Skip to content
Hacker Posts

OLVX marketplace admin charged in North Macedonia

North Macedonia charged a 20-year-old alleged administrator of the OLVX cybercrime market, which the FBI says sold stolen data and phishing kits via 1,500+ seller accounts from 2023 to 2025.

Published 3 min read
breachlaw-enforcementcybercrimefbi

North Macedonian authorities have charged a 20-year-old citizen, identified in the Ministry of Interior's release as "E.A.", as the alleged administrator of OLVX, a cybercrime marketplace the FBI says trafficked in stolen data and attack tooling. The case, announced October 14, is reported by The Record and CyberScoop, both citing the Ministry of Interior (MVR) statement and FBI involvement.

What OLVX was

Per the FBI's account relayed by both outlets, OLVX operated from 2023 to 2025 and sold stolen personal data, login credentials, phishing kits, remote-desktop access, and other cybercrime tools. It ran on cryptocurrency with no escrow service — buyers pre-loaded funds onto the platform to pay sellers directly.

On scale, the two reports frame the numbers slightly differently:

  • The FBI alleges OLVX moved stolen data "via over 1,500 seller accounts" (The Record), which CyberScoop renders as more than 1,500 listings of stolen credentials.
  • A seized server held a database of "more than 2,600 customer accounts," and platform sales exceeded $500,000, per European authorities cited by CyberScoop in connection with an April action.

Security firm ZeroFox flagged OLVX's growth in a 2023 investigation, per The Record.

The charges

The suspect — from the Tetovo-area village of Golema Rečica — faces charges including computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material. The Record adds that investigators tie the suspect to a Telegram group, ONEMILI, offering fraudulent-refund tooling, and say evidence indicates CSAM acquired through Telegram.

The timelines reported don't fully align, and we'll flag rather than smooth that over: CyberScoop reports the platform was dismantled and the suspect's home searched in April 2026, with charges announced October 14; The Record describes a home raid tied to this week's charges. What both agree on is the agencies involved — North Macedonia's MVR and the FBI — and that the FBI's Cyber Division called it "the first-ever cyber operation coordinated between the FBI and North Macedonia."

What defenders should take from it

There's no patch or detection artifact here — this is a takedown, not a vulnerability. The practical read:

  1. Data sold on OLVX predates the takedown and is still in circulation. A marketplace going dark doesn't un-leak credentials. If your users' logins passed through brokers like this, forced rotation and MFA remain the mitigation.
  2. Treat credential-stuffing and phishing-kit traffic as unchanged. OLVX was one supplier among many; its removal doesn't move the threat curve for any single defender.

Context

OLVX joins a run of 2026 marketplace, forum, and infrastructure takedowns built on cross-border police cooperation rather than a single agency's reach. The notable wrinkle is the FBI describing this as its first coordinated cyber operation with North Macedonia — the kind of new bilateral channel that matters less for this one market than for where the next ones get run from.

Related stories