Threat reportPhishingTL-2026-4758
Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team)
Prediction Markets Emerge as a New Vertical for Traffer (TL-2026-4758), also tracked as Prediction market traffer teams, is a medium-severity phishing campaign, first published 2026-10-29. It is attributed to AtlasCore with medium confidence, affects Polymarket Brand impersonated by fake prediction market sites, maps to 9 MITRE ATT&CK techniques (T1036, T1566.003, T1583.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 3AtlasCore
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4758
- Threat ID
- TL-2026-4758
- Also known as
- Prediction market traffer teams, Traffer prediction market fraud
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- AtlasCore, PolyFucked, Magnetic Team
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, consumers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Prediction Markets Emerge as a New Vertical for Traffer
Malware and tooling: telegram
How Prediction Markets Emerge as a New Vertical for Traffer works
Insikt Group reports three Russian-language traffer (affiliate-fraud) teams, AtlasCore, PolyFucked and Magnetic Team, that sell fraud-as-a-service kits built around fake prediction market sites imitating Polymarket. The kits bundle admin panels, payment infrastructure, victim management, rigged outcomes, fabricated withdrawal blocks, KYC data harvesting and AI-assisted social engineering.
Recorded Future's Insikt Group documents three Russian-language traffer teams that have adapted the affiliate-fraud (traffer) model to prediction markets since May 2026. Traffers (affiliates) drive victims to fake prediction market sites, and the team operators supply the platform, domains, admin panel, payment handling and support tooling in return for a revenue share. Victims are internally labelled "mamont" (mammoth) in the code.
AtlasCore (active since May 2026) operates a central panel at atlascore-panel.net with prediction market and casino sub-panels. Its platform imitates Polymarket (YES/NO wagering, probabilities, trading volumes) and gives the affiliate per-victim win/loss rate controls (0 = always lose, 100 = always win), fabricated market activity and configurable withdrawal-error templates (WithdrawErrorModal, WithdrawModal, MamontWithdrawErrorBlock) carrying victim-specific fees, minimum deposits and artificial starting balances. Card data (number, expiry, CVV, cardholder name) and KYC material (passport, driver's licence front and back, selfie) are collected. AtlasCore guidance covers AI-generated synthetic influencer videos (Nano-GPT image/video generation, Kling reaction videos), stripping video metadata to evade AI-content labelling, Instagram Reels targeting of event hashtags, and AI-driven victim support through NanoGPT keys. Deposits are mostly Bitcoin, then USDT, SOL, USDC and ETH. The operators publicly tracked about $10.97 million in deposits between 2 May and 18 September 2026 (self-reported, unverified). Affiliates receive 70% rising to 80%, with a 10% referral commission.
PolyFucked, led by after_day (operator of the After Change OTC exchange and the 2025 After Drainer), offers ready-to-deploy prediction market infrastructure with a panel at polyfucker.space (registered 2026-06-17) and a Telegram bot. The interface copies YES/NO outcomes, probability charts, order books and comments, claims support for 180+ geographies, and advertises smart-contract-automated payouts, a minimum 60% revenue share and fiat-to-crypto on-ramps (Transak, Ramp, Link by Stripe, Mercuryo, MoonPay, Banxa, Revolut). Affiliates are coached on Instagram account warming (VPN masking, SIM-free devices, account separation), AI-generated logos (Gemini, Nano Banana, ChatGPT) and reused hook videos. An Ethereum profile wallet falsely presents preds.co as an official Polymarket mirror.
Magnetic Team (active since July 2026) sells a white-label "PredictON" platform with a panel at magnetic-panel.space (registered 2026-07-13). Its code (partner.js, partner-rigging.js, partner-extras.js, partner-push.js, partner-wallets.js, partner-seo.js) provides 3,000+ bots across 5,000+ markets, an order-book simulator, eight comment personas, six fake support personas, a configurable withdrawal funnel (identity verification, AML review, VIP-tier upgrade fees, Account Protection Score, withdrawal taxes), per-player win-rate targeting, balance caps, forced-loss cooldowns, and bulk-generated deposit wallet pools of up to 20,000 wallets per chain (EVM, Solana, Bitcoin, Toncoin, Tron) with exportable private keys. Insikt assesses, without confirmation, that the code was developed with LLM assistance. Magnetic Team's btwoteam.xyz previously hosted a TraffHub login panel; that link is unconfirmed beyond shared infrastructure.
All profit and membership figures are actor self-reported. The source does not give a publication date; its data is current through 2026-09-18, and the severity rating is analyst-assigned from impact on victims.
MITRE ATT&CK techniques used in TL-2026-4758
Defense Evasion
T1036 Masquerading; T1684.001 Impersonation
Initial Access
T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1588.007 Artificial Intelligence; T1608.005 Link Target
Reconnaissance
T1598 Phishing for Information
Impact
Affected products and versions in Prediction Markets Emerge as a New Vertical for Traffer
- Polymarket — Brand impersonated by fake prediction market sites (platform not compromised)
Remediation for Prediction Markets Emerge as a New Vertical for Traffer
Immediate actions
- Block and monitor the domains, IP addresses and Ethereum address listed in the IOC set at DNS, proxy and email gateways
- Alert users and customers that Polymarket-style sites reached through Instagram, TikTok or Telegram links may be fraudulent, and that real withdrawal fees or pre-withdrawal deposits are a scam indicator
- Search brand-monitoring and certificate-transparency feeds for lookalike Polymarket domains (for example pollymarket, polyrnarket, poly-market, polymarket-labs) and file takedown requests
Workarounds
- Only trade through the verified official prediction-market domain typed directly or bookmarked, never through links from social media or direct messages
- Do not upload passports, driver's licences, selfies or card details to prediction-market sites reached through influencer videos
Longer-term hardening
- Pivot on shared code, admin-panel path patterns (for example /build/assets/app-*.js), WebSocket backends, hosting and domain registration patterns to find new traffer domains
- Monitor the operators' Telegram channels for new domain announcements and add them to blocklists
- Track cryptocurrency deposit flows and share them with exchanges and blockchain-analytics partners
Timeline of Prediction Markets Emerge as a New Vertical for Traffer
- AtlasCore creates the ATLASCORE | NEWS Telegram channel.
- AtlasCore launches its Deposits Telegram channel; deposit tracking begins (about $10.97M self-reported through 2026-09-18).
- Magnetic Team registers predicton.org.
- after_day advertises PolyFucked on a low-tier cybercriminal forum.
- AtlasCore (user AtlasCorp) advertises on a top-tier cybercriminal forum after recruiting on a low-tier forum on 2026-05-15.
- PolyFucked registers its admin panel domain polyfucker.space.
- Magnetic Team registers magnetic-panel.space; its updates channel follows on 2026-07-15.
- MagneticCEO advertises the PredictON white-label platform on a low-tier forum.
- AtlasCore registers prdct.cc, followed by predicate.club and predictum.app (2026-08-12) and predictedby.cc (2026-08-15) as lure domains rotate.
- AtlasCore domains event-x.cc and predicate.cc become inactive.
- PolyFucked registers preds.co (2026-08-24) and resolve.bet (2026-08-27); its CHAT channel is created 2026-08-26.
- AtlasCore deposit tracking ends at about $11M reported; the Insikt data set is current through this date.
Sources cited for Prediction Markets Emerge as a New Vertical for Traffer
- Prediction Markets Emerge as a New Vertical for Traffer Teams (Insikt Group, Recorded Future)
- Rublevka Team: Anatomy of a Russian Crypto Drainer Operation (Insikt Group, related traffer team)
- Hard-working thieves: Rublevka Team steals $10M in Solana scam-as-a-service (SecurityOnline)
- Crypto drainers analysis, October 2025 (SEAL Radar)
- WSJ: $1.9M in fake bets across Polymarket creator videos (The Defiant, context on fake-win prediction-market videos; not about these traffer teams)
Detection coverage for TL-2026-4758
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4758 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.