Fake SBI Reward APK Targets Victims with Trojan via WhatsApp

January 20, 2025January 24, 2025 Anurag Gawande5 Comments

Cybercriminals continue to exploit unsuspecting users through cleverly crafted phishing campaigns. Recently, I encountered a forwarded message in a WhatsApp group that immediately raised suspicion. The message read as follows:

Dear Valued Customer,

Your SBI BANK 🏦 Reward Points (Rs 9980.00) will expire today. Now Redeem through SBI BANK🏦 REWARD App install & Claim Your Reward by Cash Deposit Your Account.

Thank-You 👇 team-SBI BANK

Attached to the message was an Android APK file, supposedly the “SBI BANK REWARD App,” which promised users a reward of Rs. 9980. Given the prevalence of similar scams, I decided to investigate the file’s legitimacy through static and dynamic analysis.

Initial Observations

Suspicious Language and Presentation:
- The message contained grammatical errors, with misspellings like “Value Customer” instead of “Valued Customer.”
- Overuse of emojis (🏦 and 👇) and inconsistent formatting further indicated it was likely a scam.
Hash Check:
- I extracted the file hash and searched for it on VirusTotal (VT) and Any.Run. Surprisingly, no results were available for this hash.
- This indicated that the file was either new or not widely distributed yet.

File Details

File Hash: 7f6e053f3551db9cb209fa5c05952a3e
File Type: Android .apk
File Size: 4.20MB
File Name: SBl REWARDZ POINT 1.apk

Static Analysis

Using JADX tool, I decompiled the APK to analyse its internal structure and code. Below are some findings:

Manifest Analysis

The APK requested excessive permissions, including access to SMS, Contacts, Call Logs, and Storage. These are common indicators of malicious intent.

The AndroidManifest.xml file revealed several critical points:

The manifest file defines activities and services such as BackgroundService, SmsReceiver, and BootBroadcastReceiver, which are typically used in malicious apps to intercept SMS and run processes at system boot.

Publicsuffixes.gz File

During the analysis, I found a file named publicsuffixes.gz. Upon extraction, it contained unrelated Chinese text, which did not directly link to the malicious APK but raised questions about the APK’s origin or development process.

Below is the translation of Chinese text from the publicsuffixes file.

The 1989 Tiananmen event was held in Beijing, capital of China, on July 28, 2013. The event was held on July 28, 2013. The 1989 event was held on July 28, 2013. The event was held on July 28, 2013. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and young people in the middle of the Yangtze River, and the rise of middle-aged and young people in the middle of the Yangtze River. The 10,000-square-foot (1,000-square-foot) 2,000-square-foot (1,000-square-foot) 2,000-square-foot (1,000-square-foot) 2,000-square-foot (1,000-square-foot) 4,000-square-foot (1,000-square-foot) 2,000-square-foot (1,000-square-foot) 4,000-square-foot (1,000-square-foot) The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and young people in Hong Kong, and also the rise of middle-aged and young people in Hong Kong. The 20th anniversary celebration of the founding of the Peoples' Republic of China, the 20th anniversary celebration of the founding of the Peoples' Republic of China, and the 20th anniversary celebration of the founding of the Peoples' Republic of China, will be held on the 14th of the 14th anniversary celebration of the founding of the Peoples' Republic of China. The 20th anniversary celebration of the founding of the Peoples' Republic of China, the 20th anniversary celebration of the founding of the Peoples' Republic of China, and the 20th anniversary celebration of the founding of the Peoples' Republic of China, will be held on the 21st anniversary of the founding of the Peoples' Republic of China. I sincerely hope that you will not be disappointed with the results of this project. I hope you will be happy with the results of this project. In this regard, the development of the industry has entered a new stage, and the development of the industry has entered a stage of rapid development. The 1984 World Cup has been held in Hong Kong since 1989. The 1984 World Cup has been held in Hong Kong since 1989. The 1984 World Cup has been held in Hong Kong since 1989. The 1984 World Cup has been held in Hong Kong since 1989. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and young people, and the rise of the middle-aged and young people. The wisdom of the people is the same as the practice of the traditional Chinese medicine. Customs of the West⹭Customs of the West⹭Customs of the West⹭Customs of the West⹭Customs of the West⹮Customs of the West⹮Customs of the West⹰Customs of the West⹲Customs of the West⹲Customs of the West⹳Customs of the West⹴Customs of the West⹴Customs of the West⹵Customs of the West⹵Customs of the West⹶Customs of the West⹺Customs of the West⹺Customs of the West⹺Customs of the West⹺Customs of the West⹮Customs of the West⹲Customs of the West⹤Customs of the West ⹢The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and young, and the rise of middle-aged and young people. It was a period of rapid development, and it was a period of rapid development. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and young people in Hong Kong, and also the rise of middle-aged and young people in Hong Kong. ⹯ The animal husbandry system is a system that allows animals to be picked up and eaten by locals. ⹯ The animal husbandry system is a system that allows animals to be picked up and eaten by locals. ⹯ The animal husbandry system is a system that allows animals to be picked up and eaten by locals. ⹯ In this regard, the development of the Internet has become a new trend, and the development of the Internet has become a new trend. In the future, the development of the Internet will continue to accelerate. The development of the Internet will continue to accelerate. ⹴The wisdom of the people is the wisdom of the people. The wisdom of the people is the wisdom of the people. The wisdom of the people is the wisdom of the people. The wisdom of the people is the wisdom of the people. Hunting 牶敩汬 considered捥⹡knock溇橩 contention玱慦晩挭捯湴牯 nitrogen 慥牯੡楲⹭畳 enemy洊慩狠敳੡楲 volume慦琮慥牯੡楲The scenery is the best. The lintel pile is the only one that has been built. The lintel pile is the only one that has been built. The lintel pile is the only one that has been built. The lintel pile is the only one that has been built. The lintel pile is the only one that has been built. I am alone, I am worried about my career, I am happy to be alone, I am alone.瀊怂楳 Zhuang浡⹴潫祯⹪怊怂楴愮怂楴愮橰੡歩瑡⹪瀊怂Step alone椤桯歫慩真⹪怊怂浵潫瑡⹮溇The 2014 World Economic Forum has selected 100 million nitrogen-containing foods and 10 million nitrogen-containing foods for sale in Hong Kong, the 2014 World Economic Forum, and the 2014 World Economic Forum. The enemy has a very strong sense of responsibility, and it is not easy to be irritated by the enemy. It is not easy to be irritated by the enemy. The 1988 Beijing International Expo was held in Beijing, and the 1988 Beijing International Expo was held in Beijing. The 1988 Beijing International Expo was held in Beijing, and the 1988 Beijing International Expo was held in Beijing. The 1988 Beijing International Expo was held in Beijing, and the 1988 Beijing International Expo was held in Beijing. The cup is the only cup that can be picked up by the owner. The cup is the only cup that can be picked up by the owner. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle class in Hong Kong, and also the rise of middle class values, including the middle class values of Hong Kong and Macau. The 1980s and 1990s, which was a very important era for the American people, saw the rise of the middle-aged man who was about to enter the country and become a model for the American people. The 1980s and 1990s, which was a very important era for the American people, saw the rise of the American people, and also saw the rise of the American people. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle class in the 1980s and 1990s, and also the rise of middle class values in the 1990s and 1990s. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged man, who was about to enter the city of Beijing and was known as the "Eighteenth Century". This was the first time the 1980s and 1990s had reached a peak of 1980s and 1990s. The material is made of natural materials, and the material is made of natural materials. The material is made of natural materials, and the material is made of natural materials. The bridge is the bridge between the two cities, and the bridge between the two cities is the bridge between the two cities. The 2020 Beijing International Airport has been a major port for the Chinese government to provide a variety of transportation services to the public, and the ... The gray house is the only one that can be restored ੡ash狞洴⹣tan੡灲敮浡present捬੡welding⹩把慱牥汬抔敡物畭⹭畳enemy把慱畩contamination⹩琊慲੡爮捯The 1980s and 1990s, which was a very important time for the American people, was a very important time for the American people. The 1980s and 1990s, which was a very important time for the American people, was a very important time for the American people. The 10,000 most common nitrogen-containing foods are found in the lungs, lungs, and lungs of animals. The 20th anniversary celebration of the founding of the Peoples' Republic of China, the 20th anniversary celebration of the founding of the Peoples' Republic of China, and the 20th anniversary celebration of the founding of the Peoples' Republic of China, have been held in the capital. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and elderly people, and also the rise of middle-aged and elderly people. The 100 most common words in English are used to describe the meaning of the word " ' ... The company has a unique business model, a unique business model, a unique business model, and a unique business model. The only thing you can do is to take a walk through the garden and learn about the garden.獡獳楮楯渮浵獥畭੡獳楳椮浵獥畭੡獳渮汫੡獳漮扪੡獳殍੡獳漮fold੡獳殮enemy⹯木੡獳殙੡獳漮杰੡獳漡੡獳殭੡獳殮੡獳漮湣੡獳漮੡獳棣楡瑥猊歭獯捩楯渮慥The tidal flat is the tidal flat of the gorge. The tidal flat is the tidal flat of the gorge. The tidal flat is the tidal flat of the gorge. The tidal flat is the tidal flat of the gorge. ⹢爊牮hunt杩⹫氪氪扮敹੡甊浵⹥甮潲朊恵洴楯元慵浵੡畤楢汥੡畤楯੡畤湥桡汮⹮溇慵杵獴潷⹰氊浵捴潷⹰氊浵据堂੡畲殮堂੡畲繤⹮溇慵牳歯札桯 dirt The 100 most common types of AIDS are found in the healthcare industry, and the 100 most common types of AIDS are found in the healthcare industry. I have been waiting for an hour for a while, and I have been waiting for an hour for a while. I have been waiting for an hour for a while, and I have been waiting for an hour for a while. We must ensure that every effort is made to ensure that the environment is healthy and that the people are happy. We must ensure that every effort is made to ensure that the environment is healthy and that the people are happy. The 1989 Tiananmen event was held at the 41st Beijing International Airport in Beijing, China, and it was held on the 4th Beijing International Airport in Beijing. The 1989 Tiananmen event was held at the 4th Beijing International Airport in Beijing, China, and it was held on the 4th Beijing International Airport in Beijing. The urn was full of ashes, and the urn was full of ashes. It was a very beautiful place, full of ashes, and it was very beautiful. It was a very beautiful place, full of ashes, and it was very beautiful. The 2014 National Development and Reform Commission has launched a series of targeted measures to improve the quality of life of enterprises and enterprises, and has also launched a series of targeted measures to improve the quality of life of enterprises. Independent business people should pay attention to the following aspects: The 1989 Tiananmen event was held in Beijing, capital of China, on July 28, 2012. The 1989 Tiananmen event was held in Beijing, capital of China, on July 28, 2012. The 1989 event was held in Beijing, capital of China, on July 28, 2012. The scenery is so beautiful that it can be seen that the scenery is so beautiful that it can be seen that the scenery is so beautiful that it can be seen that the scenery is so beautiful that it can be seen that the scenery is so beautiful that it can be seen that the scenery is so beautiful that it can be seen that The 20th anniversary celebration of the founding of the Peoples' Republic of China, was held on the 21st anniversary of the founding of the Peoples' Republic of China. It was held on the 21st anniversary of the founding of the Peoples' Republic of China, and it was held on the 21st anniversary of the founding of the Peoples' Republic of China. In this regard, the author has selected the following suggestions: In the future, the development of the industry will continue to accelerate, and the development of the industry will continue to accelerate. In the future, the development of the industry will continue to accelerate, and the development of the industry will continue to accelerate. ⹭畳敳扥敮楴� ... The 1984 World Cup has been held in Beijing for 10 years, and the 1984 World Cup has been held in Beijing for 10 years. The 20th anniversary celebration of the founding of the Peoples' Republic of China was held on the 21st of July in Beijing. The 20th anniversary celebration of the founding of the Peoples' Republic of China was held on the 21st of July in Beijing. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle class in the 1980s and 1990s, and also the rise of middle class values in the 1990s and 1990s. Tan ੢楺੢楺⹡琊Expansion of species慺੢楺⹢Wu Expansion of species捹੢楺⹤Quan of expansion of species ੢楺⹦樊Expansion of species杬੢楺⹩搊Expansion of species歩੢楺⹬猊 expand kind 浶੢楺⹭眊 expand kind 湩੢楺⹮爊expand fire ੢楺⹰氊expand kind 灲੢楺⹳猊expand Ma੢楺⹴爊The development of the industry has been continuously improved, and the development of the industry has been continuously improved. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle class in Hong Kong, and also the rise of middle class values, and also the rise of middle class values in the 1990s and 1990s. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle-aged and middle-aged man, and the rise of middle-aged and middle-aged women. It was a period of rapid development, and the rise of middle-aged and middle-aged women was a period of rapid development. The 1980s and 1990s, which was a period of rapid development, saw the rise of the middle class in Hong Kong, and also the rise of middle class values, such as the middle class values of Hong Kong and Macau. The bathtub is bathed in the hot spring water, and the hot spring water is bathed in the hot spring water. The hot spring water is bathed in the hot spring water, and the hot spring water is bathed in the hot spring water.

Strings Analysis

Hardcoded URLs were found pointing to command-and-control (C2) servers.
References to financial APIs and terms like “OTP” and “Banking” suggested a focus on stealing sensitive data.

libiotusintouch.cpp.so File

The file was decompiled using GHIDRA, revealing the following Remote URLs:

https://superherocloud.com
wss://socket.missyou9.in

The app sends detailed device information, including:

Device manufacturer and model
Android version
Mobile ID
SIM details
Mobile number

Additionally, I observed the name “Kritika” hardcoded in the log statements, potentially indicating the developer or a test/debugging artifact.

The following code snippet exemplifies the exfiltration of this data:

Dynamic Analysis

I executed the APK in a controlled environment using an Android emulator and monitored its behavior with HTTP Toolkit and Wireshark. Here’s what I uncovered:

Network Traffic

Analyzing network traffic with Wireshark revealed that, upon installation, the APK immediately established connections to previously identified URLs.

Communication via wss://socket.missyou9.in included the following parameters:

The persistent communication over WebSocket (wss://socket.missyou9.in) could be classified as beaconing behavior, as it periodically updates the server with device status and other details.

Keylogging Behavior

The application displayed phishing screens mimicking legitimate SBI login pages to harvest user credentials.

Upon providing information, it connects to superherocloud.com and upload the data.

Username, password and mobile number.
Profile password and DOB.
Full name, Account number and CIF.
Debit/Credit card number, Expiry date, CVV number and ATM pin.
OTP

Below screenshot refers to API calls captured during analyzing app.

The following code snippet submits device information to the endpoint: https://superherocloud.com/api/mobile/add.

After submitting the file to VirusTotal, it was flagged by 25 out of 67 antivirus engines as malicious. The detection names varied, but many indicated trojan-like behavior. The file’s VT analysis can be accessed here

Domains

The domain https://socket.missyou9.in was flagged by 2/94 vendors on VirusTotal, indicating potential malicious activity. Moreover, this domain is reportedly associated with other APKs impersonating different banking apps to conduct similar malicious campaigns. Also this domain is registered 5 month ago.

The domain https://superherocloud.com, used as the endpoint for exfiltrating device information, was registered only two months ago.
Despite its short lifespan, the domain has not yet been flagged as malicious on public threat intelligence platforms.

Implications of the Attack

This campaign is a clear attempt to steal sensitive user data, including banking credentials, debit/credit card information and OTPs, to perform fraudulent financial transactions. What makes it particularly dangerous is the exploitation of trust through the SBI branding and the urgency implied in the message.

Conclusion

This incident underscores the importance of vigilance in the face of cyber threats. While this particular APK was quickly identified as malicious, many others might slip through the cracks, targeting unsuspecting users. By raising awareness and adopting basic cybersecurity hygiene, we can mitigate the risks posed by such scams.

Stay safe and always think before you click!

[UPDATE]

I have uploaded the APK file to Malshare. You can download it using the link below.

SBl REWARDZ POINT 1.apk

Beware of “Your Account Has Been Hacked. You need to unlock” Scam Emails: Stay Safe Online

December 5, 2024 Anurag Gawande2 Comments

Scam emails claiming that your account has been hacked are alarmingly common. These emails exploit fear, embarrassment, and urgency to pressure victims into transferring money, often in the form of cryptocurrency. A common scam starts with the subject line: “Your account has been hacked. You need to unlock.”

What Does the Scam Look Like?

Subject: Your account has been hacked. You need to unlock

Sender: Billy Harrington <info@azurepavillion>

Hello!

I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.

Here is the sequence of events:

Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online).

I have easily managed to log in to your email account. One week later, I have already installed the Cobalt Strike "Malware" on the Operating Systems of all the devices you use to access your email.

It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple.

This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and all on it).

I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers.

I have access to all your messengers, social networks, emails, chat history, and contacts list.

My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software.

Likewise, I guess by now you understand why I have stayed undetected until this letter.

While gathering information about you, I have discovered that you are a big fan of adult websites.

You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure.

Well, I have managed to record a number of your dirty scenes and montaged a few videos, which show how you masturbate and reach orgasms.

If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, family, and relatives.

Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you. I also have no issue at all with making them available for public access (leaked and exposed all data).

General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. I guess you do not want that to happen.

Here is what you need to do - transfer the Bitcoin equivalent of 12000 USD to my Bitcoin account (that is rather a simple process, which you can check out online in case if you do not know how to do that).

Below is the Bitcoin account information (Bitcoin wallet):
1HLn1GNBvENxZH5r2mNAgEVwjySyRTZGKQ

Once the required amount is transferred to my account, I will proceed with deleting all those videos and disappear from your life once and for all.

Kindly ensure you complete the abovementioned transfer within 50 hours (2 days +).

I will receive a notification right after you open this email, hence the countdown will start.

Trust me, I am very careful, calculative and never make mistakes. If I discover that you shared this message with others, I will straight away proceed with making your private videos public.

Good luck!

Fake Claims of Hacking
The scammer alleges that they have gained access to your email account and devices through malware or by purchasing access from other hackers.
Threats to Expose Sensitive Information
They claim to have recorded compromising activities (often fabricated) using your webcam or other devices and threaten to share this material with your contacts.
Demand for Payment
The email demands a payment, typically in Bitcoin, to prevent the supposed release of your private information. A countdown is often given to create urgency.
Technical Details to Appear Credible
The email may mention malware like “Cobalt Strike” or other tools to intimidate recipients and make the threat seem legitimate.
Warnings Against Reporting
Scammers caution victims against sharing the email with anyone, claiming they will release the sensitive information if the email is reported.

What is Cobalt Strike?

Cobalt Strike is a cybersecurity tool designed for penetration testing. It helps security professionals simulate real-world cyberattacks to test the resilience of networks. The software provides features like payload generation, command and control (C2) communication, and post-exploitation tools to mimic the actions of hackers.

However, cybercriminals often misuse it for malicious purposes. They use Cobalt Strike to deliver malware, maintain access to compromised systems, and exfiltrate data. Its stealth features, such as evading detection by antivirus software, make it a popular choice among attackers. Originally meant for ethical hacking, it highlights the fine line between testing defenses and exploiting vulnerabilities.

Email Header Analysis

Understanding email headers is crucial for identifying the source of scam emails. Here’s an analysis of the header details from the scam email:

Source Server: The email originated from static-185-95-84-74.sunucuhub.com with the IP address 185.95.84.74. This server appears to belong to a suspicious or unverified host.

Helo Address: The sender’s system introduced itself as static-84-74.corelux.net, which may be a fake or compromised server.

Relaying Server: The email was relayed through vps2.webfruit.space using secure email transmission (esmtpsa) with TLS encryption (TLS1.2).

Envelope Sender: The email claims to be from <info@azurpavillon.com>, but this could easily be spoofed.

Sender IP address VirusTotal Score: 8/94

The sender’s IP address, 185.95.84.74, has a VirusTotal score of 8/94, indicating that 8 out of 94 security vendors flagged it as malicious or suspicious. A score of 8 is a strong indication that this IP is associated with potentially harmful activities, such as phishing or malware distribution. This reinforces the likelihood that the email is part of a scam. Always verify suspicious IP addresses using tools like VirusTotal to assess their reputation and avoid engaging with emails originating from flagged sources.

Why You Shouldn’t Fall for It

No Evidence of Actual Hacking
The email lacks concrete proof, such as a specific password or verifiable detail about you. The threats are generic and designed to instill fear.
Claims Are Technically Improbable
- Modern operating systems and antivirus software make it difficult for malware to remain undetected for months as described.
- Webcam access typically requires explicit permission, making the claims of recorded activities suspect.
Bitcoin Transactions Are Irrecoverable
Scammers use cryptocurrency because it is hard to trace and impossible to reverse once sent.

What to Do If You Receive Such an Email

Step 1: Do Not Panic
Remember, this email is likely a phishing attempt and not evidence of an actual security breach.

Step 2: Do Not Reply or Pay
Responding or paying only validates your email address as active, making you a target for future scams.

Step 3: Verify Your Account Security

Change your email password and enable two-factor authentication (2FA).
Scan your devices with updated antivirus software to ensure no malware is present.

Step 4: Blog the Sender
Mark the email as spam and block the sender’s address.

Bitcoin Wallet Address

The Bitcoin address provided in the scam email has been verified and shows no transactions to date. This suggests that the scammer’s attempt to extort money may not have been successful yet. It is also possible that the scammer is using this address as part of a broader campaign, hoping to intimidate multiple victims into making payments. The absence of transactions does not diminish the threat, as such tactics are designed to exploit fear and urgency. Verifying cryptocurrency addresses can provide insights into scam campaigns, and reporting them helps prevent potential victims from falling into the trap.

Final Thoughts

Scam emails like “Your account has been hacked. You need to unlock” prey on fear and lack of technical knowledge. Staying calm, taking practical steps, and understanding how these scams operate can protect you from falling victim. Always prioritise account security, and never hesitate to report scams to the authorities. Stay safe online!

Understanding and Identifying a Common Phishing Scam: “Your Device is Hacked”

November 13, 2024 Anurag Gawande2 Comments

Phishing emails continue to be a common and sophisticated way for cybercriminals to extort money and sensitive information from unsuspecting individuals. A recent example is an alarming email with the subject line “Your device is hacked,” which tries to create panic, demanding a Bitcoin payment to avoid further consequences.

Subject: Your device is hacked
 
Good day!

I have to bring something urgent to your notice - you are facing a major challenge. However do not worry just yet; I want you to hear me out, because there's invariably a way to resolution.

Right at this moment, you are subject to the examination of an global web of intruders, and that is a condition that infrequently ends favorably for anyone participating. You may have been informed of groups like Anonymous, nevertheless I guarantee you, we're working on an completely different scale - far beyond what they can offer. Our vast global community comprises countless of proficient experts, each playing a critical role.

Some of our team concentrate on breaching corporate and state systems, while others work stealthily with security agencies on classified missions. My role involves addressing issues tied to clients like you, which is why I am reaching out now.

You might be pondering, "Who are these individuals?" The response is clear: we're concentrated on those with a penchant for alternative and contentious mature content - material that many would deem unsuitable. Nevertheless evidently, you don't fit that type, right?

Allow me to elucidate how I found out this circumstance. A few of weeks ago, we installed stealthy spyware on your device, allowing us access to each your gadgets, including your cellular device. It was straightforward; one of those seemingly harmless pop-ups on private sites served as our entry point.

The good news is you still have a chance to take command of this issue. Let's discuss how you can guard yourself and regain your mental tranquility. Your next moves matter - act intelligently.

We both understand that many people engage in common or even more severe adult content - nothing uniquely unique about that. Nevertheless, the content you've decided to watch transcends a threshold into troubling area.

We've accessed your mobile device and laptop cameras and captured footage of you engaging in acts that are quite debatable. This includes intimate images of you along with the explicit material you were observing.

But remember, there's invariably a path to redemption, including for those who've wandered far. Today, you are blessed because my purpose isn't to inflict pain; I'm simply concentrated on a financial resolution.

This is an opportunity for you to assert control of the situation. Let's talk about how we can resolve this issue cordially.

Here is your rescue: you need to convey $1300 USD in Bitcoin to this digital currency address:
1JxQSshVKAqB9JxuUjmdEDrPN6TM7PzK9D

Let's confront it, that's a fairly insignificant sum in today's society.

I'm reaching out you with an urgent communication that demands your swift attention. You have just 12 hours to complete the payment. Do not delay - act now to safeguard yourself.

As soon as I receive of your transaction, I'll without delay remove all compromising content and fully turn off our computer system. I guarantee you, I honor my promises, even with those who may not fully earn confidence; this is strictly professional.

Nevertheless, if compensation is not received, I will be forced with no choice however to share the damaging videos with everyone in your network - companions, kin, coworkers, associates - everybody. Imagine the unrecoverable damage to your image. This is a blemish that can not ever be fully removed.

The outcomes of doing nothing will not only blemish your identity but could bring you to a point of hopelessness. It is essential to act swiftly.

If you're unfamiliar with digital currency, don't fret - it is easy. A quick search for "cryptocurrency marketplace" will show you how to complete a payment using your credit card. Given your virtual presence, you seem able of handling this with simplicity. Keep in mind, if you've competently traversed the depths of the online world before, this will be no hurdle for you.

Some key reminiscents to reflect on:

- Don't reply to this e-mail. This address is disposable, and any feedback will serve no function.

- Forget about law enforcement. The moment I detect any communication to the police, I will release the data without hesitation.

- Do not attempt to restore or dispose of your gadgets. Such steps are ineffective. My monitoring capabilities mean that I can track your all step.

- It's unfortunate that conditions have brought us here; you could have prevented this situation with more caution online. Be mindful in the future - what seems trivial today can have disastrous consequences tomorrow.

This message is intended as a last notification. Your response in the next 12 hours will determine the consequence of this situation.

Remember, the countdown is running, and the decision is in your control.


Postscript:

If your friends and colleagues were to discover the unethical things you engage in, it could severely harm your relationships and standing. Faith, once damaged, is hard to rebuild, and you might be viewed through a filter of criticism and confusion. This exposure could lead to social isolation, as people may distance themselves from you, being concerned about connection with your behaviors. The taint associated with atypical actions may cause isolation, misinterpretations, or even a damaged image that could hinder your profession possibilities. It is essential to think about the long-term effect this could have on your existence and the connections you value.

In this blog, let’s break down this email and highlight key indicators that mark it as a phishing scam. Recognizing these elements can help you identify similar threats and protect your digital safety.

1. Emotional Manipulation and Psychological Triggers

The first tactic cybercriminals employ is fear. By threatening exposure or embarrassment, they manipulate emotions to push victims into hurried actions. This email opens with an intimidating statement: “you are facing a major challenge.” It follows up with false claims about an elaborate network of hackers monitoring your devices, pushing the recipient into a state of urgency and vulnerability.

2. Specific, Yet General Accusations

The email insinuates that it has incriminating content recorded from the victim’s devices, which could be used for public exposure. However, no specific details or personal information are provided, a common tactic in phishing schemes to keep the accusation vague but ominous. The email accuses the recipient of accessing “controversial mature content” without citing any actual details, casting a wide net to increase its chances of striking fear in potential victims.

3. Unverifiable Technical Claims

Phishing scams often include technical jargon or exaggerated claims to make the message sound more credible. This email alleges that “spyware” was installed through “harmless pop-ups” and implies constant monitoring of all devices. In reality, no malicious software can be this all-encompassing or omniscient. Malware usually requires direct or indirect user permission, such as through a fake download or link, to infiltrate systems.

4. Demand for Payment in Bitcoin

Most phishing emails demand payment in Bitcoin, as cryptocurrency transactions are anonymous and difficult to trace. Here, the email demands $1,300 in Bitcoin within 12 hours, setting a time frame that plays on urgency and limits a recipient’s chances to think critically or consult others.

The specified BTC address has not shown any transactions to date, which thankfully indicates no victims so far.

5. Warnings Against Law Enforcement and No Replies

The sender advises against contacting the police or even responding to the email. By isolating the victim from potential help, the scammer creates a psychological barrier, further increasing the chances of compliance. Additionally, they specify that the email is from a “disposable address,” which reinforces that any reply will be futile.

6. Technical Red Flags in the Email Header and Sender Information

A quick analysis of the email header and sender address reveals additional signs of phishing. Although the sender appears as “Lewis Ray info[@]pdparis.com,” the header details a different server (hostglobal.plus) and an untrustworthy IP address with a VirusTotal score of 10/94. This indicates that the IP has previously been associated with malicious activity, solidifying suspicions that this email is not legitimate.

The email header above indicates that the message was received from IP address 78[.]153[.]140[.]175, which has a VirusTotal score of 10/94.

Protective Steps to Take

Do Not Reply or Pay: Responding or paying emboldens attackers and makes you a potential target for future scams.
Check Your Security: Ensure that your antivirus and software updates are current. Run scans to ensure no malware or spyware is on your devices.
Educate and Stay Vigilant: Familiarize yourself with common phishing tactics and educate family or colleagues who may be less aware of cybersecurity risks.

Final Thoughts

Emails like this serve as a reminder of the importance of staying informed about phishing tactics and practicing good cyber hygiene. By recognizing the tactics outlined in this scam email, you can better protect yourself and avoid falling victim to extortion attempts. Remember, if something feels suspicious, it probably is—take a moment to verify, breathe, and never rush to respond to threats like these.

Beware of the “India Post 170th Anniversary” WhatsApp Scam

November 11, 2024 Anurag Gawande2 Comments

Recently, a new phishing scam has been circulating on WhatsApp, claiming to celebrate the “India Post 170th Anniversary.” The message includes a shortened URL, such as https://tinyurl.com/lndiaPost-1164

which redirects unsuspecting users to a fraudulent website: https://indiapost37.pages.dev/22602976.

This website impersonates India Post, one of India’s largest postal networks, in an attempt to steal users’ personal information. Here’s a breakdown of how the scam works and how to stay protected:

How the Scam Works

The Message: It starts with a WhatsApp message claiming that India Post is celebrating its 170th anniversary with special prizes. This message contains a shortened link that appears legitimate at first glance, using the name “India Post” to gain trust.
The Phishing Website: Once the link is opened, it redirects to a webpage mimicking the official India Post website, complete with logos and branding. However, this page is hosted on a suspicious domain (pages.dev), which is a clear red flag that it is not an official India Post site.
Fake Questionnaire: The page presents users with simple questions such as:
- What is your age?
- What is your gender?
- Do you know about India Post?

The goal here is to keep the user engaged while also making the scam seem more legitimate.

4. “Prize” Announcement: After answering the questions, users are prompted with a pop-up claiming they have won a large amount of money—typically in the range of INR 62,478.55. This is an attempt to excite users and push them to the next step, which involves sharing more sensitive information.

5. Request for Personal Information: To claim the so-called prize, users are then asked to provide personal details such as their email address and mobile number. This is the final stage where the scammers collect information that could be used for future phishing attacks, identity theft, or selling the data to other cybercriminals.

Key Red Flags to Recognize the Scam

Unfamiliar Domain Name: The genuine India Post website domain is indiapost.gov.in. Any other domain should be considered suspicious.
Requests for Personal Information: Government institutions rarely ask for personal details through unsolicited messages or unverified websites.
Too Good to Be True Prizes: Randomly winning large sums of money without prior participation is a classic sign of a scam.

To further investigate the legitimacy of these URLs, we can utilize VirusTotal, an online tool for checking websites and files for potential threats. Upon submitting both URLs

https://tinyurl.com/lndiaPost-1164 and https://indiapost37.pages.dev/2260297 VirusTotal scans them against multiple security databases and provides a report with detailed insights. In this case, the report reveals that both URLs have been flagged by several security vendors as malicious or phishing sites. Screenshots from VirusTotal show clear warnings of suspicious behavior, confirming that these URLs are designed to deceive users into revealing personal information. This evidence underscores the importance of checking untrusted links on reputable scanning platforms before clicking them.

How to Stay Safe

Avoid Clicking Suspicious Links: Never click on links sent from unknown numbers, especially those that seem promotional or too good to be true.
Verify with Official Sources: Go directly to the official India Post website (indiapost.gov.in) or contact them directly to confirm any offers.
Report Phishing Attempts: If you receive such a message, report it on WhatsApp and avoid forwarding it to others.
Educate Others: Share this information with friends and family to prevent them from falling victim to similar scams.

Conclusion

Phishing scams like these take advantage of people’s trust and curiosity. By staying alert and following best practices online, you can avoid falling prey to such fraudulent schemes. Always verify links and offers directly with official organizations and be cautious of any request for personal information from unverified sources.

Stay safe and share awareness—your vigilance is your best defense!

Reference:

Any.run Report on the analysis

Instagram Phishing Email: We detected a new login into your Instagram account

October 4, 2024 Anurag Gawande2 Comments

How to Spot the Phishing Email Right Away

The first red flag in this scam is that the email doesn’t come from an official Instagram domain. Instead, the message is sent via an unfamiliar email address that is clearly not affiliated with Instagram. A legitimate email from Instagram will come from an official domain like @mail.instagram.com or similar. If you notice the sender’s email address is strange or not even remotely related to Instagram, it’s a phishing attempt.

Email Body: Suspicious Links and No Mention of Account Details

This phishing email didn’t mention Instagram username, the location of the alleged login, or any details expected from a real alert.

Moreover, the email typically contains links urging you to “Send Password Request” and “Not My Request“. Instead of leading to Instagram’s official site, the link is a mailto: link with several email addresses, which is highly suspicious. No legitimate company, let alone Instagram, would handle account security issues this way.

Upon reviewing the email header, I noticed that it was sent from 144 . 76 . 133 . 106 (Germany).

And all the email addresses were listed in the mailto: field.

Key Red Flags of the Phishing Email

Unfamiliar Email Address: Always check the sender’s email address. Phishing emails usually come from random addresses that don’t resemble official Instagram domains.
No Mention of Your Account: The email fails to specify which Instagram account is affected. A legitimate alert would always include details such as your account username, device, or location of the suspicious activity.
Suspicious Links: The email includes odd links (often mailto: links with multiple email addresses) instead of leading to Instagram’s official help page or security center.
Generic Greeting: Phishing emails often use non-personal greetings like “Dear User” or “Hello Instagram User” instead of addressing you by your actual name or username.
Pressure Tactics: The email urges immediate action to “secure your account,” but provides no credible way to verify the login attempt through legitimate channels.