Intelligence briefing
Inside the scam-compound industry
Recruitment, operations, money and the scripts behind them.
The scale
An industrial system, not a few gangs.
The leak
One compound, from the inside.
As reported by WIRED, 27 January 2026. Winner, 2026 Online Journalism Award for Excellence in Technology Reporting.
The playbook
The scripts are the product.
“Judging whether the customer has money from the customer’s occupation, age, family situation, hobbies and interests.”
“You can often mention that your aunt is an important mentor in your life… Later, we will tell him that it was the aunt who taught us to invest.”
“But they denied it and delayed it, which made me very angry.” “I actually don’t think they wanted me to move my money elsewhere and thought I was being scammed.”
Leaked compound training documents. Personal details removed.
七天速战法 · “The Seven-Day Blitz”
From stranger to investor in a week.
Collect eight data points: name, gender, job, family, age, location, hobbies, investing history.
Introduce crypto “mining” paying 4% a day.
Emotional stories; slip in the deal.
The “uncle” who leads trades, with profit screenshots.
Hint they can invest; open an account.
Where the money is taken.
1,121 leaked training articles
506 leaked training articles
505 leaked training articles
295 leaked training articles
105 leaked training articles
74 leaked training articles
Ranked by training articles in the leaked portal (1,415 total). FTC 2025: WhatsApp is #2 by losses to scams starting on social media; Meta banned 6.8M scam-linked WhatsApp accounts in H1 2025.
Where they are
36 reported hubs. 6 reported active in 2026.
The Myawaddy corridor
Raids moved the compounds. They did not end them.
- KK Park raided Oct 2025; new construction found at 14 of 21 Myawaddy sites since Jan 2026 (C4ADS via Prachatai).
- Operations moved to nearby parks and further south.
- SpaceX disabled 2,500+ Starlink terminals at Myanmar compounds, Oct 2025.
- Field report, Nov 2026 (unverified): movement from Bangkok to Myawaddy continuing; compounds using Starlink.
Recruitment
The pipeline.
Fake jobs: customer support, “IT manager”, data entry, translation.
Flight to a regional hub such as Bangkok, then road travel to a border town.
Handlers meet recruits at the border and move them across, often through informal crossings, before documents are taken.
Passports taken, debt and fines, quotas, phones collected on shift.
Scripted pig-butchering, task and impersonation scams run against victims overseas, timed to their daytime.
After raids: smaller, mobile sites on generators and satellite internet; moves inland and to new countries.
Money
Follow the USDT.
US$1.07bn in crypto reached 34 Sihanoukville casinos, Jan–Sep 2026. About 64% went to casinos tied to sanctioned networks.
TRM Labs, 2026.
What works
Interrupt the script.
Hold and talk: the script prepares victims to fight you. Share indicators.
Act on “wrong number” openers, persona accounts and fake job ads.
Treat forced workers as trafficking victims; target recruiters, money and infrastructure.
Contact
theredbullleaks.com
Briefings · case support · secure referrals