INTERPOL’s Operation Jackal IV made 58 arrests and exposed global networks laundering money from scams, fraud and sextortion.

INTERPOL announced that Operation Jackal IV, running from November 2025 to June 2026, led to 58 arrests and identified 263 suspects tied to West African organized crime networks, groups like Black Axe that are responsible for a huge share of the world’s romance scams, crypto fraud, and business email compromise (BEC) schemes.

“Operation Jackal IV (November 2025 – June 2026) aimed to disrupt money laundering, identify high-value targets, seize assets, and support arrests and prosecution.” Interpol announced. “The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by West African criminal networks – such as the Black Axe and other similar groups. These groups are responsible for a significant share of the world’s cyber-enabled financial fraud, typically through romance scams, cryptocurrency and investment scams or business email compromise fraud, as well as other serious and violent crimes.”

The goal wasn’t to chase individual scammers. Investigators followed the money behind the scams: shell companies, mule accounts and criminal services that help move and hide stolen funds. Tomonobu Kaya of INTERPOL’s Financial Crime and Anti-Corruption Centre explained the approach: By following illicit financial flows across borders, we are attacking the very lifeblood of organized crime.

Argentina turned up one of the operation’s biggest finds. Investigators identified 196 individuals connected to a crime-as-a-service network suspected of supplying website domains and laundering support specifically for West African criminal groups, resulting in 17 arrests. INTERPOL sent an Operational Support Team to help analyze seized data and map out the wider network of suspects, the kind of cross-border analytical work that individual national police forces usually can’t pull off on their own.

South African authorities raided seven locations in Johannesburg linked to a group running romance and investment scams against retirees in English-speaking countries.

The syndicate assigned members to specific roles, such as “conversion” and “retention” agents. The operation led to 39 arrests, $2.67 million seized and 257 bank accounts frozen, the largest number of arrests in the operation.

Italy’s case shows how much damage a single laundering account can absorb. One individual was tied to a pan-European laundering network moving money through shell companies and remittance services, and investigators traced €845,000 laundered through a single account across 560 separate transactions using 20 different financial instruments. That’s not a careless operator; that’s someone who understood exactly how to fragment a large sum into a pattern designed to look unremarkable at every individual step.

Romania’s case was the biggest by dollar value, and arguably the most brutal in its simplicity. A call center ran a fake investment scheme promising big returns on stocks and crypto, funneling victims’ money into wallets the operators controlled, and by the time authorities dismantled it, the estimated theft and laundering total had climbed to around €143 million globally. Eleven arrests and roughly €379,000 in cash and crypto seized, plus six properties and several luxury watches, is a real result, but it’s a fraction of what actually got stolen.

“Beyond individual cases, Operation Jackal IV also enabled the analysis of critical and emerging trends, including a rise in West African organized crime groups using sextortion to target minors, with victims as young as 14. Offenders typically contact minors via social media, build trust and coerce them into sharing explicit images or videos.” concludes INTERPOL. “They then threaten to distribute this material to the victim’s contacts unless a ransom is paid.”

The report’s darkest finding sits outside any single country’s arrest count. INTERPOL flagged a rising trend of these same criminal networks using sextortion against minors as young as 14, building trust through social media before coercing victims into sharing explicit images and then threatening to distribute that material unless a ransom gets paid. Some of these groups were even observed buying crime-as-a-service support through the dark web specifically to outsource pieces of that operation, treating exploitation infrastructure as just another service line alongside laundering and fraud.

That’s the uncomfortable throughline connecting every case here: these aren’t scattered opportunists, they’re networks running organized business models with specialized roles, outsourced services, and financial engineering sophisticated enough to move hundreds of millions across borders. Twenty-two countries coordinating for eight months produced real numbers, real arrests, real frozen accounts. It also produced a fairly clear picture of how much more organized this side of cybercrime has become, and how much further there is to go.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation Jackal)

An eight-month international operation targeting West African organized crime groups has resulted in 58 arrests and the identification of 263 suspects across 22 countries, according to INTERPOL. Operation Jackal IV, conducted from November 2025 to June 2026, focused on disrupting criminal networks, tracing illicit funds, identifying high-value targets and supporting arrests and prosecutions. The operation brought together countries across six continents to tackle the growing global threat posed by West African criminal networks, including Black Axe and similar groups. These networks have been linked to a significant share of global cyber-enabled financial fraud, including romance scams, cryptocurrency and investment scams, and business email compromise fraud.

Operation Jackal IV Targets West African Organized Crime Groups

Operation Jackal IV also targeted money laundering activities used to move and conceal criminal proceeds across borders. INTERPOL coordinated cross-border intelligence sharing, analysis and operational support during the operation. It also provided specialized training to strengthen international investigations into financial crime. Tomonobu Kaya, Director of the INTERPOL Financial Crime and Anti-Corruption Centre, said the operation showed the importance of international cooperation in following illicit financial flows and disrupting criminal networks. [caption id="attachment_113806" align="aligncenter" width="600"] Image Source: INTERPOL[/caption]

Major Arrests and Financial Crime Investigations

In Argentina, authorities identified 196 individuals linked to a major Crime-as-a-Service network suspected of providing website domains and money laundering support to West African organized crime groups. The investigation resulted in 17 arrests, with an INTERPOL Operational Support Team assisting with analysis of seized data and identification of suspects and criminal networks. South African authorities raided seven locations in Johannesburg linked to a syndicate involved in romance and investment scams targeting retirees in English-speaking countries. Investigators arrested 39 people, seized USD 2.67 million and blocked 257 bank accounts. In Italy, investigators identified an individual connected to a pan-European money laundering network that used shell companies, remittance services and cash withdrawals. One account processed EUR 845,000, or about USD 736,000, through 560 transactions involving 20 financial instruments. Romanian authorities dismantled a criminal group operating an investment scam through a call centre. The group promoted high returns from stocks and cryptocurrencies, with victims' money transferred to electronic wallets controlled by perpetrators. Authorities estimated that EUR 143 million had been stolen and laundered globally. Eleven people were arrested, while cash, cryptocurrency, six real estate properties and luxury watches were seized.

Sextortion and Crime-as-a-Service Emerge

Beyond individual investigations, the operation highlighted emerging threats involving sextortion and Crime-as-a-Service. INTERPOL identified an increase in West African organized crime groups using sextortion to target minors, including victims as young as 14. In these cases, offenders typically contacted minors through social media, established trust and persuaded them to share explicit images or videos. They then threatened to distribute the material to the victim's contacts unless a ransom was paid. Investigators also found that some criminal syndicates were procuring Crime-as-a-Service from external providers, including through the dark web. These services were used to outsource activities such as money laundering and other operational functions. While several cases from Operation Jackal IV remain under investigation, the preliminary results demonstrate the scale and international reach of the networks targeted during the eight-month operation. The participating countries were Austria, Argentina, Australia, Canada, Côte d'Ivoire, France, Germany, Indonesia, Ireland, Italy, Japan, Malaysia, the Netherlands, Nigeria, Portugal, South Africa, Spain, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States.

INTERPOL’s Operation First Light 2026 led to 5,811 arrests, blocked $293M in criminal assets, and disrupted global fraud and money laundering networks.

INTERPOL coordinated a four-month operation across 97 countries and territories that ended with 5,811 arrests and the interception of USD 293 million in illicit assets. Operation First Light 2026 ran from January 15 to April 30, 2026, targeting social engineering scams and the money laundering operations that process the proceeds. Over 142,000 victims were identified globally during the operation.

“A global anti-fraud operation involving 97 countries and territories has led to the arrest of 5,811 individuals and the interception of USD 293 million in illicit assets.” reads the press release by INTERPOL.”Operation First Light 2026 (15 Jan 2026 – 30 April 2026), coordinated by INTERPOL, focused on combatting social engineering scams and associated money laundering activities.”

The operation covered business email compromise, romance scams, investment fraud, sextortion, and impersonation schemes. In total, 152,808 cases were analyzed, 31,014 bank accounts blocked, and 15,606 suspects identified.

Some of the individual cases stand out.

“In Eswatini, police arrested 82 people and dismantled a criminal network running illegal online gambling, money laundering and elaborate impersonation scams. Authorities seized 240 electronic devices, foreign currency and a realistic replica of a Brazilian police station, complete with fake uniforms, signage and equipment.” continues the press release.

The scammers posed as Brazil’s Federal Police on video calls, convincing targets they were victims of a crime and needed to transfer funds for “safekeeping.” INTERPOL deployed an Operational Support Team to help Eswatini authorities handle the scale and complexity of the digital forensics involved.

The financial flows traced in Thailand were equally striking.

In Thailand, police made two arrests and uncovered a money laundering scheme that funneled illicit funds from romance scams into various cryptocurrencies, utilizing cross-chain token swaps to obscure the financial trail. Investigations showed that the digital wallet of one of the suspects, aged 20, had processed more than USD 122.5 million in just 10 months. states the law enforcement agency.

Twenty years old, $122 million in ten months. Either the career counseling failed somewhere, or this was always the plan.

INTERPOL’s stop-payment mechanism, I-GRIP, also proved its value in real time.

“Authorities in Singapore and Oman utilized I-GRIP to block a USD 6.6 million illicit transfer linked to a Business Email Compromise scam. In this case, a Singapore-based commodity trading firm was targeted by criminals impersonating a supplier.” continues the announcement.

In Macao, a public anti-fraud outreach campaign uncovered an active fraud in progress: a participant was in the middle of being manipulated by a criminal group impersonating officials, and police intervened before nearly USD 372,000 left the victim’s account. In Palau, 22 individuals were deported after authorities dismantled two scam centers operating out of hotels, running online fraud schemes using cryptocurrency and illegal gambling platforms against victims in other countries.

“Social engineering scams continue to pose a significant threat to our society.” said Tomonobu Kaya, Director of the INTERPOL Financial Crime and Anti-Corruption Centre. “Criminal syndicates exploit human psychology to manipulate their targets, and no nation can stay safe unless all countries are equipped and committed to jointly fighting back. INTERPOL is dedicated to supporting member countries in building a comprehensive, coordinated strategy to tackle cyber-enabled financial crimes, organized criminal networks and the money laundering that fuels them.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation First Light)

Fake Interpol investigation emails are targeting small businesses with Proton Drive links that deliver ransomware, encrypt files, and route victims to Tox chat.

Interpol’s latest Asia and South Pacific cybercrime assessment shows how phishing, ransomware, DDoS attacks, infostealers, and AI-enabled scams are raising security risks across APAC.

The post Interpol: Cybercrime Hits 30% of Recorded Crime in Surveyed APAC Countries appeared first on TechRepublic.

Group-IB, INTERPOL and Algerian Police dismantle decade-old SniperDZ phishing network used to steal credentials, with its alleged developer arrested.

A large-scale cybercrime crackdown led by INTERPOL has resulted in 201 arrests and the identification of 3,867 victims across the Middle East and North Africa region. The coordinated operation, known as Operation Ramz, is being described as the first cybercrime operation of its scale conducted by INTERPOL in the MENA region. The operation ran between October 2025 and February 28, 2026, bringing together law enforcement agencies from 13 countries to disrupt malicious cyber infrastructure linked to phishing, malware campaigns, and online scams. Authorities also identified 382 additional suspects and seized 53 servers during the operation. Operation Ramz focused on tackling cyber threats that continue to cause financial and operational damage across the region. Participating countries included Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia, and the UAE. According to INTERPOL, nearly 8,000 intelligence packages and data points were shared among participating countries to support investigations and help authorities trace malicious infrastructure connected to cybercriminal activity. INTERPOL said the operation highlighted the growing importance of cross-border collaboration in combating cybercrime networks that often operate across multiple jurisdictions. “In a world where cybercriminals exploit the digital landscape without borders, Operation Ramz demonstrates the effectiveness of global collaboration,” said Neal Jetton. He added that INTERPOL remains committed to working with member countries and private-sector partners to dismantle malicious infrastructure and bring cybercriminals to justice.

Cybercrime Investigations Across MENA

Authorities involved in Operation Ramz uncovered several cybercrime operations tied to phishing schemes, malware distribution, and financial fraud. In Qatar, investigators used intelligence gathered during the operation to identify compromised devices that were unknowingly being used to spread malicious threats. Officials secured the infected systems and notified affected users to prevent further misuse. Jordanian authorities uncovered a fraudulent investment scam operating through what appeared to be a legitimate online trading platform. Victims were convinced to deposit funds before the platform disappeared. During a raid, police found 15 individuals carrying out the scams. However, investigators later determined the workers themselves were victims of human trafficking who had been lured from Asian countries with fake job offers. Their passports were confiscated upon arrival, and they were forced into cyber fraud operations. Two individuals suspected of organizing the scheme were arrested. In Oman, investigators identified a server hosted in a private residence containing sensitive information. Although the owner had legitimate access to the data, authorities found the server had multiple critical vulnerabilities and malware infections. Officials disabled the server to reduce further cybersecurity risks. Authorities in Algeria dismantled a phishing-as-a-service website during the operation. Law enforcement seized servers, computers, mobile devices, and hard drives containing phishing scripts and malicious software. One suspect was arrested in connection with the activity. Meanwhile, Moroccan authorities seized computers, smartphones, and external hard drives containing banking data and phishing software. Three individuals are currently facing judicial proceedings while investigations continue into other possible suspects.

Private Sector Partners Supported Operation Ramz

Several cybersecurity and threat intelligence organizations, including Team Cymru, Kaspersky, Group-IB, the Shadowserver Foundation, and TrendAI, supported operation Ramz. These organizations worked with INTERPOL to provide threat intelligence, internet visibility, and technical support to identify malicious servers and track illegal cyber activity linked to phishing, malware, and online scam networks. Joe Sander said cybercrime requires a coordinated international response involving both law enforcement and private-sector intelligence partners. “Cybercrime is borderless, and the only effective response is one that is equally borderless,” Sander said. “Operation Ramz is exactly that kind of response.” Team Cymru stated that it contributed external threat intelligence and internet-scale telemetry to help authorities map cybercriminal infrastructure and generate operational leads during the investigations.

Rising Focus on MENA Cybercrime Threats

The success of Operation Ramz reflects the growing focus on cybersecurity cooperation in the MENA region as phishing attacks, malware campaigns, and financial cyber scams continue to evolve. The operation also demonstrated how intelligence sharing between governments and cybersecurity firms can help authorities rapidly identify malicious infrastructure and prevent additional victims. Operation Ramz received support from Qatar’s Ministry of Interior and partial funding from the European Union and the Council of Europe under the CyberSouth+ project.