Spanish Authorities Dismantle Advanced AI Phishing Operation GoogleXcoder

Spanish law enforcement recently dismantled an advanced AI-driven phishing network and arrested the mastermind developer known as “GoogleXcoder.” The operation targeted banks and government agencies and followed a Crime as a Service model, with the 25-year-old Brazilian developer living in Spain selling ready-to-use phishing kits to hundreds of criminals across Spanish-speaking countries.

The kits could clone the websites of banks and public agencies, enabling others to launch attacks with minimal technical skill, with many contacts made via Telegram where access to the tools cost hundreds of euros per day.

Dozens of institutions were impersonated in a single day, costing victims millions, and the investigation by the Civil Guard’s Cybercrime Department identified six other individuals using the services; arrests were carried out in San Vicente de la Barquera, Cantabria, and raids in Valladolid, Zaragoza, Barcelona, Palma de Mallorca, San Fernando, and La Línea de la Concepción, with devices seized for forensic analysis.

According to Civil Guard’s Cybercrime Department, collaboration with the Brazilian Federal Police and cybersecurity firm Group IB aided the cross-border case, and further arrests may follow as investigations continue.