** rather than a single unified event.
Jun 29, 2026