Interpol Dismantles SniperDz Phishing-as-a-Service Platform
Interpol Dismantles SniperDz Phishing-as-a-Service Platform
https://www.infosecurity-magazine.com/news/interpol-dismantles-sniperdz/
Publish Date: 2026-06-11 07:30:00
Source Domain: www.infosecurity-magazine.com
Cybersecurity firm Group-IB has revealed that a recent Interpol-led cybercrime law enforcement operation has led to the takedown of an established phishing-as-a-service (PhaaS) platform and the arrest of its main operator developer.
The crackdown, dubbed Operation Ramz, ran from October 2025 to February 2026 across 13 countries in the Middle East and North Africa (MENA) region.
The results, announced by Interpol at the end of May, included 201 arrests, 53 servers seized and 382 suspects and 3867 victims identified.
A further set of almost 8000 pieces of data and intelligence was also disseminated among participating countries to initiate and support future investigations.
On June 11, Group-IB, one Interpol’s main partners for this effort, revealed that the operation led to the takedown of SniperDz and the arrest of its primary developer in Algeria.
SniperDz: A Global Phishing-as-a-Service Platform
SniperDz is a PhaaS platform that has been running since at least 2015. Today, the cybercrime platform has a global reach and has sophisticated offerings, including ready-made phishing kits, infrastructure hosting and operational support to cybercriminals.
In 2024, Palo Alto Networks’ Unit 42 said it had discovered over 140,000 phishing pages associated with SniperDz between 2023 and 2024 alone.
The researchers noted that phishers can either host these phishing pages on SniperDz-owned infrastructure or download SniperDz phishing templates to host on their own servers.
“Surprisingly, SniperDz PhaaS offers these services free of charge to phishers – perhaps because SniperDz also collects victim credentials stolen by phishers who use the platform to compensate for the cost of service,” the Unit 42 report said.
Over the past nine years, Group-IB identified more than 20,000 unique domains associated with SniperDz that impersonated at least 30 major global organizations, including PayPal, Facebook, Instagram, Yahoo, Netflix and Steam.
Group-IB’s…
