Algerian Man Charged Over Alleged Phishing and Stolen-Credential Marketplaces
Summary
Abdellah Belmili was extradited from Spain and charged with conspiracy to commit bank fraud. Investigators say he ran marketplaces selling phishing kits and stolen credentials, and linked the operation to about 5,600 victims.
Key points
- Belmili, known online as “SPOX,” was extradited from Spain and charged in the U.S. with conspiracy to commit bank fraud; the allegations have not been established as a conviction.
- Investigators say he operated market0day[.]com and spoxy[.]us, which sold phishing kits, financial credentials, compromised email-server access, and other fraud tools.
- In 2020, undercover FBI agents bought a phishing kit designed to imitate JPMorgan Chase’s login page and capture personal information.
- Investigators say Belmili embedded backdoors in kits sold to other criminals, allowing continued collection of victim data after resale.
- Authorities identified about 595 phishing kits attributed to Belmili and roughly 5,600 victims in the U.S. and internationally.
- Records showed about $900,000 deposited into a Binance account registered to Belmili between January 2020 and January 2023.
Article Details
- Event Type
- U.S. criminal prosecution of an alleged operator of cybercrime marketplaces selling phishing kits, stolen credentials, and fraud tools.
- Impact
- Prosecutors allege that Abdellah Belmili operated two marketplaces and created hundreds of phishing kits used to target financial institutions. Investigators identified approximately 5,600 victims and traced about $900,000 in deposits to an account registered to him. He was charged with conspiracy to commit bank fraud; the article does not report a conviction.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | market0day[.]com | Allegedly operated by Belmili as an illicit marketplace selling phishing kits, stolen credentials, and other fraud tools. |
| DOMAIN | spoxy[.]us | Allegedly operated by Belmili as a successor illicit marketplace after market0day.com closed. |
MITRE ATT&CK
People
Threat Actors
Abdellah BelmiliProsecutors allege that he operated the market0day.com and spoxy.us cybercrime marketplaces, created phishing kits, and built hidden backdoors into kits to continue harvesting victim data.SPOXOnline alias identified in the article for Abdellah Belmili, whom prosecutors allege operated the cybercrime marketplaces and phishing-kit operation.
Countries
SpainAn Algerian man known as “SPOX” was extradited from Spain and charged in the United States for allegedly running a black-market cybercrime operation that sold phishing kits, stolen credentials, and other fraud toolsUnited StatesAn Algerian man known as “SPOX” was extradited from Spain and charged in the United States for allegedly running a black-market cybercrime operation that sold phishing kits, stolen credentials, and other fraud tools