TL;DR
Dutch prosecutors say a 33-year-old Dutch national was arrested at Amsterdam's Schiphol Airport in connection with the AVCheck counter‑antivirus platform. Officials say he had been under international surveillance after reportedly deregistering in the Netherlands and travelling to the UAE; data storage devices were seized.
What happened
Dutch authorities announced the arrest of a 33‑year‑old Dutchman they suspect of running the AVCheck online platform, a service used by cybercriminals to test malware against antivirus products. The man was detained at Schiphol Airport on Sunday evening by the Royal Netherlands Marechaussee after being tracked internationally. Prosecutors said he deregistered in the Netherlands around the time of AVCheck’s disruption and fled to the United Arab Emirates. Investigators seized data storage devices belonging to the suspect. Prosecutors also allege the individual and two companies linked to him enabled cybercriminals to access the platform. AVCheck was taken offline on May 27, 2025, during the second operational wave of Operation Endgame, a coordinated takedown that involved authorities in the Netherlands, the United States and Finland. Intelligence from that takedown fed the investigation that led to this arrest.
Why it matters
- Shutting down and prosecuting operators of counter‑antivirus services can hinder cybercriminals’ ability to refine malware and evade defenses.
- Seized devices may provide evidence to further identify collaborators, infrastructure and other accounts tied to the platform.
- The arrest underscores cross‑border law enforcement cooperation in tackling online criminal services.
- If charges follow, prosecutions could set precedents for how providers of malware testing services are treated legally.
Key facts
- Suspect: a 33‑year‑old Dutch national, unnamed by prosecutors in their statement.
- Location of arrest: Schiphol Airport, Amsterdam; detained Sunday evening by the Royal Netherlands Marechaussee.
- Prosecutors said the man deregistered in the Netherlands around the time AVCheck was taken down and travelled to the United Arab Emirates.
- Investigators had the suspect under international surveillance prior to the arrest.
- Data storage devices belonging to the arrested man were seized at the time of detention.
- Prosecutors allege the suspect and two companies connected to him enabled cybercriminals to access AVCheck.
- AVCheck was taken offline on May 27, 2025, during Operation Endgame’s second phase of activity.
- The May 2025 takedown was coordinated between authorities in the Netherlands, the United States and Finland.
- AVCheck functioned as a counter‑antivirus (CAV) service allowing criminals to test malware against different antivirus products to assess detection and evasion.
What to watch next
- Progress of formal charges, any extradition proceedings or court dates — not confirmed in the source.
- Whether further arrests are made or additional companies are implicated as the investigation continues — not confirmed in the source.
- Findings from forensic analysis of the seized storage devices and whether they yield links to other infrastructure or actors — not confirmed in the source.
Quick glossary
- Counter‑antivirus (CAV) service: An online service that lets users test malware against multiple antivirus products to gauge detection and evasion success.
- Operation Endgame: A coordinated law enforcement effort referenced by authorities that conducted takedowns of criminal cyber infrastructure.
- Royal Netherlands Marechaussee: A branch of Dutch armed forces that performs military and certain civilian policing duties, including operations at airports.
- Schiphol Airport: Amsterdam’s primary international airport and a frequent transit point referenced in law enforcement reporting.
Reader FAQ
Who was arrested?
A 33‑year‑old Dutch national, unnamed in the prosecutor’s statement.
Where and by whom was the arrest made?
The suspect was detained at Schiphol Airport by the Royal Netherlands Marechaussee.
What is AVCheck?
AVCheck is described as a counter‑antivirus service used by criminals to test malware against antivirus products.
Was AVCheck already taken down?
Yes. Authorities say AVCheck was taken offline on May 27, 2025, during Operation Endgame’s second operational burst.
LEGAL Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam 33-year-old was under surveillance for some time before returning home from the UAE Connor Jones Tue 13 Jan 2026 // 14:32 UTC Dutch police…
Sources
- Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam
- Dutch cops cuff alleged AVCheck malware kingpin in …
- Dutch police arrest three cyberextortion suspects who …
- Police takes down AVCheck site used by cybercriminals to …
Related posts
- UK shaping a future of precrime with predictive policing and surveillance
- Iran official reports about 2,000 deaths amid unrest, Reuters says
- Mandiant open-sources AuraInspector to detect and fix Salesforce Aura misconfigs