Full Report
Group-IB researchers uncover an ongoing phishing campaign targeting major banks in the Philippines. This blog details how threat actors abuse trusted and legitimate platforms to deceive users and evade detection. It highlights a significant threat escalation with the successful hijacking of a legitimate domain to host malicious infrastructure, enabling threat actors to operate with even greater credibility and reduced detection.
Analysis Summary
# Incident Report: Ongoing Credential Hijacking Campaign Targeting Philippine Banks
## Executive Summary
Group-IB researchers identified a sophisticated phishing campaign targeting major financial institutions and their customers in the Philippines. The threat actors utilized a combination of compromised legitimate email accounts, trusted cloud services, and the hijacking of an educational domain to host malicious infrastructure. The primary goal was the real-time exfiltration of banking credentials and One-Time Passwords (OTPs) via Telegram bots to bypass Multi-Factor Authentication (MFA).
## Incident Details
- **Discovery Date:** Ongoing (Reported 2024)
- **Incident Date:** Ongoing
- **Affected Organization:** Multiple major banks in the Philippines
- **Sector:** Financial Services
- **Geography:** Philippines
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Phishing via Business Email Compromise (BEC) and SMS.
- **Details:** Attackers distributed phishing links using already-compromised legitimate email accounts from reputable organizations to bypass spam filters.
### Lateral Movement
- **Details:** While the report focuses on external phishing, the attackers moved from initial compromise of third-party domains (like an educational institution) to hosting malicious subdomains and redirection paths to support the phishing infrastructure.
### Data Exfiltration/Impact
- **Details:** Real-time theft of usernames, passwords, and One-Time Passwords (OTPs). Data was transmitted immediately to attacker-controlled Telegram bots.
### Detection & Response
- **How it was discovered:** Group-IB Threat Intelligence and Digital Risk Protection systems identified the malicious infrastructure and phishing patterns.
- **Response actions taken:** Intelligence gathering, mapping of infrastructure, and public disclosure to alert the financial sector.
## Attack Methodology
- **Initial Access:** Phishing emails/SMS; hijacking of legitimate domains.
- **Persistence:** Utilization of legitimate cloud platforms and hijacked web infrastructure.
- **Defense Evasion:**
- Use of trusted domain services for redirects.
- "Hotlinking" (dynamically fetching visual assets from the official bank websites) to make phishing pages appear identical to legitimate ones.
- Use of compromised legitimate email accounts to send phishing content.
- **Credential Access:** Phishing pages designed to harvest credentials and OTPs in real-time.
- **Discovery:** Reconnaissance of Philippine banking portals and user behaviors.
- **Exfiltration:** Data exfiltration via Telegram Bot API.
- **Impact:** Financial theft and account takeover (ATO).
## Impact Assessment
- **Financial:** High potential for direct financial loss to banking customers via unauthorized transfers.
- **Data Breach:** Compromise of PII (Personally Identifiable Information) and sensitive financial credentials.
- **Operational:** Disruption to banking security operations and fraud departments.
- **Reputational:** Erosion of trust in digital banking services within the region.
## Indicators of Compromise
- **Network Indicators:**
- Telegram Bot API communication for exfiltration.
- [Redacted Hijacked Educational Domain] (e.g., `edu[.]ph` subdomains).
- Use of various cloud-hosting services for redirection (Defanged: `hxxps[://]legit-service[.]com/path/to/malicious/redirect`).
- **Behavioral Indicators:**
- High-frequency requests to legitimate bank asset servers (Hotlinking).
- Phishing pages requesting OTPs immediately after credential entry.
## Response Actions
- **Containment:** Monitoring and reporting of hijacked subdomains.
- **Eradication:** Blocking of known phishing URLs at the ISP and DNS levels.
- **Recovery:** Notification to affected financial institutions to reset compromised user credentials.
## Lessons Learned
- **Domain Trust is a Weakness:** Attackers are moving away from obviously fake domains to hijacking `.edu` and other reputable TLDs to bypass reputation-based filtering.
- **MFA is Not a Silver Bullet:** Real-time phishing (adversary-in-the-middle style) allows attackers to bypass standard OTP-based MFA.
- **Asset Protection:** Banks should monitor for "hotlinking" where external malicious sites are pulling images and scripts directly from the bank's own servers.
## Recommendations
- **Implement FIDO2/WebAuthn:** Move away from SMS/OTP-based MFA toward hardware keys or resident credentials that are resistant to phishing.
- **Email Security:** Enhance BEC detection and implement strict DMARC/SPF/DKIM policies.
- **Continuous Monitoring:** Utilize Digital Risk Protection (DRP) services to identify hijacked domains and unauthorized use of brand assets (hotlinking) in real-time.
- **User Education:** Train customers to recognize that legitimate banks will not ask for OTPs via a link sent through a third-party email account.