US Charges Russian National in Phishing Scheme That Hit 80,000 Freelancers
A California federal grand jury has indicted a Russian national accused of running a large-scale phishing operation that targeted freelance workers around the globe. According to prosecutors, the scheme lured victims with fake job offers or client messages, tricking them into installing malicious attachments.
Once opened, the malware deployed two tools: TVRAT, which gave attackers remote control over infected machines, and DarkVNC, a hidden remote-desktop backdoor that let operators quietly watch and control victims' screens without their knowledge. Investigators say the campaign compromised roughly 80,000 machines belonging to freelancers, likely aiming to harvest payment credentials, client data, or account access for resale or further fraud.
The indictment is part of a broader US effort to prosecute foreign-based cybercriminals targeting American freelancers and gig workers, a group often lacking corporate IT protections.