Quick Summary
The Netherlands Police arrested a 21-year-old man from Dordrecht for selling access to the JokerOTP phishing automation tool, which intercepts one-time passwords (OTP). This arrest is part of a larger investigation that began three years ago, leading to the dismantling of the JokerOTP phishing-as-a-service operation in April 2025. The tool has allegedly caused over $10 million in losses across 28,000 attacks in 13 countries, targeting users of platforms like PayPal and Amazon.
The Securityish Brief
The Netherlands Police recently arrested a 21-year-old man from Dordrecht, suspected of selling access to the JokerOTP tool, which automates phishing attacks to capture one-time passwords (OTPs). This arrest marks the third in a series of actions against the JokerOTP phishing-as-a-service (PhaaS) operation, which was dismantled in April 2025 after a three-year investigation. The initial arrests included the platform’s developer and a co-developer known by the aliases ‘spit’ and ‘defone123’.
JokerOTP has been linked to at least $10 million in financial losses, resulting from over 28,000 attacks targeting users across 13 countries. Cybercriminals utilized this tool to automate calls to victims, posing as legitimate service representatives and requesting OTPs, which are critical for account security. This tactic often caught users off guard, as the calls coincided with the delivery of their authentication codes.
Victims of these scams were led to believe they were protecting their accounts by providing sensitive information, such as OTPs, PINs, and card data. The police have identified numerous buyers of the JokerOTP bot in the Netherlands, and legal actions are expected against them. Anouk Bonekamp, a team leader in Cybercrime, emphasized that victims should not feel ashamed for falling for such sophisticated scams.
Understanding the Risks of JokerOTP
The JokerOTP tool specifically targeted users of popular platforms like PayPal, Venmo, Coinbase, Amazon, and Apple. By intercepting OTPs, attackers could gain unauthorized access to accounts and potentially make fraudulent purchases or transfers. This incident highlights the growing sophistication of phishing attacks and the importance of being vigilant when receiving unexpected requests for sensitive information.
As cybercriminals increasingly employ tactics that exploit human psychology, users must remain cautious, especially when they receive urgent requests for personal data. The police recommend that individuals check for data breaches using services like Have I Been Pwned and CheckJack, as leaked information can significantly increase the risk of falling victim to similar attacks.
Key Takeaways
- Be cautious of unsolicited calls requesting sensitive information, especially if they coincide with receiving OTPs.
- Regularly check for data breaches using services like Have I Been Pwned to stay informed about potential risks.
- Enable multi-factor authentication (MFA) on your accounts to add an extra layer of security.
- Monitor your financial accounts for unauthorized transactions and report any suspicious activity immediately.
- Educate yourself about common phishing tactics to better recognize potential scams.
Key Terms & Concepts
- JokerOTP: In this article, JokerOTP refers to a phishing automation tool that captures one-time passwords to hijack accounts.
- One-Time Password (OTP): An OTP is a temporary code used as an additional security measure during account authentication.
- Phishing-as-a-Service (PhaaS): PhaaS refers to a business model where cybercriminals offer phishing tools and services to other criminals.
Read the original article here: https://www.bleepingcomputer.com/news/security/police-arrest-seller-of-jokerotp-mfa-passcode-capturing-tool/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
