Adrian Johnson
TLDR:
- GXC Team bundles phishing kits with malicious Android apps, targeting users of various institutions worldwide.
- They offer a sophisticated AI-powered phishing-as-a-service platform and sell stolen banking credentials.
Full Article:
A Spanish-speaking cybercrime group named GXC Team has been observed bundling phishing kits with malicious Android applications, taking malware-as-a-service (MaaS) offerings to the next level. The Singaporean cybersecurity company Group-IB, tracking the e-crime actor since January 2023, described the crimeware solution as a sophisticated AI-powered phishing-as-a-service platform capable of targeting users of more than 36 Spanish banks, governmental bodies, and 30 institutions worldwide. The phishing kit is priced anywhere between $150 and $900 a month, with the bundle including the phishing kit and Android malware available on a subscription basis for about $500 per month.
Targets of the campaign include users of Spanish financial institutions, tax services, governmental services, e-commerce, banks, and cryptocurrency exchanges in the United States, the United Kingdom, Slovakia, and Brazil. As many as 288 phishing domains linked to the activity have been identified to date. The group also offers the sale of stolen banking credentials and custom coding-for-hire schemes for other cybercriminal groups targeting banking, financial, and cryptocurrency businesses.
The threat actors of GXC Team combine phishing kits with an SMS OTP stealer malware, urging victims to download an Android banking app to prevent phishing attacks. Once installed, the app intercepts OTPs and other messages, exfiltrating them to a Telegram bot under their control. Another service offered is AI-infused voice calling tools that generate calls to targets based on prompts from the phishing kit, masquerading as a bank. These tactics aim to manipulate victims into revealing confidential information or taking malicious actions at the behest of the threat actors.
The phishing kits also employ adversary-in-the-middle capabilities, lower the technical barrier to executing phishing campaigns at scale, and evade security tools by encoding URLs. They have been used in conjunction with methods like social engineering and obfuscated code execution to target users and facilitate malware delivery. Overall, the use of AI-powered tools by cybercriminals highlights the evolving sophistication of phishing scams and the need for robust security measures to combat them.
