Ukraine’s cyberpolice say they disrupted 300 Telegram channels used by scam communities in an operation against phishing sites that imitated banks, marketplaces and public services. The September 18 WallHack announcement describes a network reaching beyond fake pages: messaging channels helped coordinate the people distributing them, while the pages harvested payment information and access to online banking.
Behind the fake website, a market for fraud
One police photograph is especially revealing. A Telegram advertisement on a laptop screen seeks payment services, cash-out partners and couriers. That is the backstage of the scam: a convincing website can collect information, but turning access into money requires other people and services.
The photograph helps explain why investigators targeted channels as well as links. Removing a fraudulent page interrupts one destination; disrupting the spaces where participants find partners can interrupt the work behind it. This is an interpretation of the evidence, not a claim that every advertised service led to a proven transaction.
According to police, the sites copied trading platforms, banks, government services and international organizations to obtain information from people in Ukraine and the EU. The trust failure happens when a familiar-looking page is treated as proof of who operates it. A bank’s name on a form does not establish that the form sends data to the bank.
What the operation’s numbers establish
The police report covers investigative activity in July–August 2026 across Kyiv and 19 regions. Officers conducted 239 searches and seized nearly 600 pieces of computer equipment. Twenty-three people received notices of suspicion; that is not a finding of guilt. Police also reported blocking thousands of phishing links.
The final number of victims and total losses remain under investigation. Channel audiences, account counters visible in a photograph, suspects and victims are different measurements. None should be turned into a claim that a specific number of people lost money.
Verify the destination before giving it bank details
For a buyer or banking customer, the useful check comes before submitting the form: open the service through its established app or an address you independently know, rather than following the route supplied by a stranger. A page can copy a brand without controlling the legitimate service. Our T-Mobile points investigation illustrates the same distinction between a brand displayed on a page and the domain behind it; it is a separate campaign.
If you already supplied banking credentials or payment information, contact your bank through a known channel immediately. The FBI’s account-takeover guidance recommends prompt bank contact and preserving details of the incident. Save the message, destination URL and transaction records; a deleted channel is not a reason to discard the evidence you still have.
WallHack’s lesson is that the page a victim sees may be only the front of a coordinated operation. Check who receives the information, not just whose branding asks for it.
References
- Cyberpolice of Ukraine. Police notify 23 scam-community participants of suspicion in Operation WallHack. September 18, 2026.
- FBI, Internet Crime Complaint Center. Account Takeover Fraud. Accessed September 18, 2026.
