Europol and 19 countries make 37 arrests and disrupt phishing-as-a-service platform LabHost in a year-long operation with help from Microsoft, Intel, and others
https://news.met.police.uk/... … X: @metpoliceuk : A Met-led, multi-agency operation closed down a phishing website responsible for mass fraud. LabHost allowed users to create sophisticated copies of existing bank and company websites with the purpose of tricking unsuspecting victims into revealing their personal details. We... [image] @metpoliceuk : The impact of LabHost's activities can be felt nationwide. It is estimated that just under 70k people in the UK have been targeted by fraudsters using LabHost. After infiltrating the criminal website, our officers have taken steps to protect victims' assets and target those... [image] @europol : 🎣19 countries have joined forces to take down one of the world's largest phishing-as-a-service platform. #LabHost has been shut down after a year-long investigation led by @metpoliceuk. Read how Europol supported this investigation ⤵ https://www.europol.europa.eu/ ... LinkedIn: Amy Hogan-Burney : Excellent work driven by the UK's Metropolitan Police Service! LabHost was a prolific phishing-as-a-service provider that defrauded thousands of victims worldwide. … Forums: r/cybersecurity : LabHost phishing service with 40,000 domains disrupted, 37 arrested
Context & Ripple Effects
LabHost turned cloned bank and company pages into a service for fraudsters, making the platform itself a high-leverage enforcement target rather than treating each phishing site as an isolated incident.
The case follows the earlier shutdown of the 16shop phishing service, another example of authorities targeting the infrastructure that packages phishing capabilities for many downstream users. Private-sector assistance from Microsoft, Intel and others also shows how platform and threat-intelligence data can support cross-border investigations.
First-order effects
- LabHost’s operators and users lose access to a service used to create credential-harvesting sites, while the disruption of roughly 40,000 associated domains reduces the active phishing infrastructure tied to it.
- The 37 arrests and victim-protection steps give participating authorities immediate leads for identifying affected people and pursuing alleged operators, resellers and customers.
Second-order effects
- Fraudsters that depended on LabHost must replace its templates, hosting and operational support, likely shifting activity to other services or more fragmented infrastructure.
- Banks and companies whose brands were cloned can concentrate on account monitoring and victim outreach, while security vendors and platform partners gain new indicators from the seized infrastructure.
Third-order effects
- Repeated action against phishing-as-a-service operators can raise the cost and operational risk of running centralized criminal platforms, even if it does not eliminate the underlying demand for phishing tools.
- The subsequent disruption of Tycoon2FA suggests enforcement is increasingly aimed at the service layer that scales credential theft, making sustained public-private and cross-border coordination more consequential than one-off site removals.
The trend: Phishing enforcement is shifting from takedowns of individual lures toward coordinated disruption of the shared services that industrialize large-scale credential theft.