Finance & Banking,
Fraud Management & Cybercrime,
Industry Specific
Phone-Led Fraud Ring Pushes Legitimate Remote-Support Tools to Ransack Systems
In a troubling trend, cybercriminals have been engaging in a sophisticated operation by creating fraudulent versions of legitimate banks’ customer support websites. This phenomenon aims to ensnare unsuspecting victims into unwittingly downloading maleficent software onto their computers, raising significant concerns in the financial sector. Researchers have come forward to warn the public about this elaborate phone-led fraud operation that has been on the rise since at least March of this year.
The report from British threat intelligence firm Lab539 presents a disturbing view of the campaign, describing it as a targeted effort against banking customers. The operation employs convincing replicas of support pages that are combined with remote-access software and tailored malicious payloads to gain undue access to victims’ computers. So far, more than 380 domains have been identified as associated with the attackers’ fraudulent support sites, which clone the help or support pages of several high-profile financial institutions, including Barclays, HSBC, Lloyds, Revolut, and Santander. This widespread operation poses critical risks to online banking security and customer trust.
The primary objective is deceptively straightforward: to trick individuals into downloading and executing legitimate remote-support applications that have been co-opted for malicious purposes. These tools, originally designed for customer service and technical support, are being misused to seize control of personal computers. Once in control, attackers can access sensitive information, empty bank accounts, or execute other nefarious activities.
The exact method of initial contact with potential victims remains somewhat ambiguous, but it is believed to consist of a combination of phishing tactics and telephone-oriented attack delivery (TOAD). Unlike traditional voice phishing techniques (vishing), which generally involve uninvited calls from attackers to targets, TOAD focuses on fooling individuals into making a call themselves, often believing they’re contacting a legitimate support center.
To deceive victims, the attackers create a sense of urgency, often employing fraudulent invoices that instigate action. Critics have pointed out that emails associated with these TOAD attacks can be particularly insidious because they frequently bypass corporate email defenses. They often resemble standard communication while containing a phone number for the recipient to call, thus leading individuals to unwittingly reach out to the fraudulent call center.
Once a victim is on the line with the phony support representative, they are guided through a series of steps that typically involve clicking on certain buttons that appear to be legitimate functionalities on a bank’s website. These include options labeled “Verify Call,” “Live Chat,” “Generate Case ID,” “Security Check,” and “Fraud Report.” By clicking these buttons, individuals expose themselves to malicious requests, such as providing a verification code that the fraudster on the other end is eagerly awaiting.
The “Live Chat” function, for instance, triggers the download of the AnyDesk installer, compelling the target to permit remote access to their computer—albeit for a single session. Conversely, the “Verify Call” button prompts the download of a deceptive file called verify_call.exe, masquerading as a security tool while actually installing the dangerous ScreenConnect software. Such malware grants attackers persistent access to victims’ machines, significantly increasing the potential for exploitation.
Some attackers have utilized more complex methodologies, including repackaging malicious files within seemingly benign applications. For example, a file entitled FraudReport.zip incorporates a genuine Microsoft Defender component alongside a harmful mpclient.dll. This DLL can be loaded by trusted software, allowing the attackers to execute their malicious installer under the radar of standard security protocols.
The presence of signed files, such as verify_call.exe and mpclient.dll, further complicates the scenario. These malicious entities were signed using digital certificates associated with Botania Games in Japan, and while it is not clear if this company is directly complicit, this type of misuse of signing certificates has been observed in other contexts. Over time, various organizations have found their signing credentials exploited by hackers, providing a veneer of legitimacy to nefarious software.
Data shows that both files have been circulating for several months. The verify_call.exe file was initially submitted to a virus scanning service in late April, while mpclient.dll showed up in mid-May. Alarmingly, as of earlier this week, these files were labeled as malicious on only a fraction of the antivirus engines analyzed, spotlighting the need for more robust detection methods in cybersecurity.
As a preventative measure, Lab539 reported these malicious certificates to certificate authorities, and they were subsequently revoked. While this revocation stops the certificates from being used for future signing, experts emphasize that it does not halt the distribution of malware itself. Lab539’s security researcher John Fitzpatrick elaborates that while certificate revocation is a step forward, it does not prevent the execution of infected files. The ramifications of targeted attacks like these extend beyond immediate financial loss, as they threaten the trust and stability of the banking system as a whole.
In conclusion, the Lab539 report underscores the intricate and evolving nature of cybercrime in the banking sector. As institutions grapple with these persistent threats, ongoing collaboration with cybersecurity experts is crucial. The ultimate burden falls on the banks, whose customers are being targeted, creating a pressing need for proactive campaigns to combat and disrupt these fraudulent operations.