I haven’t had much time to write here lately, but today I noticed something funny (maybe). I came across this website: bankstatementkit[.]com

It reminded me of a website from many years ago that allowed users (who weren’t too bright) to check if their credit card had been compromised, obviously by asking them to enter all their card details.

Today’s site, on the other hand, lets users upload their credit card statement as a PDF to get an Excel file in return. At the bottom, they promise to be honest, not to save anything, and to comply with the GDPR. That might even be true, but I’ve never seen a criminal website admit it publicly.

I have no reason to believe that this website isn’t a legitimate business. Its aims are, in my opinion, so absurd, and the idea that someone would upload their own bank statement is so ridiculous that it leads me to believe there aren’t actually any criminals behind it.

If it’s a legitimate business, I wish them the best of luck. If they’re criminals and manage to get their hands on someone’s data, we’ll be able to say that, once again, it’s not just the criminals who are bad, but the users who are stupid, too.

I don’t know much about how Clawdbot works. I’ve never installed it and I’ve only had a quick look at the repo.

Let’s just say I know I don’t know shit about it.

But do so many people really need to expose the service on the internet? Without any restrictions whatsoever?

please, don’t call every idiot who commits crimes using a computer a “hacker”. I know I’m harping on about this, but it’s very important to me. The term “hacker” refers to an individual who studies, commits himself, and is driven by an indomitable passion. The press, however, decided that this term was appropriate for any idiot who commits a crime using a computer.

Today I bring you a splendid example of an idiot that some will call a “hacker”.

This genius registered a domain (helpvdeskerify247[.]com) to install a kit to steal credentials from Bank of America customers. Matrix discovered the domain and reported it as “opendir.”

The domain was flagged on urlscan some minutes after registration 😉

Since it was clearly suspicious, Matrix continued monitoring. After a few hours Matrix intercepts a change on the site and identifies a cloacker, which it then reports as a possible threat.

A day later, the criminal takes down the site and exposes the kit: Matrix then intercepts, downloads, and analyzes it. It identifies and reports it, highlighting the threat.

Here, the criminal already proves he’s no genius. Analyzing the kit, however, reveals a hidden gem… To secure the credentials, the kit uses a Telegram bot:

7937236406:AAGHUl2hThlX_SuxhkIuxVk2ZhAPoxuW8Ao

Okay, nothing unusual, so what’s the strangeness? The genius, instead of leaving the information in the bot’s queue, decides to record a callback. The attack therefore seems a bit more complex than usual. But here’s where the genius shines: the callback is based on the same domain where the kit is located!

So, after traveling around the world, where did the stolen credentials end up? In a damn JSON file on the same machine. 😀 😀 😀

I challenge anyone here to use the term “hacker” to describe this guy!!!

Besides, after two days, GSB and VT continue to ignore this domain. Very well, I’d say.

In the following article I talk about some approaches to mitigate the damage from a criminal attack. I am not sure if what I am talking about is legal in all countries, so do your research first. Or use a VPS in Russia 😀

Telegram is one of the main tools used by criminals to receive stolen information through various types of attacks, including of course phishing sites.

Below I outline some simple actions we can take to mitigate Telegram bot-based attacks. But first let’s see how to use a token.

For this post I will use a token identified in these hours within a kit distributed on different domains:

• psyclum.org
• lwonsio.org
• peyssc.org
• katjrig.org
• katjriv.org
• sorajfm.org
• niondin.org

Analyzing the deployment methods of the kit, we can see how the criminal registered the various domains and only after several days installed the kit. This in an attempt to avoid being intercepted. Fortunately, Matrix also manages these situations 🙂

Let’s move on to the kit, as always it’s a piece of junk written in PHP. Inside we find the Telegram bot token to which stolen credentials are sent to unwary users.

Now let’s move on to the main topic of this article: we have a token, what do we do with it? First, let’s study. Here is the documentation on how to use bots: https://core.telegram.org/bots/api

Using VS Code and the amazing “REST Client” extension we can query bots and use it to mitigate criminal action.
First, using the “getMe” method I check if the token is active. The 200 return code and the Json in response indicate that the token is active and therefore ready to receive information from clients, including the phishing site itself.

When the unwary user enters their credentials into the phishing site, it sends the information to the Telegram bot. Two things can happen here: if there is a registered webhook, the information is sent to the resource indicated as the webhook, otherwise the information is kept in the bot’s message queue to be consumed via the “getUpdates” method.

Using the “getWebhookInfo” method we check the bot status and the possible presence of a webhook. In this case the webhook is not registered and therefore we must use the “getUpdates” method to download any messages present in the queue.

By calling the “getUpdates” method we see that there are no messages in the queue. If there were any, our call would have returned them to us by deleting them from the queue.

As mentioned, we have several ways to handle this situation. The first is to register a resource of our own as a webhook that will then receive the stolen information, allowing us to act promptly. For example, you could implement an alert system for the user to warn him that his credentials have been stolen and perhaps even deactivate his account and credit cards. As an alternative to registering your own webhook, you can implement a polling mechanism to download the stolen information, removing it from the criminal’s reach, and use it to mitigate the threat: as mentioned above, you can block the account, warn the user, and explain to them that they need to be careful.

Another approach is token deletion. I personally don’t like this approach because it prevents us from intercepting compromised accounts and therefore deprives us of the ability to act on users.

Today I found an email with an SVG attachment in my secondary email account. The account is Office 365 and the email was not in spam, this is not good, especially considering how much 365 costs! Anyway, back to the email, it was clearly suspicious also considering the attachment, an svg file with the name “Your-to-do-List.svg” supposedly sent to me by itself.

I immediately downloaded the file and opened it with Notepad++ (all this without the antivirus having anything to say about it…), inside there was a script that through a simple algorithm made a redirect to a phishing site with the aim of stealing the credentials of the same Office 365 account.

The target URL is: hxxps://bzzrr[.]yiunwox[.]es/!7ijf9v9ehpNFEKt/$

When I tried to forward the message to my Gmail account, Google’s mail server correctly returns an error 🙂

As always, avoid downloading and opening attachments if you are not sure of the source.