CTM360 has uncovered and tracked two widespread scam campaigns—PointyPhish (Rewards Points Scam) and TollShark (Toll Scam). These attacks are powered by a sophisticated Phishing-as-a-Service (PhaaS) infrastructure known as Darcula Suite. Operating at scale, the campaigns utilize SMS-based phishing vectors, targeting consumers by impersonating banking, transportation, telecom, retail, and reward-based services. The attacks aim to steal PII and credit/debit card data via convincing cloned websites of legitimate brands.
Severity Level: High
Threat Overview:
- Attack Flow:
- SMS Phishing: Fake alerts for toll dues or expiring reward points.
- Fake Website: Mimics brand UI to trick users into submitting data.
- Urgency Tactics: Push users to “redeem” or “pay” quickly.
- PII Harvesting: Names, DOB, phone numbers, addresses collected.
- Card Harvesting: Full card info (number, expiry, CVV) stolen.
- Tool Used: Darcula (Phishing Kit with rapid deployment & customization).
- Darcula Platform Insights:
- Subscription-based access model with attacker licensing.
- Real-time victim tracking with session IDs, IPs, and geolocation data.
- Targeting controls (geo-fencing, mobile-only access, OTP prompts).
- Modular phishing kits tailored for different regions and brand targets.
- Affected Regions: Asia-Pacific, Middle East, Europe, North America
- Affected Industries: Retail, Banking, Airlines (PointyPhish); Transportation and Toll Services (TollShark)
- Notable Targeted Brands: Banks in UK, India, Spain, Malaysia; Toll companies in USA, UAE, China, Australia, Canada
- Infrastructure Used: 5,000+ typo-squatted domains using TLDs like .top, .xin, .vip, .xyz, .cc, .ink, .sbs
Recommendations:
- Proactively block or monitor traffic to high-risk domains using abused TLDs such as .top, .vip, .xin, .xyz, .ink, .sbs, and .cc.
- Deploy mobile security solutions capable of detecting SMS-based phishing (smishing) and malicious link patterns.
- Restrict mobile browser-based payments in corporate environments unless validated through secured payment gateways.
- Ensure mobile devices use secure browsers with phishing protection (e.g., Google Safe Browsing, SmartScreen).
- Conduct phishing simulation campaigns focused on SMS scenarios (toll alerts, reward point expiry) to train users in identifying mobile phishing.
- Advise users to verify payment/toll requests through official apps or websites—never through links received via SMS.
- Disable or reduce reliance on SMS-based OTPs. Shift toward app-based authenticators (e.g., Google Authenticator, Authy).
Source:
- https://www.security.com/threat-intelligence/billbug-china-espionage
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
No related posts found.