This Week in Cybercrime
The FBI Agent, the Fake CEOs and the Freezers at 50°C
Weekend update · 7 November 2026 · 25:37
This week in cybercrime: an FBI counterintelligence supervisor admits stealing about $2.47 million in crypto from the Bureau's own investigations, and planning a new life on a vineyard in Portugal.
Three men are charged with using AI to impersonate CEOs and law firm lawyers on calls, allegedly tricking companies into wiring about $129 million.
Supermarket freezers across Europe, including stores in Sweden, are remotely set to 50°C. Google takes down XCPE, a 1.3 million device botnet allegedly built into TV boxes by their own manufacturer.
Europol hits a supplier of fake trading platforms after a four-year case that started with one couple's complaint. A Canadian is extradited over university supercomputers hijacked for cryptomining. And in Russia, Li Auto owners are locked out of their own cars until they pay.
Stories in this episode
The FBI agent who robbed his own cases
Patrick Steven Yaroch, an FBI supervisory special agent, pleaded guilty on 5 November to stealing about $2.47 million in crypto through about 100 transfers tied to 35 FBI investigations. He asked ChatGPT where to live, planned a vineyard in Portugal, and was caught because he confessed. Sentencing is 4 March 2027.
Sources: EDVA press release · The Record
Deepfake CEOs and a $129 million wire scheme
Jacob Soall, Sharon Hazan and Guy Sheetrit are charged with using AI to pose as CEOs and law firm lawyers on calls, allegedly tricking companies into wiring about $129 million. They were arrested in Spain and the UK, and extradition is pending.
Sources: SDNY news · The Record · AP
Freezers set to 50°C, including stores in Sweden
In the early hours of 2 November, supermarket refrigerators and freezers across Europe were remotely set to about 50°C, spoiling stock. An ICA store in Sjöbo, Sweden, was among those hit. It is the second wave after about 700 victims in France in October. Nobody has been identified. CISA and the FBI issued an advisory.
Sources: The Record · BBC · The Guardian · The Record (CISA/FBI advisory)
XCPE, the botnet allegedly built into TV boxes
Google and partners took down XCPE, a botnet of more than 1.3 million Android TV boxes. Google says the malware was built in by the manufacturer, Videostrong, and that the takedown may also cut access to more than 10 million other devices.
Source: KrebsOnSecurity
Europol hits a supplier of fake trading platforms
On 3 November, a Europol-supported operation seized more than 100 servers and arrested seven people in seven countries. The four-year case started with one German couple who could not withdraw money from an online trading platform.
Source: Europol
University supercomputers hijacked for cryptomining
Ryan James Roach was extradited from Canada on 28 October and has pleaded not guilty to a 2016–2019 scheme that allegedly hijacked university supercomputers to mine cryptocurrency. Co-defendant Mathiew James Stubbings is still in extradition proceedings.
Sources: DataBreaches.net (WDNY) · CBC · CyberScoop
Li Auto owners in Russia locked out of their cars
Hackers are taking over Li Auto EV accounts in Russia using leaked VINs and expired eSIMs, locking owners out and demanding a ransom of about $500–600 to get back in.
Source: Risky Bulletin
Charges are allegations unless a conviction or plea is stated.