North Macedonian police arrest alleged administrator of OLVX cybercrime market

Police in North Macedonia have arrested the alleged administrator of OLVX, a cybercriminal marketplace that sold stolen personal information and login credentials, in a joint operation with the FBI, The Record reported on October 14. The suspect, who has not been named, was detained this week after charges were filed and his home in the village of Golema Rečica was raided. The arrest is the latest in a series of actions against underground markets that supply the raw material for fraud and account takeover attacks.

What happened

According to The Record, the FBI says OLVX was active between 2023 and 2025 and sold victims' personally identifiable information and login credentials through more than 1,500 seller accounts. The bureau stated that the marketplace "directly endangered the digital security of thousands of American citizens."

North Macedonian police also said the suspect ran a Telegram group called ONEMILI, which offered tools for fraudulent refund schemes and other scams. The country's Interior Ministry additionally alleged that evidence showed the suspect had acquired child sexual abuse material via Telegram.

About OLVX

The Record noted that cybersecurity firm ZeroFox warned in a 2023 investigation that OLVX was growing in popularity as a place to buy phishing kits, remote desktop access, credentials and stolen data. Unlike many underground markets, OLVX did not use an escrow service; instead, users loaded cryptocurrency onto the platform and paid each other directly through it.

Markets of this kind lower the barrier to entry for cybercrime by giving less skilled actors access to ready-made phishing tools and compromised accounts that can be used for fraud, intrusion and further data theft.

Wider context

The arrest comes amid a busy period for law enforcement action against cybercrime infrastructure. The Record pointed out that law enforcement agencies have taken down dozens of cybercriminal marketplaces over the past five years, that the co-creator of the Empire Market dark web forum was sentenced to 40 years in U.S. federal prison the previous week, and that Microsoft announced the disruption of three Chinese-language phishing platforms used to send hundreds of millions of malicious messages.

What it means for defenders

Credentials and personal data sold on markets like OLVX often remain in circulation after a takedown. Organizations should continue to enforce multi-factor authentication, monitor for logins from unusual locations, rotate credentials exposed in past breaches, and restrict internet-facing remote desktop services, which were among the access types traded on the platform.