Threats Affecting South Africa

GoldDigger is a sophisticated Android banking trojan targeting mobile banking users primarily in South Africa and Europe, with indications of plans for global expansion. It uses advanced evasion techniques such as a custom packer, anti-debugging, and Frida detection. The malware disguises itself as legitimate airline and shopping apps to deceive victims. It abuses Android Accessibility services to steal credentials, intercept SMS-based two-factor authentication, and perform unauthorized transactions. A notable capability is running targeted banking apps in a virtual environment to intercept API calls and runtime behavior. Communication with command-and-control servers occurs over encrypted WebSocket, enabling screen recording, audio capture, phishing overlays, and remote device control.

MediumMalwareSouth Africa#packer evasion#android trojan#overlay attack

The Greatness phishing-as-a-service (PhaaS) platform targets Microsoft 365 accounts using advanced phishing techniques including adversary-in-the-middle and device-code phishing. It spoofs RingCentral emails to bypass email security filters by exploiting whitelisting and safe-sender list trust. Post-compromise, attackers access Microsoft 365 data and services via stolen authentication tokens. The platform is sold to cybercriminals and has been active since at least mid-2022, targeting users in multiple countries. Researchers recommend auditing safe-sender lists and monitoring suspicious MFA-approved sign-ins.

HighPhishingUnited StatesCanadaUnited Kingdom+2#phishing