ruby.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
If you are interested in the Ruby programming language, come join us! Tell us about yourself when signing up. If you just want to join Mastodon, another server will be a better place for you.

Administered by:

Server stats:

1.1K
active users

#cybercrime

65 posts37 participants9 posts today

Looking for something else entirely I notice there is a #wankstortion campaign in progress (~600 hosts) targeting (of course) the imaginary friends aka spamtraps, again.

Is that even worth reporting on in more detail these days?

(data accumulating in nxdomain.no/~peter/wankstortio as usual, previous reported in nxdomain.no/~peter/despicable_, MO repeating)

nxdomain.noIndex of /~peter/wankstortion/

Newly Registered Domains Distributing SpyNote Malware

Deceptive websites hosted on newly registered domains are being used to deliver AndroidOS SpyNote malware, mimicking the Google Chrome install page on the Google Play Store. The campaign utilizes a mix of English and Chinese-language delivery sites, with Chinese-language comments in the code. The malware is distributed through a two-stage installation process, using an APK dropper to deploy the core SpyNote RAT. SpyNote is a potent Android remote access trojan capable of extensive surveillance, data exfiltration, and remote control. It aggressively requests numerous intrusive permissions, allowing for theft of sensitive data and significant remote access capabilities. The malware's keylogging functionality and ability to manipulate calls, activate cameras and microphones, and remotely wipe data make it a formidable tool for espionage and cybercrime.

Pulse ID: 67f80a4aa4c9d5d796071af6
Pulse Link: otx.alienvault.com/pulse/67f80
Pulse Author: AlienVault
Created: 2025-04-10 18:13:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#APK#Android#Chinese

Spam activity for the December 2024 - February 2025 reporting period is now posted at the Cybercrime Information Center. This was a record-setting reporting period.

Retailers will envy the holiday season that spammers enjoyed.

Noteworthy findings

TLDs:

.BOND had less than 1M domains but over 700K spam domains. Compare to .COM which had 157M domains and just under 1M spam domains. hashtag

#ouch

Domain Registrars:

Dynadot and Key Systems had more spam domains under management than GoDaddy.

Hosting Networks (ASNs)

Amazon had a 900% increase in spam content or spambots reported.

cybercrimeinfocenter.org/spam-

Scams Taking Their Toll?

We've previously posted about toll-themed domains being used in mass smishing campaigns targeting drivers in the US, but they're not the only ones being taken for a ride. While recently investigating a huge cluster of scam domains sharing many similar traits, we've noticed toll scams targeting drivers far and wide, including in Australia, Hong Kong, New Zealand, Portugal, Saudi Arabia, Singapore, Taiwan and the United Arab Emirates.

Think you're safe because you didn't click submit? Think again! These crafty wheeler-dealers are using the JavaScript Socket.io library for real-time communications, meaning text is sent to the scammers as you type!

Examining these back-and-forth communications suggests that your data is being sent to a chat room, and the server response includes 'online-count-user,' showing you're not the only one interacting with the scam at that moment.

Regional examples:
- AU - inforequestl[.]icu
- HK - hketcupdate[.]top
- NZ - niztagoovt[.]com
- PT - visitorsa-pt[.]click
- SA - absher[.]qpon
- SG - lta-gov-sg[.]top
- TW - fetollc[.]top
- AE - dubaipoieh[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing