Live › campaign › CMP-202611-wo3xz2

medium⚡ Early warning · no CVE yetAtlasCorePolyFuckedMagnetic TeamExploited in the wildOther

Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)

Since spring 2026, Russian-language scam crews AtlasCore, PolyFucked and Magnetic Team have rented out ready-made fake prediction-market sites that look like Polymarket or Kalshi, with YES/NO bets on news, politics, crypto and sports. Affiliates promote them with AI-generated fake influencers posting Instagram Reels, Threads and YouTube Shorts about trending news, sometimes offering a sign-up bonus (one Reddit report: $1,000 for joining). The sites show fake trading activity, let the operator force a victim to lose, block withdrawals with fake errors and fees, ask for card number and CVV, and run a fake 'KYC' asking for photos of passports, ID cards or driver's licences and selfies. Support chat is answered by AI. AtlasCore claims about $10.97M in deposits from May to Sep 2026 (unverified). Recorded Future found 100+ domains; the full list is in its report appendices.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

medium

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, primary source

First public: Nov 3, 2026 UTC
Last modified: Nov 3, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-03 22:18 UTC. All times on this page are UTC.

Who is affected

3 products

Product	Ecosystem	Affected	Fixed in
Polymarket	–	–	–
Kalshi	–	–	–
Instagram	–	–	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Match links and sites against the domains Recorded Future names: prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, predictum[.]app, predictum[.]pro, predictum[.]cc, speculor[.]net, wettora[.]com, bravioar[.]com, winzo[.]live, preds[.]co, resolve[.]bet, forutsagt[.]bet, futaryx[.]com, fortvet[.]cc, fortexp[.]live, kiro-cheap[.]pro; panels atlascore-panel[.]net and polyfucker[.]space; IPs 192[.]162[.]199[.]243, 81[.]90[.]17[.]100, 83[.]217[.]208[.]78. preds[.]co falsely claims to be an official PolyMarket mirror
The real sites are polymarket.com and kalshi.com
Warning signs: a prediction market found through an Instagram/TikTok influencer reel, a joining bonus, a withdrawal error or fee before you can withdraw, or a request for ID photos plus a selfie

Know the next one before it finds you.

Get started free

Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Polymarket

–

Kalshi

–

Instagram

–

Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)

Who is affected

How to check

Know the next one before it finds you.

Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources