Loading story…
Researchers reported an aggressive phishing operation impersonating PNB MetLife Insurance to steal policyholder data and drive fraudulent payments, likely initiated via smishing lures that send victims to mobile-optimized “premium payment gateway” pages. The sites are designed to exploit brand trust and prompt users for personal details (e.g., name, policy number, mobile number) while performing no real backend validation—accepting arbitrary inputs and advancing users through the flow, indicating the pages are built for data capture rather than legitimate premium processing.
Technical analysis found the campaign avoids traditional attacker infrastructure by using the Telegram Bot API for near-real-time exfiltration of victim-submitted data. The malicious JavaScript reportedly contains hardcoded bot tokens/chat identifiers (including bots referenced as pnbmetlifesbot and goldenxspy_bot), and at least one observed lure domain was hosted on an EdgeOne subdomain (e.g., hxxps://pnb-metlife-g-shiv-1aad8zgyup.edgeone.app/). Victims are then redirected toward UPI payment steps, consistent with financial fraud objectives and a mobile-first targeting strategy.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers found the phishing kit was hosted on EdgeOne Pages, a free hosting platform, with multiple deployments showing minor configuration changes such as different UPI IDs, Telegram bots, and subdomains. This infrastructure choice enabled rapid rotation and resilience against takedowns while preserving the same malicious logic.
A more dangerous variant of the fake PNB MetLife pages was observed offering policy-service options such as refunds and auto-debit updates, then prompting victims for bank account and debit card information under a verification pretext. This showed the campaign had escalated from simple payment fraud to broader financial credential theft.
Researchers documented that one phishing template collected policy and identity details, then redirected victims into fraudulent UPI payment flows using generated QR codes, deep links to apps such as PhonePe and Paytm, and clipboard-copy abuse to prefill an attacker-controlled UPI ID. The campaign was described as mobile-optimized and likely distributed through smishing messages.
Multiple phishing pages impersonating PNB MetLife Insurance were identified as fake premium payment and policy-servicing portals that perform no legitimate payment processing or backend validation. The pages were found to steal victim-entered data by sending it to attackers through the Telegram Bot API using hardcoded bot tokens and chat IDs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcemalwr-analysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **social-engineering campaigns** that use trusted-looking lures (meeting invites, public-safety alerts, and official-looking documents) to drive victims to install malware or disclose credentials. Microsoft researchers reported a wave of **fake Zoom/Teams/Adobe update sites** reached via meeting-invite and document lures; the downloaded executables were signed with a **compromised EV code-signing certificate** (issued to *TrustConnect Software PTY LTD*) and acted as droppers for **remote monitoring and management (RMM) tools**, enabling persistent access. Separately, ClearSky described a suspected **Russian espionage** phishing operation targeting Ukraine that delivers a ZIP containing a Ukrainian-language border-crossing “permit” document, installing a loader (**BadPaw**) and a backdoor (**MeowMeow**) with file manipulation capabilities and sandbox/VM evasion; attribution was assessed as high confidence to a Russian state-aligned actor and low confidence to **APT28**. Mobile-focused lures were also reported: CloudSEK detailed **SMS phishing** targeting Israeli civilians with a trojanized **Red Alert** rocket-warning app, using a multi-stage loader chain to deploy spyware with **banking trojan** capabilities and exfiltrate **SMS, contacts, and location** to attacker infrastructure—raising concerns about surveillance and erosion of trust in official alerting. Other items in the set are either broader research or consumer-oriented scam advisories: a Zimperium write-up on the Android **“Massiv”** IPTV-app disguise highlights overlay-based banking fraud techniques, while Kaspersky’s mobile threat landscape report provides 2025 ecosystem statistics; two OnlineThreatAlerts posts describe generic **smishing** patterns (Amazon “refund” and flood-warning texts) without tying to a specific, evidenced campaign or new technical findings.
Jun 29, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
Researchers exposed two closely related smishing operations that impersonated parcel-delivery brands and used phishing kits with **live operator consoles** to steal identity and payment-card data. In one case, investigators tied a J&T Express lure to a short-lived domain, `jtexpress.mwkqbr[.]club`, and found a kit that harvested full identity details and card information before relaying victims into OTP, PIN, app, email, or CVV challenge screens. Static analysis showed AES-128-CBC encryption in browser storage and socket transport, a Socket.IO relay on the `/com/socket.io/` path, multiple client-side verification routes, and Chinese debug strings, while the infrastructure was registered through Dominet (HK) Limited and fronted by Cloudflare before being suspended days later. The findings mirror a broader investigation into **Darcula** and its `Magic Cat` phishing platform, which used smishing messages posing as postal and delivery services and streamed victim data in real time to an operator “admin” room. Researchers said the platform functioned as a mature phishing-as-a-service business with licensing, activation management, template distribution, real-time victim interaction, and possible backdoor capability, and linked it to Telegram communities and large-scale criminal monetization. The combined reporting indicates an industrialized ecosystem in which human operators actively guide victims through bank verification steps, allowing attackers to bypass 3D Secure protections and compromise hundreds of thousands of targets.
Aug 24, 2026