North Macedonia charges OLVX marketplace operator with fraud and CSAM distribution

Authorities in the Republic of North Macedonia filed formal charges against E.A., a 20-year-old citizen accused of administering the OLVX cybercrime marketplace. The suspect was charged in the village of Golema Rečica near Tetovo with computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material, according to a news release from European authorities.

The legal action follows the dismantling of the OLVX platform in April, when officials arrested the alleged operator and searched their home. According to CyberScoop, the marketplace generated illicit sales exceeding $500,000 since its inception in 2023. Investigators seized a server that contained a database with more than 2,600 customer accounts linked to the illicit operations.

Investigation details and scope

Evidence gathered during the probe revealed that the suspect allegedly offered more than 1,500 sets of stolen credentials for sale on the platform. Between 2023 and 2025, the individual administered domains and sites associated with OLVX to sell stolen data, malicious tools, and various attack services. The charges reflect the full scope of the suspect's activities during this period.

The FBI provided intelligence to North Macedonian authorities and aided in the joint investigation. In a LinkedIn post, the FBI Cyber Division stated that the marketplace endangered the digital security of thousands of American citizens who rely on account integrity. The agency described the disruption as the first-ever cyber operation coordinated between the FBI and North Macedonia.

Expanded criminal activities

Beyond the OLVX marketplace, authorities accused the suspect of running an online group on Telegram. According to CyberScoop, this group facilitated the sale of illegal services and software to support various forms of cybercrime. These activities included fraudulent refund schemes and other illicit transactions that occurred earlier this year.

That suggests the suspect maintained multiple channels for distributing criminal tools and stolen data simultaneously. The combination of a dedicated marketplace and a communication platform allowed for broader distribution of malicious services to potential buyers globally.

What should you do?

Organizations should monitor for signs of credential stuffing or account takeover attempts that may stem from breached databases like those found on OLVX. Security teams should review logs for anomalous login patterns or access from unfamiliar geographies. Users should ensure multi-factor authentication is enabled on all critical accounts to mitigate the risk of stolen credentials.

What to do and how to stay safe: OLVX

• Audit active sessions and revoke access tokens for sensitive accounts to invalidate potentially stolen credentials.
• Enforce multi-factor authentication on all user accounts to add a layer of defense against password reuse.
• Monitor financial statements and credit reports for unauthorized transactions that may indicate identity theft.
• Report suspicious activity to relevant fraud departments and law enforcement agencies if personal data is compromised.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What charges is the OLVX operator facing?

The suspect faces charges for computer fraud, misuse of personal data, and production and distribution of child sexual abuse material.

How much money did the OLVX marketplace generate?

Officials stated that illicit sales on the platform exceeded $500,000 since the marketplace began operating in 2023.

Did the FBI help investigate this case?

Yes, the FBI provided intelligence and aided in the joint investigation, calling it the first coordinated cyber operation with North Macedonia.