INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
64
Malware
INJ3CTOR3
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 29, 2026
- Last mentioned1d ago
Timeline
2 articles · newest firstINJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
Appears with
- Issabelproduct · 2
- Elastixproduct · 2
- Asteriskproduct · 2
- FreePBXproduct · 2
- ZenharRmalware · 2
- Postfixproduct · 2
- JOMANGYmalware · 2
- Unit 42organization · 1
- Cybleorganization · 1
- EncystPHPmalware · 1
- Fortinetorganization · 1
- Check Pointorganization · 1
- Sangomavendor · 1
- Cyble Research & Intelligence Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.