Rus tilidagi “traffer” jamoalari tayyor soxta bashorat bozori platformalarini sheriklarga sotmoqda. Ulardan biri — AtlasCore — jabrlanuvchilarning depozitlarida taxminan 10,97 million dollarni da'vo qilmoqda.
Recorded Future'ning Insikt Group kampaniyalarni kuzatib bordi, ular Polymarket va Kalshi kabi saytlarni taqlid qiladi. Depozit raqamlari tahdid aktorlarining o'zlari tomonidan berilgan va tasdiqlanmagan.
2026-yil bahoridan beri AtlasCore, PolyFucked va Magnetic Team sheriklarga soxta savdo saytlari, admin panellari, kripto to'lov tizimlari va qo'llab-quvvatlashni taqdim etgan.
E'lon qilingan to'lovlar — sof foydaning 70–80% (AtlasCore), daromadning kamida 60% (PolyFucked) va depozitlarning asosiy 70% (Magnetic Team). Insikt Group uchta jamoaga 100 dan ortiq domen va subdomenni bog'ladi.
Recorded Future tomonidan e'lon qilingan texnik tadqiqotga ko'ra, AtlasCore'ning Telegram “Depozitlar” kanali 2026-yil 2-maydan 18-sentabrgacha taxminan 10 971 989,72 dollarni qayd etgan. Uning aksariyati Bitcoin'da bo'lgan.
PolyFucked alohida choraklik aylanmada taxminan 2,4 million dollarni da'vo qilmoqda. O'sish Polymarketning o'zi foydalanuvchilarning ishonchini zaiflashtirgan xabar qilingan buzilish bilan bog'liq.
Telegram Depozit Ogohlantirish Bildirishnomalari (Rasm manbasi: recordedfuture)
Panellar operatorlarga natijalarni manipulyatsiya qilish imkonini beradi. AtlasCore kodida g'alaba ehtimoli sozlamasi mavjud, bunda 0 “har doim yutqazish” va 100 “har doim yutish” degan ma'noni anglatadi. Shuningdek, u yechib olish xatolari shablonlari, maxsus to'lovlar va soxta boshlang'ich balanslarni taklif qiladi. Kod jabrlanuvchilarni “mamont” (mamut) deb belgilaydi.
Magnetic Team'ning “yechib olish voronkasi” soxta rad etish sabablarini zanjirlaydi: shaxsni tasdiqlash, AML tekshiruvi, VIP yangilash to'lovlari va yechib olish soliqlari. “Boost” moduli maqsadli g'alaba stavkalarini belgilaydi va ketma-ket g'alabalardan keyin majburiy yutqazishlarni kiritadi.
Jamoa soxta savdo faoliyatini taqlid qilish uchun 5000 dan ortiq bozorda 3000 dan ortiq botni reklama qiladi. Shuningdek, har bir blokcheyn bo'yicha 20 000 tagacha depozit hamyonlarining hovuzlarini yaratadi, mablag'larni o'g'irlash uchun shaxsiy kalitlar ochiq qoldiriladi.
Jabrlanuvchi sahifalari shuningdek, soxta KYC jarayoni ostida karta raqamlari, CVVlar, shaxsni tasdiqlovchi hujjatlar va selfilarni yig'adi.
Sherik Firibgarlik Yollash Portali (Rasm manbasi: recordedfuture)
Uchta jamoa ham AI yordamida jabrlanuvchilarni qo'llab-quvvatlashni reklama qiladi yoki taqdim etadi. AtlasCore kodi chat javoblari uchun GPT-4o yoki Claude Sonnet 4 ni, jabrlanuvchilarning xabarlarini rus tiliga tarjima qilish uchun esa arzonroq modellarni tavsiya qiladi.
Uning qo'llanmalari sheriklarga sintetik ta'sirchilarni yaratish, Instagram AI yorliqlaridan qochish uchun metama'lumotlarni o'chirish va trenddagi voqealarga reaksiya videolarini joylashtirishni aytadi. PolyFucked operatorlarga Gemini, Nano Banana yoki ChatGPT bilan logotiplar yaratishni yo'naltiradi.
Magnetic Team panel kodida LLM yordamida ishlab chiqilgan belgilar ko'rinadi: ingliz tilidagi og'ir izohlar va “TEAMV2DESIGN.md” fayliga havolalar. Insikt Group buni uslubga asoslangan xulosa deb ataydi, tasdiqlangan imzo emas. Bu naqsh kripto firibgarlik operatsiyalarining kengroq hisobotlari bilan mos keladi.
Foydalanuvchilar va tashkilotlar faqat rasmiy bashorat bozori domenlaridan foydalanish va depozit qilishdan oldin URL manzillarini tekshirish orqali himoya choralarini ko'rishlari, kutilmagan yechib olish to'lovlari yoki “soliq” talablarini esa firibgarlik belgisi sifatida qabul qilishlari kerak.
Shaxslar tasdiqlanmagan savdo saytlariga hech qachon shaxsni tasdiqlovchi hujjatlar yoki karta ma'lumotlarini taqdim etmasligi, xavfsizlik jamoalari esa ro'yxatdagi domen va IP manzillarni bloklash va kuzatish, shuningdek, savdo havolalarini targ'ib qiladigan Instagram Reels va ta'sirchi hisoblarini kuzatishi kerak.
Insikt Group bashorat bozori firibgarligi qayta ishlatiladigan vertikalga aylanishini kutmoqda. Alohida domenlar aylanishda davom etadi, asosiy vositalar esa saqlanib qoladi. To'liq ko'rsatkichlar Recorded Future tadqiqotida keltirilgan.
Russian-language “traffer” teams are selling ready-made fake prediction-market platforms to affiliates. One of them, AtlasCore, claims about $10.97 million in victim deposits.
Recorded Future’s Insikt Group tracked the campaigns, which impersonate sites like Polymarket and Kalshi. The deposit figures come from the threat actors themselves and are unverified.
Since spring 2026, AtlasCore, PolyFucked and Magnetic Team have supplied affiliates with fake trading sites, admin panels, crypto payment systems and support.
Advertised payouts are 70–80% of net profit (AtlasCore), at least 60% of revenue (PolyFucked) and a base 70% of deposits (Magnetic Team). Insikt Group tied more than 100 domains and subdomains to the three teams.
According to technical research published by Recorded Future, AtlasCore’s Telegram “Deposits” channel recorded roughly $10,971,989.72 between May 2 and September 18, 2026. Most of it was in Bitcoin.
PolyFucked separately claims about $2.4 million in quarterly turnover. The surge comes as Polymarket itself faced a reported compromise that put users’ trust in the platform under strain.
Telegram Deposit Alert Notifications (Image Source: recordedfuture)
The panels let operators manipulate outcomes. AtlasCore’s code includes a win-chance setting where 0 means “always lose” and 100 means “always win”. It also offers withdrawal-error templates, custom fees and fake starting balances. The code labels victims “mamont” (mammoth).
Magnetic Team’s “withdrawal funnel” chains fake refusal reasons: identity verification, AML review, VIP upgrade fees and withdrawal taxes. A “Boost” module sets target win rates and forces losses after consecutive wins.
The team advertises more than 3,000 bots across 5,000+ markets to fake trading activity. It also generates pools of up to 20,000 deposit wallets per blockchain, with private keys exposed for sweeping funds.
Victim pages also collect card numbers, CVVs, ID documents and selfies under a fake KYC process.
Affiliate Fraud Recruitment Portal (Image Source: recordedfuture)
All three teams advertise or provide AI-assisted victim support. AtlasCore’s code recommends GPT-4o or Claude Sonnet 4 for chat replies and cheaper models for translating victim messages into Russian.
Its manuals tell affiliates to build synthetic influencers, strip metadata to avoid Instagram AI labels, and post reaction videos on trending events. PolyFucked guides operators to generate logos with Gemini, Nano Banana or ChatGPT.
Magnetic Team’s panel code shows signs of LLM-assisted development: heavy English commenting and references to a “TEAMV2DESIGN.md” file. Insikt Group calls this a style-based inference, not a confirmed signature. The pattern matches wider reports of crypto scam operations.
Users and organizations should take defensive measures by using only official prediction-market domains and verifying URLs before depositing, while treating unexpected withdrawal fees or “tax” demands as fraud indicators.
Individuals must never submit ID documents or card data to unverified trading sites, and security teams should block and monitor the listed domains and IP addresses while watching for Instagram Reels and influencer accounts promoting trading links.
Insikt Group expects prediction-market fraud to become a reusable vertical. Individual domains will keep rotating while the underlying tooling persists. Full indicators are in the Recorded Future research.