Category Archives: Web Fraud 2.0

Karma Catches Up to Global Phishing Service 16Shop

Posted on by

You’ve probably never heard of “16Shop,” but there’s a good chance someone using it has tried to phish you.

Last week, the international police organization INTERPOL said it had shuttered the notorious 16Shop, a popular phishing-as-a-service platform launched in 2017 that made it simple for even complete novices to conduct complex and convincing phishing scams. INTERPOL said authorities in Indonesia arrested the 21-year-old proprietor and one of his alleged facilitators, and that a third suspect was apprehended in Japan. Continue reading Karma Catches Up to Global Phishing Service 16Shop→

Teach a Man to Phish and He’s Set for Life

Posted on by

One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn, or abusing an encoding method that makes it easy to disguise booby-trapped Microsoft Windows files as relatively harmless documents. Continue reading Teach a Man to Phish and He’s Set for Life→

How Malicious Android Apps Slip Into Disguise

Posted on by

Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into benign mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. Continue reading How Malicious Android Apps Slip Into Disguise→

Who and What is Behind the Malware Proxy Service SocksEscort?

Posted on by

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort, which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. Continue reading Who and What is Behind the Malware Proxy Service SocksEscort?→

SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool

Posted on by

The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details about recent orders, and warned that those orders wouldn’t be shipped unless the customer paid an added delivery fee. Continue reading SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool→

Why Malware Crypting Services Deserve More Scrutiny

Posted on by

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. In fact, the process of “crypting” malware is sufficiently complex and time-consuming that most serious cybercrooks will outsource this critical function to a handful of trusted third parties. This story explores the history and identity behind Cryptor[.]biz, a long-running crypting service that is trusted by some of the biggest names in cybercrime. Continue reading Why Malware Crypting Services Deserve More Scrutiny→

Service Rents Email Addresses for Account Signups

Posted on by

One of the most expensive aspects of any cybercriminal operation is the time and effort it takes to create large numbers of new throwaway email accounts. Now a new service offers to help dramatically cut costs associated with large-scale spam and account creation campaigns, by paying people to sell their email account credentials and letting customers temporarily rent access to a vast pool of established accounts at major providers. Continue reading Service Rents Email Addresses for Account Signups→

Discord Admins Hacked by Malicious Bookmarks

Posted on by

A number of Discord communities focused on cryptocurrency have been hacked this past month after their administrators were tricked into running malicious Javascript code disguised as a Web browser bookmark. Continue reading Discord Admins Hacked by Malicious Bookmarks→

Interview With a Crypto Scam Investment Spammer

Posted on by

Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. What follows is an interview with a Russian hacker responsible for a series of aggressive crypto spam campaigns that recently prompted several large Mastodon communities to temporarily halt new registrations. According to the hacker, their spam software has been in private use until the last few weeks, when it was released as open source code. Continue reading Interview With a Crypto Scam Investment Spammer→

Giving a Face to the Malware Proxy Service ‘Faceless’

Posted on by

For the past seven years, a malware-based proxy service known as “Faceless” has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. In this post we’ll examine clues left behind over the past decade by the proprietor of Faceless, including some that may help put a face to the name. Continue reading Giving a Face to the Malware Proxy Service ‘Faceless’→