In a significant blow against cybercrime, a 21-year-old UK resident has been sentenced to seven years in prison for developing and selling more than a thousand phishing kits used by criminals worldwide.

A Global Fraud Network Fueled by One Individual

Ollie Holman, a university student from Eastcote, West London, admitted to creating over 1,000 phishing kits that mimicked the branding and login portals of trusted financial institutions, charities, and major organizations across 24 countries. These tools were designed to deceive users into handing over sensitive personal and financial data—ultimately leading to an estimated $134 million in global losses.

The phishing kits included malicious scripts that harvested user credentials, banking information, and other personally identifiable data. The stolen information was then funneled into broader fraud schemes, amplifying the damage across industries.

Telegram-Fueled Cybercrime and Persistent Activity

Holman marketed his phishing kits via Telegram, providing not only the tools but also technical support and fraud guidance to buyers—effectively enabling large-scale financial crimes. Even after his first arrest in October 2023, Holman allegedly continued his operations, offering advice through the same Telegram channel until his re-arrest in May 2024.

UK authorities seized multiple devices during both arrests, uncovering digital evidence linking Holman directly to the operations.

The Impact: Over 1,000 Kits, 69 Organizations Targeted

According to law enforcement, the kits Holman sold targeted at least 69 high-profile institutions, including banks, non-profits, and enterprise organizations. His tools allowed cybercriminals to replicate login portals with alarming accuracy, drastically lowering the barrier to entry for online fraudsters.

Legal Action and Asset Recovery in Progress

Holman pleaded guilty to seven criminal charges, and authorities are now pursuing asset confiscation to recover the illicit proceeds gained through his phishing enterprise.

“By creating and selling phishing kits, Ollie Holman facilitated a widespread fraud which others used to exploit innocent victims on a vast scale,” said Sarah Jennings, specialist prosecutor at the UK’s Crown Prosecution Service.

Jennings emphasized that no one is truly anonymous online, regardless of encryption or obfuscation techniques.

“This case sends a clear message: individuals who profit from cybercrime will be relentlessly pursued, prosecuted, and held accountable,” she added.

Source: https://www.securityweek.com/uk-student-sentenced-to-prison-for-selling-phishing-kits