Markopolo
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- individual
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:16:02
Targeted industries: financial-services
Context
Markopolo is a threat actor known for running scams targeting cryptocurrency users through a fake app called Vortax. They use social media and a dedicated blog to legitimize their malicious activities. Markopolo has been linked to a credential-harvesting operation and is agile in pivoting to new scams when detected. The actor leverages shared hosting and C2 infrastructure for their malicious builds.
Reports & references
- darkreading.com — Vortax Meeting Software Branding Spreads Infostealers (report)
- recordedfuture.com — The Travels Of Markopolo Self Proclaimed Meeting Software Vortax Spreads Infostealers (report)