Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSpain’s Guardia Civil announced on 9 October 2025 that it had arrested a suspected phishing-kit provider known as “GoogleXcoder” and carried out six searches. Group-IB separately identified the target as the “GXC Team” operation. The announcement describes an investigation and police allegations—not a court finding of guilt.
What was the alleged GXC Team operation?
The Guardia Civil described a crime-as-a-service operation in which a suspected developer supplied phishing tools to other criminals. Group-IB’s account names the target as GXC Team and says its intelligence supported the operation. The explicit GXC Team identification comes from Group-IB; the Guardia Civil’s release focuses on the suspected provider and the service attributed to him.
According to the Guardia Civil, the suspected developer, a 25-year-old Brazilian known as “GoogleXcoder,” designed and marketed phishing kits that could imitate bank and government websites. The alleged service included customizations, technical support, and updates. The police said customers contacted him through Telegram and paid hundreds of euros per day.
What did Spanish authorities do?
The Guardia Civil reported six searches in Spanish locations and the arrest of the suspected principal provider of the kits. It said investigators identified six people directly connected with using the service. Devices seized during the searches reportedly contained phishing kits, accounts, and conversations with cyber-fraudsters.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
The searches were named as taking place in Valladolid, Zaragoza, Barcelona, Palma de Mallorca, San Fernando, and La Línea de la Concepción. These are locations cited in the Spanish police announcement; they should not be confused with other countries or regions that may appear in accounts of the operation as targets or victims.
The Guardia Civil said Telegram channels had been subject to deactivation measures. Investigators were still analyzing digital evidence when the announcement was published, and the release did not rule out further action.
How did the investigation develop?
- From 2023: The Guardia Civil said phishing campaigns impersonating Spanish public bodies and major banks were taking place.
- 9 October 2025: The Guardia Civil published its announcement of the arrest and searches.
- International and private-sector cooperation: The Guardia Civil said Brazil’s Federal Police and Group-IB collaborated. Group-IB’s own account says its intelligence supported the operation.
What is established—and what is not?
The Guardia Civil’s announcement records the law-enforcement account of an investigation: an arrest, searches, identified service users, and evidence seized. Its claims about the suspected provider and customers remain allegations in that account. The announcement is not a judgment establishing guilt, and it reported that the investigation remained open on 9 October 2025. The sources cited here do not establish what later arrests or judicial outcomes, if any, followed.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
