A Coordinated Eight-Month Push Against Financial Fraud

Interpol has pulled back the curtain on a sprawling investigation that identified 263 suspects and resulted in 58 arrests. Operation Jackal IV, which ran from November 2025 to June 2026, spanned 22 countries across six continents. The announcement came on August 25, with Interpol framing the effort as a direct strike against West African organized crime groups profiting from cyber-enabled financial fraud.

The operation didn’t just chase street-level criminals. It targeted the infrastructure that keeps these networks alive — money laundering channels, high-value targets, and the assets that fund further criminal activity. This wasn’t a single raid. It was a coordinated, multi-national campaign designed to dismantle entire ecosystems.

This latest push builds on the momentum of Operation Jackal III, which saw 300 arrests in 2024. The pattern is clear: Interpol is doubling down on African cybercrime, and the results are compounding.

South Africa: Romance Scams and Retiree Targets

In South Africa, police executed raids at seven locations tied to a syndicate that ran romance and investment scams. Their victims? Retirees living in English-speaking countries. The emotional toll of these schemes is hard to quantify, but the financial damage is not.

Authorities arrested 39 people, froze 257 bank accounts, and seized $2.67 million in assets. It’s a significant blow, but it also highlights how lucrative these operations have become. Scammers aren’t just phishing for pocket change anymore. They’re running sophisticated operations that drain life savings.

Romania: A Call Center Disguised as an Investment Firm

Romanian authorities took down a different kind of beast — a call center operation that peddled fake investment opportunities. The pitch was familiar: high returns from stocks and cryptocurrencies. The reality was a €143 million fraud machine.

The arrests netted 11 people, along with roughly €330,000 ($385,000) in cash and cryptocurrency. Police also seized six properties and a collection of luxury watches. When you see assets like that, you understand the scale of the grift. This wasn’t a side hustle. It was an industry.

Argentina: The Crime-as-a-Service Connection

Perhaps the most intriguing piece of the puzzle emerged in Argentina. Interpol identified a 196-person Crime-as-a-Service (CaaS) network that allegedly supplied website domains and money laundering support to West African organized crime groups. Seventeen people were arrested.

This is the modern face of cybercrime. Criminal groups are outsourcing their technical needs to specialists, much like legitimate businesses outsource their IT. The CaaS model means you don’t need to be a tech genius to run a global scam. You just need to know who to pay.

Interpol’s country-level arrest figures actually total more than the 58 arrests reported for the operation overall, suggesting some cases are still being processed or transferred between jurisdictions.

A Growing Concern: Sextortion and Child Victims

Beyond the financial toll, investigators flagged a disturbing trend: an increase in sextortion targeting minors. Some victims were as young as 14. This isn’t just a money crime anymore. It’s a threat to vulnerable young people, and it demands a different kind of response.

Interpol also noted that some criminal networks were purchasing CaaS capabilities from external providers to outsource money laundering and other activities. The lines between different types of cybercrime are blurring, and law enforcement is having to adapt.

Following the Money to Break the Cycle

Tomonobu Kaya, director of the Interpol Financial Crime and Anti-Corruption Centre, summed up the strategy: “following illicit financial flows across borders” to target what he called the lifeblood of organized crime. It’s a simple concept with complex execution.

The results speak for themselves. Millions in assets seized, hundreds of suspects identified, and a clear message sent to criminal networks: your money is traceable, and your operations are not invisible.

For a deeper look at how Interpol is leveraging international cooperation, check out our coverage of the Chinese-funded Interpol cybercrime crackdown that led to 5,800 arrests. The scale of these operations is growing, and the collaboration between nations is becoming more sophisticated.

If you’re interested in how these scams actually work on the ground, our analysis of romance scam tactics and prevention offers practical insights. And for those tracking the evolution of digital fraud, our piece on Crime-as-a-Service business models explains why these networks are so hard to dismantle.

Agent Tesla v4: A Smarter, Sneakier Infostealer

There’s a new version of Agent Tesla malware making the rounds, and it’s brought some tricks that should worry anyone in finance. Researchers at KnowBe4 just published a deep dive on Agent Tesla v4, an infostealer that’s been spotted arriving via a business email compromise (BEC) lure aimed squarely at accounting departments.

The headline feature? Unicode emoji characters scattered through the malicious code. Hearts, water droplets, the works. It sounds almost playful, until you realize what those little symbols are doing: breaking string-based signature matching and making the code noisy enough to slip past casual review.

This isn’t your run-of-the-mill credential stealer. It’s designed to evade detection at every turn, and it’s good at it.

How the Attack Unfolds

The delivery mechanism is a JScript dropper, which can be launched with a simple open-with dialog. The email itself is a forwarded thread, made to look like internal correspondence. The recipient is brought in late, told to confirm an attached document, and reply. Classic social engineering, executed well.

The attackers spoofed the address of Metropolitan Bank and Trust Company, a legitimate Philippines-based commercial bank. The whole thread feels like an in-progress discussion you’ve just been pulled into. That urgency, that sense of being out of the loop—it works.

The Emoji Obfuscation Trick

Once the JScript dropper runs, it writes two files to C:UsersPublicLibraries. One is a decoy. The other passes the payload into DonutLoader shellcode for reflective PE injection. That means the final Agent Tesla binary never touches the filesystem. File-based scanners? Useless.

The emoji characters are interleaved directly through the script body. They disrupt signature matching and make the code visually noisy. A human glancing at it in a text editor sees a mess. An automated scanner sees something it doesn’t recognize. Both are defeated.

KnowBe4’s researchers note that any YARA rule looking for the Unicode code points alongside JScript-specific patterns will catch this family. A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will do it. That’s the mitigation playbook, in a nutshell.

Evasion Techniques That Go Beyond Emojis

The obfuscation doesn’t stop at the dropper. Agent Tesla v4 is scrambled with ConfuserEx, an obfuscator tool that makes the assembly nearly unreadable. Its embedded metadata presents the malware as a Python installer. A little misdirection, a little disguise.

The malware also checks for debuggers using a standard Windows function. If it detects one, it stops running. No analysis, no sample collection, no fun for researchers.

Before harvesting anything, it creates a persistent hardware fingerprint. That lets attackers track victims across OS reinstalls and IP rotations. Even if you rebuild your machine, they know it’s you.

It also disables validation for all outgoing connections, ensuring smooth communication with C2 infrastructure without triggering security alerts or errors. Persistence is the name of the game.

Credential Theft and Data Exfiltration

Once it’s settled in, Agent Tesla v4 sweeps credentials from more than 40 applications. Web browsers, messaging platforms, native Windows credential repositories—it’s all fair game. It also has a keylogger and clipboard tool for intercepting keystrokes and copied text.

All exfiltrated files carry a system fingerprint header: timestamp, username, computer name, OS name, CPU, RAM, public IP, and the MD5 hardware ID. That’s a lot of identifying information, all packaged neatly for the attacker.

The credential dump lands on the attacker’s FTP server within seconds of execution. No delayed staging, no waiting around. The whole operation is fast, efficient, and ruthless.

What Security Teams Should Do

KnowBe4’s advice is straightforward: update email security rules to catch Agent Tesla before it can harvest credentials. The emoji obfuscation doesn’t survive YARA rules that look for the specific Unicode code points used alongside JScript patterns.

For defenders, that means:

• Deploy YARA rules that match emoji distribution patterns combined with WScript.Shell or CreateObject calls.
• Monitor for unusual JScript activity, especially in environments where it’s rarely used.
• Train finance teams to recognize BEC lures, even when they look like internal threads.
• Keep an eye on outbound FTP traffic to unknown domains.

Agent Tesla has been around for years, but this version shows the threat is evolving. Emoji obfuscation is a new twist on an old problem. The fundamentals, though, remain the same: verify before you click, and keep your email filters sharp.

For more on defending against credential theft, check out our guide on phishing email detection best practices and learn how to secure your email gateway against BEC attacks.

A day of digital chaos in Norway

For more than 30 hours, a relentless DDoS attack has been hammering the digital infrastructure that Norwegians rely on for everything from logging into government portals to picking up prescriptions. The Norwegian Digitalisation Agency, known as Digdir, confirmed that the attack began on Monday and has continued with varying intensity, leaving a trail of disrupted services in its wake.

This isn’t just a minor inconvenience. Ten digital services have been affected, including the critical ID-porten system, which serves as a gateway to thousands of government services. With over 4.5 million users, ID-porten is the digital key to Norway’s public sector, and its downtime has sent ripples across the country.

What exactly was hit?

The attack targeted the infrastructure of Vivicta, Digdir’s IT partner. According to Digdir’s status page, the affected services include identity verification, login systems, data exchange between government agencies and businesses, access to public records, and employee access management. That’s a broad swath of the digital public sphere.

One of the most concerning knock-on effects was on Norway’s health infrastructure. Several health services depend on ID-porten for authentication, meaning patients faced potential problems accessing online pharmacies and the country’s electronic prescription system. For a nation that prides itself on digital efficiency, this was a stark reminder of how fragile that efficiency can be.

Not the first time, and getting bigger

This is the third DDoS incident to hit Digdir’s services since June, according to Norwegian media. But it’s not just a repeat performance. Are Kvistad, a press officer at Digdir, told public broadcaster NRK that this attack is “two to three times larger than what we experienced last time.” That’s a significant escalation, and it raises questions about whether these incidents are connected or part of a broader campaign targeting Norway.

So far, no group has claimed responsibility, and it’s unclear who’s behind the assault or whether the recent incidents are linked. What is clear is that the attackers didn’t manage to breach sensitive data. Digdir has stated that no sensitive information stored in the affected systems was compromised. That’s a small comfort, but a comfort nonetheless.

What’s being done about it?

Digdir is working closely with Vivicta to stabilize the systems and bring services back online. As of Tuesday morning, some services were gradually returning, but the attack was still affecting others. The response has been a mix of technical mitigation and public communication, with Digdir keeping a status page updated for concerned citizens.

For those watching from the sidelines, this is a textbook case of how a DDoS attack works: flood the servers with traffic until they can’t handle legitimate requests. It’s a blunt instrument, but it can be devastatingly effective when aimed at critical infrastructure.

The bigger picture: A trend or a one-off?

The repeated nature of these attacks on Digdir’s services is worrying. Three incidents since June suggests a pattern, even if the motives remain unclear. Could this be a test of Norway’s defenses? A political statement? Or just a particularly persistent group of cybercriminals? Without more information, it’s hard to say.

What is certain is that Norway isn’t alone in facing this threat. DDoS attacks on government services have become a common tool for hacktivists and state-sponsored actors alike. The recent incidents in Norway could be a sign of things to come, not just for the country but for the region.

What should citizens expect?

For now, the advice is to be patient. Digdir is working to restore full functionality, but it’s a process. If you’re in Norway and need to access public services, it’s worth checking the status page before trying to log in. And if you’re waiting for a prescription, you might want to give it a little more time.

The attack may be over soon, but its implications will linger. This incident has exposed vulnerabilities in Norway’s digital infrastructure that will likely require a hard look at how such services are protected. For a country that has embraced digitalization so fully, the stakes are high.

As the situation develops, one thing is clear: the digital age has brought immense convenience, but it has also opened the door to new kinds of chaos. Norway is now learning that lesson firsthand.