{"id":"CMP-202611-wo3xz2","kind":"campaign","aliases":[],"related":[],"title":"Fake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)","description":null,"summary":"Since spring 2026, Russian-language scam crews AtlasCore, PolyFucked and Magnetic Team have rented out ready-made fake prediction-market sites that look like Polymarket or Kalshi, with YES/NO bets on news, politics, crypto and sports. Affiliates promote them with AI-generated fake influencers posting Instagram Reels, Threads and YouTube Shorts about trending news, sometimes offering a sign-up bonus (one Reddit report: $1,000 for joining). The sites show fake trading activity, let the operator force a victim to lose, block withdrawals with fake errors and fees, ask for card number and CVV, and run a fake 'KYC' asking for photos of passports, ID cards or driver's licences and selfies. Support chat is answered by AI. AtlasCore claims about $10.97M in deposits from May to Sep 2026 (unverified). Recorded Future found 100+ domains; the full list is in its report appendices.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-03T22:18:56+00:00","products":[{"name":"Polymarket","fixed":[],"vendor":"Polymarket"},{"name":"Kalshi","fixed":[],"vendor":"Kalshi"},{"name":"Instagram","fixed":[],"vendor":"Meta"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Match links and sites against the domains Recorded Future names: prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, predictum[.]app, predictum[.]pro, predictum[.]cc, speculor[.]net, wettora[.]com, bravioar[.]com, winzo[.]live, preds[.]co, resolve[.]bet, forutsagt[.]bet, futaryx[.]com, fortvet[.]cc, fortexp[.]live, kiro-cheap[.]pro; panels atlascore-panel[.]net and polyfucker[.]space; IPs 192[.]162[.]199[.]243, 81[.]90[.]17[.]100, 83[.]217[.]208[.]78. preds[.]co falsely claims to be an official PolyMarket mirror. The real sites are polymarket.com and kalshi.com. Warning signs: a prediction market found through an Instagram/TikTok influencer reel, a joining bonus, a 'withdrawal error' or fee before you can withdraw, or a request for ID photos plus a selfie.","fix":"Do not deposit on any prediction-market site reached from a social-media post; type polymarket.com or kalshi.com yourself. If you already deposited, do not pay any 'withdrawal fee' or 'verification fee' (the money will not come back), keep the transaction IDs and report to your local fraud authority. If you sent card details, call your bank to block the card; if you uploaded ID photos, watch for identity fraud. Organisations can block the listed domains.","status":"open","published_at":null,"first_seen_at":"2026-11-03T22:18:56+00:00","triaged_at":"2026-11-03T22:18:56+00:00","updated_at":"2026-11-03T22:20:15+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':31A '000':113B '1':112B '10.97':170B '100':183B '2026':46B,178B 'activ':121B 'affili':83B 'ai':12A,88B,166B 'ai-gener':87B 'ai-mad':11A 'answer':164B 'appendic':192B 'ask':137B,148B 'atlascor':52B,167B 'atlascore':33A 'bet':76B 'block':130B 'bonus':108B 'campaign':40B 'card':139B,154B 'chat':162B 'claim':168B 'cmp':30A 'crew':51B 'crypto':18A,80B 'cvv':142B 'deposit':19A,173B 'document':22A 'domain':184B 'driver':156B 'earli':42B 'early-warn':41B 'error':134B 'fake':1A,63B,90B,119B,133B,146B 'fee':136B 'forc':125B 'found':182B 'full':186B 'futur':29A,181B 'generat':89B 'id':21A,153B 'influenc':14A,91B 'instagram':16A,39A,93B 'join':115B 'kalshi':4A,38A,73B 'kyc':147B 'languag':49B 'let':25A,122B 'licenc':158B 'like':70B 'list':187B 'look':69B 'lose':129B 'm':171B 'made':13A,62B 'magnet':55B 'magnetic':35A 'market':7A,66B 'may':175B 'never':24A 'news':78B,101B 'number':140B 'offer':103B 'one':109B 'oper':124B 'passport':152B 'photo':150B 'polit':79B 'polyfuck':53B 'polyfucked':34A 'polymarket':2A,37A,71B 'post':92B 'predict':6A,65B 'prediction-market':5A,64B 'promot':9A,84B 'readi':61B 'ready-mad':60B 'record':28A,180B 'reddit':110B 'reel':94B 'rent':58B 'report':111B,191B 'run':144B 'russian':48B 'russian-languag':47B 'scam':50B 'selfi':160B 'sep':177B 'short':98B 'show':118B 'sign':106B 'sign-up':105B 'sinc':44B 'site':8A,67B,117B 'sometim':102B 'sport':82B 'spring':45B 'support':161B 'take':17A 'team':36A,56B 'thread':95B 'trade':120B 'trend':100B 'unverifi':179B 'victim':26A,127B 'warn':43B 'withdraw':27A,131B 'wo3xz2':32A 'yes/no':75B 'youtub':97B","nicknames":["AtlasCore","PolyFucked","Magnetic Team"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["atlascore","instagram","kalshi","magneticteam","polyfucked","polymarket"],"ptokens":["instagram","kalshi","polymarket"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"fraud","first_public_at":"2026-11-03T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-wo3xz2","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T22:18:56+00:00","fetched_at":"2026-11-03T22:18:56+00:00","note":null}],"documents":[{"id":60756,"url":"https://blog.knowbe4.com/warning-phishing-operations-are-impersonating-prediction-markets","title":"KnowBe4: Warning: Phishing Operations Are Impersonating Prediction Markets","kind":"blog","source":"blog","publisher":null,"text":"Warning: Phishing Operations Are Impersonating Prediction Markets\n\nFraudsters are exploiting the increased public interest in prediction markets such as PolyMarket and Kalshi, according to researchers at Recorded Future. Criminal groups known as “traffers” are providing fellow crooks with “websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance” to target users of prediction markets.","published_at":"2026-11-03T21:00:12+00:00","relation":"describes","confidence":null,"note":null},{"id":61217,"url":"https://www.recordedfuture.com/research/prediction-markets-traffer-teams","title":"Prediction Markets Emerge as a New Vertical for Traffer Teams (Recorded Future Insikt Group)","kind":"blog","source":"analyst","publisher":null,"text":"Since spring 2026, Russian-language traffer teams AtlasCore, PolyFucked and Magnetic Team run fake prediction-market sites imitating Polymarket and Kalshi: YES/NO markets, fabricated activity imported from the Polymarket API, operator-forced losses, withdrawal-blocking error messages and fees, card number/CVV collection and fake KYC asking for ID document images and selfies. Promoted via AI-generated synthetic influencer Instagram Reels, Threads, YouTube Shorts about trending news events; Reddit report of accounts promoting event-x[.]cc with offers of $1,000 for joining. preds[.]co falsely claims to be an official PolyMarket mirror. AI chatbots (via NanoGPT) answer victim support. AtlasCore claimed ~$10.97M deposits May 2 - Sep 18 2026 (unverified). 100+ domains. Shared scam domains: prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[.]cc, predicate[.]world, predicate[.]live, predicate[.]club, predictum[.]app, predictum[.]pro, predictum[.]cc, speculor[.]net, wettora[.]com, bravioar[.]com, winzo[.]live, preds[.]co, resolve[.]bet, forutsagt[.]bet, futaryx[.]com, fortvet[.]cc, fortexp[.]live, kiro-cheap[.]pro. Panels: atlascore-panel[.]net, polyfucker[.]space. IPs 192[.]162[.]199[.]243, 81[.]90[.]17[.]100, 83[.]217[.]208[.]78.","published_at":"2026-11-03T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}