# Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team)

> Insikt Group reports three Russian-language traffer (affiliate-fraud) teams, AtlasCore, PolyFucked and Magnetic Team, that sell fraud-as-a-service kits built around fake prediction market sites imitating Polymarket. The kits bundle admin panels, payment infrastructure, victim management, rigged outcomes, fabricated withdrawal blocks, KYC data harvesting and AI-assisted social engineering.

- **Published:** 2026-10-29T17:26:27Z
- **Last reviewed:** 2026-10-29T17:26:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4758
- **ID:** TL-2026-4758
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** AtlasCore
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Recorded Future's Insikt Group documents three Russian-language traffer teams that have adapted the affiliate-fraud (traffer) model to prediction markets since May 2026. Traffers (affiliates) drive victims to fake prediction market sites, and the team operators supply the platform, domains, admin panel, payment handling and support tooling in return for a revenue share. Victims are internally labelled "mamont" (mammoth) in the code.

AtlasCore (active since May 2026) operates a central panel at atlascore-panel.net with prediction market and casino sub-panels. Its platform imitates Polymarket (YES/NO wagering, probabilities, trading volumes) and gives the affiliate per-victim win/loss rate controls (0 = always lose, 100 = always win), fabricated market activity and configurable withdrawal-error templates (WithdrawErrorModal, WithdrawModal, MamontWithdrawErrorBlock) carrying victim-specific fees, minimum deposits and artificial starting balances. Card data (number, expiry, CVV, cardholder name) and KYC material (passport, driver's licence front and back, selfie) are collected. AtlasCore guidance covers AI-generated synthetic influencer videos (Nano-GPT image/video generation, Kling reaction videos), stripping video metadata to evade AI-content labelling, Instagram Reels targeting of event hashtags, and AI-driven victim support through NanoGPT keys. Deposits are mostly Bitcoin, then USDT, SOL, USDC and ETH. The operators publicly tracked about $10.97 million in deposits between 2 May and 18 September 2026 (self-reported, unverified). Affiliates receive 70% rising to 80%, with a 10% referral commission.

PolyFucked, led by after_day (operator of the After Change OTC exchange and the 2025 After Drainer), offers ready-to-deploy prediction market infrastructure with a panel at polyfucker.space (registered 2026-06-17) and a Telegram bot. The interface copies YES/NO outcomes, probability charts, order books and comments, claims support for 180+ geographies, and advertises smart-contract-automated payouts, a minimum 60% revenue share and fiat-to-crypto on-ramps (Transak, Ramp, Link by Stripe, Mercuryo, MoonPay, Banxa, Revolut). Affiliates are coached on Instagram account warming (VPN masking, SIM-free devices, account separation), AI-generated logos (Gemini, Nano Banana, ChatGPT) and reused hook videos. An Ethereum profile wallet falsely presents preds.co as an official Polymarket mirror.

Magnetic Team (active since July 2026) sells a white-label "PredictON" platform with a panel at magnetic-panel.space (registered 2026-07-13). Its code (partner.js, partner-rigging.js, partner-extras.js, partner-push.js, partner-wallets.js, partner-seo.js) provides 3,000+ bots across 5,000+ markets, an order-book simulator, eight comment personas, six fake support personas, a configurable withdrawal funnel (identity verification, AML review, VIP-tier upgrade fees, Account Protection Score, withdrawal taxes), per-player win-rate targeting, balance caps, forced-loss cooldowns, and bulk-generated deposit wallet pools of up to 20,000 wallets per chain (EVM, Solana, Bitcoin, Toncoin, Tron) with exportable private keys. Insikt assesses, without confirmation, that the code was developed with LLM assistance. Magnetic Team's btwoteam.xyz previously hosted a TraffHub login panel; that link is unconfirmed beyond shared infrastructure.

All profit and membership figures are actor self-reported. The source does not give a publication date; its data is current through 2026-09-18, and the severity rating is analyst-assigned from impact on victims.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1588.007 Artificial Intelligence
- T1608.005 Link Target
- T1598 Phishing for Information
- T1566.003 Spearphishing via Service
- T1036 Masquerading
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Prediction Markets Emerge as a New Vertical for Traffer Teams (Insikt Group, Recorded Future)](https://www.recordedfuture.com/research/prediction-markets-traffer-teams)
- [Rublevka Team: Anatomy of a Russian Crypto Drainer Operation (Insikt Group, related traffer team)](https://www.recordedfuture.com/research/rublevka-team-anatomy-russian-crypto-drainer-operation)
- [Hard-working thieves: Rublevka Team steals $10M in Solana scam-as-a-service (SecurityOnline)](https://securityonline.info/hard-working-thieves-rublevka-team-steals-10m-in-solana-scam-as-a-service/)
- [Crypto drainers analysis, October 2025 (SEAL Radar)](https://radar.securityalliance.org/2025-10-drainers-vol-1/)
- [WSJ: $1.9M in fake bets across Polymarket creator videos (The Defiant, context on fake-win prediction-market videos; not about these traffer teams)](https://thedefiant.io/wsj-1-9m-fake-bets-polymarket-creator-videos)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4758