Fraudsters use open-banking links to test stolen cards, Group-IB says
Group-IB says a spend platform paid aggregator fees while attackers checked credentials and phished via its own notices.
1
Stories per day · 30 days
4 RSS
Relatedkeylogger2kgb-rat2njrat2rat2classiscam1credential-stuffing1credential-theft1cryptoclipper1malware-as-a-service1open-banking1phishing1poshmark1ransomware1windows1
26 stories, newest first · one card per story
Stories tagged #group-ib
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.
KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading
ASOS says names and contact details may have been accessed after rogue customer notifications; broader hack claims remain unproven.
4
Fake brand discounts on social media prey on shoppers’ fear of missing out
Group-IB details the Milk Dragon phishing kit using fake social-media discounts to steal payment cards and 3DS one-time passwords across 66 countries.
3
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
3
New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs
RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.
1
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
4
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
3
.jpg&w=828&q=75)
New RemControl Android banking malware targets users in Europe and Canada
New RemControl Android banking MaaS steals credentials via 30+ phishing overlays targeting Europe, Canada, and the Middle East.
3
Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware
Group-IB links HEAVYGRAM, a Telegram-based Windows surveillance backdoor targeting Iranian dissidents and journalists since 2023, to the Handala Hack group with moderate confidence.
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
1
Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
2
Android malware creates a hidden copy of your banking app
Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.
2
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
5
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
5
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
3
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
1
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.
Outsider Phishing Kit Survives Takedown With 700 New Pages
Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.
Iran-linked hackers expand infrastructure across Europe and Middle East, report says
Group-IB found Iran-linked Tortoiseshell expanding command-and-control infrastructure into the UK, Belgium, Saudi Arabia and the UAE with new malware tooling.
Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel
Group-IB uncovered new infrastructure linked to the Tortoiseshell threat actor, including an additional backdoor and an SSH tunneling tool.