Dutch authorities have arrested a 33-year-old man at Schiphol Airport in Amsterdam, believed to be the mastermind behind the AVCheck malware platform. This platform, which was shut down during Operation Endgame in May 2025, allowed cybercriminals to test their malware against various antivirus products. The arrest followed a period of international surveillance after the suspect fled the Netherlands for the United Arab Emirates shortly after AVCheck was dismantled. The public prosecutor's office confirmed the arrest but did not disclose the suspect's identity. Authorities seized data storage devices from him at the time of his apprehension. AVCheck was considered a major tool for cybercriminals, providing insights into which antivirus systems could be evaded. This information was critical for planning attacks against potential targets, making AVCheck a significant player in the cybercrime ecosystem. The takedown of AVCheck involved cooperation between law enforcement agencies from the Netherlands, the United States, and Finland. The intelligence gathered from this operation ultimately led to the investigation and arrest of the alleged kingpin. Officials emphasize that such counter-antivirus services enable criminals to enhance their malware, making it more effective against security measures and increasing the potential damage to victims.