45
30
30
45
45
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.
60
30
30
30
30
45
30
45
30
30
Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.
60
30
30
30
30
30
30
30
30
45
30
30
30
WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
Group-IB details WindRelay, a new Android NFC relay malware paired with SpyNote RAT to relay card data live for contactless payment fraud and loans.
Group-IB identified WindRelay, a previously unseen Android near-field-communication relay malware first seen in the wild in late August 2025, deployed alongside the SpyNote RAT in a contactless payment fraud scheme. Victims are lured via personalized phishing, smishing, or vishing into sideloading an app; SpyNote's Accessibility access silently installs WindRelay, whose reader component captures live EMV APDU card data over NFC and relays it via WebSocket C2 to an emulator component at a payment terminal. The scheme enables dual monetization: RAT-driven remote access to take out digital loans and NFC relay for physical card-present cashouts, known as Ghost Tap. Twenty-three WindRelay samples uploaded to VirusTotal between November 2025 and July 2026 impersonate financial institutions in Czechia, Slovakia, and Slovenia, with the technique also spreading to Brazil and Poland.
56
30
30
30
30
45
30
30
30
30
45