Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A phishing campaign exploiting the aftermath of a military conflict between Israel and Iran has been identified. The scam, using a fake domain 'lineageembraer.online', offers evacuation flights from Tel Aviv to New York on an Embraer Lineage 1000E business jet. The website presents unrealistic pricing and logistical details, aiming to steal personal and financial information from individuals seeking to flee the region. The operation uses fear and urgency tactics, offering seats at $2,166 USD, significantly below market rates for similar flights. The scheme involves a PDF with instructions hosted on a Shopify CDN, raising further suspicions. The campaign demonstrates how threat actors exploit crisis situations to target vulnerable individuals.

The threat described is a phishing campaign exploiting the geopolitical tensions and military conflict between Israel and Iran. The attackers have created a fraudulent website using the domain 'lineageembraer.online' that purports to offer evacuation flights from Tel Aviv to New York aboard an Embraer Lineage 1000E business jet. This scam leverages fear and urgency by presenting unrealistically low prices ($2,166 USD per seat) and implausible logistical details to lure individuals desperate to escape the conflict zone. Victims are encouraged to provide personal and financial information under the guise of booking these evacuation flights. The campaign also distributes a PDF hosted on a Shopify content delivery network, which contains instructions likely designed to further manipulate victims or facilitate the theft of sensitive data. The use of a legitimate CDN like Shopify adds a veneer of credibility to the phishing materials, increasing the likelihood of victim engagement. This campaign exemplifies how threat actors exploit crisis situations to target vulnerable populations, combining social engineering with phishing techniques to commit identity theft and financial fraud. The campaign is tagged with multiple MITRE ATT&CK techniques such as T1566 (Phishing), T1583.001 (Acquire Infrastructure: Domains), T1589 (Gather Victim Identity Information), and T1598 (Phishing for Information), indicating a sophisticated approach to infrastructure setup and information harvesting. No known exploits or threat actors are currently linked to this campaign, and it is classified with medium severity due to its targeted nature and potential for significant personal data compromise.

Detailed information about A Special Mission to Nowhere. Get real-time updates, technical details, and mitigation strategies.

A Special Mission to Nowhere - Live Threat Intelligence - Threat Radar | OffSeq.com

A Special Mission to Nowhere

A new Android SMS stealer family, named Qwizzserial, has been uncovered, primarily targeting users in Uzbekistan. The malware exploits the reliance on SMS for two-factor authentication in local payment systems, allowing fraudsters to intercept SMS messages and gain control over victims' finances. Distributed through Telegram, the Qwizzserial campaign mirrors the structure of Classiscam. The stealer has infected approximately 100,000 users, resulting in financial losses of at least US$62,000. The malware's effectiveness stems from the widespread use of SMS for various financial transactions in Uzbekistan, including P2P transfers, payments, and authorization confirmations, often serving as the sole security layer in the absence of 3D Secure or biometric authentication.

Qwizzserial is a newly identified Android malware family designed to steal SMS messages from infected devices. This malware primarily targets users in Uzbekistan, exploiting the prevalent use of SMS-based two-factor authentication (2FA) in local financial systems. By intercepting SMS messages, Qwizzserial enables attackers to bypass authentication mechanisms and gain unauthorized access to victims' financial accounts, facilitating fraudulent transactions and financial theft. The malware is distributed mainly through Telegram channels, mimicking the operational structure of the previously known Classiscam malware family. Qwizzserial has reportedly infected around 100,000 users, causing financial losses estimated at a minimum of US$62,000. The malware’s success is largely due to the reliance on SMS as the sole or primary security layer for payment authorizations, peer-to-peer transfers, and other financial operations in Uzbekistan, where more advanced security measures like 3D Secure or biometric authentication are often absent. Although no known exploits are currently reported in the wild beyond the initial infection vector, the malware’s capability to silently intercept SMS messages poses a significant threat to the confidentiality and integrity of user financial data. The lack of patch links or specific affected Android versions suggests that the malware exploits social engineering and distribution through Telegram rather than exploiting a specific software vulnerability.

MD5 of 85648d3c1106b2f19ac0a0f41e122d17258893e0

MD5 of 643753ce846339765ffe9f483c30e1652fc3d75e

SHA256 of 643753ce846339765ffe9f483c30e1652fc3d75e

SHA256 of 85648d3c1106b2f19ac0a0f41e122d17258893e0

MD5 of 0ff0182805e573533646992496d7b28602e9121d

MD5 of ec7cc098bdf56a58df93b1d6626786ab59224870

SHA256 of 0ff0182805e573533646992496d7b28602e9121d

SHA256 of ec7cc098bdf56a58df93b1d6626786ab59224870

Detailed information about Discovery of Qwizzserial: A New Android SMS Stealer Family. Get real-time updates, technical details, and mitigation strategies.

Discovery of Qwizzserial: A New Android SMS Stealer Family - Live Threat Intelligence - Threat Radar | OffSeq.com

Discovery of Qwizzserial: A New Android SMS Stealer Family

A SpyLoan application called 'RapiPlata' was identified on a victim's device, having been downloaded by over 150,000 users from both Google Play and Apple App Store. The app, which ranked in the top 20 finance category in Colombia, had extensive access to sensitive user data, including SMS messages, call logs, calendar events, and installed applications. It uploaded this data to its servers, posing significant risks to users' privacy and financial security. The app's malicious behavior included harassing messages, unauthorized loan approvals, and data theft. Despite its removal from official app stores, it remains accessible through third-party websites. The app is part of a larger SpyLoan malware operation, with similarities to previously identified malicious apps.

The threat involves a malicious mobile application named 'RapiPlata,' part of the SpyLoan malware family, which was distributed via both the Google Play Store and Apple App Store before being removed. The app was downloaded by over 150,000 users, primarily in Colombia, where it ranked in the top 20 finance apps. RapiPlata masquerades as a legitimate loan application but performs extensive unauthorized data collection and malicious activities. It gains access to highly sensitive user data, including SMS messages, call logs, calendar events, and lists of installed applications. This data is exfiltrated to attacker-controlled servers, enabling privacy violations and potential financial fraud. The app also engages in harassing users with messages and can approve loans without user consent, indicating a direct financial impact on victims. Despite removal from official app stores, the app remains accessible through third-party websites, increasing the risk of continued infections. The malware shares characteristics with other SpyLoan variants, suggesting a coordinated campaign targeting mobile users with predatory lending and data theft objectives. The indicators of compromise include numerous file hashes and malicious domains used for command and control or data exfiltration. The threat does not require user authentication beyond installation and likely requires user interaction to install, but once installed, it operates stealthily to harvest data and conduct fraudulent activities. No known exploits in the wild are reported, but the app’s presence in official stores prior to removal highlights gaps in app store security and the potential for widespread impact.

Detailed information about Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'financial fraud'

Filter Threats

Threats Tagged 'financial fraud'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility