Ukraine Identifies 18-Year-Old Suspect in Infostealer Operation Affecting 28,000 Accounts

Summary

Ukrainian cyberpolice say an 18-year-old suspect ran an infostealer operation targeting a California online store, affecting about 28,000 accounts. Authorities seized devices and evidence; no arrest was announced.

Key points

• Ukrainian cyberpolice, working with U.S. law enforcement, identified an 18-year-old suspect from Odesa; authorities have not announced an arrest.
• Police say infostealer malware was used between 2024 and 2025 to steal customer credentials and browser session tokens.
• About 28,000 customer accounts were affected; police say 5,800 were used for unauthorized purchases totaling about $721,000.
• Authorities report about $250,000 in direct losses, including chargebacks.
• Police say stolen information was processed and sold through online resources and Telegram bots, and that the suspect administered infrastructure used in the operation.
• Searches at two residences resulted in seizures of phones, computers, bank cards, storage media, and other digital evidence, including server logs and accounts on cryptocurrency exchanges.
• The article explains that stolen session tokens can enable account access without credentials and may bypass MFA in some cases.

Countries