Breaches

Dutch Police Arrest Third Suspect Behind JokerOTP Phishing Platform That Caused $10M in Losses

Zero Day Wire

11 Feb 2026 — 2 min read

Netherlands police have arrested a 21-year-old man from Dordrecht suspected of selling access to the JokerOTP phishing automation platform — a tool designed to intercept one-time passwords through automated voice calls that tricked victims into handing over their MFA codes.

The arrest is the third in a three-year investigation that dismantled the JokerOTP phishing-as-a-service operation in April 2025. Authorities previously arrested the platform's developer and a co-developer who operated under the aliases "spit" and "defone123."

How JokerOTP Worked

The platform operated on a subscription model, with the arrested suspect selling license keys via Telegram. Subscribers could configure the tool to automate calls to victims and capture OTPs, PINs, card data, and social security numbers. Targets included users of PayPal, Venmo, Coinbase, Amazon, and Apple.

The attack chain exploited a critical timing window. Attackers would use stolen credentials — obtained from infostealer malware or purchased on dark web markets — to initiate a login on a target account. This triggered a legitimate OTP delivery to the victim. Simultaneously, JokerOTP placed an automated call to the victim impersonating the service's security team, requesting the code they had just received.

"Victims were automatically called by the bot and informed that criminals were attempting to gain access to their account," explained Anouk Bonekamp, team leader of Cybercrime Oost-Brabant. "The bot then asked them to enter the one-time password. Victims therefore believe they are protecting themselves by cooperating."

Because the calls coincided precisely with the real authentication prompt, many victims failed to recognize the scam and willingly provided their codes.

Scale and Impact

Over two years of operation, JokerOTP was used in more than 28,000 attacks targeting users across 13 countries, causing an estimated $10 million in financial losses. Compromised accounts were used for unauthorized purchases, fund transfers, and full account takeovers.

Investigation Ongoing

Dutch police confirmed the investigation continues, with dozens of JokerOTP subscribers in the Netherlands already identified and facing prosecution. The takedown underscores law enforcement's increasing focus on the PhaaS ecosystem that enables credential theft at scale.

Recommendation

Users who receive unsolicited calls requesting OTPs or PINs should hang up immediately — legitimate services never ask for authentication codes via phone. Check exposure on Have I Been Pwned, as leaked credentials are the prerequisite for these attacks. Organizations should consider transitioning from SMS and voice-based OTP to hardware security keys or app-based FIDO2 authentication, which are resistant to real-time phishing interception.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors