INJ3CTOR3 installer steals PBX secrets for calls after cleanup

INJ3CTOR3’s updated installer uploads PBX and mail secrets so billed calls can continue after a cleaned host.

Cyble’s review of September 2026 staging-server artifacts says INJ3CTOR3’s k.php installer on FreePBX, Issabel, and Elastix uploads 17 files—SIP trunk, AMI, database, and mail-relay credentials—to two hosts about once a minute. Stolen trunk secrets can place billed calls from outside a cleaned or rebuilt PBX unless the carrier restricts source addresses, unlike earlier JOMANGY webshell calling. The webshell, encoding, and persistence are largely unchanged; watermarks and an MD5 gate hash were rotated, and an admin password reset does not end a forged FreePBX session. Researchers recovered the upload commands but did not capture live exfiltration or a victim list. Cyble says trunks written under /etc/asterisk stay hidden from the FreePBX console; GBHackers and Cyber Security News say a hidden trunk was not observed in this campaign.