Prediction Market Scams Turnkey Fraud for Russian-Language Traffer Teams
Fake prediction markets are becoming a ready-made product for affiliate fraud. Since spring 2026, Insikt Group has tracked Russian-language traffer teams adapting familiar scam operations to mimic platforms such as PolyMarket and Kalshi. Their pitch to affiliates is practical: launch a convincing site, attract deposits, and manage victims through tools and support supplied by the team. That division of labor makes the model easier to repeat. The affiliate handles recruitment; the team supplies much of the infrastructure needed to keep a campaign running.
The format draws on a genuine feature of prediction markets: users can place trades tied to outcomes and events. A fraudulent clone can borrow that visual language and the public attention around it without offering real markets or trading. For a visitor, a familiar layout and active-looking markets may lend the site an air of legitimacy. The appearance is the product.
Turnkey operations with tailored payouts
AtlasCore, PolyFucked, and Magnetic Team offer combinations of simulated trading sites, administrative panels, cryptocurrency payment systems, victim management, technical help, and marketing guidance. The packages let affiliates follow public interest in prediction markets without building the infrastructure themselves. They also lower the amount of technical work an affiliate needs to do before soliciting deposits. The underlying fraud relies on familiar controls: operators can dictate trading outcomes, invent market activity, restrict withdrawals with fabricated fees or other pretexts, and collect identity and payment details.
The teams compete in part on affiliate economics. AtlasCore advertises 70% to 80% of net profits, while PolyFucked offers at least a 60% revenue share. Magnetic Team promotes a base payout equal to 70% of victim deposits. Those terms put the teams’ role in focus: they supply the machinery and operational guidance, while affiliates bring in victims. The payout structures also show how the offers differ; a share of net profits and a share of deposits aren’t necessarily calculated on the same basis.
Reported earnings suggest the scale these operators claim to reach, though the figures haven’t been independently verified. AtlasCore Telegram posts cited about $10.97 million in deposits across its scam offerings from May 2 through September 18, 2026, with most attributed to prediction markets. PolyFucked advertises roughly $2.4 million in quarterly turnover. Both numbers come from the threat actors themselves, so they’re best read as claims made to recruit or impress affiliates, not confirmed measures of victim losses. The numbers here are striking, but their source limits what they can establish.
Magnetic Team’s tools show how these sites can manufacture credibility. The team advertises more than 3,000 simulated traders active across over 5,000 markets. Its source code includes controls for forced losses and withdrawal blocks, along with pools containing as many as 20,000 deposit wallets per blockchain. AtlasCore’s platform also lets operators force wins or losses and apply withdrawal restrictions to individual users. These features make the deception adjustable: operators can present a busy marketplace while retaining control over what each user sees and whether money can be withdrawn.
AI speeds up campaign changes
AI appears across the operation, from platform work to victim contact. All three teams advertise or provide AI-assisted support for conversations with victims. AtlasCore and PolyFucked also offer guidance for promotional material, including synthetic influencers and branding. Magnetic Team’s code contains signs of likely AI-assisted development, although Insikt Group hasn’t confirmed that assessment. That distinction matters: the report describes evidence of possible AI use in the code, not a verified account of how the software was built.
That use matters because prediction-market scams depend on quick adaptation to news and online attention. AI can help teams change site content, promotional material, and social engineering with less time and specialist effort. It may also make it easier to tailor messages to the people an affiliate is trying to persuade. The fraud model can then follow the next popular event while reusing the same payment, management, and deception tools.
Here’s the thing: the tools don’t need to make a fake market convincing to every visitor. They need to help affiliates attract enough people to deposit, then give operators ways to control the account experience. In this category of fraud, polished marketing and operational control can matter more than accurate market data. A familiar brand reference can open the door; the platform’s controls determine what happens after a deposit.
AtlasCore’s affiliate pitch
Insikt Group identified AtlasCore in August 2026 after finding an affiliate recruitment post on a lower-tier cybercriminal forum. The thread, published by the user “AtlasCore,” dates to May 15. A user named “AtlasCorp” advertised the program on a higher-tier forum on May 28. Prediction markets sit alongside more established offers from the team, including cryptocurrency exchanges and casinos. That mix suggests the prediction-market theme is being added to an existing affiliate operation rather than built as a standalone business.
For affiliates, the forum posts appear to serve as both advertising and a point of entry into the operation. They present the commercial terms and the available product, while the broader package promises support with setup and promotion. If you're working in this space, the practical warning is that a recognizable interface or a busy market page doesn’t tell you who controls the underlying trades or withdrawals.
A reusable fraud model
Insikt Group identified more than 100 unique domains and subdomains tied to AtlasCore, PolyFucked, and Magnetic Team, spanning administrative systems and scam sites likely run by the teams or their affiliates. The count points to a broad web presence, though it doesn’t establish how many sites were active at once or how many victims they reached. Domains alone are a measure of infrastructure, not proof of financial impact.
The pattern points to a durable fraud ecosystem: prediction markets give traffer teams a timely theme, while their existing infrastructure lets them turn that attention into deposit-driven campaigns. The model can be reused as public interest shifts, with marketing and site content adapted around a new event while payment and victim-management systems stay in place. That said, the operators’ own revenue claims shouldn’t be mistaken for independently verified results.
This is more significant than it looks. The product isn’t just a fake trading page; it’s a packaged operation that connects recruitment, promotion, deposits, and withdrawal control. And yet, the source evidence leaves important questions open about the actual reach and losses. The infrastructure is visible. The full human cost isn’t.
