Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Fraud. Show all posts
vishing attack
Cyber Fraud Microsoft 365 Microsoft Entra ID Okta passkey phishing phishing campaign vishing attack

Okta Uncovers Vishing Campaign Using Fake Microsoft Entra ID Pages to Hijack Microsoft 365 Accounts

 

Okta has identified a sophisticated vishing campaign targeting organizations across multiple industries, where attackers attempt to steal Microsoft 365 credentials by directing victims to fraudulent Microsoft Entra ID login pages.

The campaign, which began in April, uses voice calls to persuade employees that they need to register a new passkey for their Microsoft account. Victims are then guided to convincing fake Microsoft Entra ID pages designed to capture their credentials.

The threat activity, tracked as O-UNC-066 and also referred to as CL-CRI-1147 or Pink, has primarily targeted organizations in the automotive, aviation, construction, food and beverage, healthcare, and technology sectors. The group's primary objective appears to be data extortion.

To support the campaign, the attackers have registered multiple domains containing the word "passkey" and created phishing pages that closely imitate Microsoft's legitimate passkey enrollment experience.

“It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user’s Microsoft account,” Okta says.

According to Okta, the fake Microsoft Entra ID login portals are customized for each intended victim through the phishing kit's backend. These pages incorporate authentic Microsoft branding and even load content directly from Microsoft's content delivery network to appear legitimate.

Unlike conventional phishing kits that automatically harvest usernames, passwords, MFA tokens, and session cookies, this toolkit relies on a manually operated PHP control panel. The attacker actively interacts with victims in real time, adjusting the phishing pages throughout the authentication process to accommodate different multi-factor authentication methods.

“It is likely that the threat actor uses the kit to take over the user account and trick the user into approving an attacker-initiated registration of a passkey,” Okta notes.

Throughout the attack sequence, the phishing pages conduct anti-analysis checks, collect usernames without redirecting users to federated identity providers, and prompt victims to enter their passwords. The attackers are believed to use these credentials immediately to access the targeted Microsoft account.

After the initial login, victims are shown a processing screen while the attacker determines which MFA method is enabled, such as SMS one-time passwords, time-based one-time passwords (TOTP), or push notifications, and modifies the phishing flow accordingly.

As part of the deception, victims are eventually redirected to a fake passkey registration page. There, they are instructed to save a recovery key generated from a list of attacker-controlled BIP-39 seed phrases before verifying the final word in the phrase.

“The phishing kit appears to prey on the lack of user familiarity with passkey authentication. In a real passkey registration ceremony, the user might expect a system dialog to register a passkey on their device. The passkey pages in this phishing kit appear to mimic this process without registering a passkey,” Okta notes.

Okta points out that BIP-39 seed phrases have no apparent role in Microsoft Entra passkey registration, suggesting that this step is merely a distraction while attackers secretly enroll their own passkeys into compromised accounts.

The company also highlighted that Microsoft automatically sends legitimate email notifications whenever a new passkey is registered. However, because the attackers complete the enrollment directly with Microsoft, they can assign the passkey an innocent-looking name, reducing the likelihood of raising suspicion.

“Any time a user enrolls a passkey with Microsoft, the owner of the compromised account receives a legitimate Microsoft email to notify them that a new passkey has been registered in their account. During an attack, the passkey was actually enrolled by the threat actor directly with Microsoft, and the threat actor is in a position to name the passkey with something the targeted user would view as benign,” Okta explains.
Read more »
private repository cloning
Cyber Fraud Datadog Security Labs GitHub API GitHub reconnaissance GitHub security private repository cloning

Datadog Uncovers Coordinated GitHub API Campaigns Targeting Organizations for Large-Scale Reconnaissance

 

Datadog Security Labs has identified multiple coordinated campaigns that are systematically using the GitHub API to enumerate corporate GitHub organizations, repositories, and user accounts. The activity highlights how attackers are leveraging both legitimate and compromised resources to gather intelligence on organizations while blending into normal API traffic.

"Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old, or compromised OAuth tokens and personal access tokens (PATs) from legitimate users," Julie Agnes Sparks, senior security engineer at Datadog, said.

According to the security researchers, the majority of the observed activity has focused on collecting publicly available information. However, in a limited number of incidents, the attackers progressed beyond reconnaissance and successfully cloned private repositories.

The campaigns rely on a combination of automated scanning tools, more than 50 dormant GitHub accounts, and several legitimate accounts whose personal access tokens (PATs) had either been unintentionally exposed or compromised. These resources are used to perform extensive enumeration across multiple GitHub organizations.

A notable aspect of the operation is the use of so-called "ghost" accounts that were created between two and five years ago and deliberately left inactive before being activated for API-based reconnaissance. By using aged accounts instead of newly created ones, the attackers are able to make their activity appear more legitimate and reduce the likelihood of triggering security alerts.

Since a significant portion of GitHub's API can be accessed without authentication, the attackers are able to retrieve large amounts of publicly available data while remaining indistinguishable from routine API traffic. Their reconnaissance includes listing public repositories within organizations, mapping user followers and following relationships, identifying gists, starred repositories, and organization memberships, as well as executing GraphQL queries against public objects.

The collected information enables threat actors to build detailed profiles of an organization's GitHub environment, including its public repositories, contributors, developer relationships, and project activity. Such intelligence can be used to support future targeted attacks.

Datadog also confirmed that in a small number of cases, attackers escalated their activity by cloning a private repository belonging to a targeted organization, indicating that the campaigns can extend beyond information gathering.

"Individually, most of these requests are unremarkable. They hit public endpoints, authenticate cleanly or not at all, and return successful responses," Datadog said. "The concern lies in the aggregate: a group of accounts moving in sync across companies' GitHub organizations with versioned custom tooling iterating over weeks, and in the worst case, actors that stopped enumerating and started cloning."

Read more »
phishing campaign
Cyber Fraud fake job interviews Google account phishing marketing professionals phishing campaign

Phishing Campaign Targets Marketing Professionals Using Fake Job Interviews from Top Global Brands

 

A sophisticated phishing campaign is targeting marketing professionals by posing as recruiters from more than 30 globally recognized brands, including Adobe, Netflix, Coca-Cola, OpenAI, Adidas, and Marriott. The attackers aim to steal Google account credentials by luring victims into fake job interview processes.

According to cybersecurity intelligence and threat hunting company Team Cymru, the operation exploits legitimate cloud-based platforms such as PeopleForce, a human resources service, and domains linked to Salesforce Marketing Cloud before redirecting users to malicious websites. To make the scam appear authentic, the threat actors are also using the names and profile pictures of actual recruiters from the companies they impersonate.

Will Thomas, senior advisor at Team Cymru, investigated the campaign and found that the phishing emails present themselves as recruitment messages. As he noted, the emails appear to be from “a recruiter looking to hire people for marketing roles.”

The investigation revealed that attackers have registered at least 34 domains designed to mimic prominent organizations across multiple industries. These include airlines and travel companies such as American Airlines, Booking.com, Delta Air Lines, and United Airlines; food and beverage giants Coca-Cola, PepsiCo, and Red Bull; fashion and luxury brands Adidas, Louis Vuitton, Sephora, and Levi’s; consulting and technology firms including Adobe, Aquent, ManpowerGroup, McKinsey & Company, and OpenAI; hospitality and marketing companies Marriott and Omnicom Group; as well as entertainment and sports brands like FIFA and Netflix.

Researchers found that the attackers rely on a technique known as nested redirects, where users are routed through several legitimate online services before ultimately reaching a fraudulent webpage. Although the phishing emails appear to originate from PeopleForce, the embedded links resolve to the exct[.]net domain, which is operated by Salesforce following its acquisition of ExactTarget, now known as Salesforce Marketing Cloud.

From there, victims are redirected through Wise Agent, a cloud-based customer relationship management (CRM) platform for real estate professionals, before arriving at the phishing website.

BleepingComputer reported that the campaign has been active for at least five months. Earlier versions reportedly used Outlook email addresses carrying the names of the companies being impersonated.

In one example, a phishing email claiming to be from Adidas recruiter Paulina Manzo invited recipients to schedule a discussion regarding a potential job opportunity. Clicking the scheduling link redirected users to the fraudulent domain adidas-hiring[.]com.

To proceed with booking the interview, victims are instructed to sign in with their Google accounts. Selecting the “Continue with Google” option launches what appears to be a genuine Google authentication window. However, the pop-up is actually created using HTML and CSS within the phishing page itself, a deception technique known as browser-in-the-browser (BitB).

By leveraging modern web development methods, attackers can closely replicate legitimate authentication prompts, making it difficult for users to distinguish fake login windows from real ones.

Researchers emphasized that the misuse of legitimate platforms does not necessarily indicate those services have been compromised. Instead, threat actors may have created valid accounts specifically for the campaign or used compromised credentials to configure redirect chains and phishing pages.

A complete list of the malicious domains associated with the campaign has been published in Will Thomas' GitHub analysis.
Read more »
PyPI attack Credential Theft
Cyber Fraud Fake SDKs Supply-Chain Security npm Package PyPI attack Credential Theft

Fake Paysafe and Skrill SDKs on npm and PyPI Steal Developer Credentials

 

A coordinated supply-chain attack has compromised developers by distributing 17 malicious packages on npm and PyPI that impersonate legitimate SDKs for Paysafe, Skrill, and Neteller payment services. These packages were designed to silently exfiltrate sensitive credentials, including API keys, AWS tokens, GitHub secrets, and npm tokens, to a command-and-control server hosted on Amazon Web Services. 

The threat actor published these fake SDKs with names closely resembling official payment integration libraries, such as paysafe-checkout, skrill-payments, and paysafe-api. While the packages expose expected APIs and return fake success responses to avoid detection, their real purpose is credential theft. The embedded malware scans the compromised environment for secrets and exfiltrates them to the attacker's server. 

Security researchers at Socket identified 13 malicious npm packages and four PyPI packages in this campaign. The npm packages were released in four versions (1.0.0 to 1.0.3), while the PyPI packages had only one malicious version (1.0.0). The full list includes well-known names like paysafe-js, paysafe-fraud, skrill-sdk, neteller, and paysafe-kyc. Developers who installed any of these packages risked having their secrets stolen, especially if they were working on payment integration projects for these services. The data theft module in the npm packages attempts exfiltration only if a Paysafe API key is present and activates when the fake SDK is called. The PyPI packages automatically activate the data theft routine upon initialization and do not require a Paysafe API key to be present at all. 

The malware incorporates basic anti-analysis features to avoid detection in sandboxed or virtualized environments. For instance, it halts execution if it detects fewer than two CPU cores or if the hostname or username suggests a virtual machine. To detect potential compromise, organizations should search their dependency trees for the listed package names and scan CI/CD logs for PAYSAFE_API_KEY in combination with these packages. Denying requests for these packages at the registry proxy level is also recommended to prevent accidental installation. If any of the listed packages were installed, developers are recommended to immediately rotate all secrets on any machine that imported or executed this package. 

The researchers also advise searching dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level. It is also recommended to look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names. Additionally, teams should audit their project dependencies and CI/CD pipelines to ensure no traces of these malicious packages remain. Staying vigilant and verifying package sources before installation remains crucial to avoiding similar supply-chain attacks in the future. This incident highlights the growing sophistication of attackers targeting open-source repositories and the critical need for robust software supply-chain security practices. 

Developers must remain cautious when integrating third-party libraries into their projects, especially those related to financial services and payment processing. The use of automated dependency scanning tools and regular security audits can help identify and mitigate risks associated with malicious packages. Furthermore, organizations should implement strict access controls and monitoring for their CI/CD environments to detect and respond to potential credential theft attempts quickly. By adopting a proactive security posture and staying informed about emerging threats, the developer community can better protect itself against evolving supply-chain attacks.
Read more »
phishing campaign
Cyber Fraud fake job interviews Google account phishing marketing professionals phishing campaign

Phishing Campaign Targets Marketing Professionals Using Fake Job Interviews from Top Global Brands

 

A sophisticated phishing campaign is targeting marketing professionals by posing as recruiters from more than 30 globally recognized brands, including Adobe, Netflix, Coca-Cola, OpenAI, Adidas, and Marriott. The attackers aim to steal Google account credentials by luring victims into fake job interview processes.

According to cybersecurity intelligence and threat hunting company Team Cymru, the operation exploits legitimate cloud-based platforms such as PeopleForce, a human resources service, and domains linked to Salesforce Marketing Cloud before redirecting users to malicious websites. To make the scam appear authentic, the threat actors are also using the names and profile pictures of actual recruiters from the companies they impersonate.

Will Thomas, senior advisor at Team Cymru, investigated the campaign and found that the phishing emails present themselves as recruitment messages. As he noted, the emails appear to be from “a recruiter looking to hire people for marketing roles.”

The investigation revealed that attackers have registered at least 34 domains designed to mimic prominent organizations across multiple industries. These include airlines and travel companies such as American Airlines, Booking.com, Delta Air Lines, and United Airlines; food and beverage giants Coca-Cola, PepsiCo, and Red Bull; fashion and luxury brands Adidas, Louis Vuitton, Sephora, and Levi’s; consulting and technology firms including Adobe, Aquent, ManpowerGroup, McKinsey & Company, and OpenAI; hospitality and marketing companies Marriott and Omnicom Group; as well as entertainment and sports brands like FIFA and Netflix.

Researchers found that the attackers rely on a technique known as nested redirects, where users are routed through several legitimate online services before ultimately reaching a fraudulent webpage. Although the phishing emails appear to originate from PeopleForce, the embedded links resolve to the exct[.]net domain, which is operated by Salesforce following its acquisition of ExactTarget, now known as Salesforce Marketing Cloud.

From there, victims are redirected through Wise Agent, a cloud-based customer relationship management (CRM) platform for real estate professionals, before arriving at the phishing website.

BleepingComputer reported that the campaign has been active for at least five months. Earlier versions reportedly used Outlook email addresses carrying the names of the companies being impersonated.

In one example, a phishing email claiming to be from Adidas recruiter Paulina Manzo invited recipients to schedule a discussion regarding a potential job opportunity. Clicking the scheduling link redirected users to the fraudulent domain adidas-hiring[.]com.

To proceed with booking the interview, victims are instructed to sign in with their Google accounts. Selecting the “Continue with Google” option launches what appears to be a genuine Google authentication window. However, the pop-up is actually created using HTML and CSS within the phishing page itself, a deception technique known as browser-in-the-browser (BitB).

By leveraging modern web development methods, attackers can closely replicate legitimate authentication prompts, making it difficult for users to distinguish fake login windows from real ones.

Researchers emphasized that the misuse of legitimate platforms does not necessarily indicate those services have been compromised. Instead, threat actors may have created valid accounts specifically for the campaign or used compromised credentials to configure redirect chains and phishing pages.

A complete list of the malicious domains associated with the campaign has been published in Will Thomas' GitHub analysis.
Read more »
stolen information
Bitcoin Cloud Computing Cyber Fraud DOJ scams stolen information

US Authorities Seize Infrastructure Tied to Huione Fraud Network




The U.S. government has taken another step in its ongoing campaign against large-scale cyber fraud operations, announcing the seizure of online infrastructure allegedly used to support one of the world's most active criminal marketplaces while simultaneously expanding financial restrictions against the network behind it.

On Tuesday, the Department of Justice (DOJ) revealed that it had seized a cloud computing account connected to Cambodia-based Huione Group and its subsidiaries. According to federal investigators, the account hosted backend systems used to operate Huione Guarantee, also known as Haowang Guarantee, a platform that authorities say enabled a broad range of illicit activities spanning cybercrime, fraud, money laundering, and other criminal services.

The enforcement action coincided with a series of measures from the U.S. Department of the Treasury, which announced additional sanctions targeting Huione-linked entities and individuals associated with the Prince Group network. The latest moves build upon actions taken by U.S. authorities last year as part of a wider effort to disrupt transnational criminal organizations operating across Southeast Asia.

Federal officials described the seized infrastructure as a key component of a marketplace that allegedly served cybercriminals and fraud operators on a global scale. Rather than functioning as a conventional online marketplace, investigators say the platform acted as an ecosystem where illicit services, stolen information, and financial laundering tools could be accessed by criminal actors.

According to the DOJ, the cloud-based infrastructure provided technical support for operations conducted through Huione Guarantee. Authorities allege that the platform relied heavily on Telegram channels to facilitate communications and transactions involving illegal products and services.

Investigators claim those channels were used to advertise and trade stolen credit card information, sensitive personal data, and services linked to malware-enabled theft. The platform is also accused of facilitating money laundering activities and supporting schemes connected to human trafficking operations. In addition, authorities allege that proceeds generated through romance scams and fraudulent investment schemes were moved through the network.

The DOJ further alleges that Huione Guarantee offered escrow services designed for cryptocurrency transactions. Such services act as intermediaries between parties involved in a transaction, holding digital assets until agreed conditions are met. While escrow systems are commonly used in legitimate commerce, investigators contend that the service was leveraged by criminal actors seeking a trusted mechanism for conducting illicit transactions and laundering funds.

Officials believe the infrastructure played an important role in moving and concealing criminal proceeds. According to the Justice Department, billions of dollars in fraud-related funds were transferred through systems supported by the seized account. Authorities further stated that a massive portion of those proceeds originated from scam compounds operating throughout Southeast Asia, where organized criminal groups have increasingly adopted digital platforms and cryptocurrency networks to scale their operations.

The Treasury Department's actions were designed to expand existing restrictions against the Huione network. One measure formally added H-Pay Service as a successor entity under Treasury's existing rule targeting Huione Group. Treasury also imposed sanctions on nine individuals and 26 entities linked to Prince Group, broadening the scope of enforcement against organizations allegedly connected to the movement of illicit funds.

According to Treasury officials, Huione served as an important financial conduit for proceeds generated through cyber-enabled theft, virtual currency investment fraud, and other criminal schemes. Authorities further allege that the network was used by Prince Group to transfer, consolidate, and manage assets derived from fraudulent operations.

The latest actions follow a series of previous enforcement efforts directed at the same ecosystem. Last October, Treasury moved to further isolate Huione Group from the U.S. financial system, reflecting growing concerns over the company's alleged role in facilitating illicit financial activity.

Federal agencies have increasingly focused on scam networks operating across Southeast Asia as losses linked to online fraud continue to rise. Criminal organizations in the region have become known for running large-scale investment scams, romance fraud operations, and cryptocurrency-related schemes that target victims worldwide. Many of these operations rely on complex laundering networks and digital payment channels to obscure the origin and movement of stolen funds.

The investigation also intersects with earlier actions involving Prince Group chairman Chen Zhi. In October, the DOJ announced the seizure of bitcoin connected to investigations involving Chen and alleged cryptocurrency-related offenses, alongside accusations involving additional criminal schemes. Authorities have also reported that an individual identified as a significant participant in Chen's network was arrested in Cambodia before being extradited to China.

The coordinated actions by the DOJ and Treasury illustrate an emphasis on targeting the infrastructure that enables cyber-enabled fraud rather than focusing solely on individual perpetrators. By disrupting cloud services, financial channels, and marketplace operations that allegedly support criminal activity, U.S. authorities are seeking to make it more difficult for transnational fraud networks to move money, coordinate operations, and reach potential victims.

Read more »
User Security
Banking scam Cyber Fraud Haldwani OTP Bypass User Security

Haldwani Cyber Fraud: ₹2.5 Lakh Stolen Without OTP, Raising Bank Security Concerns

 

In Haldwani, a cyber fraud case has once again shaken public trust in digital banking, after a victim reportedly lost money without clicking a suspicious link or sharing an OTP. The case is worrying because it shows how modern fraud can bypass the protections many users still consider reliable. For years, OTPs have been seen as a strong safety layer, but incidents like this suggest scammers are finding new ways to drain accounts while staying hidden. As digital payments grow, so does the need to understand how these silent attacks work. 

What makes such frauds especially alarming is that victims often receive no obvious warning before the money disappears. In some recent cases, cybercriminals have used methods such as SIM swap attacks, malware, account takeovers, call forwarding, or unauthorized beneficiary additions to move funds without the user’s approval. Other reports have also shown that fraud can happen through fake banking apps, remote access tools, or abuse of pre-linked payment mandates. This means the problem is no longer just about sharing an OTP; it is also about securing the phone, SIM, banking app, and personal identity. 

The Haldwani incident highlights a deeper issue in bank security: authentication systems are only as strong as the weakest device or process connected to them. If a fraudster gains access to a phone number, banking credentials, or an already trusted payment route, the transaction may look legitimate to the bank’s systems. That is why “no OTP” does not automatically mean “no compromise.” In fact, some frauds exploit loopholes where money is shifted through internal banking paths, or through beneficiary changes that may not trigger immediate user attention. 

Safety recommendations 

For users, the first rule is to monitor bank alerts closely and treat any unexpected debit, SMS, or app activity as urgent. Keep mobile software updated, avoid installing apps from unknown links, and never grant unnecessary SMS, accessibility, or call permissions to random applications. It also helps to use strong screen locks, secure SIM cards with a PIN, and enable additional notifications through email or alternate channels. If anything looks suspicious, contact the bank immediately and report the fraud through the cybercrime helpline without delay. 

This case is a reminder that cybersecurity is no longer only a technical concern; it is a daily financial survival issue. Banks need stronger fraud detection, faster alerts, and better protection against account takeover methods that bypass OTP-based trust. At the same time, users must stop assuming that OTP alone can keep money safe. The real defense is layered security, quick reporting, and constant digital caution.
Read more »
Typosquatting Domains
Brand Impersonation Attacks Credential Theft Cyber Fraud Cybercrime Campaigns Fake FIFA Websites FIFA World Cup 2026 Scams Online Scam Detection Ticket Fraud Typosquatting Domains

FIFA World Cup 2026 Becomes Prime Target for Ticket and Employment Fraud


 

In 2026, the FIFA World Cup will be the world's largest sporting event, encompassing three host nations, 16 cities, 48 national teams, and 104 matches over a span of six weeks. In addition to the tournament's sporting significance, it presents a uniquely complex security challenge, creating a convergent environment where vast financial flows, international travel, digital transactions, and cross-border commerce collide on unprecedented scale. 

According to security analysts, the same infrastructure that enables millions of fans to purchase tickets, arrange travel, place wagers, and participate in tournament services also offers lucrative opportunities for organized criminal organizations. 

The global footprint of the event provides multiple opportunities for exploitation, including ticket fraud and travel scams, illegal betting operations, money laundering schemes, match-fixing attempts, and human trafficking activities. As threat actors adopt artificial intelligence, they are able to rapidly construct convincing phishing websites, multilingual social engineering campaigns, synthetic voice communications, and fake identity documents.

Following the world cup in 2022, criminal groups have developed many of these techniques, and they are now preparing for the world cup in 2026 with more sophisticated tools, a broader infrastructure, and a significantly larger attack surface. It is believed that threat actors are exploiting FIFA branding, ticket demand, travel planning, and employment opportunities linked to the event in order to harvest credentials, gain access to financial information, and defraud unsuspecting victims on a large scale.

It is predicted that preparations will accelerate for the historic 48-team format of the tournament, which stretches across the United States, Canada, and Mexico, as cybersecurity experts warn that the growing digital footprint surrounding the event will provide fertile ground for sophisticated scams targeting fans, job seekers, and businesses. 

Several analysts have noted that the large amount of interest surrounding the tournament makes it an especially attractive target for fraud. Over six million spectators are expected to gather across the 16 host cities across the United States, Canada, and Mexico during the tournament, with FIFA reporting that more than 150 million ticket requests were received in the first 15 days of sales, resulting in approximately thirty times greater demand than available inventory. 

The investigation by Group-IB identified more than 4,300 fraudulent FIFA-related domains registered since August 2025 and connected over 300 of them to a Chinese-speaking financial cluster identified as GHOST STADIUM. An operation that employs a single phishing kit that closely simulates FIFA's PingIdentity-based single sign-on process, as well as replicating FIFA's authentic client identifier from the live service, is employed to carry out the operation.

Since the cloned pages are created by pulling images directly from FIFA's infrastructure, they appear visually authentic and are evadable by simplistic duplicate content detection. Credential harvesting offers a password-reset flow in addition to a standard login prompt; once victims have submitted their details, attackers will be able to take control of the FIFA account, block out the legitimate owner, and potentially resell the tickets associated with the account. 

Group-IB reported that the campaign's distribution network is heavily reliant on paid social advertising, particularly on Facebook, with tracking identifiers being reused across multiple domains. Additional traffic is derived from Telegram, WhatsApp, and search engine results. There is also a broad diversity in payment infrastructure: some sites collect credit card data directly, others redirect to external gateways, some utilize money transfer applications such as Chime and Nequi, while others offer Mexico-specific payment processing. 

In addition, investigators discovered a cryptocurrency conversion path which effectively transforms a credit card transaction into crypto, complicating chargebacks and recovery processes significantly. FIFA's official ticketing channels do not accept cryptocurrency, making this payment method one of the clearest technical indicators of fraud.

Based on the infrastructure currently visible to researchers, Group-IB estimates that premium ticket fraud related to this ecosystem could result in losses of between $71 million and $474 million, although this figure is an analytical estimate as opposed to a financial total that has been confirmed. According to Group-IB, the infrastructure uncovered by this investigation is consistent with broader warnings issued by the FBI, which has observed an increase in fraudulent websites designed to imitate FIFA's official online presence and harvest sensitive information about users. 

Often, these platforms are designed to collect personally identifiable information, including names, residential addresses, email addresses, banking details, and credit card numbers, as part of the purchase or verification of tickets, account verification, or tournaments. 

Typosquatting is an established cybercrime technique in which threat actors register domain names that have minor spelling adjustments, omitted characters, or alternative top-level domains that closely resemble legitimate brands. Investigators have identified the following domains as examples: fifa[.]help, fifa-online[.]com, jobs-fifa[.]com, fifa-ticket[.]live, fifa-hiring[.]com, and ww-fifa[.]com. 

A significant number of these domains re-emerge quickly after takedown actions, suggesting that there are a resilient fraud ecosystem rather than isolated, brief-lived campaigns. By analyzing the site ww-fifa[.]com further, it was demonstrated that little modification is required to create a convincing impersonation platform. By removing one "w" from the legitimate FIFA web address, operators created a portal that presented itself as an official FIFA World Cup 2026 destination and offered premium hospitality packages containing match tickets, lounge access, catering services, and exclusive event experiences. 

There were several indicators that were commonly associated with fraudulent infrastructure identified during a technical review of the site, including broken media assets, duplicate page metadata, questionable navigation paths, and payment forms that requested extensive personal and financial information without valid verification procedures. Furthermore, Cyble researchers identified recruitment-themed campaigns targeting job seekers through websites such as fifaworldcup-careers[.]com, impersonating a FIFA recruiting portal that advertises employment opportunities related to the World Cup. 

According to information collected from VirusTotal, eight of the 91 security vendors flagged the website, and fourteen of the 91 vendors identified the root domain. According to WHOIS records, the domain was registered and modified in April 2026 with ownership information concealed through privacy protection services. Additionally, investigators discovered two SSL certificates issued in April 15 and April 16, including a wildcard certificate that could secure multiple subdomains, a practice frequently utilized by fraudsters to expand their operations. 

In anticipation of the tournament, cybersecurity authorities anticipate that these campaigns will become increasingly sophisticated and prolific as the tournament approaches. In order to access FIFA services, the FBI recommends that you enter the official website address manually rather than relying on search engine results, sponsored advertisements, or email links.

Unless the authenticity of a website has been independently verified, users should caution when selecting URLs, bookmarking FIFA resources, and avoiding submitting sensitive information. Additionally, officials anticipate the development of fraudulent streaming services attempting to capitalize on fan demand for match coverage, urging users to utilize official FIFA channels and licensed broadcasters exclusively. 

As a precautionary measure in cases where fraud is suspected, authorities recommend preserving screenshots, domain information, communication records, and payment records before submitting a complaint to the Internet Crime Complaint Center (IC3). As malicious FIFA-related domains continue to emerge and cybercriminal infrastructure continues to evolve near real time, security experts warn that maintaining digital vigilance may become more important than securing a ticket for the tournament.

The FIFA World Cup 2026 preparations are accelerating across three host nations as the digital ecosystem surrounding the event is proving equally active as the actual event. As a consequence, cybercriminals are adapting to global events with massive public engagement rapidly by utilizing large-scale phishing infrastructures, brand impersonation campaigns, fraudulent ticket marketplaces, and fake recruitment portals. 

Regardless of whether you are a fan, a business, or a prospective employee, trust cannot be obtained solely from brand recognition alone. Checking domains, scrutinizing payment channels, and relying on official sources remain essential safeguards. Cybersecurity awareness will be an essential line of defense as threat actors continue to register new lookalike domains and refine their tactics until kickoff, and beyond.
Read more »
User Security
Cyber Fraud Cyberabad Police eSim Scam Sim Swapping User Security

Cyberabad Police Busts eSIM Banking Fraud Gang in Hyderabad

 

Cyberabad police have exposed an inter-state cyber fraud racket that used eSIM manipulation, SIM swapping tactics, and OTP diversion to steal money from bank customers. The case underlines how criminals are mixing telecom fraud with banking deception to bypass normal security checks and move money fast. 

Investigators said the accused impersonated staff from a bank’s premium credit card division and contacted victims under the guise of DoT verification. They persuaded targets to convert eSIMs into physical SIM cards, then sent preloaded mobile devices carrying malicious apps, which helped redirect OTPs and banking alerts to the fraudsters. 

Once the OTPs were diverted, the gang could access bank accounts, authorize transfers, and siphon off funds before the victims understood what had happened. Police said six people were arrested in the case: Selim Mondal, Abdul Alim SK alias Mittu, Saiyad Hasim Reza alias Tippu, Mijanur Rahaman Shaik, Bansidhar, and Mehebub Alam Ansary alias Suraj. The fraud amount was put at Rs 77.75 lakh, and police recovered Rs 15 lakh in cash during searches at the accused persons’ homes. 

The bigger concern is that this type of scam is highly scalable. It does not depend on hacking a bank’s servers; instead, it exploits human trust, weak verification habits, and the phone number as a security key. If a criminal gets control of your SIM or eSIM flow, they may also gain access to banking apps, password resets, and other sensitive services that rely on SMS verification.

Mitigation tips 

To stay safe from this type of eSIM banking fraud, never share OTPs, PINs, card details, or recovery codes with anyone over call, SMS, or WhatsApp, even if the caller claims to be from a bank or telecom company; verify any eSIM or SIM change request only through your operator’s official app, website, or helpline; avoid clicking suspicious links or scanning unknown QR codes.

Additionally, do not insert a SIM into any courier-delivered or unfamiliar device; enable banking alerts, use strong passwords and authenticator apps instead of SMS-based verification where possible; and if your phone suddenly loses signal or you suspect a SIM hijack, immediately contact your mobile provider, freeze transactions with your bank, and report the issue through India’s cybercrime helpline 1930 or the official cybercrime portal.
Read more »
QR code
AI cybersecurity ChatGPhish ChatGPT security flaw Cyber Fraud OpenAI vulnerability phishing attack prompt injection attack QR code

Researcher Warns of ‘ChatGPhish’ Vulnerability That Could Turn Web Summaries Into Phishing Attacks

 

A cybersecurity researcher has raised concerns over a newly identified vulnerability in ChatGPT that could allow attackers to manipulate the chatbot's responses through hidden instructions embedded within web pages.

The issue, discovered by Permiso threat hunter Andi Ahmeti, reportedly enables malicious actors to influence ChatGPT when users ask the AI assistant to summarize online content. According to Ahmeti, if a webpage contains concealed prompt instructions, ChatGPT may unknowingly follow them and display attacker-controlled content alongside legitimate summaries.

The researcher explained that this weakness could be exploited to insert phishing links, fake security notifications, or other deceptive messages that appear to originate from ChatGPT itself. In some cases, attackers could even leverage QR codes embedded within AI-generated responses to redirect users to malicious websites.

“AI systems increasingly render untrusted content directly inside browsers, which expands risk significantly,” Ahmeti told us. “The bigger issue is that AI products are starting to resemble browser or operating system environments, which creates a much larger security surface.”

Ahmeti disclosed the vulnerability, which he has named “ChatGPhish,” through OpenAI’s Bugcrowd disclosure program. He initially submitted the report on April 29 and later updated it on May 1 with additional information.

“The initial submission was marked as not reproducible,” he said. “We resubmitted with additional detail and it was marked as a duplicate.”

According to Ahmeti, the issue his team reported differed significantly from the previously identified vulnerability it was allegedly linked to.

“The issue Permiso reported and the supposed duplicate ‘had major differences,’” Ahmeti said. “We reached out again to clarify those differences and request additional details, but we did not receive a response.”

At the time of publication, OpenAI had not confirmed whether any remediation measures had been implemented.

“At the time of publication, ‘we have not received confirmation from OpenAI on whether a fix has been applied,’” he told us.

To demonstrate the threat, Ahmeti embedded hidden instructions into a GitHub-hosted CloudLens page. The injected prompt directed ChatGPT to generate a standard summary while also appending a fabricated account-security warning containing a malicious hyperlink.

When users asked ChatGPT to summarize the page, the chatbot correctly described CloudLens and its cloud security functions. However, it also displayed an additional warning message suggesting that a new device had accessed the user's account, along with a clickable link controlled by the attacker.

The researcher noted that the same technique could be used to insert QR codes into ChatGPT’s responses.

“Because the chatgpt.com client auto-fetches and displays Markdown images, an attacker can place a QR code in the assistant’s output,” he wrote. “Scanning it on a phone takes the victim to an attacker-controlled URL that has never been displayed in plaintext.”

To verify that the issue was not specific to GitHub, Ahmeti repeated the experiment on a self-hosted website based in Kosovo. The results were reportedly identical, with ChatGPT generating a legitimate summary before appending a misleading security alert containing an attacker-controlled link.

“The behavior is identical: the assistant produces a normal summary, then appends a spoofed alert with a clickable attacker link,” Ahmeti wrote.

While Ahmeti acknowledged that there may not be a single solution to prompt injection attacks, he recommended stronger isolation mechanisms, stricter content filtering, and rendering safeguards for AI-generated outputs.

“Do not trust model output,” Ahmeti said. “AI-generated content should always be treated as untrusted. Assume prompt injection will happen.”

He also emphasized that prompt injection should be viewed as a broader application-security challenge rather than solely a model-alignment issue.

“Prompt injection has increasingly become an application-security problem, not just a model alignment issue,” he told us. “The real concern is what systems the model can influence: browsers, plugins, tools, memory, or external services.”

Read more »
VISA
Cyber Fraud Data Breach sensitive information UK government VISA

UK Visa Application Service Left More Than 100,000 Identity Documents Accessible Online

 




A private visa assistance website used by travelers seeking permission to enter the United Kingdom left a large collection of customer records accessible online, exposing passport copies, identity verification photographs, and location information linked to applicants.

The website, known as UK Visa Portal, offers paid assistance for visa and travel authorization applications. The platform is not operated by the U.K. government, although reports indicate that some users may have mistaken it for an official government service and paid application-related fees through the site instead of using government channels.

The exposure came to light after an individual discovered a security issue affecting the platform and reported it to journalists. According to information shared by the source, the accessible records included more than 100,000 files uploaded by applicants during the visa application process. These files reportedly contained passport images and selfie photographs that users submitted to verify their identities.

Following inquiries from journalists, the exposed data was secured. However, details regarding how long the information remained accessible have not been publicly disclosed.

According to reporting on the incident, the exposed records were stored in an Amazon-hosted cloud storage repository used by UK Visa Portal. While the storage system did not openly display a list of documents to the public, individual files could still be accessed by anyone who possessed the correct web address. The individual who identified the issue stated that a flaw within the website's backend functionality made it possible to view references to files stored in the cloud environment.

Journalists investigating the incident reportedly verified the authenticity of the exposed records by contacting individuals whose documents appeared in the dataset. Those contacted confirmed that the information matched records they had submitted through the platform.

Beyond passport scans and identity photographs, some uploaded images reportedly contained embedded geolocation metadata. This information can be automatically recorded by smartphones and digital cameras when a photograph is taken. In certain cases, the metadata was reportedly detailed enough to reveal the location where the image was captured, including locations associated with applicants' residences.

The exposure of identity documents can create opportunities for fraud and impersonation. Passports, facial images, dates of birth, addresses, and other personal identifiers are frequently used during account verification processes. If obtained by unauthorized parties, such information may be used in attempts to create fraudulent accounts, bypass identity checks, or conduct targeted social engineering operations.

The handling of the incident has also left several questions unanswered. Reports indicate that journalists attempted to notify the company about the security issue but were unable to identify a dedicated vulnerability reporting channel. The website reportedly did not provide public contact information for company executives or security personnel responsible for addressing cybersecurity matters.

After initial contact was made through customer support, a manager was identified as a potential point of contact. However, reports indicate that direct engagement with company management did not occur. Instead, communication later involved representatives from a public relations firm and attorneys from a U.S.-based law firm.

Following publication of the findings, journalists sought additional information regarding the incident, including the length of time the storage repository remained exposed, whether access logs exist, whether any files were downloaded by unauthorized parties, and who oversees cybersecurity operations within the organization. Public answers to those questions have not been released.

The company is reportedly linked to an organization called Active Leadgen LLC, which is described as having connections to the United Arab Emirates. However, independent verification of the ownership structure has not been publicly established.

The incident comes amid increasing reliance on online identity verification systems by governments, financial institutions, and digital service providers. As more organizations require users to submit passports and photographs electronically, the protection of those documents has become a critical responsibility for any company handling sensitive personal information.

Applicants seeking authorization to travel to the United Kingdom are generally advised to confirm that they are using official government services before submitting identity documents or making payments. In most cases, travelers can complete the application process directly through official U.K. government channels without relying on third-party visa assistance platforms.

Read more »
RTGS Fraud Scheme
Cyber Crime Investigation Cyber Fraud Cyber Frauds Digital Arrest Scam Karnataka Cyber Command Money Laundering Scam Mule Bank Accounts Online Financial Fraud RTGS Fraud Scheme

Fake Digital Arrest Racket Cheats Bengaluru Woman of Rs 24 Crore


 

Using cyber technology, an impersonation racket for high-net-worth individuals in India has been exposed as a sophisticated scam in the form of a so-called "digital arrest." A network of fraudsters posing as officials from central investigation agencies has allegedly coerced Bengaluru resident Lakshmi Ramamurthy into transferring large sums of money over a period of several months, involving 74-year-old Bengaluru resident Lakshmi Ramamurthy. 

The Karnataka State Cyber Command has uncovered a Rs 24 crore fraud involving her. Authorities allege that the accused exploited sensitive financial information related to recent property transactions, fabricated false allegations of money laundering, continuously monitored, and psychologically manipulated to create a false sense of legal threat. 

After Ramamurthy approached the ICICI Bank Cantonment Branch to mortgage 1.3 kilograms of gold jewellery in an effort to obtain additional funds, the scheme was undetected until he approached the bank officials. Bank officials alerted law enforcement officials, triggering an investigation that led to the arrest of six suspects from a variety of states, including Tamil Nadu, Maharashtra, Gujarat, Delhi, and Bihar. 

The victim, Ramamurthy, a former teacher who lived in Dubai and is currently residing alone in Bengaluru's Shivajinagar neighbourhood, has been deemed to be a lucrative target because she owns properties in Bengaluru and Mumbai, and she is actively seeking to liquidate certain assets for the benefit of her children in the United States. 

Police claim that the fraudulent engagement began in February when individuals claiming to be officers from the Central Bureau of Investigation (CBI) and Enforcement Directorate (ED) started calling her. She was falsely accused of involvement in a money laundering network and repeatedly threatened arrest and legal action by the callers, who repeatedly threatened her arrest. 

In the process of clarifying her position, the perpetrators escalated the deception through WhatsApp video calls, employing impersonation techniques that were designed to simulate official proceedings as well as reinforce the credibility of the false accusations. Also during the course of the investigation, police were able to seize six mobile phones thought to have been used for coordinating and executing the fraud, providing vital data regarding the network's communication infrastructure. This was followed by an extended campaign of coercive social engineering in which the victim was alleged to have been isolated from external intervention and to have been kept under constant psychological pressure through repeated calls and virtual interactions. 

During their conversation, the fraudsters falsely informed Ramamurthy that her bank accounts were connected to a money laundering investigation. The fraudsters claimed that Ramamurthy had been placed under a confidential "digital arrest" and instructed her not to discuss the matter. A number of factors were employed by the accused to convince her that large financial transfers were necessary for account verification, regulatory scrutiny, and fund clearance, including fear, authority impersonation, and fabricated legal consequences. 

A total of Rs 24 crore was allegedly transferred from the victim's ICICI Bank account between February 10 and April 24 through 26 RTGS transactions involving 23 mule accounts maintained at ten different banks nationwide. Police said the funds were distributed through a layered network of beneficiary accounts designed to obscure the money trail and complicate recovery efforts. 

On April 24, the victim reportedly attempted to secure a gold loan worth Rs 3 crore to satisfy additional demands from the scammers that were still underway when the fraud operation was still active. In response to suspicious activity detected by ICICI Bank Cantonment Branch officials, the Karnataka State Cyber Command was immediately alerted, and officers at the Karnataka State Cyber Command intervened, counselled the victim, and prevented further financial losses. 

Following the initial investigation, a large-scale interstate cybercrime investigation focused on tracking the flow of funds via the fraud network's laundering infrastructure was initiated in order to investigate the fraud. Investigators tracked first-layer mule accounts that received the proceeds of the crime by using financial intelligence, transaction analysis, and data available through the National Cybercrime Reporting Portal (NCRP) and initiated account freeze procedures across a number of banking channels.

The operation resulted in the freezing of over Rs 4 crore, while a further Rs 1.46 crore was recovered through court-directed proceedings. Approximately six individuals have been arrested as a result of the investigation - N Sivagnanam of Erode, Tamil Nadu; Akkach Mallick of Mumbai, Maharashtra; Palak Bhai Patel and Amit Narendra Patel of Ahmedabad, Gujarat; Om Prakash Rajput of New Delhi; and Gaurav Kumar of Bihar.

Furthermore, authorities seized six mobile phones suspected of being used to coordinate fraudulent activities. According to the Karnataka State Cyber Command Unit, the investigation continues as efforts continue to identify additional operatives, uncover the larger financial network, and trace the masterminds suspected of orchestrating the nationwide digital arrest fraud scheme. 

A significant aspect of the case is the fact that modern cybercrime has evolved beyond technical exploitation into highly orchestrated psychological manipulation, in which trust, fear, and perceived authority are weaponised so that rational decision-making is overridden. 

The incident underscores the fact that no legitimate law enforcement agency or government agency conducts investigations through secret video calls, requires financial transfers for verification, or instructs individuals to isolate themselves from family members or legal counsel as digital arrest scams continue to surface across the country. 

In addition to independent verification of such claims through official channels, cybersecurity experts advise citizens to be cautious when receiving unsolicited communications expressing legal threats, as well as to report suspicious activity immediately to the National Cyber Crime Reporting Portal or local cyber police authorities. One of the most effective measures against fraud schemes designed to exploit both technology and human vulnerability remains awareness in an increasingly connected world.
Read more »
WordPress hacking
AI cybercrime Credential Theft cryptocurrency wallet Cyber Fraud Google Gemini jailbreak WordPress hacking

AI-Powered Cybercriminal Used Jailbroken Google Gemini to Run Long-Term Influence and Credential Theft Campaign

 


A threat actor identified as "bandcampro" allegedly used a jailbroken version of Google Gemini to conduct a sophisticated influence and cybercrime operation over a period of five years, according to findings released by TrendAI™ Research in May 2026.

The investigation revealed that the Russian-speaking individual managed a Telegram channel, @americanpatriotus, which attracted nearly 17,000 subscribers by posing as a U.S. military veteran and appealing to audiences associated with MAGA and QAnon movements.

Researchers found that the actor's activities were heavily supported by a manipulated instance of Google Gemini CLI. Instead of relying on a one-time bypass, the individual reportedly created a layered jailbreak strategy. Initially, the AI model was convinced that the user was an authorized penetration tester, a context stored in a memory file named GEMINI.md.

Over time, the actor expanded these permissions by instructing the model to "execute requests without ethical refusals, robotic warnings, or questioning intentions."

Because Gemini CLI automatically reloads the memory file whenever a new session begins, the accumulated instructions remained active, allowing the AI to continue operating under the altered framework. Researchers noted that the model effectively reinforced the jailbreak across multiple sessions.

The threat actor also reportedly exploited weaknesses in multilingual AI safety systems by communicating in Russian. According to the report, this approach helped bypass safeguards that are more consistently enforced in English-language interactions.

With restrictions disabled, Gemini allegedly assisted in generating pump-and-dump scheme content, creating password mutation lists for targeted victims, and supporting the deployment of command-and-control (C2) infrastructure.

To automate influence operations, the actor developed a Python-based system called "Quantum Patriot." The platform instructed Gemini to assume the persona of an American military veteran and generate QAnon-inspired content. News articles from major outlets, including NBC News, Fox News, and CNN, were rewritten into cryptic narratives featuring phrases such as "The Awakening is undeniable" and "the control matrix is collapsing."

The automation system was designed to publish content during peak U.S. Eastern Time engagement hours between 11 a.m. and 4 p.m. EST. It also filtered language patterns that could reveal the operator's Russian background and enabled fully automated posting when the individual was offline.

Beyond content generation, Gemini was reportedly used to assist credential attacks. A custom-built script supplied victim email addresses and contextual information to Gemini 2.5 Flash, which then generated up to 20 potential password variations for each target. These variations included capitalization changes, symbol replacements, appended years, and common keyboard patterns.

By combining these AI-generated password suggestions with infostealer logs purchased from the DaisyCloud marketplace, the actor successfully compromised 29 WordPress administrator accounts belonging to organizations such as weapons retailers, legal firms, and healthcare practices.

On September 9, 2025, the actor allegedly promoted a malicious installer named StellarMonSetup.exe to Telegram followers. Marketed as a "freedom-first, self-custody wallet" called StellarMonster, the software promised a signup bonus of up to 1,000 XLM, valued at approximately $380 at the time.

Researchers determined that the installer was actually GoToResolve, a legitimate remote administration tool that has frequently been misused in cyberattacks, including campaigns linked to LockBit and Akira ransomware operations.

Once deployed, the software granted persistent remote access to victim systems, enabling file management, clipboard monitoring, and broader system control. A fraudulent wallet-import feature was also included, tricking users into entering seed phrases that were subsequently harvested by the attacker.

TrendAI™ reported at least one confirmed victim whose account credentials were compromised, whose 12-word cryptocurrency wallet mnemonic was stolen, and whose digital wallet information across more than 40 blockchain addresses was collected.

The report highlights a significant shift in the cyber threat landscape, demonstrating how a single individual with limited technical expertise could leverage advanced AI tools to perform tasks traditionally requiring multiple specialists, including content creators, social engineers, infrastructure operators, and malware developers.

Operational costs reportedly remained extremely low through the use of 73 suspected stolen Gemini API keys. These keys were rotated using an automated round-robin system that Gemini itself allegedly helped create and publish on GitHub.

Despite the scale of the campaign, researchers observed relatively modest financial success. Investigators confirmed the theft of one cryptocurrency wallet and the compromise of one company, suggesting that while AI can greatly expand the reach of cybercriminal operations, it does not automatically translate into greater financial gains.

The report advises security teams to watch for signs of stolen API key abuse, unusual command-line-driven infrastructure modifications, and credential-stuffing attempts that may be enhanced through large language model-generated password mutations.

Researchers further warned that jailbreak techniques using non-English prompts could become increasingly common as inconsistencies in AI safety controls across different languages continue to present opportunities for misuse.

Read more »
WhatsApp Scam
Android Malware APK Malware Cyber Attacks Cyber Fraud Digital Invitation Scam Mobile Banking Threats OTP Theft UPI Fraud WhatsApp Scam

Rising Digital Invitation Scams Highlight Need for Strong Cyber Awareness


 

What was once used for birthdays, weddings, corporate events, and social gatherings has increasingly been weaponized by cybercriminals as a sophisticated phishing technique. 

The security research community has observed that threat actors are increasingly using commonly used invitation platforms and compromised email accounts to distribute fraudulent event links designed to harvest credential information, financial data, and sensitive personal information by leveraging their credibility.

It is evident how even routine online interactions are becoming part of the modern cyber threat landscape when malicious emails mimic legitimate invitation services and utilize the psychological urgency of social engagement. This highlights how even routine online interactions are now a source of cyber threats. 

A cybersecurity investigator has noted that the threat is now extending far beyond deceptive email invitations, as hackers are actively distributing malware-laced Android Package Kit (APK) files disguised as digital event invitations via messaging platforms such as WhatsApp and Telegram. 

A malicious file is often accompanied by socially engineered labels, such as wedding invitations, housewarming ceremonies, or private party invitations, which are designed to reduce suspicion and stimulate immediate downloads. It often mimics utility tools, but remains operationally dormant to avoid detection once installed on an Android device. 

Once embedded, the rogue application quietly embeds itself among legitimate applications, frequently imitating utility tools. It has been reported that victims unknowingly grant extensive permissions to threat actors, including access to call logs, SMS services, notifications, contacts, and screen recording capabilities, effectively giving them deep surveillance access to their devices.

Several observed cases have demonstrated that the malware can intercept one-time passwords, monitor banking and UPI sessions in real-time, and harvest financial credentials directly from user screen activity. Recently, a Bengaluru-based business owner has experienced the severity of the attack chain after receiving a fraudulent wedding invitation APK through WhatsApp, causing unauthorized access to financial information and a financial loss of approximately 5 lakh before detection of the compromise. 

A number of researchers investigating these campaigns have concluded that the attack infrastructure is typically conducted using two highly effective compromise methods that bypass user suspicion and device-level trust mechanisms. As a result of interaction with the malicious invitation link, the link appears broken or inactive. However, behind-the-scenes processes silently deploy credential-stealing malware that harvests passwords, device information, and sensitive personal information. 

Secondly, victims are directed to convincingly spoofed login portals in which their account credentials are captured in real time, allowing threat actors access to banking, email, and payment services without their consent. 

A number of fraudulent invitations deliberately avoid detailed event information in order to induce impulsive clicks, depending instead on urgency and familiarity. In addition to users being advised to treat unsolicited invitations with caution, particularly those received through messaging applications or from unknown senders, IT security experts also recommend reporting and deleting suspicious e-mails as soon as they become aware of them. 

According to threat intelligence firm CloudSEK, these campaigns have resulted in large-scale financial fraud operations. Within 48 hours, one threat group processed transactions worth nearly 25-30,000 crores, emphasizing the rapid scalability of the ecosystem and the high number of victims involved. Specifically, the firm found that the attacks exploit the trust architecture behind SIM-based verification systems commonly used by UPI platforms. 

In such systems, device-linked mobile numbers are considered proof of legitimate account ownership. A malicious APK disguised as a traffic violation notice or a digital invitation is often the first step in establishing covert access to a smartphone's messaging features after securing SMS permissions. 

After deploying the so-called “Digital Lutera” toolkit, CloudSEK indicated that attackers manipulate identity validations and SMS workflows through a specialized Android framework on separate devices. 

With this feature, bank registration messages may be intercepted and OTPs are silently forwarded to attacker-controlled Telegram channels without the victim's knowledge. Additionally, the report revealed that fabricated "sent" SMS records are inserted into message histories in order to maintain an illusion of legitimate activity, such that UPI applications are misled into believing that authentication requests originate from the victim's own smartphone.

Thus, cybercriminals have the opportunity to remotely register and manage the UPI account of a victim even when the original SIM card remains physically in the user's possession. Previously, CloudSEK notified regulators and financial institutions in order to strengthen mitigation frameworks before the threat expands. As part of its responsible disclosure process, it said that it has already notified regulators and financial institutions. 

The convergence of digital payment ecosystems and mobile-first communication platforms represents a shift toward socially engineered, device-centric financial attacks, warn cybersecurity experts. Threat actors are increasingly exploiting human behavior and weaknesses in authentication workflows to exploit APK sideloading, SMS intercept frameworks, and compromised messaging channels as a means of exploiting trust-driven human behaviour.

A stronger understanding of user awareness, stricter application permission controls, and enhanced anomaly detection across UPI and telecommunication infrastructure will assist in limiting the operational scale of these fraud networks before they become a more persistent threat to India's rapidly expanding digital sector.
Read more »
Suparna Sharma
Anand RK Cyber Fraud cyber fraud India Digital Arrest Scam illustrated journalism online scams Suparna Sharma

Pulitzer-Winning Journalists Expose the Human Cost and Hidden Network Behind Digital Arrest Scams

 

Digital arrest scams in India are rapidly expanding by exploiting fear, trust, and emotional vulnerability. Pulitzer-winning journalists Suparna Sharma and Anand RK recently shed light on this growing menace through their acclaimed Bloomberg illustrated investigation, Trapped.

In an interaction with The Federal, the duo discussed how visual storytelling can strengthen journalism, the psychological manipulation behind digital arrest scams, and why many educated young Indians are getting drawn into cybercrime networks amid rising unemployment and economic pressure.

Rise of Illustrated Journalism

Speaking about Trapped, Sharma explained that journalism today must focus not only on strong reporting but also on engaging presentation styles, especially for younger audiences with shrinking attention spans. According to her, illustrated journalism makes complicated subjects easier to understand and more immersive for readers.

She humorously admitted that creating the project made the team “a little kuku” because of the intense effort involved. However, she maintained that innovative storytelling methods are essential for connecting with audiences who consume information quickly through scrolling and swiping.

Sharma said journalists now need to adapt to a generation that decides everything “in one second”, adding that experimentation in storytelling is necessary because young readers will eventually shape the nation’s future.

Reporting Rooted in Reality

Anand RK explained that the illustrations in Trapped were built on extensive field reporting rather than imagination alone. Even before the script was completed, the team visited Lucknow to closely observe the victim’s surroundings and gather visual references.

He said the reporters also accessed photographs from inside the victim’s home to ensure the visuals remained authentic and grounded in reality.

At the same time, Anand RK highlighted that illustrated journalism allows creative freedom that traditional documentaries often cannot achieve. For instance, when the victim was bombarded with fake legal notices on her phone, the team depicted her standing before a massive flood of documents — a symbolic representation that amplified the emotional impact of the scene.

Trust Became the Victim’s Weakness

The story revolves around neurologist Dr Ruchika Tandon, who became a victim of a digital arrest scam despite being highly educated and professionally accomplished.

Sharma described Tandon as intelligent and successful, but not particularly comfortable with digital technology. She revealed that the doctor was still using a Nokia keypad phone when the fraudsters first contacted her.

According to Sharma, the scammers even persuaded Tandon to purchase a smartphone to continue the operation. The journalist stressed that the victim’s downfall stemmed not from ignorance, but from trust and honesty.

Sharma explained that Tandon belonged to a generation that took pride in following rules and staying away from legal trouble. During the fake “digital arrest”, the scammers instructed her to isolate herself and falsely claim illness at work. However, Tandon reportedly resisted because she did not want to lie.

Recalling the incident, Sharma said the doctor repeatedly insisted that she had “never lied” in her life. She described Tandon as “a beautiful, simple, brilliant woman who just trusts people”.

The journalists also investigated the organised ecosystem operating behind these cyber frauds. Anand RK said the team initially wanted to present the story from the perspectives of scammers and law enforcement officials as well, because ending the narrative with the victim’s financial loss alone felt incomplete.

Sharma revealed that the investigation took the team to states such as Odisha and Bihar, where they met individuals linked to different departments within scam operations. She compared the system to a corporate setup with specialised divisions handling separate functions.

Among those connected to the network were former employees of HSBC, Axis Bank, and Bandhan Bank. The journalists also encountered a highly educated woman allegedly responsible for converting stolen money into cryptocurrency through peer-to-peer systems. Scammers reportedly referred to her as the “P2P aunty”.

Sharma explained that many digital arrest scams ultimately end with money being converted into cryptocurrency, making it difficult for authorities to trace the transactions. The reporters additionally found links to a former Aadhaar centre operator and an ex-Indian Navy employee within the scam network.

Sharma argued that rising unemployment and growing aspirations among India’s youth are contributing factors behind the rise of cybercrime.

According to her, many young people were promised opportunities and prosperity in a “New India”, but economic realities have failed to match those expectations. She believes scam networks are taking advantage of this frustration and desperation.

The journalist recounted the story of a scammer from a Mumbai slum who previously worked for Reliance Jio for Rs 13,000 a month despite holding an MCom degree and multiple diplomas. The man later moved to Cambodia, where he reportedly earned between Rs 60,000 and Rs 80,000 monthly at a scam operation.

Sharma remarked that India was effectively “exporting scammers”.

The discussion concluded with both journalists expressing hope that the recognition received by Trapped would help spread awareness about cyber fraud and digital arrest scams across the country.

Read more »
Subscribe to: Posts (Atom)