Lookout recently discovered an advanced phishing kit exhibiting novel tactics to target cryptocurrency platforms as well as the Federal Communications Commission (FCC) via mobile devices. Following the tactics of groups like Scattered Spider, this kit enables attackers to build carbon copies of single sign-on (SSO) pages, then use a combination of email, SMS, and voice phishing to trick the target into sharing usernames, passwords, password reset URLs and even photo IDs from hundreds of victims, mostly in the United States.…
Author: Lookout
What is Infamous Chisel?
Read More
Infamous Chisel is a collection of surveillance tooling used to target Android devices. It was first reported by the Ukrainian Security Service (SBU) in early August 2023 and attributed to Russia’s Sandworm APT. According to the SBU, the main purpose of this toolset was to collect information from Android devices likely connected to Ukrainian military information systems during the Russia-Ukraine war.…
What is Robin Banks Phishing as a Service
Read More
Robin Banks is a phishing as a service (PhaaS) that was discovered by IronNet in July 2022 [and has been active as recently as September 2023]. It is a platform that sells phishing kits for deployment. Since the most recent reporting in November 2022, Robin Banks has largely been unnoticed.…
Summary
The BadBazaar malware family is tied to Chinese hacking group APT15.
In January 2024, Lookout published an in-depth analysis of the iOS variant of BadBazaar.
Previously, Lookout researchers uncovered the Android version in November 2022.
BadBazaar, alongside MOONSHINE spyware, have been known to target Tibetan and Uyghur minorities within China.…
Read More
What are WyrmSpy and DragonEgg surveillanceware?
Read More
WyrmSpy and DragonEgg are two advanced Android surveillanceware that Lookout attributes to high-profile Chinese threat group APT41, also known as Double Dragon, BARIUM, and Winnti.
While APT41 is mostly known for exploiting web-facing applications and infiltrating traditional endpoint devices, these malware are rare reported instances of the group exploiting mobile platforms.…
Researchers at Lookout have discovered a new Android surveillance tool which we attribute with moderate confidence to the Law Enforcement Command of the Islamic Republic of Iran (FARAJA). Named BouldSpy for the “BoulderApplication” class which configures the tool’s command and control (C2), we have been tracking the spyware since March 2020.…