Ukrainian police name 18-year-old infostealer operator who targeted California shoppers
In what could be called a truly international criminal op, an 18-year-old hacker from Odessa, a port city in Ukraine, ran an infostealer malware operation and conspired with other cyber crooks to target users of an online store in the US state of California.
Image by Cybernews.
Follow us
In what could be called a truly international criminal op, an 18-year-old hacker from Odessa, a port city in Ukraine, ran an infostealer malware operation and conspired with other cyber crooks to target users of an online store in the US state of California.
According to the Ukrainian cyber police, the young hacker used information-stealing malware between 2024 and 2025 to infect users’ devices and steal browser sessions and account credentials.
Infostealers are a type of malware that harvests sensitive data, including passwords, browser cookies, session tokens, payment information, and crypto wallets from infected devices and sends it to cybercriminals for account theft, fraud, and resale.
That’s precisely what the Ukrainian youngster has been doing. He stole session data from users of an (unnamed) online store in California and sold it to cybercriminals.
The police said that the attacks linked to the hacker impacted 28,000 customer accounts, allowing the crooks to make unauthorized purchases totaling around $721,000.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
The operation caused more than $250,000 in direct losses, including in the form of chargebacks.
“To implement the criminal scheme, the attackers used malicious software such as ‘infostealer,’ which imperceptibly infected users’ devices, collected credentials and transferred them to servers controlled by the attackers,” the police said in a statement.
“The information obtained was then processed and sold through specialized online resources and Telegram bots.”
According to authorities, the suspect used cryptocurrency services to conduct financial transactions with his accomplices.
The suspect’s role in the operation seems to have been central. He administered the online infrastructure needed to process, sell, and utilize the stolen data.
During two searches of the suspect’s residence, mobile phones, computer equipment, bank cards, electronic media, and other digital evidence were seized.
Bizarrely, the announcement doesn’t mention an arrest. This would normally suggest that investigators are still building the case, but the press release contains a photo of police officers standing next to the suspect in his place of residence.
Unlock more exclusive Cybernews content on YouTube.