Major Phishing Network ‘GXC Team’ Dismantled, Network’s Suspected Leader Arrested in Spain
Published
- Key arrest: Spain's Guardia Civil has arrested a 25-year-old Brazilian national considered the primary developer of phishing kits for the Spanish-speaking world.
- Crime-as-a-Service model: The individual, operating under the alias "GoogleXcoder," sold credential theft kits to other cybercriminals through a CaaS model.
- Significant impact: The “GXC Team” network is responsible for stealing millions of euros by impersonating major public bodies and banking entities in Spain.
The Guardia Civil's Central Operational Unit (UCO) in Spain has dismantled one of the country's most active banking phishing networks, GXC Team. The operation culminated in the arrest of the network's suspected leader, a 25-year-old Brazilian national known by the alias GoogleXcoder.
The investigation, which involved collaboration with Brazilian Federal Police and the cybersecurity firm Group-IB, remains open as authorities analyze the seized digital evidence.
The "GoogleXcoder" Crime-as-a-Service Operation
The investigation revealed that "GoogleXcoder" operated a professional Crime-as-a-Service (CaaS) business, designing and marketing phishing kits capable of cloning the websites of financial institutions and state organizations, according to Guardia Civil.
These kits were sold to other criminal groups via the Telegram messaging app for hundreds of euros per day. One of the Telegram groups used by the criminals was brazenly named "Robarle todo a las abuelas" ("Steal everything from grandmothers").
The service included technical support and regular updates, enabling widespread and abusive deployment.
The 25-year-old operator maintained a "digital nomad" lifestyle, frequently moving between provinces and using stolen identities for phone lines and payment cards to evade detection.
He is accused of being the principal developer and supplier of sophisticated credential theft kits used to defraud countless victims across the nation.
Coordinated Raids and Seizures
The Guardia Civil operation concluded with the main arrest in San Vicente de la Barquera (Cantabria) and six additional raids in various Spanish cities, including Valladolid, Zaragoza, and Barcelona.
Authorities seized electronic devices containing phishing kits, cryptocurrency transaction records, and communications with dozens of other cybercriminals.
The investigation began in 2023 following a surge in phishing campaigns that impersonated prominent Spanish banks and government agencies.
Last month, a Chinese scammer was convicted in the U.K. after one of the world’s largest crypto seizures, and a network of over 300 SIM servers and 100,000 SIM cards in the New York tristate area was dismantled.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular