LabHost: The Phishing Service With Over a Million Victims
Phishing used to need a skilled criminal. LabHost sold the fake pages, the support and the stolen data trail to anyone who paid a monthly fee.
By Siddharth ShankarUpdated October 11, 2026The Crown Prosecution Service says Zak Coyne was sentenced to eight and a half years at Manchester Crown Court on April 14, 2025 for running LabHost, which enabled thousands of criminals to defraud at least one million victims in 91 countries. UK losses exceeded £32 million. The April 2024 takedown involved partners in 18 countries. See what to do if your email was in a breach.
Scammers start with details that have already leaked. Is your email one of them?
Free · About 30 seconds · No sign-up · Email not stored
Phishing means tricking someone into entering their details on a fake page. LabHost made it into a subscription product. That changes the picture: a fraud that once took technical skill became something a customer could rent.
What happened
The CPS reported that Zak Coyne was sentenced to eight and a half years on April 14, 2025 at Manchester Crown Court. He had been arrested at Manchester Airport on April 14, 2024, exactly a year earlier, and pleaded guilty on September 18, 2024.
According to the CPS, LabHost enabled thousands of criminals worldwide to defraud at least one million victims in 91 countries. UK losses exceeded £32 million, and the estimated global loss was at least £100 million. The takedown in April 2024 involved partners in 18 countries.
How it worked
LabHost sold subscription access to phishing pages that imitated major banking, government and commercial websites, with technical support over encrypted messaging. A customer did not have to build a convincing fake login page; they chose one from the catalog.
Subscribers collected as much victim information as possible, to sell or use for fraud, including authorised push payment fraud, in which a victim is tricked into sending money themselves. Coyne received $230,000 in cryptocurrency.
What was exposed
The credentials and personal details of people who typed them into the fake pages were exposed. The CPS release does not say what kinds of data or what volumes were collected, and we do not guess. The common risk with any phishing kit is that what is entered into the fake page is immediately in the criminal's hands.
How it ended
For the criminal, the outcome was a long prison sentence. For the one million victims, the picture is less clear. The release does not describe any repayment, though the UK also introduced mandatory reimbursement rules for certain bank transfer scams in October 2024, which are covered in our article on the 88 percent reimbursement figures.
Your best defence is knowing what scammers may already have. Check your email free.
Free · About 30 seconds · No sign-up · Email not stored
How the case unfolded
The arrest came at Manchester Airport on April 14, 2024. A guilty plea followed on September 18, 2024, and the sentence on April 14, 2025. Coyne received $230,000 in cryptocurrency from the operation, according to the CPS.
The investigation depended on international cooperation, which is typical for services that sell to customers in dozens of countries. A site run from one country can harm people in ninety others, and stopping it needs police in many places to act together.
Key facts at a glance
- Sentence: eight and a half years
- Sentencing date: April 14, 2025, Manchester Crown Court
- Victims: at least one million in 91 countries
- UK losses: over £32 million
- Estimated global losses: at least £100 million
- Takedown: April 2024, with partners in 18 countries
How to avoid fake login pages
1Type your bank's address yourself
Or use its official app. Do not follow links in messages.
2Use a password manager
A manager usually will not autofill a login on a lookalike domain, which acts as a warning.
3Turn on multi-factor authentication
An entered password alone then does not open the account.
4Act fast if you typed details on a suspicious page
Contact your bank, change passwords and see what to do after an email breach.
What the release does not say
The release does not say how many fake sites LabHost hosted or how many people lost money in total. For an earlier case of fake bank calls offered as a service, see iSpoof.
Why this case matters
LabHost shows the industrial side of phishing. A criminal service with customer support and a product catalog produces more fraud than any single operator could. Taking it down in April 2024, with partners in 18 countries, removed a tool used by thousands.
It also shows why the old advice about spotting badly written fake pages no longer works well. Pages built from templates can look exactly like the real thing. The reliable check is not the look of the page but the route you took to reach it.
Nothing here can be undone for the people involved, but you can prepare. See the guides on how to tell a real breach notice from a phishing message, how credential stuffing works and what to do after your email appears in a breach. You can also try our free email exposure check.
Sources
- Crown Prosecution Service: LabHost creator sentenced (sentence, arrest, plea, victims, losses, 18 countries)
Frequently asked questions
What was LabHost?
A service that sold subscriptions to phishing pages imitating banks, government and commercial sites, with technical support for customers.
How many victims did LabHost have?
The CPS said at least one million victims in 91 countries, with UK losses over £32 million.
What sentence did the creator receive?
Eight and a half years, imposed on April 14, 2025 at Manchester Crown Court.
How can I spot a fake login page?
Check the web address, use a password manager that will not fill on lookalike domains, and open the real site yourself instead of following links.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Get alerted when your email leaks
Every NordVPN plan includes Dark Web Monitor, which alerts you if your email appears in new leaks.
See NordVPN →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.