INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
64
Product
Asterisk
- Mentions · 7d2
- Mentions · 30d2
- All mentions4
- First seenSep 2, 2026
- Last mentioned1d ago
Timeline
4 articles · newest firstINJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
74
Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.
58
Related CVEs
by mentions- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-890263%9.3Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework
Appears with
- Sangomavendor · 2
- INJ3CTOR3malware · 2
- FreePBXproduct · 2
- Elastixproduct · 2
- ZenharRmalware · 2
- Postfixproduct · 2
- JOMANGYmalware · 2
- Issabelproduct · 2
- Fortinetorganization · 1
- Check Pointorganization · 1
- Defused Cybervendor · 1
- Unit 42organization · 1
- VulnCheckvendor · 1
- Shadowserver Foundationvendor · 1
- Horizon3organization · 1
- Horizon3vendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.