Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Scam. Show all posts
Scam
Cyber Fraud Cyberattack CyberCrime Hacking Pune Scam

Pune Company Falls Victim to ₹6.49 Crore Cyber Fraud in Major Man-in-the-Middle Attack

 

A 39-year-old director of a Mohammedwadi-based firm, which operates in IT services and dry fruit imports, was duped into transferring ₹6.49 crore following a sophisticated Man-in-the-Middle (MitM) cyberattack on March 27. In a MitM scam, cybercriminals secretly intercept communications between two parties, impersonating one to deceive the other, often stealing sensitive information or funds.

According to investigators, the company director was at his residence near NIBM Road when he received what appeared to be a legitimate payment request via email from a business associate. Trusting the authenticity, he initiated the payment and even instructed his bank to process it. However, when he later contacted the exporter to confirm receipt, they denied getting any money.

Upon closer inspection, the director discovered subtle changes in the sender's email ID and bank account details — just one letter altered in the email address and a different bank account number. These minor discrepancies went unnoticed initially, police said.

Senior Inspector Swapnali Shinde of the Cyber Police told TOI, "It has two divisions, one for IT services and another for importing dry fruits. The company director would import the dry fruits from different countries, including the United States and those in the Middle-East. On March 27, he received a payment request from an exporter of dry fruits based in the US. The email demanded payment of nearly Rs 6.5 crore. The victim, thinking it was for the almonds he'd recently imported, initiated the transaction."

Realizing the fraud only on April 17, the director registered an FIR with Pune's cyber police on April 23.

Shinde added, "Officials from his bank called him to verify the transaction, but he told them to proceed. The amount was across in five transactions," explaining that the online ledger displayed only the first few letters of the firm's name and bank details.

"The victim did not realise that the account number of the company, with whom he had regular business with, was changed. He just clicked on the button and initiated the transactions," Shinde said.

Cyber investigators are now tracing the trail of the siphoned funds. "The cash went to several accounts. We're still trying to establish a trail. As of now we can say that about Rs 3 crore is yet to reach the suspects. We will try our best to salvage the money," Shinde stated.
Read more »
Scam
Cyber Crime Payment QR Codes Quishing Scam

QR Code Frauds Growing Fast in the UK: What You Should Know

 



A new kind of digital scam is spreading across the UK, where criminals trick people using fake QR codes. This type of scam is called “quishing,” and it has been growing quickly. In 2023, there were over 1,300 reports of this scam, compared to only 100 cases in 2019, showing just how fast it's increasing.


How These Scams Work

Scammers take advantage of everyday places where QR codes are used for payments or information. This includes locations like parking spots or restaurant tables where you scan codes to pay or view menus. What these scammers do is cover the real QR codes with fake ones that they control.

When someone scans the fake code, it sends them to a fake website. The site may ask them to enter payment details, thinking it's a normal payment page. In some cases, clicking the link may even install harmful software on the person’s phone without them knowing.


Why It’s Hard to Notice

These scams can be hard to detect. Unlike large frauds that take big sums of money at once, these scams often take small amounts over time, making it less likely for someone to notice. The charges might look like monthly fees or parking payments, so they often go unnoticed.

Cyber experts say that what makes this scam dangerous is how real the fake websites appear. The links that come up after scanning look just like real ones, so people don’t think twice before entering their card numbers or other personal information.


What You Can Do to Stay Safe

Here are some simple steps to protect yourself:

1. Only scan QR codes that you trust. If the code looks tampered with or placed unevenly, avoid using it.

2. Never enter sensitive information like card numbers on a website you reached through a QR code unless you’re sure it’s safe.

3. Before submitting any details, double-check the website’s name or URL for spelling errors or anything unusual.

4. Use a reliable security app on your phone that can detect harmful links or files.


QR codes were created to make daily tasks faster and more convenient. But now, scammers are misusing them to steal people’s information and money. As these scams become more common, the best defense is to be alert and avoid scanning any QR code that looks even slightly suspicious.


Read more »
TaxSeason
2FA Cybersecurity Data Breach GoogleAds OTP phishing QuickBooks Scam TaxSeason

Cybercriminals Target QuickBooks Users with Phishing Attacks via Google Ads Ahead of Tax Deadline

 

With the April 15 U.S. tax deadline looming, millions of users are logging in to manage their finances online—unfortunately, cybercriminals are watching too. Leveraging this surge in digital activity, attackers are exploiting trusted platforms like Google to deceive users of Intuit’s QuickBooks.

By purchasing top Google Ads placements, hackers are directing users to authentic-looking but fraudulent login pages. These fake portals are designed to steal crucial information including usernames, passwords, and even one-time passcodes (OTPs)—granting criminals access to victims’ financial data needed for filing taxes.

Understanding how this scam works is the first step toward staying safe. Phishing scams targeting accounting software are nothing new. Fraudulent support calls and infected software downloads—often traced to large-scale operations in India and nearby regions—have long been tactics in the scammer playbook.

Late last year, security experts uncovered a malicious QuickBooks installer that prompted users to call a fake support number through a deceptive pop-up.

This new scam is even more concerning. Instead of malware, attackers are now going straight for login credentials. The scam begins with a simple Google search. An ad mimicking Intuit’s branding for “QuickBooks Online” leads users to a convincing fake website.
  • Domain Name: QUICCKBOORKS-ACCCOUNTING.COM
  • Registrar URL: https://www.hostinger.com
  • Creation Date: 2025-04-07T01:44:46Z
The phishing site mirrors the actual QuickBooks login portal. Once users enter their credentials, the information is harvested in real-time and sent to cybercriminals.

"Passwords alone offer a limited level of security because they can be easily guessed, stolen through phishing, or compromised in data breaches. It is highly recommended to enhance account protection by enabling a second form of authentication like one-time passcodes sent to your device or utilizing a 2FA app for an extra layer of verification."

However, even two-factor authentication (2FA) and OTPs are being targeted. Modern phishing kits use advanced tactics like “man-in-the-middle” or “adversary-in-the-middle” (AiTM) attacks to intercept this second layer of protection.

As users unknowingly submit both their password and OTP to a fake login page, the information is relayed instantly to the attacker—who uses it before the code expires.

Cybercriminals ramp up efforts during tax season, banking on urgency and the volume of financial activity to catch users off guard. Their tools? Deceptive Google ads that closely resemble legitimate QuickBooks links. These reroute users to cloned websites that can collect sensitive data—or even install malware.

While 2FA and OTPs still offer critical protection against many threats, they must be used on verified platforms to be effective. If you land on a malicious site, even the best security tools can be bypassed.
Read more »
Tax
Cyber Fraud IRS Cybersecurity phishing Scam Tax

Microsoft Warns of Tax-Themed Phishing Scams Targeting Americans This April

 

As the tax deadline looms, cybercriminals are seizing the opportunity to exploit anxious taxpayers. Microsoft has sounded the alarm on a new surge of sophisticated phishing scams that are preying on individuals during the 2025 tax season.

From fake IRS communications to malicious PDFs and QR codes, scammers are using increasingly deceptive methods to trick users into handing over sensitive information or installing malware.

These phishing campaigns are engineered to deliver a variety of dangerous payloads including Latrodectus, BruteRatel C4, and AHKBot. They also often deploy remote access trojans (RATs), enabling hackers to take over infected systems, steal financial data, or commit identity theft.

The fraudulent emails appear convincing, often featuring urgent subject lines such as "Unusual Activity Detected in Your IRS Filing" or "Important Action Required: IRS Audit." With one click, users are redirected to fake websites—like spoofed DocuSign pages—that automatically trigger malware downloads.

In some cases, scammers are playing the long game. One tactic involves emails from fake "clients" claiming tax-related emergencies due to past CPA errors. A response to these emails could lead to receiving a malicious attachment disguised as a tax document.

Microsoft has flagged a particularly stealthy campaign aimed at accountants. The bait? A malware-laced PDF that deploys GuLoader, a tool that leverages encrypted shellcode and cloud-based services to bypass standard security protocols. Once installed, Remcos, a remote access trojan, takes over the device, allowing hackers to manipulate files or exfiltrate data unnoticed.

“Scammers thrive on panic, so don't let them rush you. Always double-check sender addresses, avoid clicking links in unexpected emails, and never download attachments unless you're absolutely certain they're safe,” the advisory warns.

The IRS, it’s important to note, does not contact individuals via email, text, or social media for sensitive information.

Microsoft reassures users that their security solutions are actively combating these threats.

“Defender for Office 365 automatically flags and blocks phishing emails and malicious attachments, while Defender for Endpoint provides comprehensive protection across devices.”

With awareness and caution, individuals can better protect themselves from falling victim during this high-risk season.
Read more »
Scam
Antivirus Cyber Fraud Cybersecurity Fraud Hackers phishing Scam

Phishing Scams Are Getting Smarter – And More Subtle : Here’s All You Need to Know

 

Cybercriminals are evolving. Those dramatic emails warning about expired subscriptions, tax threats, or computer hacks are slowly being replaced by subtler, less alarming messages. New research suggests scammers are moving away from attention-grabbing tactics because people are finally catching on.

Kendall McKay, strategic lead for cyber threat intelligence at Cisco’s Talos division, said phishing scams are adapting to stay effective. “They probably know that we've caught on to this and the tricky, sensational email isn't going to work anymore,” McKay said. “So they've moved towards these benign words, which are likely to show up in your inbox every day."

Cisco’s 2024 Year in Review report found that common phishing emails now include subject lines like “request,” “forward,” and “report”—a shift from the usual “urgent” or “payment overdue.” Despite the growing use of advanced tools like AI, scammers still favor phishing because it works. Whether they’re targeting large corporations or individuals, their aim remains the same: to trick users into clicking malicious links or giving up sensitive information.

The most impersonated brands in blocked phishing emails last year included:
  • Microsoft Outlook – 25% of total phishing attempts
  • LinkedIn
  • Amazon
  • PayPal
  • Apple
  • Shein
“Phishing is still prominent, phishing is effective, and phishing is only getting better and better, especially with AI,” McKay said.

Common phishing tactics include:
  • Unsolicited messages via email, text, or social media—especially if they come from people or companies you haven’t contacted.
  • Fake job offers that appear legitimate. Always verify recruiter details, and never share personal information unless it’s through a trusted channel.
  • Requests for gift cards or cryptocurrency payments—these are favored by scammers because they’re untraceable. Official entities like the IRS won’t ever ask for payment in these forms or reach out via email, phone, or text.
  • Online romance scams that play on emotional vulnerability. The FTC reported $384 million in losses from romance scams in just the first nine months of 2024.
  • Charity scams tied to current events or disasters. Always donate through official websites or verified sources.
To protect yourself if you think you’ve been phished:
  • Install and update antivirus software regularly—it helps filter spam and block malware-laced attachments.
  • Use strong, unique passwords for every account. A password manager can help manage them if needed.
  • Enable two-factor authentication (2FA) using apps or physical security keys (avoid SMS-based 2FA when possible).
  • Freeze your credit if your Social Security number or personal data may have been compromised. Experts even suggest freezing children’s credit to prevent unnoticed identity theft.
  • Scams are no longer loud or obvious. As phishing becomes more polished and AI-powered, the best defense is staying alert—even to the emails that seem the most routine.
Read more »
Windows
CAPTCHA malware Scam Windows

Fake CAPTCHA Scams Trick Windows Users into Downloading Malware

 



Cybercriminals have found a new way to trick Windows users into downloading harmful software by disguising malware as a CAPTCHA test. A recent investigation by security researchers revealed that attackers are using this method to install infostealer malware, which secretly collects sensitive data from infected computers.  


How the Scam Works  

The attack begins when a user visits a compromised website and encounters what appears to be a routine CAPTCHA verification. These tests are usually used to confirm that a visitor is human, but in this case, clicking on it unknowingly triggers a harmful command.  

Instead of simply verifying the user’s identity, this fake CAPTCHA executes a hidden script that launches a multi-step infection process. The malware then installs itself and starts collecting sensitive information like usernames, passwords, and banking details.  


Step-by-Step Breakdown of the Attack  

1. Fake CAPTCHA Displayed: The user sees what looks like a normal CAPTCHA test.  

2. PowerShell Command Executed: Clicking on the CAPTCHA activates a hidden script that runs harmful commands.  

3. Additional Malicious Code Downloaded: The script retrieves more files, which help the malware spread without detection.  

4. Final Infection: The malware, such as Lumma or Vidar, is installed and begins stealing personal data.  


How Attackers Evade Detection  

Hackers use several techniques to keep their malware hidden from security software:  

Obfuscation: The malware code is made more complex to avoid being detected by antivirus programs.  

Multiple Layers of Encryption: Attackers scramble the malware’s code so that security tools cannot recognize it.  

Bypassing Security Measures: The script manipulates Windows settings to prevent detection and removal.  

In some cases, the malware uses a special trick called XOR encryption to disguise itself. Some versions even include commands that trick Windows security tools into believing the malware is safe.  


How to Protect Yourself  

To avoid falling victim to this scam, follow these precautions:  

1. Be Wary of Suspicious CAPTCHAs: If a CAPTCHA test appears unusual or asks for unexpected actions, do not interact with it.  

2. Stay on Trusted Websites: Avoid unknown or unverified sites, as they may be compromised.  

3. Keep Your System Updated: Install the latest security updates for Windows and your antivirus software.  

4. Use Reliable Security Tools: A strong antivirus program can help detect and block suspicious activity.  

5. Enable Browser Protections: Modern web browsers offer security features that warn against unsafe websites — keep them turned on.  


This deceptive CAPTCHA scam is a reminder that cybercriminals are always coming up with new ways to infect devices and steal personal data. By staying alert and following basic security practices, users can reduce their chances of being targeted by such attacks.

Read more »
Scam
Cybersecurity FBI malware Ransom Scam

FBI Warns of Fake Ransom Demands Sent by Mail to US Executives

 



A new scam is targeting top business leaders in the United States, where criminals are sending letters demanding large ransom payments. Unlike typical ransomware attacks that involve hacking into computer systems, this scheme relies on physical mail. The letters claim that hackers have stolen company data and will leak it unless a ransom of $250,000 to $500,000 is paid. However, cybersecurity experts believe this is a fraud, with no actual hacking involved.  


How the Scam Works  

Investigators from the GuidePoint Research and Intelligence Team (GRIT) discovered that several companies have received these ransom letters through the US Postal Service (USPS). The letters are addressed to high-level executives and claim to be from the BianLian ransomware group, a known cybercriminal organization.  

The message states that the company's confidential information has been stolen and will be exposed unless the demanded payment is made within ten days. To make the threat appear real, the letter includes a Bitcoin wallet address and a QR code that links directly to it. Some letters also provide links to BianLian’s dark web site to add legitimacy to the claim.  

Despite these details, security analysts have found no proof that any actual data theft has occurred. The scam relies on fear and deception, hoping that executives will panic and send money.  


Why Experts Believe the Threat Is Fake  

Cybersecurity specialists have carefully examined multiple cases of this scam and found no signs of hacking or data breaches. The companies targeted in this scheme have not reported any unusual activity or unauthorized access to their systems. This strongly suggests that the criminals behind the letters are only pretending to be the BianLian ransomware group.  

The FBI has confirmed that these letters are part of a fraud campaign and do not represent a real cyberattack. Many of the envelopes are marked as "Time Sensitive" to create urgency, and some even list a return address in Boston, Massachusetts, which appears to be another false detail.  

Since there is no actual ransomware attack, businesses do not need to take technical action like removing malware or restoring stolen files. The main risk comes from executives believing the scam and paying the ransom.  


What to Do If You Receive One of These Letters  

If your company receives a similar ransom demand, take the following precautions:  

1. Check Your Systems for Security Issues – Ensure that company networks are protected and that there are no signs of hacking or data leaks. Keeping cybersecurity measures updated is always important.  

2. Do Not Send Any Money – These threats are fake, and paying the ransom will only encourage further scams.  

3. Report the Scam – Contact law enforcement and inform the nearest FBI field office about the letter. Complaints can also be filed with the Internet Crime Complaint Center (IC3).  

4. Inform Key Personnel – Let executives and employees know about this scam so they can recognize and ignore similar fraud attempts in the future.  

 

This scam is a reminder that cybercriminals do not always rely on advanced hacking techniques. Sometimes, they use old-fashioned methods like physical mail to create fear and manipulate victims into paying. While real ransomware attacks remain a serious concern, this particular scheme is based on false claims.  

Companies should stay informed and take precautions to avoid falling victim to these types of fraud. Being aware of such scams is the best way to protect against them.

Read more »
UPI
Banking Digital Arrest Jumped Deposit Scam SBI Scam Technology UPI

Banking Fraud: Jumped Deposit Scam Targets UPI Users


Users of the unified payments interface (UPI) are the victims of a recent cyber fraud known as the "jumped deposit scam." First, scammers persuade victims by making a modest, unsolicited deposit into their bank accounts. 

How does it operate? 

A scammer uses UPI to transfer a tiny sum to the victim's bank account. After that, they ask for a larger withdrawal right away. The victim might quickly verify their bank account amount due to this sudden deposit. The victim must input their personal identification number (PIN) to access their bank details, and the stolen withdrawal is authorized. The difference money is stolen by fraudsters.

The Hindu reports, “Scammers exploit the recipient’s curiosity over an unsolicited deposit to access their funds.”

The public was previously warned by the Tamil Nadu Cyber Crime Police to exercise caution when dealing with such unforeseen deposits. It noted that the latest scam was the subject of numerous complaints to the National Cyber Crime Reporting Portal.

What to do?

There are two methods UPI customers can use to guard against jumped deposit scams. 

Since withdrawal requests expire after a certain amount of time, wait 15 to 30 minutes after noticing an unexpected transaction in your bank account before checking your balance. Try carefully entering an incorrect PIN number to reject the prior transaction if you don't have time to wait a few minutes. 

Additionally, to confirm the legitimacy, notify your bank if you discover an unexpected or sudden credit in your account. Scam victims need to file a complaint with the cybercrime portal or the closest police station.

Banking attacks on the rise

The State Bank of India recently highlighted several cybercrimes, including digital arrests and fake customs claims, in light of the rise in cybercrimes. To safeguard themselves, the bank advised its clients to report shady calls and confirm any unexpected financial requests. 

It explained scams like "digital arrests," where scammers pretend to be law enforcement officers and threaten to question you about fictitious criminal conduct. For easy chores, some scammers may offer large quantities of money as payment. After that, they might request a security deposit.
Read more »
Scam
Cyber Awareness Cyber Crime Digital Arrest India Internet Scam

Digital Arrest: How Even The Educated Become Victims

Digital Arrest: How Even The Educated Become Victims

One of the most alarming trends in recent times is the surge in digital arrest scams, particularly in India. These scams involve cybercriminals impersonating law enforcement officials to extort money from unsuspecting victims. 

Cybersecurity threats are rapidly escalating in India, with digital arrest scams becoming a major issue. Even well-educated individuals are falling victim to these sophisticated schemes. 

Digital Arrest: A Scam

The concept of a digital arrest does not exist in law. These scams involve cybercriminals masquerading as law enforcement officials or government agencies like the State Police, CBI, Enforcement Directorate, and Narcotics Bureau. 

These scams often leverage official-sounding language and sometimes even use fake police or court documents to appear legitimate. Scammers sometimes use deepfake technology to create convincing video calls, making it even harder for victims to distinguish between a real and a fraudulent interaction.

Scammers may also send fake arrest warrants, legal notices, or official-looking documents via email or messaging apps. They accuse victims of severe crimes like money laundering, drug trafficking, or cybercrime. 

Common claims include: "a phone number linked to your Aadhaar number is involved in sending abusive messages or making threatening calls," "a consignment with drugs addressed to you has been intercepted," or "your son has been found engaged in nefarious activity." They may even fabricate evidence to make their accusations more credible.

The Problem in India

India has seen a significant rise in digital arrest scams, affecting individuals across different strata of society. The problem is exacerbated by the fact that many people are unaware of the nuances of cybercrime and can easily fall prey to such tactics. 

Factors contributing to the rise of these scams in India include:

  1. Increased Internet Penetration: With more people accessing the Internet, especially on mobile devices, the pool of potential victims has expanded significantly.
  2. Lack of Cyber Awareness: Despite the growth in internet usage, there is a significant gap in cyber awareness and education. Many individuals are not equipped with the knowledge to identify and respond to such scams.
  3. The sophistication of Scammers: Cybercriminals are becoming increasingly sophisticated, using advanced technologies and psychological tactics to manipulate victims.

The impact of digital arrest scams on victims can be severe. Apart from financial loss, victims often experience psychological distress and a loss of trust in digital platforms. Educated individuals, who might otherwise be cautious, can also fall victim to these scams, as the fear of legal repercussions can cloud judgment.

Read more »
Scam
Amazon Hacking links phishing Scam

Chenlun’s New Phishing Schemes Target Big-Name Brands

 


A new phishing campaign unveiled by researchers from DomainTools is a phishing campaign on the go, deceiving users via fake text messages. The messages masquerade as trusted brands like Amazon to get the targets to give away sensitive data. This operation is put at the hands of the threat actor "Chenlun," who was seen tricking people last year for masquerading as a USPS delivery alert during the holiday season. On 18 October 2024, consumer targeting waves, this wave represents new waves in tactics that target trusting consumers on the most-used brands.

Phishing Attack Evolution: From USPS Notification Scam to Authentication and Authorization Hack

In December 2023, DomainTools reported on the earlier approach that Chenlun used through exploiting USPS alerts to instruct users on how to navigate to fraudulent websites. This scheme, also labelled as "smishing, tricked users into message prompting them to visit virtually identical websites to the one genuine USPS websites. These next sent information that victims did not need to provide. With the current attack, however, Chenlun used the more narrow deception of alerts that there is unauthorised access to his or her online store accounts. This prompted victims into confirmation of their account information with links that led him to a scam website. To this end, it goes without saying that one ought to be careful when opening any link on email or text.


Advanced techniques of hiding and concealing evidence

The strategies that Chenlun uses today are more advanced than that of not being detected. The phishing attack this year is different from the past years because it does not use domain names containing USPS but instead uses a DGA. A DGA automatically generates new, arbitrary domain names, which creates an added difficulty in blocking malicious websites and makes it challenging for the security systems to identify phishing attempts. The constant change in the infrastructure of the domain leaves Chenlun free to continue their attacks without instant interference from cybersecurity defences.


Changed Domain Structures and Aliases

The latest phishing campaign also demonstrates the changed structure of the Chenlun domain. Last year, the fraudsters utilised domains like the official USPS websites. This time around, they change them into simple domains and even switch to other registrars and name servers. Now, they use NameSilo and DNSOwl, for example, and not Alibaba Cloud's DNS service, just like last year. The changing tendency makes phishing attempts less predictable and also complicates the procedure for cybersecurity analysts in relation to the identification and monitoring of suspicious domains.

Moreover, the most recent activity of Chenlun used pseudonyms like "Matt Kikabi" and "Mate Kika". These pseudonyms, which were first identified in the 2023 report, have more than 700 active domains. Reusing these identities, Chenlun has been able to maintain a massive presence online undetected by cybersecurity tools.


Collaboration as a Critical Form of Defense Against Phishing

DomainTools emphasises that effective countermeasures against phishing attacks require the collective efforts of organisations. Recommendations from security experts include active monitoring of registration patterns, sharing threat intelligence, and developing robust strategies that can counter changing phishing techniques.

DomainTools further emphasises that Chenlun's strategy changes reflect the ongoing problem that cybersecurity professionals face. By constantly changing obfuscation techniques, Chenlun underlines the importance of domain-related data in identifying patterns and suspect domains.


Takeaway for Business and Consumers

Continuous activity by Chenlun also points to the fact that vigilance needs to be maintained, given the sophistication in phishing scams. Business entities need to strengthen cybersecurity measures in monitoring domain registrations and promote threat intelligence sharing. Individual consumers need to maintain vigilance by avoiding a response to unsolicited messages or links.

In short, Chenlun's latest phishing campaign calls out for proactive defence. While the attackers continue adapting with a view to remain unseen, the necessity for people to stay updated and network inter-sectorally is the urgent requirement in the world of digitization.


Read more »
Scam
Bengaluru Cyber crimes Fraud porter Scam

Delivery Partners Exploit App Loophole, Defraud Logistics Company in Bengaluru

 




This is a major fraud case whereby delivery partners exploited a weakness in the logistics app Porter, syphoning Rs 90 lakh from Bengaluru. The swindle was detected by a routine business audit conducted in July by Smart Shift Logistics Solutions Pvt Ltd, which runs Porter. After this, an official of the logistics company filed a complaint with the police. Insider involvement was ruled out through automated operations.

The authorities suspected it could be an inside job when the fraud was first detected, considering the scale of the crime. They looked at the backend operations of the company and found nothing internal as most processes were automated. This led to a deep probe with Sarah Fathima, the Deputy Commissioner of Police (Southeast), assigning a team to trace the refunds made by the company since January. This series of operations was headed by ACP Govardhan Gopal, along with inspector Eshwari from the Southeast Cybercrime, Economic Offences, and Narcotics (CEN) police station.


Understanding the Scam

The investigators soon came across several refunds credited to the same accounts, and a rather clear fraud pattern began to emerge. The police were following this chain of suspicious transactions when it led them to a Shreyas TL, a 29-year-old from Hassan's Hirisave. Based on confession questioning of Shreyas, the police managed to seize three others: Kaushik KS, aged 26, from Mandya, Ranganath PR, also 26, and Anand Kumar, 30, both from Mandya.

These were earlier cab drivers and food delivery partners for various online applications who chanced upon loopholes in the Porter app after dabbling in such scams in other delivery services. They eventually managed to pinpoint how to exploit the Porter system through trial and error for their financial gains.


How the scam was run

Porter has a system where the driver can get a part of the total bill through his wallet whenever he accepts the job. And if he rejects the delivery, he will have his money back automatically. The application does not allow abusing this system, and therefore it has a strict cancellation policy where it blacklists the drivers in case they cancel two deliveries consecutively.

The fraudsters bypassed the system. Geo-spoofing is an application of the technology, using which they manipulated the app so as to pose their locations at places where there are few available drivers. This way, they accepted the jobs using their fake delivery accounts. The amount of the bill was credited to their digital wallets. Then the amount was drawn from these wallets into bank accounts. They canceled the delivery, and customers canceled the order and received a refund.

The reason they did not get blacklisted was because of repeated cancellations, so to avoid that, the gang bought fake phone numbers from Telegram groups and created new accounts on the app with them. Additionally, the gang practiced geo-spoofing to change their location into neighbouring states, making it hard for the authorities to trace them.


A Perfected Scam

The operation of the gang was so sophisticated that they managed to make off with a total of Rs 90 lakh from the company. Taking advantage of loopholes in the automation of the app, they had syphoned off the amount without raising any suspicion in the beginning. But finally, after going through a detailed investigation, it was traced by the police, and the fraudsters were caught.

This case shines a light on the importance of secure and foolproof systems in online platforms, especially those handling financial transactions. It also highlights the need to frequently audit and monitor company automated processes to detect fraud before it gets out of hand.




Read more »
Trading
Apple cryptocurrency Cyber Fraud Cybersecurity Fake Apps Fraud Google investment phishing Scam Trading

Massive Global Fraud Campaign Exploits Fake Trading Apps on Apple and Google Platforms

 

A recent investigation by Group-IB revealed a large-scale fraud operation involving fake trading apps on the Apple App Store and Google Play Store, as well as phishing sites to deceive victims. The scheme is part of a wider investment scam known as "pig butchering," where fraudsters lure victims into investments by posing as romantic partners or financial advisors.

Victims are manipulated into losing funds, with scammers often requesting additional fees before disappearing with the money.

Group-IB, based in Singapore, noted that the campaign targets victims globally, with reports from regions like Asia-Pacific, Europe, the Middle East, and Africa. The fraudulent apps, created using the UniApp Framework, are labeled under "UniShadowTrade" and have been active since mid-2023, offering promises of quick financial gains.

One app, SBI-INT, even bypassed Apple’s App Store review process, giving it an illusion of legitimacy. The app disguised itself as a tool for algebraic formulas and 3D graphics calculations but was eventually removed from the marketplace.

The app used a technique that checked if the date was before July 22, 2024, and, if so, displayed a fake screen with mathematical formulas. After being taken down, scammers began distributing it via phishing websites for Android and iOS users.

For iOS, downloading the app involved installing a .plist file, requiring users to trust an Enterprise developer profile manually. Once done, the fraudulent app became operational, asking users for their phone number, password, and an invitation code.

After registration, victims went through a six-step process involving identity verification, providing personal details, and agreeing to terms for investments. Scammers then instructed them on which financial instruments to invest in, falsely promising high returns.

When victims tried to withdraw their funds, they were asked to pay additional fees to retrieve their investments, but the funds were instead stolen.

The malware also included a configuration with details about the URL hosting the login page, hidden within the app to avoid detection. One of these URLs was hosted by a legitimate service, TermsFeed, used for generating privacy policies and cookie consent banners.

Group-IB discovered another fake app on the Google Play Store called FINANS INSIGHTS, which had fewer than 5,000 downloads. A second app, FINANS TRADER6, was also linked to the same developer. Both apps targeted countries like Japan, South Korea, Cambodia, Thailand, and Cyprus.

Users are advised to be cautious with links, avoid messages from unknown sources, verify investment platforms, and review apps and their ratings before downloading.
Read more »
Scam
Hong Kong malware Online Scams phishing Scam

Cybersecurity Attacks Rise in Hong Kong, Scammers Steal Money


Hong Kong has experienced a rise in cybersecurity threats, scammers are targeting individuals and businesses. A recent survey highlighted by the South China Morning Post (SCMP) reveals that nearly two-thirds of victims have suffered financial losses or wasted valuable time due to these cyber threats. This alarming trend underscores the urgent need for heightened awareness and robust cybersecurity measures.

The Growing Menace of Cyber Scams

In the past year, 49% of Hong Kong respondents faced online threats, up from 40% previously, according to Norton. Scams were the most common, impacting 34% of respondents, with nearly two-thirds losing money or time. Phishing and malware each affected 28% of respondents.

Cyber scams have become the most prevalent online threat in Hong Kong. These scams range from phishing emails and fraudulent websites to sophisticated social engineering tactics. 

Phishing and Malware

Phishing attacks, where cybercriminals disguise as legitimate entities to steal personal information, have seen a marked increase. These attacks often come in emails or messages that appear to be from trusted sources, such as banks or government agencies. Once the victim clicks on a malicious link or downloads an attachment, their personal data is compromised.

Malware attacks are another growing concern. These malicious software programs can infiltrate systems, steal data, and cause extensive damage. The SCMP survey indicates that a considerable portion of the population has been affected by malware, leading to data breaches and financial losses.

In June, police arrested 10 individuals for impersonating mainland security officials and defrauding a 70-year-old businesswoman of HK$258 million (US$33.2 million) in a phone scam. 

By August, local authorities, including the police and the Hong Kong Monetary Authority (HKMA), instructed 32 banks and 10 stored-value-facility operators to broaden their anti-fraud alerts to cover suspicious transactions at bank counters and online.

The Human Factor: A Critical Vulnerability

Despite advancements in technology, human vulnerabilities remain a significant risk factor. Cybercriminals often exploit the lack of awareness and vigilance among users. For instance, clicking on suspicious links, using weak passwords, and failing to update software are common mistakes that can lead to security breaches.

Read more »
Security
Cyber Fraud Data Leak Privacy Scam Scamster Security

Chemical Giant Orion Loses $60 Million in Email Scam

 

Luxembourg-based Orion S.A., a leading supplier of carbon black, has been defrauded of a staggering $60 million. The company alerted the US Securities and Exchange Commission (SEC) on August 10th through an official filing (Form 8-K).

The filing reveals that a non-executive employee became the target of a criminal operation. The document states: "On August 10, 2024, Orion S.A. determined that a Company employee, who is not a Named Executive Officer, was the target of a criminal scheme that resulted in multiple fraudulent wire transfers to accounts controlled by unknown individuals."

While Orion refrained from sharing specific details about the attack, the nature of the incident - multiple fraudulent wire transfers initiated by an employee - strongly suggests a BEC scam.

In a typical BEC scam, cybercriminals gain access to a legitimate email account belonging to a high-ranking official within a company or impersonate them through a spoofed email address. They then target employees with access to company finances, tricking them into authorizing unauthorized payments.

Common tactics employed by BEC scammers include:

  • Urgency and secrecy: Criminals may claim the company is in the process of acquiring a competitor and needs to expedite the transaction confidentially to avoid media attention or alerting rivals.
  • Impersonation: Scammers may use stolen email credentials or create lookalike email addresses to convincingly impersonate executives.
  • Phone calls: In some cases, the attackers may even follow up with phone calls to pressure the targeted employee into acting swiftly.

The effectiveness of BEC scams lies in their ability to exploit gaps in communication within large organizations. Many employees may not have personal interactions with senior management, making them more susceptible to falling for impersonations and deceptive tactics.

Reports indicate that BEC attacks are a major form of cybercrime, causing significant financial losses, and rivaling the damage inflicted by ransomware attacks.

Read more »
Scam
Android Users APK Files bank account cyber attack Financial Fraud KYC Scam

New APK Scam: Protect Your Bank Account from Fraudsters


 


Punjab and Sind Bank (PSB) recently issued a public notice alerting customers to a new scam involving fraudulent messages and malicious APK files. This scam threatens grave  financial losses if customers do not take proper precautions.

How the APK Scam Works

Step 1: Creating Panic with Fake Messages

Scammers initiate the fraud by sending text messages that mimic legitimate bank communications. These messages claim that recipients must update their Know Your Customer (KYC) information to avoid having their bank accounts blocked. The fraudulent messages create a sense of urgency, making recipients more likely to follow the instructions.

Kaushik Ray, Chief Operating Officer of Whizhack Technologies, explains that these messages exploit users' fears and desires, bypassing rational judgement. The goal is to trick recipients into downloading a malicious APK file, a common format for Android apps.

Step 2: Installing Malicious APK Files

Once recipients are convinced by the false narrative, they are instructed to download and install an APK file. These files often contain malware. Upon installation, the malware grants hackers access and control over the victim's mobile device.

Step 3: Executing Cyber Attacks

With control of the device, hackers can perform various malicious activities. These include installing a keylogger to capture sensitive information like banking credentials and passwords, launching ransomware attacks that lock the device until a ransom is paid, and accessing the clipboard to steal copied information such as account numbers.

How to Protect Yourself from APK Scams

To protect against these scams, PSB advises customers to take the following precautions:

1. Avoid Downloading Files from Unknown Sources: Only download apps from trusted sources like the Google Play Store.

2. Do Not Click on Suspicious Links: Be wary of links received in unsolicited messages, even if they appear to be from your bank.

3. Block and Report Suspicious Contacts: If you receive a suspicious message, block the sender and report it to your bank or relevant authorities.

4. Never Share Personal Information Online: Do not disclose personal or financial information to unverified sources.

Why APK Scams Target Android Users

Ray highlights that this scam primarily targets Android users because APK files are specific to Android devices. iOS devices, which use a different file format called IPA, generally have stricter controls against installing third-party apps, making them less vulnerable to this type of attack. However, iOS users should remain vigilant against phishing and other scams.

Real-Life Impacts of the APK Scam

Imagine receiving a message that your bank account will be frozen if you do not update your KYC information immediately. This could lead to panic about how you will pay for everyday expenses like groceries, school fees, or utility bills. Scammers exploit this fear to convince people to download the malicious APK file, giving them access to your device and your money.

Stay alert, verify the authenticity of messages, and protect your personal information to safeguard your financial assets.


Read more »
Transactions
Bengaluru Cyber Crime Scam Stock market Transactions

Stock Market Scam in Bengaluru: Businessman Loses Rs 5.2 Crore



In a recent cybercrime incident, a 52-year-old businessman from Bengaluru fell victim to a stock market scam, losing a staggering Rs 5.2 crore. The victim, referred to as Sharath for anonymity, reported the incident to the cybercrime police on April 8. According to his account, the ordeal began when he received a WhatsApp message on March 11 promoting stock market investments with promises of high returns. Despite refraining from clicking the accompanying link, Sharath found himself involuntarily added to a WhatsApp group named "Y-5 Ever Core Financial Leader," boasting around 160 members.

Subsequently, Sharath received numerous calls from unidentified numbers, urging him to download an application linked to the investment scheme. Initially resistant, Sharath eventually succumbed to the persuasion tactics employed by the fraudsters and downloaded the app. Under the guidance of the perpetrators, Sharath began purchasing stocks facilitated by multiple accounts provided by the fraudsters. Assured that his funds were being invested in the stock market, Sharath transferred a staggering Rs 5.2 crore to five designated accounts by April 2.

Despite his growing suspicions, Sharath's attempts to withdraw profits or reclaim some of his invested capital for further investments were thwarted by the fraudsters. It was only then that he realised he had fallen victim to a scam. In response to the complaint, authorities have initiated legal proceedings under the IT Act, with ongoing investigations. Efforts have been made to freeze the funds in the fraudsters' accounts in collaboration with bank officials, raising hopes for potential recovery of some of the lost money, as confirmed by a senior police official.

Senior Citizen Scammed: Woman Loses Rs 6 Lakh

In another distressing incident, a 61-year-old woman fell prey to cybercriminals impersonating Delhi police and Customs officials. Exploiting her fear, the fraudsters falsely accused her of drug smuggling and money laundering, coaxing her to transfer Rs 6.56 lakh. Manipulating her trust, they provided fake validation procedures, leading to her significant loss.

These incidents serve as stark reminders of the growing tactics of cybercrime and the importance of caution while engaging in online transactions. Authorities urge the public to exercise caution and scepticism when encountering unsolicited investment opportunities or suspicious requests for financial transactions. As investigations continue into these cases, efforts to combat cybercrime through deliberate security measures and real-time data sharing remain imperative to safeguard individuals and businesses from falling prey to such fraudulent schemes.


Read more »
US Schools
CAPTCHA Security cyber attack Cyber Attacks PHaas phishing Scam Storm-1575 Tycoon US Schools

Rise in Phishing Attacks Targeting US Schools Raises Concerns

 



Through a recent report by PIXM, a cybersecurity firm specialising in artificial intelligence solutions, public schools in the United States face a significant increase in sophisticated phishing campaigns. Threat actors are employing targeted spear phishing attacks, utilising stealthy patterns to target officials in large school districts, effectively bypassing Multi-Factor Authentication (MFA) protections.

Since December 2023, there has been a surge in MFA-based phishing campaigns targeting teachers, staff, and administrators across the US. The attackers, identified as the Tycoon and Storm-1575 threat groups, employ social engineering techniques and Adversary-in-the-Middle (AiTM) phishing to bypass MFA tokens and session cookies. They create custom login experiences and use services like dadsec and Phishing-as-a-Service (PhaaS) to compromise administrator email accounts and deliver ransomware.

The Tycoon Group's PhaaS, available on Telegram for just $120, boasts features like bypassing Microsoft's two-factor authentication. Meanwhile, Microsoft identifies Storm-1575 as a threat actor engaging in phishing campaigns through the Dadsec platform. The attacks involve phishing emails prompting officials to update passwords, leading them to encounter a Cloudflare Captcha and a spoofed Microsoft password page. If successful, attackers forward passwords to legitimate login pages, requesting two-factor authentication codes and bypassing MFA protections.

The attacks commonly target officials such as the Chief of Human Capital, finance, and payroll administrators. Some attempts involve altering Windows registry keys, potentially infecting machines with malicious scripts. The attackers conceal their tracks using stealth tactics, hiding behind Cloudflare infrastructure and creating new domains.

Despite using CAPTCHAs in phishing attacks providing a sense of legitimacy to end-users, there's potential for malicious trojan activity, including modifying Windows registry keys and injecting malicious files. These attacks can result in malware installation, ransomware, and data exfiltration.

Schools are the most targeted industry by ransomware gangs, with student data being a prominent prey of cybercrime. A concerning trend shows unprecedented data loss, with over 900 schools targeted in MOVEit-linked cyber attacks. Recent data leaks, such as the one involving Raptor Technologies, have exposed sensitive records belonging to students, parents, and staff, raising concerns about student privacy and school safety.

To protect against these phishing attacks, organisations are advised to identify high-priority staff, invest in tailored awareness efforts, caution users against suspicious links, and implement proactive AI-driven protections at the browser and email layers.

To take a sharp look at things, the surge in phishing attacks targeting US schools states the significance of cybersecurity measures and the need for increased awareness within educational institutions to safeguard sensitive information and ensure the privacy and safety of students and staff.


Read more »
Scam
2FA Cash App Cyber Security Data protection Financial Fraud Holiday Scam Identity Theft Money Transfer Scam

Fallen Victim to Zelle Scams During the Holiday Season

Identity theft is a serious concern at a time of rapid technology development and digital commerce. It becomes essential to strengthen our defenses against potential cyber threats as we negotiate the complexities of internet platforms and financial services. Identity protection must be prioritized immediately, as shown by several recent instances. 

A thorough analysis by CNET states that as more people become aware of the significance of protecting their personal information online, there is a growing demand for identity theft protection services. The paper emphasizes that because hackers have become more skilled, protecting sensitive data needs to be done proactively.

The holiday season, a time of increased financial activity, poses additional challenges. Fraudsters exploit popular money transfer services like Zelle, Venmo, and Cash App during this period. As we enter 2023, it is crucial to be aware of potential threats and adopt preventive measures. Emily Mason's analysis serves as a wake-up call, urging users to exercise caution and be vigilant in protecting their accounts.

One of the prevalent scams involves Zelle, as reported by sources. Victims of Zelle scams find themselves ensnared in a web of financial deceit, with the aftermath often leaving them grappling for solutions. Refund scams, in particular, have become a cause for concern, prompting financial experts to emphasize the need for enhanced security measures and user education.

To fortify your defenses against identity theft and financial fraud, consider implementing the following recommendations:
  • Employ Robust Identity Theft Protection Services: Invest in reputable identity theft protection services that monitor your personal information across various online platforms.
  • Enable Two-Factor Authentication (2FA): Add an extra layer of security to your accounts by enabling 2FA. This additional step can thwart unauthorized access attempts.
  • Stay Informed and Vigilant: Keep abreast of the latest scams and fraud techniques. Awareness is your first line of defense.
  • Regularly Monitor Financial Statements: Review your bank and credit card statements regularly for any suspicious activity. Promptly report any discrepancies to your financial institution.
  • Educate Yourself on Common Scams: Familiarize yourself with the modus operandi of common scams, such as refund fraud and phishing attempts, to recognize and avoid potential threats.
Safeguarding your identity in the constantly changing world of digital transactions is a shared duty between users and the platforms they use. People can greatly lower their chance of being victims of identity theft and financial fraud by being informed and taking preventative action. As technology develops, maintaining the integrity of our personal data increasingly depends on taking a proactive approach to security.

Read more »
User Privacy
Banglore Cyber Security Data Privacy Investment fraud Law Enforcement Phising Attacks Scam User Privacy

Bengaluru Police Bust Rs 854 Crore Cyber Fraud

The Bengaluru Police have made significant progress in uncovering a sophisticated cyber investment fraud that involved an astonishing amount of Rs 854 crore. The study clarifies the complex network of mule accounts that was essential to carrying out this financial crime.

The cyber investment fraud, as reported by various news sources, involved the arrest of six individuals allegedly orchestrating the massive scam. The criminals exploited unsuspecting victims through promises of lucrative investment opportunities, ultimately siphoning off a colossal sum of money.

Mule accounts, a term less known to the general public, have emerged as a linchpin in cybercrime operations. These accounts act as intermediaries, facilitating the movement of illicit funds while providing a layer of anonymity for the perpetrators. The Bengaluru Police, in their diligent investigation, uncovered the intricate network of mule accounts that were instrumental in the success of this cyber investment fraud.

The criminals behind the fraud reportedly used a combination of advanced technology and social engineering tactics to lure victims into their scheme. Once hooked, the victims were persuaded to invest significant sums of money, which were then funneled through a complex web of mule accounts to conceal the illicit transactions. The scale and sophistication of this operation highlight the evolving nature of cybercrime and the challenges faced by law enforcement agencies in tackling such crimes.

The timely intervention of the Bengaluru Police showcases the importance of proactive measures in combating cybercrime. The investigation not only led to the arrest of the alleged perpetrators but also served as a wake-up call for individuals to exercise caution and due diligence in their online financial activities.

As the digital landscape continues to evolve, the need for cybersecurity awareness becomes more critical than ever. The Bengaluru case underscores the necessity for individuals, businesses, and law enforcement agencies to collaborate in developing robust cybersecurity measures. Education about the tactics employed by cybercriminals, such as the utilization of mule accounts, is crucial for staying one step ahead in the ongoing battle against online fraud.



Read more »
Social Media
Data Breach Goa Malicious actor Password Hacking Phising Attacks Scam senior citizens Sensitive Information Social Media

Protecting Goa's Seniors from Increasing Cyber Threats

Cybercrimes have increased alarmingly in recent years in Goa, primarily targeting elderly people who are more vulnerable. The number of cybercrime incidents in the state has been continuously increasing, according to reports from Herald Goa, raising concerns among the public and law enforcement.

Data from the Goa Police Department indicates a concerning rise in cases of cybercrime against senior citizens. Scammers frequently use sophisticated techniques to prey on this group's lack of digital literacy. To acquire unlawful access to private data and financial assets, they employ deceptive schemes, phishing emails, and bogus websites.

In an interview with Herald Goa, Inspector General of Police, Jaspal Singh, emphasized the need for enhanced awareness and education regarding online safety for senior citizens. He stated, "It is crucial for our senior citizens to be aware of the potential threats they face online. Education is our strongest weapon against cybercrime."

To address this issue, the Goa Police Department has compiled a comprehensive set of cybercrime prevention tips, available on their official website. These guidelines provide valuable insights into safeguarding personal information, recognizing phishing attempts, and securing online transactions.

Additionally, experts advise seniors to be cautious when sharing personal information on social media platforms. Cybercriminals often exploit oversharing tendencies to gather sensitive data, which can be used for malicious purposes. Individuals must exercise discretion and limit the information they disclose online.

Furthermore, the importance of strong, unique passwords cannot be overstated. A study conducted by cybersecurity firm Norton revealed that 65% of individuals use the same password for multiple accounts, making them vulnerable to hacking. Senior citizens are encouraged to create complex passwords and consider using password manager tools to enhance security.

The increasing number of cybercrimes in Goa that target senior folks highlights how urgent the problem is. It is essential to give priority to education, awareness, and preventative security measures to combat this expanding threat. Seniors can use the internet safely if they follow the advice for prevention and stay educated about potential risks. 
Read more »
Subscribe to: Posts (Atom)