Loading threat actor…
GXC Team is a Spanish-speaking cybercrime group and crime-as-a-service operation associated with the alias GoogleXcoder and attributed to a Brazilian operator arrested by Spanish authorities in 2025. The group functioned as an enabler for downstream fraud actors by developing, selling, and supporting phishing kits, Android malware, and AI-assisted voice scam tooling through underground channels including Telegram and hacker forums. Its phishing infrastructure impersonated banks, government portals, transportation services, e-commerce brands, and other institutions to harvest credentials and one-time authentication codes at scale. The operation is notable for combining phishing-as-a-service with mobile malware and voice-based social engineering. Reported tooling included phishing kits tailored to financial institutions and other organizations, Android malware capable of intercepting SMS or one-time passwords, and AI-enabled voice scam tools used to trick victims into disclosing authentication codes. Investigators also linked the group to broad support services for criminal customers, indicating a mature service model rather than isolated campaigns. Victim organizations and users were reported in Spain, Slovakia, the United Kingdom, the United States, and Brazil. Targeting focused especially on banking, transportation, e-commerce, and government-related entities. The group’s activity reportedly caused multimillion-euro losses and involved a large phishing infrastructure with hundreds of fraudulent sites and multiple malware variants. Spanish law enforcement, supported by private-sector investigators, dismantled the operation through coordinated searches, arrests, seizures of source code and financial records, and disruption of the channels used to market and operate the service. Known aliases directly associated with the operation include GXC Team and GoogleXcoder.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Crime-as-a-service platform distributing AI-powered phishing kits, Android malware, and voice-scam tooling.
GXC Team operated a Crime-as-a-Service (CaaS) network, selling phishing kits, Android malware, and AI-powered voice scam tools to facilitate large-scale financial fraud targeting banks, transportation companies, and online shops across multiple countries.
GXC Team is a crime-as-a-service group providing AI-powered phishing kits, Android malware, and scam tools to cybercriminals targeting financial and e-commerce sectors across multiple countries.
GXC Team operated a phishing-as-a-service platform capable of bypassing 2FA and included Android malware for targeting banks and crypto services, serving the Spanish-speaking cybercrime underground.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.