Search Engine “Malvertising” Ring Disrupted: DOJ Seizes Backend of $14.6 Million Bank Fraud Scheme

A sprawling cybercrime operation that weaponised trusted search engines to drain millions from American bank accounts has been dismantled, with the DOJ seizing a backend domain used to manage thousands of stolen credentials. According to Department of Justice (DOJ), the attackers bought advertising space on major search engines to display fake ads mimicking legitimate banking portals, directing victims to high-fidelity replica sites when they clicked sponsored links.

The criminals harvested credentials through a malicious programme embedded in the fake site and used those bank details on legitimate sites to access and drain funds. The seizure focused on web3adspanels[.]org, described as the operational backbone or backend web panel for storing and manipulating stolen login data.

FBI investigations indicate at least 19 victims, with attempted losses of approximately $28 million and actual losses of approximately $14.6 million, and authorities note the backend was still active as recently as November 2025. Authorities urge vigilance against malvertising, advising people to use bookmarks for login sites rather than relying on search results.