LIVE · cybersecurity feed
phishing

Two arrested over credit card phishing – as the Netherlands is named Europe’s worst for payment fraud

zeroday.news·1d ago

Two young men have been arrested in the Netherlands in connection with a credit card phishing operation. Dutch police detained a 23-year-old from Zaandam and a 21-year-old from Amsterdam on June 23, 2026. Their homes were searched, and devices believed to be used in fraudulent activities, along with luxury items and a car, were seized.

Authorities allege that the suspects operated phishing websites designed to trick victims into divulging their payment card details. While the specific methods used in this case were not detailed by police, common phishing tactics in the Netherlands include fake delivery fee texts from postal services, spoofed bank websites, and malicious QR codes. Investigators suspect the arrested individuals not only used the stolen card information themselves but also supplied it to other criminals.

The arrests come as new figures from the Dutch central bank reveal a significant rise in payment fraud. In 2025, payment fraud cases in the Netherlands increased by approximately 30% to around 658,000, with total losses reaching €198 million, a 22% jump. Card payment fraud was the most prevalent category, accounting for over half a million fraudulent transactions, a more than 25% increase from the previous year. The central bank identified phishing as the primary method criminals use to obtain card details.

Data analyzed by fraud prevention firm BioCatch, using European Banking Authority information, indicates that the Netherlands now leads all countries in the European Economic Area for digital payment fraud. The cybercrime unit of the Noord-Holland division of the Dutch police is continuing its investigation and has not ruled out further arrests in connection with the phishing operation.

This incident is part of a broader trend. In a separate case on May 19, the same police unit arrested two 23-year-old men suspected of selling "phishing panels" – pre-made kits of fake bank websites – as a phishing-as-a-service. These kits were allegedly sold via social media to fraudsters across Europe.

The impact on victims remains a significant concern. Statistics from 2024 show that only 1% of fraud victims in the Netherlands recovered their money. While about half reported the crime to their bank, only a fifth reported it to the police. This suggests that the recent arrests may represent only a fraction of the overall problem.

phishingarrestfraudcybercrimenetherlands
← Back to latest

More News

view all →
zeroday.news · 2h ago·high

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.

zeroday.news · 2h ago·high

RedWing Android Spyware Sold as a Service on Telegram

A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.

zeroday.news · 3h ago·high

Operationalizing Day Minus Seven: The Cloud-Native ROC

The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.

zeroday.news · 3h ago·critical

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

Ubiquiti has released security updates to address several critical vulnerabilities affecting its UniFi product line, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow attackers to escalate privileges or execute arbitrary commands on affected devices. While no active exploitation has been reported for these specific vulnerabilities, the company has previously seen its UniFi OS and Edge OS products targeted by threat actors.

zeroday.news · 3h ago·high

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.

zeroday.news · 3h ago·critical

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)

CISA has issued a warning regarding a critical vulnerability (CVE-2026-55255) in the Langflow AI framework, which is being actively exploited by attackers. The flaw allows authenticated users to execute arbitrary flows belonging to other users, potentially leading to the theft of sensitive credentials and data exposure, especially in multi-tenant environments. US federal agencies have been mandated to patch this vulnerability by July 10th.