GXC Team CaaS phishing ecosystem disrupted after global banking-fraud tool sales
Threat Actor Meta
Summary
Hide ▲
Show ▼
The arrest of the alleged leader disrupted GXC Team's Crime-as-a-Service phishing ecosystem, cutting off turnkey tooling used for banking fraud by criminal customers worldwide. The group sold customized phishing kits, an Android Trojan, and AI-based voice-scam tools through Telegram channels and underground forums. Its services were linked to attacks on banks, transportation firms, and e-commerce platforms across Spain, Brazil, Slovakia, the UK, and the US.
Related Happenings
European Council sanctions Emennet Pasargad over cyber-enabled activity
Regulatory/Legal Action
First: 26.05.2026 18:48
Last: 26.05.2026 18:48
Sources 1
About this happening:
The **European Council** imposed **sanctions** on Iranian company **Emennet Pasargad**, escalating legal pressure over alleged **hacking** and **disinformation** activity. The act...
European Council sanctions Emennet Pasargad over cyber-enabled activity
Regulatory/Legal ActionAbout this happening: The **European Council** imposed **sanctions** on Iranian company **Emennet Pasargad**, escalating legal pressure over alleged **hacking** and **disinformation** activity. The act...
Formula 1 fan scam ecosystem campaign
Campaign
First: 25.05.2026 12:00
Last: 25.05.2026 12:00
Sources 1
About this happening:
A coordinated scam ecosystem is targeting **Formula 1 fans** with **fake streaming apps**, **counterfeit merchandise**, and **social-media lures**, creating theft, fraud, and malw...
Formula 1 fan scam ecosystem campaign
CampaignAbout this happening: A coordinated scam ecosystem is targeting **Formula 1 fans** with **fake streaming apps**, **counterfeit merchandise**, and **social-media lures**, creating theft, fraud, and malw...
Interpol Operation Ramz cybercrime crackdown in MENA
Law Enforcement
First: 18.05.2026 17:00
Last: 18.05.2026 17:00
Sources 1
About this happening:
**INTERPOL**'s **Operation Ramz** led to **more than 200 arrests** across the **Middle East and North Africa**, with law enforcement also identifying **382 additional suspects** i...
Interpol Operation Ramz cybercrime crackdown in MENA
Law EnforcementAbout this happening: **INTERPOL**'s **Operation Ramz** led to **more than 200 arrests** across the **Middle East and North Africa**, with law enforcement also identifying **382 additional suspects** i...
US Scam Center Strike Force indictments and domain seizures against scam centers
Law Enforcement
First: 24.04.2026 19:48
Last: 24.04.2026 19:48
Sources 1
About this happening:
US authorities **indicted** two people and **seized** scam infrastructure in a **financial-fraud** case targeting Southeast Asian scam centers, disrupting operations used to scam...
US Scam Center Strike Force indictments and domain seizures against scam centers
Law EnforcementAbout this happening: US authorities **indicted** two people and **seized** scam infrastructure in a **financial-fraud** case targeting Southeast Asian scam centers, disrupting operations used to scam...
FBI-led takedown of W3LL phishing network
Law Enforcement
First: 13.04.2026 13:35
Last: 13.04.2026 13:35
Sources 1
About this happening:
**FBI Atlanta** and **US and Indonesian law enforcement** took down the **W3LL** phishing network, escalating a cross-border cybercrime case tied to **more than $20 million in fra...
FBI-led takedown of W3LL phishing network
Law EnforcementAbout this happening: **FBI Atlanta** and **US and Indonesian law enforcement** took down the **W3LL** phishing network, escalating a cross-border cybercrime case tied to **more than $20 million in fra...
Timeline
-
13.10.2025 18:00 2 articles · 7mo ago
Spanish authorities arrest alleged GXC Team leader
Legal Policy Action UpdateSpanish authorities arrested a 25-year-old Brazilian national alleged to lead GXC Team, a Crime-as-a-Service operation that sold phishing kits, Android malware, and AI-based tools through Telegram channels and underground forums. The Guardia Civil said the suspect, known online as GoogleXcoder, was detained in San Vicente de la Barquera, Cantabria, after a year-long investigation with six coordinated raids across Spain, while investigators seized electronic devices containing source code, client communications, and cryptocurrency records and began disabling the group's online infrastructure. Authorities said the tools were used in attacks targeting banks, transportation firms, and e-commerce platforms in Spain, Brazil, Slovakia, the UK, and the US.
Show sources
- Spain Arrests Alleged Leader of GXC Team Cybercrime Network — www.infosecurity-magazine.com — 13.10.2025 18:00
- Spain Arrests Alleged Leader of GXC Team Cybercrime Network — www.infosecurity-magazine.com — 13.10.2025 18:00