North Macedonia and FBI Arrest Suspected OLVX Cybercrime Market Administrator

North Macedonian authorities and the Federal Bureau of Investigation arrested a suspect this week in connection with the OLVX cybercriminal marketplace. The raid took place at a home in the village of Golema Rečica after charges were filed against the individual.

The suspect, who remains unnamed, is accused of administering the platform that operated between 2023 and 2025. According to the FBI, the marketplace unlawfully sold victims’ personally identifiable information and login credentials. The agency stated that the site directly endangered the digital security of thousands of American citizens.

Operational Details and Background

OLVX functioned as a hub where cybercriminals exchanged stolen data, phishing kits, and remote desktop access tools. The platform gained popularity among bad actors for its payment structure, which relied on cryptocurrency rather than traditional escrow services. Users loaded funds onto the site to pay other sellers directly, bypassing third-party holding accounts.

Security researchers at ZeroFox published an investigation into OLVX in 2023, noting its growing use for selling credentials and cyber tools. This arrest follows a broader trend of law enforcement dismantling such platforms, as noted in earlier reporting by Threat Times regarding charges filed against the operator in October 2026.

Additional Allegations and Related Cases

Beyond the marketplace operations, North Macedonian police stated the suspect ran a Telegram group called ONEMILI. This group offered tools designed for fraudulent refund schemes and other scams. Authorities also reported finding evidence that the suspect had acquired and possessed child sexual abuse material for personal use through the Telegram application.

Recent global law enforcement actions have targeted similar illicit infrastructure. Last week, a co-creator of the Empire Market dark web forum received a 40-year federal prison sentence. Additionally, Microsoft announced the takedown of three Chinese phishing sites used to impersonate over 75,000 organizations worldwide.

What should you do?

Organizations should monitor for signs of credential compromise, such as unusual login locations or failed authentication attempts. Security teams should review logs for access patterns consistent with leaked data from known breaches. Users should ensure multi-factor authentication is enabled on all critical accounts to mitigate the risk of stolen credentials.

What to do and how to stay safe: OLVX

• Enable multi-factor authentication on all accounts that store sensitive personal or financial data.
• Monitor credit reports and bank statements for unauthorized transactions or identity theft indicators.
• Use unique, complex passwords for each service to prevent credential stuffing attacks.
• Review account recovery settings to ensure only authorized contact methods are listed.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who was arrested in connection with the OLVX marketplace?

An unnamed suspect was arrested in North Macedonia by local police and the FBI.

What services did the OLVX platform provide to criminals?

It allowed users to buy and sell stolen personally identifiable information, login credentials, and cyber tools.

Did the suspect face charges related to content other than cybercrime tools?

Yes, evidence indicated the suspect possessed child sexual abuse material and ran a Telegram group for refund scams.