Law enforcement infiltrates fraud platform used by thousands of criminals worldwide

A website used by more than 2,000 criminals to defraud victims worldwide has been infiltrated in the Met’s latest joint operation to tackle large-scale online fraud.

‘LabHost’ is a service which was set up in 2021 by a criminal cyber network. It enabled the creation of “phishing” websites designed to trick victims into revealing personal information such as email addresses, passwords, and bank details.

Users were able to log on and choose from existing sites or request bespoke pages replicating those of trusted brands including banks, healthcare agencies and postal services.

But LabHost has now been infiltrated and disrupted as the result of a worldwide operation led by the Met.

Work began in June 2022 after detectives received crucial intelligence about LabHost’s activity from the Cyber Defence Alliance. Once the scale of site and the linked fraud became clear the Met’s Cyber Crime Unit joined forces with the National Crime Agency, City of London Police, Europol, Regional Organised Crime Units (ROCUs) across the country and other international police forces to take action.

Partners including Chainalysis, Intel 471, Microsoft, The Shadowserver Foundation and Trend Micro have also been at the centre of our efforts to bring down this platform.

Between Sunday, 14 April and Wednesday, 17 April a total of 37 suspects were arrested across the UK and by international law enforcement agencies. This included arrests at both Manchester and Luton airports, as well as in Essex and London. Both in the UK and across the world over 70 addresses were searched.

On Wednesday, 17 April LabHost and its linked fraudulent sites were disrupted and existing information was replaced with a message stating law enforcement has seized the services.

History of the operation

After being set up in 2021, LabHost quickly gained a criminal user base. By the beginning of 2024 more than 40,000 fraudulent sites had been created and 2,000 users were registered and paying a monthly subscription fee. Those subscribing to the ‘worldwide membership’, meaning they could target victims internationally, paid between £200 and £300 a month.

Since creation LabHost has received just under £1 million ($1,173,000) in payments from criminal users, many of whom Met cyber-crime detectives have now been able to identify. Some have been arrested in this week’s activity, others are now the focus of the ongoing investigation and have been warned we’re now working to track them down.

Shortly after the platform was disrupted, 800 users received a message telling them we know who they are and what they’ve been doing. We’ve shown them we know how much they’ve paid to LabHost, how many different sites they’ve accessed and how many lines of data they’ve received. Many of these individuals will remain the focus of investigation over the coming weeks and months.

Detectives have so far established that just under 70,000 individual UK victims have entered their details into one of LabHost’s fraudulent sites. Globally, the service has obtained 480,000 card numbers, 64,000 PIN numbers, as well as more than one million passwords used for websites and other online services. The total number of victims is likely to be even higher than already established and work is ongoing to identify and support as many as possible.

As of Thursday, 18 April detectives have contacted up to 25,000 victims in the UK to tell them their data has been compromised. Each and every one of those cases has been reported to both Action Fraud and UK Finance and every victim has been given advice about next steps and how to further protect their data. A team of officers from the Met will be stood up to provide personalised support to any victims who want further help and advice.

Full article

See the full police report on this operation here.

See our advice on how to spot and deal with fraud by clicking on the relevant links on the menu