Arrest, Raids Tied to ‘U-Admin’ Phishing Kit
Summary: Ukrainian authorities arrested a 39-year-old man from the Ternopil region and carried out several raids in connection with U-Admin, a phishing kit whose administrative panel he developed, in an operation coordinated with the FBI and Australian authorities. The Ukrainian attorney general's office said foreign law enforcement analysis found more than 50% of all phishing attacks in Australia in 2019 were carried out using the Ternopil developer's product, and investigators identified hundreds of U-Admin customers.
Key Takeaway: U-Admin's core selling point was a web-inject module that intercepts multi-factor authentication codes, and it has been used alongside Qakbot to harvest one-time codes so an attacker can log in with stolen credentials plus the 2FA token and start transactions. The kit also carried an SQL injection flaw documented as recently as 2020, meaning phished data could be viewed or altered by parties other than the phisher.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026