Interpol Busts $45M Cybercrime Network
An Interpol operation across 15 African countries resulted in the arrest of 651 suspects connected to a cyber-scam network valued at $45 million. The operation highlights the persistent threat of cross-border cybercrime for fintech and prediction market platforms. The scale of the network serves as a reminder for platforms to continually review anti-fraud and KYC processes.
- This specific crackdown, dubbed "Operation Red Card 2.0," ran from December 8, 2025, to January 30, 2026. It was a coordinated effort under the African Joint Operation against Cybercrime (AFJOC), an initiative that leverages the regional focus of AFRIPOL with the global intelligence-sharing capabilities of INTERPOL. - The operation targeted a range of cybercrimes, including high-yield investment scams, mobile money fraud, and fraudulent mobile loan applications. In Nigeria, authorities dismantled a major investment fraud ring that utilized phishing and fake crypto schemes, leading to the shutdown of over 1,000 fraudulent social media accounts. - Beyond the arrests, the operation successfully dismantled 1,442 malicious IP addresses, domains, and servers. Authorities also seized 2,341 electronic devices, which will be used for digital forensics to support ongoing investigations. - This operation is one of several recent large-scale efforts to combat cybercrime in Africa. For instance, "Operation Serengeti 2.0" (June-August 2025) resulted in over 1,200 arrests and the recovery of more than $97 million. Another, "Operation Contender 3.0," focused on romance scams and extortion, leading to 260 arrests and the identification of nearly $2.8 million in financial losses. - Private cybersecurity firms play a crucial role in these operations by providing threat intelligence. Fortinet contributed to "Red Card 2.0" through the World Economic Forum's Cybercrime Atlas, and Group-IB has repeatedly provided intelligence for operations like "Serengeti" and "Contender 3.0". - A common tactic uncovered in a related Nigerian investigation was the use of the "Agent Tesla" Remote Access Trojan (RAT). This malware allows criminals to steal corporate credentials and reroute financial transactions by logging keystrokes and capturing sensitive information from business computers.
