255 Fake Accounts Used to Send Malicious Excel Files to 80,000 Freelancers

Federal prosecutors allege that a Russian national operated a large phishing campaign (June 2016–Nov 2017) using 255 fake freelancer accounts to send macro-laden Excel attachments to ~80,000 users on a freelance platform; executing the macros deployed TVRAT and DarkVNC remote-access malware to steal credentials, exfiltrate data to C2 infrastructure (domains paid with virtual currency), and enable follow-on fraud. The indictment, unsealed after the suspect’s extradition to the U.S., highlights how marketplace messaging can serve as a trusted initial-access vector and details victim scale, malware families, and related charges including wire fraud and computer fraud.