Shakedown Social

ANY.RUN🚨 Fake Booking.com phishing pages used to deliver malware and steal data ⚠️ Attackers use <a href="https://infosec.exchange/tags/cybersquatting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersquatting</a>, mimicking Booking website to create legitimate-looking phishing pages that trick users into executing malicious actions. Leveraging <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a>'s interactivity, security professionals can follow the entire infection chain and gather <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>.👨‍💻 Case 1: The user is instructed to open the Run tool by pressing Win + R, then Ctrl + V to paste the script, and hit Enter. This sequence of actions executes a <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malicious</a> script that downloads and runs malware, in this case, <a href="https://infosec.exchange/tags/XWorm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XWorm</a>. Take a look at the analysis: <a href="https://app.any.run/tasks/61fd06c8-2332-450d-b44b-091fe5094335/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/tasks/61fd06c8-2332-450d-b44b-091fe5094335/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice</a>🔍 TI Lookup request to find domains, IPs, and analysis sessions related to this campaign: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522mktoresp.com%255C%2522%2520AND%2520domainName:%255C%2522booking.*.%255C%2522%2522,%2522dateRange%2522:30%7D%20%20" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522mktoresp.com%255C%2522%2520AND%2520domainName:%255C%2522booking.*.%255C%2522%2522,%2522dateRange%2522:30%7D%20%20</a>🎯 Use this search query to find more examples of this fake <a href="https://infosec.exchange/tags/CAPTCHA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CAPTCHA</a> technique and enhance your organization's security response: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522commandLine:%5C%2522" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522commandLine:%5C%2522</a>👨‍💻 Case 2: In this scenario, threat actors aim to steal victims’ banking information. It’s a typical phishing site that mimics Booking website and, after a few steps, prompts users to enter their card details to ‘verify’ their stay. See example: <a href="https://app.any.run/tasks/87c49110-90ff-4833-8f65-af87e49fcc8d/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/tasks/87c49110-90ff-4833-8f65-af87e49fcc8d/?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_term=060325&utm_content=linktoservice</a>📌 A key domain in this campaign, Iili[.]io, was also used by <a href="https://infosec.exchange/tags/Tycoon2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tycoon2FA</a> <a href="https://infosec.exchange/tags/phishkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishkit</a>. 🔍 Use this TI Lookup query to find more examples: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522bzib.nelreports.net%255C%2522%2520AND%2520domainName:%255C%2522xpaywalletcdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522cdnjs.cloudflare.com%255C%2522%2520AND%2520domainName:%255C%2522xpaycdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522iili.io%255C%2522%2522,%2522dateRange%2522:180%7D%20" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=fake_booking&utm_content=linktoti&utm_term=060325#%7B%2522query%2522:%2522domainName:%255C%2522bzib.nelreports.net%255C%2522%2520AND%2520domainName:%255C%2522xpaywalletcdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522cdnjs.cloudflare.com%255C%2522%2520AND%2520domainName:%255C%2522xpaycdn.azureedge.net%255C%2522%2520AND%2520domainName:%255C%2522iili.io%255C%2522%2522,%2522dateRange%2522:180%7D%20</a>Investigate the latest <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> and <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> attacks with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a> 🚀<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Stefan BohacekInteresting story from <a href="https://social.tedium.co/@tedium" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@tedium</a> about an extortion scheme targeting prominent personalities on Bluesky who don't own their own domain."Cybersquatting is not a new issue, of course, but Bluesky’s decision to tie verification to domains as social proof shows the limitations of the strategy."<a href="https://tedium.co/2024/12/17/bluesky-impersonation-risks/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://tedium.co/2024/12/17/bluesky-impersonation-risks/</a>I wonder how this would play out in the fediverse.<a href="https://stefanbohacek.online/tags/bluesky" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bluesky</a> <a href="https://stefanbohacek.online/tags/fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverse</a> <a href="https://stefanbohacek.online/tags/domains" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#domains</a> <a href="https://stefanbohacek.online/tags/verification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#verification</a> <a href="https://stefanbohacek.online/tags/cybersquatting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersquatting</a>

Recent searches

Search options

Administered by:

Server stats:

#cybersquatting