INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
Original title: INJ3CTOR3 Malware Steals FreePBX Credentials to Enable Fraudulent Calls Even After Server Cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
Cyble says INJ3CTOR3’s updated k.php installer on FreePBX, Issabel, and Elastix repeatedly exports configuration secrets to two staging servers. Stolen SIP trunk credentials can let operators place billed calls from outside the cleaned PBX, unlike earlier JOMANGY webshell calling. The JOMANGY panel and multiple persistence paths remain, and an admin password reset does not close a forged FreePBX session. Researchers recovered upload commands but did not capture live exfiltration or a victim list.
Unconfirmed: Cyble demonstrated collection capability but did not capture live exfiltration or a victim list.
- Three cron beacons run the installer every minute.
- Uploads go to /hima_data/index.php on 45.95.147.178 and 160.119.69.4.
- Targets include SIP, PJSIP, manager.conf, database passwords, and Postfix sasl_passwd.
- JOMANGY and ZenharR share a rotated MD5 authentication gate.
- Hidden Asterisk trunks were shown in a lab, not observed in this campaign.
Impact: Stolen SIP and mail credentials used for billed calls
| Product | Affected |
|---|---|
| FreePBX | — |
| Issabel | — |
| Elastix | — |
- 1.Isolate affected systems and block both staging IP addresses.
- 2.Remove all persistence before rotating PBX and carrier secrets.
- 3.Investigate outbound HTTP POSTs to /hima_data/ and unfamiliar trunk registrations.
- ATT&CK
- T1552.001 Credentials In FilesT1053.003 CronT1505.003 Web ShellT1041 Exfiltration Over C2 Channel
- Organizations
- CybleCheck PointUnit 42Fortinet
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 160.119.69.4 | Source : Cyble). Plain-text download commands now reference 160[.]119[.]69[.]4, while encoded persistence commands retain 45[.]95[.] |
| ipv4 | 45.95.147.178 | pied elsewhere. Indicators of Compromise Value Type Context 45[.]95[.]147[.]178 IPv4 Staging host since April 160[.]119[.]69[.]4 IPv4 |
| url | http://160.119.69.4/hima_data/index.php | 47[.]178/hima_data/index.php URL Credential upload endpoint hxxp://160[.]119[.]69[.]4/hima_data/index.php URL Credential upload endpoint Note: IP addresses and |
| url | http://45.95.147.178/hima_data/index.php | [.]4 IPv4 Second staging host and credential collector, new hxxp://45[.]95[.]147[.]178/hima_data/index.php URL Credential upload endpoint hxxp://160[.]119[.]69[ |
From the original article
3 min read at gbhackers.com
INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft, letting attackers keep billing unauthorized calls to victims even after infected servers are cleaned. September 2026 artifacts described in the supplied research show the installer targeting 17 configuration files containing telephony, database, management, and mail-relay secrets.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.