Quick Summary
The US has shut down web3adspanels.org, a platform used by cybercriminals to steal bank account credentials through SEO poisoning campaigns. The Justice Department reported that this operation led to $14.6 million in actual losses and $28 million in attempted illegal transfers. At least 19 victims, including two companies, have been identified, highlighting a broader issue of account takeover scams affecting many users across the country.
The Securityish Brief
The recent shutdown of web3adspanels.org marks a significant action against cybercriminal activities targeting American bank accounts. This platform facilitated SEO poisoning campaigns, where criminals paid for top search engine placements to lure victims into fake banking websites. Users unknowingly entered their passwords, which were then stored in a database for malicious use.
The FBI has reported at least 19 victims from this scheme, including two companies, which is part of a larger trend of account takeover incidents. The total attempted illegal transfers linked to this operation reached $28 million, with actual losses estimated at $14.6 million. Since the beginning of the year, law enforcement has received over 5,100 complaints related to similar scams, resulting in reported losses exceeding $262 million.
Despite the shutdown, the Justice Department did not disclose how these criminals managed to bypass security measures like multi-factor authentication (MFA). This raises concerns about the effectiveness of current security protocols in preventing unauthorized access to sensitive accounts.
Criminals often use social engineering tactics alongside phishing to manipulate victims into providing their credentials and MFA codes. Once they gain access, they typically transfer funds to accounts they control, often converting the stolen money into cryptocurrencies, complicating tracking efforts.
The rise in e-crime losses has been consistent since 2020, with cyber-enabled fraud accounting for 83 percent of the total $16.6 billion in losses reported in 2024. This trend underscores the importance of vigilance among users and organizations alike.
Understanding the Risks
This incident highlights the ongoing risks associated with phishing and account takeover schemes. Users should be aware of the tactics employed by cybercriminals, such as fake websites and social engineering, which can lead to significant financial losses.
Organizations must ensure that their security measures are robust and regularly updated to protect against these evolving threats. Monitoring account activity and implementing strong authentication methods can help mitigate risks.
- web3adspanels.org: A phishing platform that facilitated the theft of banking credentials through SEO poisoning.
- FBI: The agency that reported on the number of victims and financial losses associated with the phishing scheme.
- multi-factor authentication (MFA): A security measure that criminals managed to bypass in some cases, allowing unauthorized access to accounts.
- cryptocurrencies: Often used by criminals to launder stolen funds, making tracking difficult.
- Internet Crime Complaint Center (IC3): The FBI division that tracks e-crime complaints and reported significant losses in 2024.
Key Takeaways
- Regularly monitor your bank account statements for unauthorized transactions to catch potential fraud early.
- Enable multi-factor authentication (MFA) on all accounts to add an extra layer of security against unauthorized access.
- Be cautious of unsolicited emails or messages that request personal information or direct you to login pages.
- Use a password manager to create and store complex passwords, reducing the risk of credential theft.
- Report any suspicious activity or phishing attempts to the appropriate authorities to help combat cybercrime.
Key Terms & Concepts
- web3adspanels.org: In this article, web3adspanels.org refers to a phishing platform used by criminals to steal bank account credentials.
- multi-factor authentication (MFA): MFA is a security measure that requires multiple forms of verification before granting access to an account.
- Internet Crime Complaint Center (IC3): The IC3 is a division of the FBI that tracks and reports on internet-related crimes, including phishing and fraud.
- SEO poisoning: SEO poisoning is a tactic used by cybercriminals to manipulate search engine rankings to direct users to malicious websites.
- cryptocurrencies: Cryptocurrencies are digital currencies that criminals often use to launder stolen funds, making tracking difficult.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2025/12/24/us_shutters_phishermens_146m_passwordhording/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
