Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Fraud. Show all posts
Phising Scam
Android Trojan Cyber Fraud Google Firebase I4C Notices India Phising Scam

India Orders Google to Remove 57 Firebase Sites Linked to Cyber Scams

 

The Indian government has directed Google to take down dozens of websites and databases hosted on Firebase after finding that cybercriminals were allegedly using the platform to impersonate banks, distribute malware, and steal sensitive financial data. According to notices from the Indian Cyber Crime Coordination Centre (I4C), at least 57 Firebase-hosted properties were targeted for removal in August. The case highlights how attackers are increasingly leaning on legitimate cloud services to make scams look more trustworthy. 

Investigators said several of the sites were designed to resemble official online services of major Indian banks such as SBI, ICICI Bank, and Axis Bank. Seven of the 57 were reportedly phishing pages built to trick users into entering credentials, while others were used to collect information stolen from victims’ smartphones. The tactics were carefully layered, with fake pages, malicious links, and data collection systems all working together to make the fraud harder to spot. 

The I4C also said some campaigns used Android malware disguised as legitimate banking or financial apps. Victims were allegedly lured with offers for new credit cards, reward redemptions, or higher credit limits before being asked to install an app. Once installed, the malware could steal card details, one-time passwords, and other sensitive information, then send it to attacker-controlled infrastructure. Another campaign reportedly abused the PM-KISAN government scheme by promising help with payments and pushing users to download a malicious app. 

Security researchers have described similar malware families as “Android God Mode” because they can gain broad access to infected devices and the data stored across multiple apps. In this case, the appeal of Firebase appears to have been its database features and free or low-cost hosting options, which can be abused to create scalable scam operations. That makes legitimate cloud platforms a growing concern for regulators and cybersecurity teams alike. 

Google said it has strict policies against phishing, malware, and financial fraud and works with law enforcement agencies, including the I4C, to review abuse reports and remove harmful content. The notices reportedly gave Google just three hours to act, warning of legal action if the flagged links remained live. The episode is another reminder that users should verify banking apps carefully, avoid sideloading unknown APKs, and treat urgent payment or reward messages with caution.
Read more »
Vadodara
Attack vendors Cross Border Cybercrime Cyber Fraud Email scam Email Spoofing Vadodara

Vadodara Businessman Duped of Rs 19.75 Lakh in Fake Supplier Email Scam

 



A city-based businessman lost close to Rs 20 lakh after fraudsters hijacked his correspondence with a Dubai supplier and rerouted a payment meant for a shipment of doors and windows into their own account.

Indrajit Basu, 32, has told the Cyber Crime police station that the fraud unfolded over nearly two months, between May 25 and July 13 this year. Basu had placed an order for material with True Sea Services FZC, a Dubai-based company, after reaching out to the firm through its website and official email address. He sent an advance of $11,216.21 through SWIFT on March 10 to the company's genuine bank account, and the order moved ahead as planned.

The trouble started while the goods were still being readied. Police say an unidentified person created a near-identical email address, swapping the supplier's genuine inquiry@trusea.ae for inquiry@trusea-ae.com, a domain close enough to pass an unhurried glance. Messages sent from this lookalike address, still carrying the True Sea Services name, informed Basu that the company's bank details had changed. In their place was an account said to belong to First Abu Dhabi Bank PJSC, complete with an IBAN number and a listed branch address.

Basu had no reason to doubt the communication and processed the documentation for the balance payment accordingly. On June 9, he wired $20,830, roughly Rs 19.75 lakh at the time, to the new account. The money never reached the actual supplier, and repeated follow-ups brought no resolution, at which point Basu approached the police.

The Cyber Crime police registered a complaint on Thursday night under relevant sections of the Bharatiya Nyaya Sanhita and the Information Technology Act. The named accused include whoever operated the fraudulent email address, the person who holds and controls the bank account that received the transfer, and others believed to have taken part in the conspiracy. Investigators are working to trace the account holder and the digital trail left by the spoofed domain.

Basu's case falls squarely into the bracket Gujarat Police now treats as serious enough to route away from local stations. Under a restructuring the state carried out this year, complaints involving losses above Rs 10 lakh are handled exclusively by dedicated Cyber Crime Police Stations rather than the jurisdictional police, precisely because cases of this size tend to involve cross-border transfers and mule accounts that local units are not equipped to trace.

The scale of the problem in Gujarat gives that decision some context. State figures put cumulative cyber fraud losses at around Rs 3,707 crore, with roughly Rs 1,435 crore of that lost in 2025-26 alone, and only about 3 percent of the total has been recovered so far. Police have leaned on what they call the golden hour, the narrow window right after a fraudulent transfer in which a call to the national helpline, 1930, or a report on the National Cyber Crime Reporting Portal can still get an account frozen before the money is moved on. Gujarat Police's Operation Mule Hunt, which wrapped up its first phase in June, flagged more than 900 mule accounts and led to over 600 arrests, stressing how heavily this kind of fraud depends on layers of accounts opened specifically to receive and quickly disperse stolen funds.

The method used against Basu, a lookalike domain slipped into an active supplier conversation, is what cybersecurity researchers classify as vendor email compromise, a variant of the broader business email compromise problem that the FBI's Internet Crime Complaint Center logged at nearly 25,000 complaints and just over $3 billion in reported losses in the US alone in 2025, both figures higher than the year before. Security researchers who track these schemes note that attackers increasingly avoid tipping off a target with an urgent, out-of-context demand for money. Instead they wait inside a live, legitimate transaction, often after quietly monitoring an inbox for weeks, and strike only when a payment is already due, using a domain that differs from the original by a hyphen, an extra letter or a swapped top-level domain, easy to miss on a quick read. Investigators and bank officials advise businesses dealing with overseas suppliers to treat any mid-transaction change in payment or account details as a red flag, and to confirm such changes only through a phone number sourced independently of the email itself, rather than one supplied in the message.

Read more »
Phishing As A Service
Activation Lock AI Voice Scam AnonyMousKIT Apple ID Theft Apple Phishing Apple Support Scam Cyber Fraud Phishing As A Service

Fake Apple Support Agents Target Stolen-Device Owners in Credential Scam


Using AI-powered voice calls and phishing messages, a new phishing-as-a-service platform targets owners of recently stolen Apple devices to obtain device passcodes, Apple ID credentials and two-factor authentication codes. 

In response to SOCRadar Threat Research Unit (STRU) research, security researchers have identified AnonyMousKIT as a credit-based service designed to assist criminals in defeating Apple's Activation Lock. By using this platform, attackers can communicate with their victims via email, SMS, WhatsApp, recorded calls, and artificial intelligence-generated voice agents posing as Apple Support representatives. 

AnonyMousKIT also makes the contact appear legitimate by utilizing information tied to the stolen device. By providing a serial number or IMEI to the platform, attackers can identify the device's model and determine whether it is currently in Find My. Victims can be directed to Apple-branded pages with an animated map showing the location of the device reported. 

People whose devices have recently been lost or stolen are more likely to actively check for their whereabouts as a result of these campaigns. By providing accurate device information and describing the circumstances surrounding the theft, attackers can increase the likelihood that the communication is a genuine notification regarding recovery or support. 

In most cases, the campaign seeks a device's passcode, followed by Apple ID credentials and an Apple 2FA code. Apple's support guidance states that legitimate representatives do not request passwords, device passcodes, or 2FA codes. With anonymousMousKIT, customers are permitted to choose from a variety of methods for contacting victims through a credit-based model. 

Email campaigns cost 1.50 credits, recorded voice calls cost 1 credit, and artificial intelligence voice agents cost 2 credits. A single set of stolen-device details can also be used for SMS and WhatsApp, allowing attackers to take multiple approaches to the same victim from a single set. Researchers identified the operation as more than just a conventional phishing kit, describing it as similar to a subscription-based criminal service, with credit packages, pricing tiers, customer support, and mechanisms for replacing compromised infrastructure. 

A stolen iPhone can have a number of consequences in addition to unlocking it. An attacker may be able to access the information stored in the account, including iCloud backups and other credentials, if he or she obtains the associated Apple ID credentials and 2FA code. Additionally, SOCRadar found coding errors within the platform that exposed links between multiple domains and backend installations, providing researchers with additional insights into the operation's infrastructure. 

With the AI voice component, SOCRadar was able to locate 200 call records and 55 transcripts related to the commercial voice platform Vapi which provide a closer look at the social engineering process. The callers appeared as “Alice” from Apple Support, and were able to use five voice personas across English, Spanish and Brazilian Portuguese.

Call recordings were collected between August 31, 2025, and May 30, 2026. 179 of 200 calls were directed to Brazilian telephone numbers. The fake support agent confirms ownership of the device before requesting the four- or six-digit passcode of the device in the reviewed conversations. After repeating the digits for confirmation, the agent claims to have been contacted by an Apple Store regarding an Activation Lock issue. 

The conversation then moves to the recovery link that was supposedly sent via text message. As determined by the recovered records, the voice operation was relatively inexpensive to run, with all 200 calls requiring approximately $19.24 per call. However, the available data does not indicate how many victims actually surrendered their passcodes, Apple ID credentials or 2FA codes. 

Among the recorded calls, 100 ended when the recipients hung up, 48 timed out due to silence, 24 did not receive an answer, and 28 ended because of platform errors or busy signals. The researchers also discovered that the call records had been retrieved due to an accessibility flaw in the platform's codebase. 

Two file paths exposed through the shared code enabled unauthenticated access to files stored in the web root, enabling the recovery of call logs and transcripts. Since the vulnerability was inherited by deployments based on the same codebase, it provides valuable insight into the broader infrastructure supporting AnonyMousKIT.

AnonyMousKIT demonstrates a structured criminal supply chain rather than a standalone phishing campaign, according to SOCRadar. Developers of the platform build and sell it, customers license the platform through storefronts, and operators use those services to conduct phishing campaigns. In addition to outsourcing the credential-harvesting process, criminals can concentrate on resale of stolen devices while criminals with limited technical expertise can perform the credential-harvesting process.

Activation Lock represents an important threat to criminals who steal devices. Once Find My is activated, an iPhone remains associated with its owner's Apple ID even after a factory reset, which creates a broader threat. 

By obtaining the account credentials and verification codes, attackers are able to defeat a security mechanism that otherwise makes activating and reselling stolen devices difficult. At the conclusion of SOCRadar's investigation, AnonyMousKIT was still active, emphasizing the increasing use of automated services to target stolen devices. According to the operation, criminals have been able to steal credentials from lost or stolen iPhones by combining stolen data, phishing and artificial intelligence. 

Apple accounts that have been compromised can expose data far beyond the device itself, posing a significant security risk to those who receive them.
Read more »
US police department
camera data Cyber Fraud data misuse Flock Cameras Flock Safety surveillance system US police department

US Police Officers Face Arrests and Firing for Misusing Flock Camera Data

 


Police officers across the United States are facing arrests, firings and investigations for allegedly misusing Flock Safety's automated license plate reader system to track people for personal reasons, including romantic partners, former partners and colleagues.

Flock operates more than 120,000 cameras across over 6,000 US communities, with the system recording around 20 billion license plate scans each month. The cameras are designed to help law enforcement locate stolen vehicles, identify vehicles connected to investigations and assist in finding missing people. However, their growing deployment has raised concerns about how much vehicle-movement data police can access and whether agencies are adequately monitoring that access.

A Washington Post analysis found that at least 50 law enforcement officers had been accused or charged with using license plate readers for unauthorized purposes. Flock systems were involved in 46 of those cases, while 26 involved officers allegedly using the technology to monitor women, including current or former romantic partners. The Institute for Justice has separately documented dozens of similar cases nationwide, with many occurring since 2024.

One of the most prominent cases involved former Braselton, Georgia, Police Chief Michael Steffman. According to The Washington Post, Steffman used Flock searches to monitor the movements of his former girlfriend and her daughter roughly 600 times. He was arrested on stalking, harassment and license-plate-reader misuse charges but died before his case went to trial.

Georgia has continued to see cases involving alleged misuse. Habersham County Deputy Christian Brewer was fired and arrested after an internal audit reportedly found that he had used Flock data to track someone with whom he had a personal relationship. A second Habersham County investigator, Jonathan Thomas, was arrested this week following another internal investigation into alleged misuse of the system.

The problem is not limited to Georgia. In Texas, former Lufkin police officer Zachary Anthony Klein was indicted on 100 felony counts after allegedly conducting more than 45,000 Flock searches over approximately 200 days. One license plate was reportedly searched nearly 3,500 times. The department subsequently suspended its use of Flock while investigations continued.

The Institute for Justice's database has continued adding cases in 2026, including allegations involving officers in Florida, Illinois, Georgia, Texas and other states. The database records incidents involving stalking, unauthorized searches and other non-law-enforcement uses of automated license plate reader data.

Flock says its platform records every search and provides audit tools intended to identify unusual activity. The company has also introduced additional safeguards, including mandatory case codes, stronger audit mechanisms and a recommended reduction in data retention from 30 days to seven days.

Critics argue that logging searches is only useful if police departments actually review those records and investigate suspicious activity. In several documented cases, alleged misuse was discovered only after victims or outside investigators identified unusual searches.

The issue has now expanded beyond individual officers. At least 69 alleged misuse incidents have been identified nationwide, while communities are increasingly questioning whether extensive vehicle surveillance can be deployed without stronger controls over retention, access and data sharing.

Residents have also begun investigating the system themselves. Have I Been Flocked allows users to check whether their license plate appears in publicly obtained Flock search records. The service has reportedly compiled more than 242 million recorded searches from audit logs obtained through public-records requests.

As Flock's network continues expanding, the controversy is shifting from whether automated license plate readers can help police solve crimes to a more difficult question: who watches the people given access to the surveillance system?

Read more »
Cyber Fraud
Bitcoin Theft COLDCARD phishing campaign COLDCARD wallet vulnerability cryptocurrency phishing Cyber Fraud

Phishing Campaign Exploits COLDCARD Vulnerability Fears to Spread ScreenConnect

 

A new phishing campaign is taking advantage of concerns over a recently revealed COLDCARD wallet vulnerability and the suspected theft of $88.6 million in Bitcoin to trick cryptocurrency users into installing remote-access software.

Cybersecurity firm Proofpoint, which identified the campaign, said attackers are sending emails that impersonate COLDCARD and falsely claim that a security audit is being conducted across its hardware cold-storage wallets.

The campaign follows the reported theft of around 1,367 Bitcoin, estimated to be worth $88.6 million, from 4,585 addresses. The incident is believed to have been linked to a random number generation flaw affecting several COLDCARD models and firmware versions.

The fraudulent emails originate from compliance@coldcardteamnews.com and carry the subject line "Hardware audit now available." Recipients are told that recent security findings have prompted COLDCARD to verify devices across different hardware revisions.

"We are writing to inform you of a coordinated security audit now underway across the COLDCARD device network. Recent findings have prompted us to verify the integrity of hardware across all revisions, and your participation is needed," reads the fake security audit emails.

The messages direct recipients to a supposed "Security Verification & Incident Reporting Tool." The attackers claim that the process is air-gapped, does not require users to provide their recovery seed and must be completed by August 10.

Clicking the "Access the Audit Tool" button takes users to coldcardcompliance.com, a fraudulent website designed to resemble COLDCARD. Visitors are then prompted to click "Start Hardware Audit" to download the alleged diagnostic tool.

The site also features a live "Customer Service" chat function, which is presented as a way for users to receive assistance with their COLDCARD devices.

According to conversations reviewed by Proofpoint, an operator asks victims whether they are using Windows or macOS before providing further instructions. Windows users are told to execute the downloaded file. When one victim reported seeing a black command window and an administrator prompt, the operator claimed the prompt was necessary to begin installation and instructed the user to select "Yes."

Proofpoint suspects that the chat interactions are being conducted by human operators rather than an automated system. This would allow the attackers to address victims' concerns directly and persuade hesitant users to continue with the installation.

Fake diagnostic tool installs ScreenConnect

Proofpoint said clicking "Start Hardware Audit" downloads a batch file named Coldcard_Diagnostic_Tool.bat from a GitHub account.

An analysis by BleepingComputer found that the 25.7MB batch file contains two Base64-encoded files embedded within it.

When executed, the script initially appears to run a diagnostic check. In reality, it determines whether the victim has administrator privileges. If elevated access is unavailable, it uses PowerShell to restart itself and trigger a User Account Control prompt.

The script subsequently extracts the embedded files into a randomly generated directory inside the Windows temporary folder. The files are saved as setup.msi and docusign.exe before being decoded using Windows certutil.

After installing setup.msi, the script launches docusign.exe, displays an "Installation Complete" message and removes the temporary directory. The executable is a legitimate, digitally signed program associated with a DocuSign printer driver and serves as a distraction from the malicious activity.

The setup.msi package, however, installs ConnectWise ScreenConnect, a remote-management application that can provide attackers with access to the compromised computer.

Proofpoint said the malicious installation connects to activeretirementrelocation[.]com, which serves as the ScreenConnect command-and-control server operated by the attackers.

Once a connection is established, threat actors could potentially control the affected computer remotely, steal sensitive information or cryptocurrency, and deploy additional malicious software. Proofpoint also warned that the compromised access could ultimately be leveraged to deploy ransomware.


Read more »
Fake Videos
AI misinformation China floods Cyber Fraud Disaster Rumors Fake Videos

China's New Challenge: Fake AI Videos During Natural Disasters

 

As China grapples with intensified storms and flooding over recent months, authorities face an unexpected secondary crisis: a surge of AI-generated fake videos flooding social media platforms. These manipulated clips, ranging from fabricated rescue operations to false claims of casualties, are causing real-world panic and complicating emergency response efforts. 

The misinformation wave includes highly realistic but entirely synthetic content. Videos have depicted bodies floating in floodwaters, crocodiles escaping into rivers, and collapsed infrastructure in areas untouched by disasters. Some creators edit overseas or historical footage, stripping watermarks and altering subtitles to present old events as current emergencies. Others use generative AI tools to produce convincing scenes of overflowing dams, emergency vehicles, and even fictional witness interviews.

This deluge has tangible consequences. In certain regions, false videos claiming imminent power outages triggered panic buying of emergency supplies. Misleading content about rescue operations has undermined public trust in official responses. The Chinese government has identified specific cases, such as a flood rescue video and footage of "released crocodiles," as examples of AI-generated material deliberately misrepresenting the situation to mislead the public. 

Government crackdown and enforcement 

In response, Chinese authorities launched a nationwide campaign on July 23 to remove illegal and harmful disaster-related online content. The Cyberspace Administration of China and the Ministry of Emergency Management issued a joint notice targeting misleading footage, recycled reports, fabricated data, fake official announcements, and AI-generated material. Police have arrested and penalized numerous individuals, with punishments ranging from detention to fines. Under the "Clean Net 2026" campaign, the Ministry of Public Security's Cybersecurity Bureau detailed 20 cases involving AI tools used to create fake videos, repackaged flood footage from other regions, and fabricated disaster claims to attract online traffic. 

One notable case involved a 45-year-old man from Chengde, Hebei province, who created an AI-generated video claiming heavy rain caused ground collapse in Kuancheng county, sending vehicles into water. Posted on WeChat to gain followers, the video triggered widespread online discussion, caused local panic, and disrupted flood prevention efforts. 

Experts attribute the problem to dramatic advances in generative artificial intelligence. Modern AI systems can now generate highly convincing disaster scenes, imitate news broadcasts, and produce realistic content with minimal technical skill. As Professor Chen Bing noted in an article for the Central Party School's Study Times, the barrier to creating rumors has significantly lowered: content generators need only capture hot topics and use AI tools to rapidly produce text, images, audio, and video, with even "one-sentence commands" yielding deceptive information that fuels mass rumor production. 

Social media platforms face pressure to strengthen content review mechanisms. Authorities urge the public to approach disaster-related information from unknown sources with skepticism and rely on official announcements. Police emphasize trusting accredited sources during emergencies, though identifying AI-generated content remains increasingly difficult. As Typhoon Maysak and other recent weather events continue to affect regions like Guangxi province—where at least four died and 62,000 were evacuated—the battle against misinformation has become as critical as the physical disaster response itself.
Read more »
OpenAI
AI-Powered Cybercrime Cambodia Scam Network ChatGPT Abuse Cyber Fraud human trafficking Investment fraud Online Fraud OpenAI

OpenAI Disrupts Cambodia-Based Scam Network That Used ChatGPT for Global Fraud Campaigns


The use of ChatGPT by OpenAI has enabled it to dismantle a coordinated scam operation based in Poipet, Cambodia which used ChatGPT for multiple online fraud schemes, including investment scams, romance scams, illegal gambling promotion, and impersonating police officers. According to the company, the network operated in an area that has historically been associated with organized cybercrime, scam compounds, and human trafficking. 


Using ChatGPT, OpenAI asserted that the operation was capable of creating convincing fake online identities, generating multilingual messages, translating conversations, and creating promotional materials for fraudulent campaigns using ChatGPT. Furthermore, the AI tool was used in order to streamline the internal administrative tasks of the criminal operation, such as drafting announcements, maintaining employee records, tracking salary deductions, visa statuses, recruitment incentives, and financial obligations.

In a statement, OpenAI said that the investigation was initiated after WhatsApp provided intelligence that led to the identification of coordinated ChatGPT abuse. As the company notes, the network employed AI models for both generating fake online personas and messages, translating conversations, producing promotional content, and managing day-to-day operations, thus demonstrating how generative AI can significantly enhance cyber fraud efficiency and scale. 

There were several noteworthy aspects of the campaign, including social media advertisements advertising "chatter" jobs in Poipet. Specifically, the advertisement targeted job seekers in India and Bangladesh with salaries of $800, performance bonuses, free flights, lodging, meals, work permits, and Cambodian visas for one year. This offer is believed to have been made to lure victims into scam compounds, where forced labor is often practiced. 

OpenAI said its investigation, in collaboration with WhatsApp, resulted in the removal of a coordinated cluster of ChatGPT accounts, which originated from Southeast Asia. The criminal group was operating multiple fraud schemes simultaneously in contrast to one fraud scheme at a time. The victims were contacted via messaging platforms such as WhatsApp and Telegram by individuals who presented themselves as dating profiles, investment advisors, gambling platform representatives, or law enforcement officials using fabricated dating profiles.

In order to build trust with victims, these personas were designed to persuade them to invest in cryptocurrencies or gold trading schemes, to pay fabricated activation fees, to claim fake winnings, or to pay bogus legal fines. An attacker uses forged passports, legal notices, investment confirmations, fabricated payment screenshots, as well as interfaces for gambling platforms to convince victims that their transactions are legitimate. 

According to OpenAI, the scammers employed a ping-zing-sting method to establish contact with potential victims, gain their trust through extended conversations, and ultimately pressure them into making financial payments. A scam compound operated by organized criminal groups was located in Poipet, a Cambodian city widely known for hosting scam operations. 

In the region, there has been a sustained pattern of large-scale cyber fraud and human trafficking operations, in which victims are lured with false job offers and then coerced into conducting online scams against people across the globe. 

There was also evidence of links between the operation and human trafficking, as some artificial intelligence generated content suggested workers were recruited through deceptive job offers, before their passports were confiscated and they were forced into scams. Moreover, investigators discovered internal conversations indicating that some workers recruited through these advertisements may have been victims of human trafficking. 

According to OpenAI, the records referenced employee debts, disciplinary fines, immigration problems, visa overstays, and even discussions about detentions, escape attempts, and criminal liability, illustrating the exploitative nature of scam compounds. However, OpenAI said internal communications indicated the network may have targeted several fraud campaigns and hundreds of victims, with some conversations referring to individual losses worth thousands of dollars, although the full financial impact has not yet been established. 

In light of the disruption, generative artificial intelligence is playing an increasingly important role in organized cybercrime, enabling threat actors to automate content creation, social engineering, and operational management in unprecedented quantities. The findings also aligned with a recent INTERPOL assessment, which indicated that artificial intelligence has increasingly been utilized throughout the cyberattack lifecycle, from reconnaissance and phishing to extortion and evasion. 

While law enforcement agencies are continuing to target scam compounds across Southeast Asia, experts caution that these operations continue to expand into other regions, causing concern about the global reach of AI-assisted cyber fraud.
Read more »
Infostealer
Cyber Fraud Fake Repositories GitHub Impersonation Attacks Infostealer

GitHub Fake Repos Spread Malware in New Infostealer Campaign

 

Cybersecurity researchers have uncovered a large-scale campaign in which hundreds of GitHub repositories were made to look like legitimate software projects while actually distributing malware. 

According to the report, the attackers created 292 fake repositories that impersonated security tools, developer utilities, macOS apps, games, and other popular software categories. Each repository included a polished README file that pushed visitors toward a download link on a separate malicious page. The tactic works because GitHub is widely trusted by developers and everyday users alike, making it an ideal place for criminals to hide harmful payloads behind a familiar interface. 

The campaign is linked to a new variant of the BoryptGrab infostealer family, which is designed to silently collect sensitive data once installed. Researchers say the malware targets passwords, cookies, payment information, browser sessions, and wallet credentials from 19 browsers and 32 cryptocurrency wallets. It also steals data from Telegram, Discord, Steam, Windows Credential Manager, and other applications. One particularly concerning detail is that the malware can bypass Chrome’s App-Bound Encryption by using code injection, showing that the operators built the payload to defeat modern browser protections. 

The attack appears to have begun in the last days of June, and most of the malicious repositories have now been removed. Even so, researchers noted that several dozen redirectors or related pages were still active at the time of reporting. That means users searching for free downloads or copies of premium tools could still stumble onto a fake repository or a spoofed landing page. The scale of the operation shows how quickly attackers can abuse open-source platforms when they know users are likely to trust project names, readmes, and download buttons without deeper verification. 

For users and organizations, the lesson is simple: treat any unsolicited GitHub download with caution. Always verify that a project comes from the official developer or vendor, and avoid installing software from repositories that rely on hidden ZIP files or external download pages. Security teams should also monitor for unusual browser credential theft, wallet activity, and suspicious outbound connections tied to newly installed software. In a threat landscape where attackers can make malicious code look polished and professional, careful source verification is one of the best defenses available.
Read more »
Financial crime
Capillary Technologies Cyber Fraud Deepfake Financial crime

Deepfake Cyber Fraud Costs Capillary Technologies Over ₹32 Crore

 

Capillary Technologies’ recent deepfake-enabled cyber fraud incident highlights how rapidly evolving AI tools are transforming from business enablers into serious security threats for global enterprises. The Bengaluru-based SaaS company disclosed that an overseas step-down subsidiary lost around €3 million, or over ₹32 crore, after attackers used sophisticated AI-powered impersonation to divert funds to unauthorized bank accounts. This case, reported in regulatory filings and multiple business media outlets, is now being seen as one of the most significant deepfake-related corporate frauds involving an Indian technology firm. 

According to the company’s stock exchange disclosure, fraudsters combined deepfake voice cloning, forged signatures and social engineering to convincingly pose as key managerial personnel and approve high-value fund transfers. By mimicking senior executives and manipulating trust within internal workflows, they managed to circumvent standard verification controls at the affected overseas subsidiary. The transfers were executed just before the first weekend of July, giving criminals a narrow yet effective window to move money across multiple accounts before robust checks could kick in. 

Capillary Technologies has said that no customer data, employee data or core technology infrastructure were compromised in the attack, which was restricted to banking transactions. The company has already recovered about €0.45 million and worked with local authorities to trace and freeze additional suspicious accounts linked to the fraud. Importantly, the impacted subsidiary is covered under cyber and crime insurance, and the insurer has been informed as the firm assesses how much of the loss will ultimately be absorbed.

Operationally, Capillary has emphasized that its business continues without material disruption and that this incident does not alter its annual or long-term growth guidance. However, the episode lands at a time when investors are already wary about rising AI-related pressures on the company’s business model and recent profit softness, potentially adding another layer of risk perception. While the direct fraud targeted a specific overseas unit, it underlines how AI-driven threats can quickly become a boardroom and investor concern, beyond just a cybersecurity issue. 

For the broader ecosystem, the Capillary case is a cautionary illustration of how deepfake voice and identity spoofing can defeat traditional approval chains, especially in finance and treasury operations. Enterprises now need multi-factor verification for high-value transactions, routine out-of-band confirmations, and continuous employee training to resist social engineering built on AI-generated content. As deepfake tools become cheaper and more accessible, robust cyber insurance, AI-aware internal controls, and proactive regulatory reporting will be critical to limit financial and reputational damage when such attacks inevitably occur.
Read more »
vishing attack
Cyber Fraud Microsoft 365 Microsoft Entra ID Okta passkey phishing phishing campaign vishing attack

Okta Uncovers Vishing Campaign Using Fake Microsoft Entra ID Pages to Hijack Microsoft 365 Accounts

 

Okta has identified a sophisticated vishing campaign targeting organizations across multiple industries, where attackers attempt to steal Microsoft 365 credentials by directing victims to fraudulent Microsoft Entra ID login pages.

The campaign, which began in April, uses voice calls to persuade employees that they need to register a new passkey for their Microsoft account. Victims are then guided to convincing fake Microsoft Entra ID pages designed to capture their credentials.

The threat activity, tracked as O-UNC-066 and also referred to as CL-CRI-1147 or Pink, has primarily targeted organizations in the automotive, aviation, construction, food and beverage, healthcare, and technology sectors. The group's primary objective appears to be data extortion.

To support the campaign, the attackers have registered multiple domains containing the word "passkey" and created phishing pages that closely imitate Microsoft's legitimate passkey enrollment experience.

“It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user’s Microsoft account,” Okta says.

According to Okta, the fake Microsoft Entra ID login portals are customized for each intended victim through the phishing kit's backend. These pages incorporate authentic Microsoft branding and even load content directly from Microsoft's content delivery network to appear legitimate.

Unlike conventional phishing kits that automatically harvest usernames, passwords, MFA tokens, and session cookies, this toolkit relies on a manually operated PHP control panel. The attacker actively interacts with victims in real time, adjusting the phishing pages throughout the authentication process to accommodate different multi-factor authentication methods.

“It is likely that the threat actor uses the kit to take over the user account and trick the user into approving an attacker-initiated registration of a passkey,” Okta notes.

Throughout the attack sequence, the phishing pages conduct anti-analysis checks, collect usernames without redirecting users to federated identity providers, and prompt victims to enter their passwords. The attackers are believed to use these credentials immediately to access the targeted Microsoft account.

After the initial login, victims are shown a processing screen while the attacker determines which MFA method is enabled, such as SMS one-time passwords, time-based one-time passwords (TOTP), or push notifications, and modifies the phishing flow accordingly.

As part of the deception, victims are eventually redirected to a fake passkey registration page. There, they are instructed to save a recovery key generated from a list of attacker-controlled BIP-39 seed phrases before verifying the final word in the phrase.

“The phishing kit appears to prey on the lack of user familiarity with passkey authentication. In a real passkey registration ceremony, the user might expect a system dialog to register a passkey on their device. The passkey pages in this phishing kit appear to mimic this process without registering a passkey,” Okta notes.

Okta points out that BIP-39 seed phrases have no apparent role in Microsoft Entra passkey registration, suggesting that this step is merely a distraction while attackers secretly enroll their own passkeys into compromised accounts.

The company also highlighted that Microsoft automatically sends legitimate email notifications whenever a new passkey is registered. However, because the attackers complete the enrollment directly with Microsoft, they can assign the passkey an innocent-looking name, reducing the likelihood of raising suspicion.

“Any time a user enrolls a passkey with Microsoft, the owner of the compromised account receives a legitimate Microsoft email to notify them that a new passkey has been registered in their account. During an attack, the passkey was actually enrolled by the threat actor directly with Microsoft, and the threat actor is in a position to name the passkey with something the targeted user would view as benign,” Okta explains.
Read more »
private repository cloning
Cyber Fraud Datadog Security Labs GitHub API GitHub reconnaissance GitHub security private repository cloning

Datadog Uncovers Coordinated GitHub API Campaigns Targeting Organizations for Large-Scale Reconnaissance

 

Datadog Security Labs has identified multiple coordinated campaigns that are systematically using the GitHub API to enumerate corporate GitHub organizations, repositories, and user accounts. The activity highlights how attackers are leveraging both legitimate and compromised resources to gather intelligence on organizations while blending into normal API traffic.

"Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub 'ghost' accounts that are often years old, or compromised OAuth tokens and personal access tokens (PATs) from legitimate users," Julie Agnes Sparks, senior security engineer at Datadog, said.

According to the security researchers, the majority of the observed activity has focused on collecting publicly available information. However, in a limited number of incidents, the attackers progressed beyond reconnaissance and successfully cloned private repositories.

The campaigns rely on a combination of automated scanning tools, more than 50 dormant GitHub accounts, and several legitimate accounts whose personal access tokens (PATs) had either been unintentionally exposed or compromised. These resources are used to perform extensive enumeration across multiple GitHub organizations.

A notable aspect of the operation is the use of so-called "ghost" accounts that were created between two and five years ago and deliberately left inactive before being activated for API-based reconnaissance. By using aged accounts instead of newly created ones, the attackers are able to make their activity appear more legitimate and reduce the likelihood of triggering security alerts.

Since a significant portion of GitHub's API can be accessed without authentication, the attackers are able to retrieve large amounts of publicly available data while remaining indistinguishable from routine API traffic. Their reconnaissance includes listing public repositories within organizations, mapping user followers and following relationships, identifying gists, starred repositories, and organization memberships, as well as executing GraphQL queries against public objects.

The collected information enables threat actors to build detailed profiles of an organization's GitHub environment, including its public repositories, contributors, developer relationships, and project activity. Such intelligence can be used to support future targeted attacks.

Datadog also confirmed that in a small number of cases, attackers escalated their activity by cloning a private repository belonging to a targeted organization, indicating that the campaigns can extend beyond information gathering.

"Individually, most of these requests are unremarkable. They hit public endpoints, authenticate cleanly or not at all, and return successful responses," Datadog said. "The concern lies in the aggregate: a group of accounts moving in sync across companies' GitHub organizations with versioned custom tooling iterating over weeks, and in the worst case, actors that stopped enumerating and started cloning."

Read more »
phishing campaign
Cyber Fraud fake job interviews Google account phishing marketing professionals phishing campaign

Phishing Campaign Targets Marketing Professionals Using Fake Job Interviews from Top Global Brands

 

A sophisticated phishing campaign is targeting marketing professionals by posing as recruiters from more than 30 globally recognized brands, including Adobe, Netflix, Coca-Cola, OpenAI, Adidas, and Marriott. The attackers aim to steal Google account credentials by luring victims into fake job interview processes.

According to cybersecurity intelligence and threat hunting company Team Cymru, the operation exploits legitimate cloud-based platforms such as PeopleForce, a human resources service, and domains linked to Salesforce Marketing Cloud before redirecting users to malicious websites. To make the scam appear authentic, the threat actors are also using the names and profile pictures of actual recruiters from the companies they impersonate.

Will Thomas, senior advisor at Team Cymru, investigated the campaign and found that the phishing emails present themselves as recruitment messages. As he noted, the emails appear to be from “a recruiter looking to hire people for marketing roles.”

The investigation revealed that attackers have registered at least 34 domains designed to mimic prominent organizations across multiple industries. These include airlines and travel companies such as American Airlines, Booking.com, Delta Air Lines, and United Airlines; food and beverage giants Coca-Cola, PepsiCo, and Red Bull; fashion and luxury brands Adidas, Louis Vuitton, Sephora, and Levi’s; consulting and technology firms including Adobe, Aquent, ManpowerGroup, McKinsey & Company, and OpenAI; hospitality and marketing companies Marriott and Omnicom Group; as well as entertainment and sports brands like FIFA and Netflix.

Researchers found that the attackers rely on a technique known as nested redirects, where users are routed through several legitimate online services before ultimately reaching a fraudulent webpage. Although the phishing emails appear to originate from PeopleForce, the embedded links resolve to the exct[.]net domain, which is operated by Salesforce following its acquisition of ExactTarget, now known as Salesforce Marketing Cloud.

From there, victims are redirected through Wise Agent, a cloud-based customer relationship management (CRM) platform for real estate professionals, before arriving at the phishing website.

BleepingComputer reported that the campaign has been active for at least five months. Earlier versions reportedly used Outlook email addresses carrying the names of the companies being impersonated.

In one example, a phishing email claiming to be from Adidas recruiter Paulina Manzo invited recipients to schedule a discussion regarding a potential job opportunity. Clicking the scheduling link redirected users to the fraudulent domain adidas-hiring[.]com.

To proceed with booking the interview, victims are instructed to sign in with their Google accounts. Selecting the “Continue with Google” option launches what appears to be a genuine Google authentication window. However, the pop-up is actually created using HTML and CSS within the phishing page itself, a deception technique known as browser-in-the-browser (BitB).

By leveraging modern web development methods, attackers can closely replicate legitimate authentication prompts, making it difficult for users to distinguish fake login windows from real ones.

Researchers emphasized that the misuse of legitimate platforms does not necessarily indicate those services have been compromised. Instead, threat actors may have created valid accounts specifically for the campaign or used compromised credentials to configure redirect chains and phishing pages.

A complete list of the malicious domains associated with the campaign has been published in Will Thomas' GitHub analysis.
Read more »
PyPI attack Credential Theft
Cyber Fraud Fake SDKs Supply-Chain Security npm Package PyPI attack Credential Theft

Fake Paysafe and Skrill SDKs on npm and PyPI Steal Developer Credentials

 

A coordinated supply-chain attack has compromised developers by distributing 17 malicious packages on npm and PyPI that impersonate legitimate SDKs for Paysafe, Skrill, and Neteller payment services. These packages were designed to silently exfiltrate sensitive credentials, including API keys, AWS tokens, GitHub secrets, and npm tokens, to a command-and-control server hosted on Amazon Web Services. 

The threat actor published these fake SDKs with names closely resembling official payment integration libraries, such as paysafe-checkout, skrill-payments, and paysafe-api. While the packages expose expected APIs and return fake success responses to avoid detection, their real purpose is credential theft. The embedded malware scans the compromised environment for secrets and exfiltrates them to the attacker's server. 

Security researchers at Socket identified 13 malicious npm packages and four PyPI packages in this campaign. The npm packages were released in four versions (1.0.0 to 1.0.3), while the PyPI packages had only one malicious version (1.0.0). The full list includes well-known names like paysafe-js, paysafe-fraud, skrill-sdk, neteller, and paysafe-kyc. Developers who installed any of these packages risked having their secrets stolen, especially if they were working on payment integration projects for these services. The data theft module in the npm packages attempts exfiltration only if a Paysafe API key is present and activates when the fake SDK is called. The PyPI packages automatically activate the data theft routine upon initialization and do not require a Paysafe API key to be present at all. 

The malware incorporates basic anti-analysis features to avoid detection in sandboxed or virtualized environments. For instance, it halts execution if it detects fewer than two CPU cores or if the hostname or username suggests a virtual machine. To detect potential compromise, organizations should search their dependency trees for the listed package names and scan CI/CD logs for PAYSAFE_API_KEY in combination with these packages. Denying requests for these packages at the registry proxy level is also recommended to prevent accidental installation. If any of the listed packages were installed, developers are recommended to immediately rotate all secrets on any machine that imported or executed this package. 

The researchers also advise searching dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level. It is also recommended to look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names. Additionally, teams should audit their project dependencies and CI/CD pipelines to ensure no traces of these malicious packages remain. Staying vigilant and verifying package sources before installation remains crucial to avoiding similar supply-chain attacks in the future. This incident highlights the growing sophistication of attackers targeting open-source repositories and the critical need for robust software supply-chain security practices. 

Developers must remain cautious when integrating third-party libraries into their projects, especially those related to financial services and payment processing. The use of automated dependency scanning tools and regular security audits can help identify and mitigate risks associated with malicious packages. Furthermore, organizations should implement strict access controls and monitoring for their CI/CD environments to detect and respond to potential credential theft attempts quickly. By adopting a proactive security posture and staying informed about emerging threats, the developer community can better protect itself against evolving supply-chain attacks.
Read more »
phishing campaign
Cyber Fraud fake job interviews Google account phishing marketing professionals phishing campaign

Phishing Campaign Targets Marketing Professionals Using Fake Job Interviews from Top Global Brands

 

A sophisticated phishing campaign is targeting marketing professionals by posing as recruiters from more than 30 globally recognized brands, including Adobe, Netflix, Coca-Cola, OpenAI, Adidas, and Marriott. The attackers aim to steal Google account credentials by luring victims into fake job interview processes.

According to cybersecurity intelligence and threat hunting company Team Cymru, the operation exploits legitimate cloud-based platforms such as PeopleForce, a human resources service, and domains linked to Salesforce Marketing Cloud before redirecting users to malicious websites. To make the scam appear authentic, the threat actors are also using the names and profile pictures of actual recruiters from the companies they impersonate.

Will Thomas, senior advisor at Team Cymru, investigated the campaign and found that the phishing emails present themselves as recruitment messages. As he noted, the emails appear to be from “a recruiter looking to hire people for marketing roles.”

The investigation revealed that attackers have registered at least 34 domains designed to mimic prominent organizations across multiple industries. These include airlines and travel companies such as American Airlines, Booking.com, Delta Air Lines, and United Airlines; food and beverage giants Coca-Cola, PepsiCo, and Red Bull; fashion and luxury brands Adidas, Louis Vuitton, Sephora, and Levi’s; consulting and technology firms including Adobe, Aquent, ManpowerGroup, McKinsey & Company, and OpenAI; hospitality and marketing companies Marriott and Omnicom Group; as well as entertainment and sports brands like FIFA and Netflix.

Researchers found that the attackers rely on a technique known as nested redirects, where users are routed through several legitimate online services before ultimately reaching a fraudulent webpage. Although the phishing emails appear to originate from PeopleForce, the embedded links resolve to the exct[.]net domain, which is operated by Salesforce following its acquisition of ExactTarget, now known as Salesforce Marketing Cloud.

From there, victims are redirected through Wise Agent, a cloud-based customer relationship management (CRM) platform for real estate professionals, before arriving at the phishing website.

BleepingComputer reported that the campaign has been active for at least five months. Earlier versions reportedly used Outlook email addresses carrying the names of the companies being impersonated.

In one example, a phishing email claiming to be from Adidas recruiter Paulina Manzo invited recipients to schedule a discussion regarding a potential job opportunity. Clicking the scheduling link redirected users to the fraudulent domain adidas-hiring[.]com.

To proceed with booking the interview, victims are instructed to sign in with their Google accounts. Selecting the “Continue with Google” option launches what appears to be a genuine Google authentication window. However, the pop-up is actually created using HTML and CSS within the phishing page itself, a deception technique known as browser-in-the-browser (BitB).

By leveraging modern web development methods, attackers can closely replicate legitimate authentication prompts, making it difficult for users to distinguish fake login windows from real ones.

Researchers emphasized that the misuse of legitimate platforms does not necessarily indicate those services have been compromised. Instead, threat actors may have created valid accounts specifically for the campaign or used compromised credentials to configure redirect chains and phishing pages.

A complete list of the malicious domains associated with the campaign has been published in Will Thomas' GitHub analysis.
Read more »
stolen information
Bitcoin Cloud Computing Cyber Fraud DOJ scams stolen information

US Authorities Seize Infrastructure Tied to Huione Fraud Network




The U.S. government has taken another step in its ongoing campaign against large-scale cyber fraud operations, announcing the seizure of online infrastructure allegedly used to support one of the world's most active criminal marketplaces while simultaneously expanding financial restrictions against the network behind it.

On Tuesday, the Department of Justice (DOJ) revealed that it had seized a cloud computing account connected to Cambodia-based Huione Group and its subsidiaries. According to federal investigators, the account hosted backend systems used to operate Huione Guarantee, also known as Haowang Guarantee, a platform that authorities say enabled a broad range of illicit activities spanning cybercrime, fraud, money laundering, and other criminal services.

The enforcement action coincided with a series of measures from the U.S. Department of the Treasury, which announced additional sanctions targeting Huione-linked entities and individuals associated with the Prince Group network. The latest moves build upon actions taken by U.S. authorities last year as part of a wider effort to disrupt transnational criminal organizations operating across Southeast Asia.

Federal officials described the seized infrastructure as a key component of a marketplace that allegedly served cybercriminals and fraud operators on a global scale. Rather than functioning as a conventional online marketplace, investigators say the platform acted as an ecosystem where illicit services, stolen information, and financial laundering tools could be accessed by criminal actors.

According to the DOJ, the cloud-based infrastructure provided technical support for operations conducted through Huione Guarantee. Authorities allege that the platform relied heavily on Telegram channels to facilitate communications and transactions involving illegal products and services.

Investigators claim those channels were used to advertise and trade stolen credit card information, sensitive personal data, and services linked to malware-enabled theft. The platform is also accused of facilitating money laundering activities and supporting schemes connected to human trafficking operations. In addition, authorities allege that proceeds generated through romance scams and fraudulent investment schemes were moved through the network.

The DOJ further alleges that Huione Guarantee offered escrow services designed for cryptocurrency transactions. Such services act as intermediaries between parties involved in a transaction, holding digital assets until agreed conditions are met. While escrow systems are commonly used in legitimate commerce, investigators contend that the service was leveraged by criminal actors seeking a trusted mechanism for conducting illicit transactions and laundering funds.

Officials believe the infrastructure played an important role in moving and concealing criminal proceeds. According to the Justice Department, billions of dollars in fraud-related funds were transferred through systems supported by the seized account. Authorities further stated that a massive portion of those proceeds originated from scam compounds operating throughout Southeast Asia, where organized criminal groups have increasingly adopted digital platforms and cryptocurrency networks to scale their operations.

The Treasury Department's actions were designed to expand existing restrictions against the Huione network. One measure formally added H-Pay Service as a successor entity under Treasury's existing rule targeting Huione Group. Treasury also imposed sanctions on nine individuals and 26 entities linked to Prince Group, broadening the scope of enforcement against organizations allegedly connected to the movement of illicit funds.

According to Treasury officials, Huione served as an important financial conduit for proceeds generated through cyber-enabled theft, virtual currency investment fraud, and other criminal schemes. Authorities further allege that the network was used by Prince Group to transfer, consolidate, and manage assets derived from fraudulent operations.

The latest actions follow a series of previous enforcement efforts directed at the same ecosystem. Last October, Treasury moved to further isolate Huione Group from the U.S. financial system, reflecting growing concerns over the company's alleged role in facilitating illicit financial activity.

Federal agencies have increasingly focused on scam networks operating across Southeast Asia as losses linked to online fraud continue to rise. Criminal organizations in the region have become known for running large-scale investment scams, romance fraud operations, and cryptocurrency-related schemes that target victims worldwide. Many of these operations rely on complex laundering networks and digital payment channels to obscure the origin and movement of stolen funds.

The investigation also intersects with earlier actions involving Prince Group chairman Chen Zhi. In October, the DOJ announced the seizure of bitcoin connected to investigations involving Chen and alleged cryptocurrency-related offenses, alongside accusations involving additional criminal schemes. Authorities have also reported that an individual identified as a significant participant in Chen's network was arrested in Cambodia before being extradited to China.

The coordinated actions by the DOJ and Treasury illustrate an emphasis on targeting the infrastructure that enables cyber-enabled fraud rather than focusing solely on individual perpetrators. By disrupting cloud services, financial channels, and marketplace operations that allegedly support criminal activity, U.S. authorities are seeking to make it more difficult for transnational fraud networks to move money, coordinate operations, and reach potential victims.

Read more »
User Security
Banking scam Cyber Fraud Haldwani OTP Bypass User Security

Haldwani Cyber Fraud: ₹2.5 Lakh Stolen Without OTP, Raising Bank Security Concerns

 

In Haldwani, a cyber fraud case has once again shaken public trust in digital banking, after a victim reportedly lost money without clicking a suspicious link or sharing an OTP. The case is worrying because it shows how modern fraud can bypass the protections many users still consider reliable. For years, OTPs have been seen as a strong safety layer, but incidents like this suggest scammers are finding new ways to drain accounts while staying hidden. As digital payments grow, so does the need to understand how these silent attacks work. 

What makes such frauds especially alarming is that victims often receive no obvious warning before the money disappears. In some recent cases, cybercriminals have used methods such as SIM swap attacks, malware, account takeovers, call forwarding, or unauthorized beneficiary additions to move funds without the user’s approval. Other reports have also shown that fraud can happen through fake banking apps, remote access tools, or abuse of pre-linked payment mandates. This means the problem is no longer just about sharing an OTP; it is also about securing the phone, SIM, banking app, and personal identity. 

The Haldwani incident highlights a deeper issue in bank security: authentication systems are only as strong as the weakest device or process connected to them. If a fraudster gains access to a phone number, banking credentials, or an already trusted payment route, the transaction may look legitimate to the bank’s systems. That is why “no OTP” does not automatically mean “no compromise.” In fact, some frauds exploit loopholes where money is shifted through internal banking paths, or through beneficiary changes that may not trigger immediate user attention. 

Safety recommendations 

For users, the first rule is to monitor bank alerts closely and treat any unexpected debit, SMS, or app activity as urgent. Keep mobile software updated, avoid installing apps from unknown links, and never grant unnecessary SMS, accessibility, or call permissions to random applications. It also helps to use strong screen locks, secure SIM cards with a PIN, and enable additional notifications through email or alternate channels. If anything looks suspicious, contact the bank immediately and report the fraud through the cybercrime helpline without delay. 

This case is a reminder that cybersecurity is no longer only a technical concern; it is a daily financial survival issue. Banks need stronger fraud detection, faster alerts, and better protection against account takeover methods that bypass OTP-based trust. At the same time, users must stop assuming that OTP alone can keep money safe. The real defense is layered security, quick reporting, and constant digital caution.
Read more »
Typosquatting Domains
Brand Impersonation Attacks Credential Theft Cyber Fraud Cybercrime Campaigns Fake FIFA Websites FIFA World Cup 2026 Scams Online Scam Detection Ticket Fraud Typosquatting Domains

FIFA World Cup 2026 Becomes Prime Target for Ticket and Employment Fraud


 

In 2026, the FIFA World Cup will be the world's largest sporting event, encompassing three host nations, 16 cities, 48 national teams, and 104 matches over a span of six weeks. In addition to the tournament's sporting significance, it presents a uniquely complex security challenge, creating a convergent environment where vast financial flows, international travel, digital transactions, and cross-border commerce collide on unprecedented scale. 

According to security analysts, the same infrastructure that enables millions of fans to purchase tickets, arrange travel, place wagers, and participate in tournament services also offers lucrative opportunities for organized criminal organizations. 

The global footprint of the event provides multiple opportunities for exploitation, including ticket fraud and travel scams, illegal betting operations, money laundering schemes, match-fixing attempts, and human trafficking activities. As threat actors adopt artificial intelligence, they are able to rapidly construct convincing phishing websites, multilingual social engineering campaigns, synthetic voice communications, and fake identity documents.

Following the world cup in 2022, criminal groups have developed many of these techniques, and they are now preparing for the world cup in 2026 with more sophisticated tools, a broader infrastructure, and a significantly larger attack surface. It is believed that threat actors are exploiting FIFA branding, ticket demand, travel planning, and employment opportunities linked to the event in order to harvest credentials, gain access to financial information, and defraud unsuspecting victims on a large scale.

It is predicted that preparations will accelerate for the historic 48-team format of the tournament, which stretches across the United States, Canada, and Mexico, as cybersecurity experts warn that the growing digital footprint surrounding the event will provide fertile ground for sophisticated scams targeting fans, job seekers, and businesses. 

Several analysts have noted that the large amount of interest surrounding the tournament makes it an especially attractive target for fraud. Over six million spectators are expected to gather across the 16 host cities across the United States, Canada, and Mexico during the tournament, with FIFA reporting that more than 150 million ticket requests were received in the first 15 days of sales, resulting in approximately thirty times greater demand than available inventory. 

The investigation by Group-IB identified more than 4,300 fraudulent FIFA-related domains registered since August 2025 and connected over 300 of them to a Chinese-speaking financial cluster identified as GHOST STADIUM. An operation that employs a single phishing kit that closely simulates FIFA's PingIdentity-based single sign-on process, as well as replicating FIFA's authentic client identifier from the live service, is employed to carry out the operation.

Since the cloned pages are created by pulling images directly from FIFA's infrastructure, they appear visually authentic and are evadable by simplistic duplicate content detection. Credential harvesting offers a password-reset flow in addition to a standard login prompt; once victims have submitted their details, attackers will be able to take control of the FIFA account, block out the legitimate owner, and potentially resell the tickets associated with the account. 

Group-IB reported that the campaign's distribution network is heavily reliant on paid social advertising, particularly on Facebook, with tracking identifiers being reused across multiple domains. Additional traffic is derived from Telegram, WhatsApp, and search engine results. There is also a broad diversity in payment infrastructure: some sites collect credit card data directly, others redirect to external gateways, some utilize money transfer applications such as Chime and Nequi, while others offer Mexico-specific payment processing. 

In addition, investigators discovered a cryptocurrency conversion path which effectively transforms a credit card transaction into crypto, complicating chargebacks and recovery processes significantly. FIFA's official ticketing channels do not accept cryptocurrency, making this payment method one of the clearest technical indicators of fraud.

Based on the infrastructure currently visible to researchers, Group-IB estimates that premium ticket fraud related to this ecosystem could result in losses of between $71 million and $474 million, although this figure is an analytical estimate as opposed to a financial total that has been confirmed. According to Group-IB, the infrastructure uncovered by this investigation is consistent with broader warnings issued by the FBI, which has observed an increase in fraudulent websites designed to imitate FIFA's official online presence and harvest sensitive information about users. 

Often, these platforms are designed to collect personally identifiable information, including names, residential addresses, email addresses, banking details, and credit card numbers, as part of the purchase or verification of tickets, account verification, or tournaments. 

Typosquatting is an established cybercrime technique in which threat actors register domain names that have minor spelling adjustments, omitted characters, or alternative top-level domains that closely resemble legitimate brands. Investigators have identified the following domains as examples: fifa[.]help, fifa-online[.]com, jobs-fifa[.]com, fifa-ticket[.]live, fifa-hiring[.]com, and ww-fifa[.]com. 

A significant number of these domains re-emerge quickly after takedown actions, suggesting that there are a resilient fraud ecosystem rather than isolated, brief-lived campaigns. By analyzing the site ww-fifa[.]com further, it was demonstrated that little modification is required to create a convincing impersonation platform. By removing one "w" from the legitimate FIFA web address, operators created a portal that presented itself as an official FIFA World Cup 2026 destination and offered premium hospitality packages containing match tickets, lounge access, catering services, and exclusive event experiences. 

There were several indicators that were commonly associated with fraudulent infrastructure identified during a technical review of the site, including broken media assets, duplicate page metadata, questionable navigation paths, and payment forms that requested extensive personal and financial information without valid verification procedures. Furthermore, Cyble researchers identified recruitment-themed campaigns targeting job seekers through websites such as fifaworldcup-careers[.]com, impersonating a FIFA recruiting portal that advertises employment opportunities related to the World Cup. 

According to information collected from VirusTotal, eight of the 91 security vendors flagged the website, and fourteen of the 91 vendors identified the root domain. According to WHOIS records, the domain was registered and modified in April 2026 with ownership information concealed through privacy protection services. Additionally, investigators discovered two SSL certificates issued in April 15 and April 16, including a wildcard certificate that could secure multiple subdomains, a practice frequently utilized by fraudsters to expand their operations. 

In anticipation of the tournament, cybersecurity authorities anticipate that these campaigns will become increasingly sophisticated and prolific as the tournament approaches. In order to access FIFA services, the FBI recommends that you enter the official website address manually rather than relying on search engine results, sponsored advertisements, or email links.

Unless the authenticity of a website has been independently verified, users should caution when selecting URLs, bookmarking FIFA resources, and avoiding submitting sensitive information. Additionally, officials anticipate the development of fraudulent streaming services attempting to capitalize on fan demand for match coverage, urging users to utilize official FIFA channels and licensed broadcasters exclusively. 

As a precautionary measure in cases where fraud is suspected, authorities recommend preserving screenshots, domain information, communication records, and payment records before submitting a complaint to the Internet Crime Complaint Center (IC3). As malicious FIFA-related domains continue to emerge and cybercriminal infrastructure continues to evolve near real time, security experts warn that maintaining digital vigilance may become more important than securing a ticket for the tournament.

The FIFA World Cup 2026 preparations are accelerating across three host nations as the digital ecosystem surrounding the event is proving equally active as the actual event. As a consequence, cybercriminals are adapting to global events with massive public engagement rapidly by utilizing large-scale phishing infrastructures, brand impersonation campaigns, fraudulent ticket marketplaces, and fake recruitment portals. 

Regardless of whether you are a fan, a business, or a prospective employee, trust cannot be obtained solely from brand recognition alone. Checking domains, scrutinizing payment channels, and relying on official sources remain essential safeguards. Cybersecurity awareness will be an essential line of defense as threat actors continue to register new lookalike domains and refine their tactics until kickoff, and beyond.
Read more »
Subscribe to: Posts (Atom)