A fake prediction market lets its operator decide, per victim, whether a bet wins or loses. Set the win chance to zero and the victim always loses; set it to 100 and they always win, at least until they try to cash out. That setting sits in code recovered by Recorded Future's Insikt Group, which details in its original report how Russian-language fraud crews have turned public interest in platforms like Polymarket and Kalshi into a franchise business.
Since spring 2026, Insikt Group has tracked three such "traffer teams" (crews that recruit affiliates to drive traffic to scams for a cut of the proceeds): AtlasCore, PolyFucked and Magnetic Team. Each supplies affiliates with convincing prediction-market websites, admin panels, crypto payment rails, victim management and technical support, so an affiliate only needs a domain and an audience.
Rigged markets and withdrawals that never clear
The fraud mechanics are built in. AtlasCore's panel exposes configurable withdrawal-error templates, customisable per victim, along with deposit, trade and withdrawal fees, minimum deposits and artificial starting balances. It can import data from the public Polymarket API to mimic real market activity. Magnetic Team advertises more than 3,000 simulated traders across more than 5,000 markets, and its code includes withdrawal-blocking pretexts, forced-loss controls and pools of up to 20,000 deposit wallets per blockchain.
The sites also harvest data. AtlasCore's victim interface collects card number, cardholder name, expiry and CVV, plus a fake "know-your-customer" check that asks for both sides of a passport, ID card or driver's licence and a selfie holding each one. The code labels victims "mamont", Russian fraud slang for a mark.
How big the crews say they are
AtlasCore pays affiliates 70% of net profits, rising to 80% with turnover. Its Telegram "Deposits" channel recorded roughly $10.97 million in claimed deposits between May 2 and September 18, 2026, mostly in Bitcoin and mostly from the prediction-market offer. PolyFucked, advertised by a forum user Insikt Group links to the After Drainer crypto drainer offer, claims about $2.4 million in quarterly turnover. Recorded Future stresses both figures are self-reported by the criminals and unverified.
AI writes the influencers and answers the victims
All three crews advertise or provide AI-assisted victim support. AtlasCore's manuals tell affiliates to blend photos of two real people into a synthetic influencer, film reaction videos about trending news alongside a winning wager on their scam domain, post them as Instagram Reels, and strip metadata so the platform does not label the content as AI-generated. Its code recommends GPT-4o or Claude Sonnet 4 for chatting with victims, cheaper models for translating their messages into Russian, and a fallback model from another provider when the first one refuses.
Check the domain before you deposit
Insikt Group identified more than 100 domains and subdomains tied to the three crews. Treat any prediction market reached through an influencer link, a cash joining bonus or a direct message as suspect, never upload identity documents to an unfamiliar betting site, and assume a withdrawal "fee" is a sign the money is already gone. Similar lures have pushed fake trading apps onto investors before.
Selected indicators
- atlascore-panel[.]net, polymarket[.]atlascore-panel[.]net
- prdct[.]cc, predicate[.]club, predictum[.]app
- polyfucker[.]space
- 192[.]162[.]199[.]243
None of this required new criminal capability. The same crews that ran fake exchanges and casinos simply repainted the storefront, and AI made the repaint fast.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.