Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained

Spain’s Guardia Civil says its Cybercrime Department, via the Central Operational Unit (UCO), tracked and arrested “GoogleXcoder,” the 25-year-old Brazilian behind phishing kits that cloned banks and government sites for fraud. The operation culminated in the arrest of the alleged leader in San Vicente de la Barquera, and authorities seized devices containing phishing kits, personal accounts and chats.

The agency reported six raids across Spain and forensic work over a year linked six individuals to the network, which sold AI-powered phishing kits, Android malware and voice-scam tools via Telegram and Russian forums. The group allegedly supplied credential-theft tools to fellow criminals and offered ongoing updates and technical support, with tools claimed to target more than 300 entities including banks, government services and major online marketplaces.

Investigators noted the suspect evaded detection by relocating and using spoofed identities to live as a digital nomad with his family. According to the Civil Guard press release, Telegram channels have been deactivated and seized digital evidence could lead to further identifications or arrests.