Loading story…
Brazilian and German authorities have disrupted a cyber-enabled bank fraud operation that allegedly stole about €30 million from German bank accounts by exploiting a vulnerability introduced through a faulty software update at a payment and transaction processing provider. Investigators said the attackers used the flaw over four days in November 2023 to trigger unauthorized direct debits and withdrawals from German online banking customers, with media reports identifying Commerzbank as the affected institution. The bank confirmed that clients were impacted but said customers did not ultimately suffer financial losses.
The joint investigation, conducted by Brazil’s Federal Police with support from Germany’s BKA under Operation Klonen, led to arrests in both Brazil and Europe. Authorities said four suspects were arrested in Brazil and three more were identified or detained in Europe for prosecution in Spain and Bulgaria, while police also carried out 21 search-and-seizure warrants. Investigators said much of the stolen money was withdrawn in Brazil, with additional cash-outs in four European countries, and that the laundering scheme involved cloned payment cards; seized assets were reported at up to R$106 million (more than $20 million).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Brazilian investigators found that one suspect had run for elected office in 2024 and that part of the illicit proceeds was used to support that campaign. Local media reported the person had been a city council candidate in Rio de Janeiro.
Over four days in November 2023, attackers exploited a vulnerability introduced by a faulty software update at a payment and transaction-processing service provider and initiated numerous unauthorized direct debits or withdrawals from German online banking accounts. Authorities said the fraud caused losses of about €30 million and routed much of the stolen money to Brazil, with some cashed out in four European countries.
German and Brazilian media identified Commerzbank as the affected institution, and the bank said its clients were impacted by unauthorized debits tied to technical issues at a service provider. Commerzbank stated that customers would not suffer financial losses from the incident.
Brazilian authorities executed 21 search-and-seizure warrants across seven cities, arrested four suspects in Brazil under preventive detention warrants, and identified or arrested three additional suspects in Europe for prosecution in Spain and Bulgaria. A Brazilian federal court also ordered the seizure of financial assets, vehicles, and real estate worth up to R$106 million, and police seized items including a 3-D printer used to make weapons.
Brazil’s Federal Police, supported by Germany’s BKA and assisted by authorities in Spain, Bulgaria, and the Frankfurt public prosecutor’s office, opened a joint investigation into the bank fraud scheme under Operation Klonen. Investigators traced laundering through pass-through accounts, companies, payment institutions, virtual-asset platforms, and cloned or unauthorized payment cards.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcegov.br
Open sourcebka.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Brazilian Federal Police, supported by **ESET**, **Interpol**, Spain’s National Police, and **Caixa Bank**, disrupted the **Grandoreiro** banking trojan operation and arrested five suspects tied to its infrastructure. Investigators said the malware crew had been active since at least 2017, primarily targeting **Spain, Mexico, Brazil, and Peru**, and used the trojan to conduct hands-on banking fraud through credential phishing, remote interaction with victims’ machines, screen monitoring, and keylogging. Authorities said the group moved at least **€3.6 million** through fraud since 2019, while Caixa Bank linked the operators to roughly **$120 million** in losses. Grandoreiro was distributed through spam campaigns using fake **Java** or **Flash** updates and other lures, including COVID-19-themed messages, with payloads often delivered in encrypted ZIP archives via public file-sharing services. ESET said the Delphi-based malware used a modular design with bank-specific DLLs, a **domain generation algorithm (DGA)** for command-and-control discovery, registry-stored configuration, startup-folder persistence, and evasion features such as binary padding and anti-emulation; it also stole credentials from Chrome and Outlook and attempted to disable banking protection tools. By tracking the DGA and clustering command-and-control servers, researchers estimated about **551 daily unique connections** and **114 new daily victims**, and said the law-enforcement action appears to have halted the operation for now, though a return on new infrastructure remains possible.
Aug 15, 2026
International law enforcement agencies dismantled three interconnected credit card fraud and money laundering networks responsible for defrauding millions of victims worldwide. The operation, coordinated by Eurojust and Europol and involving authorities from Germany, the USA, Canada, Singapore, Luxembourg, Cyprus, Spain, Italy, and the Netherlands, resulted in the arrest of 18 individuals, including five executives from four German payment service providers. The fraudsters used stolen credit card data to create fake online subscriptions for dating, pornography, and streaming services, keeping charges below €50 to avoid detection and laundering proceeds through shell companies and complicit payment providers. Authorities estimate the fraud affected over 4.3 million cardholders, involved 19 million accounts, and resulted in losses exceeding €300 million, with attempted fraud totaling more than €750 million. The investigation began in Luxembourg and expanded globally, with German authorities conducting 29 searches and seizing assets worth over €35 million, including luxury vehicles, cryptocurrency, and electronic devices. The suspects, hailing from multiple countries, are accused of exploiting payment infrastructure and using shell companies in Cyprus and the UK to obscure transactions. The operation, dubbed "Operation Chargeback," highlights the role of complicit financial service providers and the use of "Crime-as-a-Service" vendors to facilitate large-scale, cross-border financial crime. The case underscores the complexity and international scope of modern payment fraud and the importance of coordinated law enforcement action.
Jul 12, 2026
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026