A joint operation led by Group-IB, INTERPOL, and Algerian authorities has dismantled “SniperDz,” a Phishing-as-a-Service (PhaaS) platform that operated for nine years while providing sophisticated phishing kits targeting over 30 major global organizations. The takedown represents one of the longest-running cybercrime platform shutdowns in recent memory.
SniperDz offered turnkey phishing templates and social engineering toolkits that enabled even low-skill attackers to harvest credentials and sensitive data at scale. The platform’s longevity is particularly notable — nine years of continuous operation means it predated many of today’s anti-phishing defenses and adapted through multiple generations of security controls. Group-IB’s investigation, which supported the INTERPOL-coordinated action, ultimately led to the identification and takedown of the platform’s infrastructure.
While specific arrest details and the full scope of the operation remain under wraps, the dismantling of SniperDz removes a significant enabler of credential theft campaigns that fueled downstream fraud, account takeovers, and initial access brokering for more serious threat actors.
Sources
Commentary
Nine years is an eternity in cybercrime operations. Most PhaaS platforms get burned within a year or two — either through law enforcement action, internal disputes, or competitors. The fact that SniperDz survived for nearly a decade speaks to either exceptional operational security or a frustrating lack of international enforcement coordination until now.
The PhaaS model is one of cybercrime’s most democratizing forces. It turns phishing from a skilled trade into a commodity service, dramatically expanding the pool of people who can execute convincing credential-harvesting campaigns. Taking down SniperDz will create a temporary gap, but the demand for these services means competitors will fill the void quickly. The real value of this takedown is the intelligence gathered during the investigation — the customer lists, payment records, and operational patterns that can feed into broader cybercrime investigations for months to come.