Spain Dismantles GXC Team Cybercrime Syndicate

Spanish authorities have dismantled the GXC Team cybercrime syndicate and arrested its suspected leader in a large-scale operation across multiple cities. The 25-year-old Brazilian national, known online as “GoogleXcoder,” led one of the most active cybercrime-as-a-service (CaaS) operations in Europe.

The Guardia Civil, supported by Europol and Group-IB, carried out coordinated raids in Barcelona, Zaragoza, and Palma de Mallorca. Investigators seized computers, smartphones, and cryptocurrency linked to criminal profits.

Inside the GXC Team’s Criminal Operation

The GXC Team specialized in selling ready-to-use cybercrime tools to other threat actors. These included:

• AI-enhanced phishing kits that mimicked banks and e-commerce sites
• Android malware that intercepted SMS messages and one-time passwords
• Voice scam utilities used to deceive victims through fake customer support calls

The group offered customized phishing campaigns and technical support to clients through Telegram and dark web forums. Investigators linked the GXC Team to more than 250 fraudulent websites and nine active malware families.

Global Reach and Victims

The GXC Team cybercrime syndicate operated internationally, targeting victims in Spain, the United States, Brazil, the United Kingdom, and Slovakia. Their phishing kits imitated financial institutions, online retailers, and logistics companies to harvest credentials and payment details.

Spanish law enforcement reported that many of the attacks targeted local banking customers and used Spanish-language lures to increase success rates.

How Authorities Tracked and Stopped the Group

Investigators used blockchain analysis and digital forensics to trace cryptocurrency transactions linked to the group’s operations. The raids uncovered detailed records of clients, payment logs, and source code for multiple malware tools.

Authorities also shut down Telegram channels that promoted the group’s services and froze assets associated with money laundering. The leader faces charges of fraud, computer intrusion, and membership in a criminal organization.

Why the Arrest Matters

The takedown of the GXC Team cybercrime syndicate disrupts one of the largest underground networks supplying phishing and malware kits to other criminals. By removing a major CaaS provider, authorities have weakened a chain that supported thousands of smaller cybercrime operations.

This case highlights how global collaboration between law enforcement and cybersecurity researchers can dismantle complex online ecosystems. It also shows that cybercrime facilitators—those who build and sell malicious tools—face increasing accountability.

Conclusion

The dismantling of the GXC Team cybercrime syndicate marks a major success in Europe’s fight against organized digital crime. The arrest of its leader ends a network responsible for hundreds of phishing attacks worldwide. Spain’s operation demonstrates that even transnational cybercriminals cannot hide behind anonymity forever.