INJ3CTOR3 Expands PBX Toll Fraud With Recurring SIP Trunk Credential Theft

INJ3CTOR3 has expanded its self-healing JOMANGY campaign against FreePBX, Issabel, and Elastix from on-host toll fraud to recurring credential theft. September 2026 artifacts show that its PHP installer contains commands to upload 17 configuration files holding SIP, Asterisk Manager Interface, database, and mail-relay credentials to two staging hosts every minute. Stolen SIP trunk credentials could allow fraudulent calls from attacker-controlled infrastructure even after a victim rebuilds its PBX, unless carrier restrictions prevent their reuse. Researchers verified the upload functionality in code but did not capture victim uploads in transit or identify affected organizations.

The campaign retains extensive persistence, forged administrator sessions, log destruction, and webshell access through encoded-whitespace URLs, while rotating identifiers previously used for detection. It extends a history of related PBX abuse: Check Point documented INJ3CTOR3 exploiting the FreePBX authentication bypass CVE-2019-19006 in 2020, while Unit 42 later reported a similar campaign linked to CVE-2021-45461 that used obfuscated PHP backdoors and recurring reinfection. Remediation must address both host persistence and stolen credentials: isolate affected systems and preserve evidence, rebuild from trusted sources or comprehensively remove persistence, then rotate exposed credentials only after the host is clean. Carrier-side restrictions can help prevent stolen trunks from being used elsewhere.