French Authorities confirm XSS.is admin arrested in Ukraine
July 23, 2025 
French authorities announced the arrest in Ukraine of an alleged administrator of the long-running cybercrime forum XSS.is.
A joint investigation conducted by French police, Ukrainian authorities, and Europol led to the arrest of the suspected administrator of the major Russian-speaking cybercrime forum xss.is.
“The Paris prosecutor’s office announced on Wednesday, July 23, that an individual suspected of being the administrator of XSS, a major discussion forum considered one of the world’s most significant cybercrime platforms, had been taken into custody.” reported French newspaper Le Monde.
“The authorities suspect this person, who was arrested the day before in Kyiv, of being the forum’s central administrator, under the pseudonym “toha.””
The xss.is forum has over 50,000 users, it is a major hub in the cybercrime ecosystem. Services and products advertised by forum members include trading stolen data, malware, zero-day exploits, and hacking tools. On July 22, Ukrainian police arrested its suspected admin in Kyiv during a coordinated operation to collect evidence and disrupt the forum’s operations.
The man wasn’t just a tech operator, according to Europol’s press release, he acted as a key enabler in the cybercrime world, arbitrating deals and securing transactions. He also ran thesecure.biz, a private messaging platform for criminals. Authorities believe he earned over €7 million from these activities and was active in the cybercrime scene for nearly 20 years, maintaining strong links with major threat actors.
“The forum’s administrator was not only a technical operator but is believed to have played a central role in enabling criminal activity. Acting as a trusted third party, he arbitrated disputes between criminals and guaranteed the security of transactions.” reads the press release published by Europol.
The French Police launched the investigation in 2021, moving into action in Ukraine by late 2024 with Europol’s support. This led to the arrest of the main suspect in Kyiv in July 2025. Europol played a key role in coordinating efforts, analyzing data, and linking the suspect to major cybercriminals. A Europol mobile unit also helped collect evidence during the arrest, aiding broader investigations across Europe.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, XSS.is)