The original text is in EN, taken from the source site. Source ↗

Russian-language “traffer” teams are selling ready-made fake prediction-market platforms to affiliates. One of them, AtlasCore, claims about $10.97 million in victim deposits.

Recorded Future’s Insikt Group tracked the campaigns, which impersonate sites like Polymarket and Kalshi. The deposit figures come from the threat actors themselves and are unverified.

Since spring 2026, AtlasCore, PolyFucked and Magnetic Team have supplied affiliates with fake trading sites, admin panels, crypto payment systems and support.

Advertised payouts are 70–80% of net profit (AtlasCore), at least 60% of revenue (PolyFucked) and a base 70% of deposits (Magnetic Team). Insikt Group tied more than 100 domains and subdomains to the three teams.

According to technical research published by Recorded Future, AtlasCore’s Telegram “Deposits” channel recorded roughly $10,971,989.72 between May 2 and September 18, 2026. Most of it was in Bitcoin.

PolyFucked separately claims about $2.4 million in quarterly turnover. The surge comes as Polymarket itself faced a reported compromise that put users’ trust in the platform under strain.

Telegram Deposit Alert Notifications (Image Source: recordedfuture)

The panels let operators manipulate outcomes. AtlasCore’s code includes a win-chance setting where 0 means “always lose” and 100 means “always win”. It also offers withdrawal-error templates, custom fees and fake starting balances. The code labels victims “mamont” (mammoth).

Magnetic Team’s “withdrawal funnel” chains fake refusal reasons: identity verification, AML review, VIP upgrade fees and withdrawal taxes. A “Boost” module sets target win rates and forces losses after consecutive wins.

The team advertises more than 3,000 bots across 5,000+ markets to fake trading activity. It also generates pools of up to 20,000 deposit wallets per blockchain, with private keys exposed for sweeping funds.

Victim pages also collect card numbers, CVVs, ID documents and selfies under a fake KYC process.

Affiliate Fraud Recruitment Portal (Image Source: recordedfuture)

All three teams advertise or provide AI-assisted victim support. AtlasCore’s code recommends GPT-4o or Claude Sonnet 4 for chat replies and cheaper models for translating victim messages into Russian.

Its manuals tell affiliates to build synthetic influencers, strip metadata to avoid Instagram AI labels, and post reaction videos on trending events. PolyFucked guides operators to generate logos with Gemini, Nano Banana or ChatGPT.

Magnetic Team’s panel code shows signs of LLM-assisted development: heavy English commenting and references to a “TEAMV2DESIGN.md” file. Insikt Group calls this a style-based inference, not a confirmed signature. The pattern matches wider reports of crypto scam operations.

Users and organizations should take defensive measures by using only official prediction-market domains and verifying URLs before depositing, while treating unexpected withdrawal fees or “tax” demands as fraud indicators.

Individuals must never submit ID documents or card data to unverified trading sites, and security teams should block and monitor the listed domains and IP addresses while watching for Instagram Reels and influencer accounts promoting trading links.

Insikt Group expects prediction-market fraud to become a reusable vertical. Individual domains will keep rotating while the underlying tooling persists. Full indicators are in the Recorded Future research.