CampaignPublished 6 Oct 2025

SecuritySnack: 18+E-Crime

Source AlienVault OTX General

Description

A financially motivated cybercrime operation has been identified, targeting users with over 80 spoofed domain names and lure websites. The campaign, which began in September 2024, focuses on government tax sites, consumer banking, age 18+ social media content, and Windows assistant applications. The actors use these domains to deliver Android and Windows trojans, likely for credential theft. The operation employs common techniques such as spoofed domains and lure websites, prioritizing scale and conversion rates over technical sophistication. The most common lures exploit curiosity and desire, making victims less likely to report infections. Users are advised to be cautious when encountering unfamiliar links or download prompts.

Impact

For European organizations, the impact of this campaign can be significant, particularly for government agencies managing tax services and financial institutions offering consumer banking. Credential theft can lead to unauthorized access to sensitive financial and personal data, resulting in financial losses, reputational damage, and regulatory penalties under GDPR. The targeting of Windows assistant applications and Android devices broadens the attack surface, potentially affecting both enterprise and consumer users. The use of adult content as a lure may increase infection rates among certain demographics, complicating incident response due to underreporting. The campaign’s scale and use of numerous spoofed domains can overwhelm security monitoring and increase the risk of successful phishing attempts. Additionally, the theft of credentials can facilitate further attacks such as account takeover, fraud, and lateral movement within networks. The campaign’s medium severity reflects moderate technical complexity but high potential for widespread impact due to social engineering effectiveness.

Defensive guidance

European organizations should implement multi-layered defenses tailored to this campaign’s tactics. Specific recommendations include: 1) Deploy advanced email and web filtering solutions capable of detecting and blocking spoofed domains and phishing URLs, leveraging threat intelligence feeds that include the identified 80+ spoofed domains. 2) Conduct targeted user awareness training focusing on recognizing social engineering tactics related to financial and adult content lures, emphasizing caution with unsolicited links and downloads. 3) Implement endpoint detection and response (EDR) tools with capabilities to detect trojan behaviors on both Windows and Android devices, including monitoring for credential theft indicators. 4) Monitor DNS traffic for suspicious domain queries and employ domain reputation services to identify and block access to known malicious spoofed domains. 5) Enforce strong multi-factor authentication (MFA) on all critical systems, especially government tax and banking portals, to mitigate the impact of credential compromise. 6) Collaborate with domain registrars and law enforcement to take down malicious spoofed domains promptly. 7) Regularly update and patch all systems and applications to reduce the attack surface, even though this campaign primarily exploits social engineering. 8) Establish incident response procedures that include rapid containment and forensic analysis of infections linked to this campaign.

Indicators of compromise

Domains 140

11windows.pro
18pllus-tiktok.pro
18tiktok-get.pro
adac-banklnq-solarlsqroup.com
admin-octorate.icu
alphazone.icu
alveriq.run
americanfiscalroots.digital
app-degiro.life
app-lodgify.today

Hashes 3

3767140145cef85204ddec1285f5dc8544bfcf8ff22318c11073baaa476385fc
71cd466073bf23b43111dbc68ccaf1064e737f3f9ffebfec9a6f5146af6a34b9
a83a442f930fea310d391f852385e3673d8c7128e5bbdc2b68217838c78381fa

Email addresses 10

feleko2722@replyloop.com
host_sdji21cxvmj12@dropjar.com
lux_47_jkscnxkjasd@fviainboxes.com
lux_49_kcsdfer321@fviainboxes.com
lux_bl_20_ilskdfgnoi_reg@fviainboxes.com
lux_bl_21_sdfgsun_reg@fviainboxes.com
lux_bl_22_fdjhgza_reg@fviainboxes.com
pq-black234333123@clowmail.com
pq_bl_6_safs_sssw@fviainboxes.com
zapuwo3736@robot-mail.com

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Oct 2025, 11:28 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 140

Hashes 3

Email addresses 10

Community reviews

Related threats