Full Report
Discover the latest phishing campaign targeting a major toll road service provider, where cybercriminals use sophisticated evasion techniques to bypass security detections. This in-depth blog reveals how threat actors exploit legitimate platforms and deploy cloaking methods to disguise malicious links, allowing them to evade detection by security solutions. Discover how these sophisticated tactics create highly convincing phishing pages designed to steal victims’ card information, and how to safeguard yourself against these evolving cyber threats.
Analysis Summary
# Incident Report: Sophisticated SMS Phishing Campaign Targeting Toll Road Services
## Executive Summary
A sophisticated Smishing (SMS Phishing) campaign targeted customers of a major toll road service provider using advanced defense evasion techniques. Threat actors utilized legitimate redirection services and browser fingerprinting to deliver highly convincing fraudulent pages designed to steal sensitive payment card information. The campaign successfully bypassed traditional security filters by employing "cloaking" methods that restricted access to genuine potential victims while blocking security researchers.
## Incident Details
- **Discovery Date:** Not explicitly stated (Reported via Group-IB blog)
- **Incident Date:** Ongoing/Recent
- **Affected Organization:** Major Toll Road Service Provider (Unnamed)
- **Sector:** Transportation / Infrastructure
- **Geography:** Likely North America or APAC (regions where toll SMS alerts are common)
## Timeline of Events
### Initial Access
- **Date/Time:** Variable; campaign-based.
- **Vector:** SMS (Smishing).
- **Details:** Victims receive an SMS message claiming an unpaid toll or account issue, creating a sense of urgency. The message contains a masked link.
### Lateral Movement
- **Details:** N/A. This was an external credential/data harvesting attack targeting customers rather than a breach of the organization’s internal network.
### Data Exfiltration/Impact
- **Details:** Attackers captured full payment card details (PAN, Expiry, CVV) and personal identifying information (PII) via localized, convincing phishing forms.
### Detection & Response
- **How it was discovered:** Detected through Digital Risk Protection monitoring and threat intelligence analysis identifying suspicious domains mimicking toll services.
- **Response actions taken:** Domain takedown efforts, brand protection alerts, and publication of threat intelligence to warn the public and industry peers.
## Attack Methodology
- **Initial Access:** SMS messages with embedded links.
- **Persistence:** N/A (Session-based phishing).
- **Privilege Escalation:** N/A.
- **Defense Evasion:**
- **Multi-layered Redirection:** Use of Google AMP links to leverage the reputation of legitimate Google domains and bypass email/SMS filters.
- **Cloaking (FingerprintJS):** Used to identify the visitor's device. Traffic from VPNs, datacenters, or known security crawlers (e.g., VirusTotal, urlscan.io) was blocked.
- **Localized Content:** Content served in the victim's native language based on IP geo-location.
- **Credential Access:** Real-time data validation using **Cleave.js** to ensure victims entered valid card formats, increasing the quality of stolen data.
- **Discovery:** N/A.
- **Lateral Movement:** N/A.
- **Collection:** Automated harvesting of form data submitted by the user.
- **Exfiltration:** Data sent to attacker-controlled C2 or backend databases.
- **Impact:** Financial fraud against customers and reputational damage to the toll service provider.
## Impact Assessment
- **Financial:** High potential for direct financial loss to customers via fraudulent card charges.
- **Data Breach:** Compromise of PII and Credit Card numbers.
- **Operational:** Increased load on customer service centers and fraud departments.
- **Reputational:** Significant brand erosion as customers lose trust in official SMS communications.
## Indicators of Compromise
- **Network Indicators:**
- `google.com/amp/s/[defanged_malicious_domain]`
- Various look-alike domains mimicking toll services (e.g., `toll-pay-[identity].com`)
- **Behavioral Indicators:**
- Presence of `FingerprintJS` scripts on non-analytical pages.
- Use of `Cleave.js` on unauthorized payment forms.
- Redirection chains originating from Google AMP.
## Response Actions
- **Containment:** Flagging malicious URLs to hosting providers and registrars for suspension.
- **Eradication:** Implementation of Digital Risk Protection (DRP) to identify and sinkhole fraudulent infrastructure.
- **Recovery:** Customer notification campaigns advising against clicking SMS links.
## Lessons Learned
- **Evasion Evolved:** Traditional blocklists are insufficient when attackers use legitimate services like Google AMP for redirection.
- **Fingerprinting as a Weapon:** Attackers are now using professional-grade developer tools (FingerprintJS) to hide from security analysts.
- **Validation Increases Yield:** By using input formatting libraries (Cleave.js), attackers ensure the stolen data is accurate and immediately usable for fraud.
## Recommendations
- **For Organizations:** Implement Digital Risk Protection to monitor for brand impersonation and unauthorized logo usage.
- **For Organizations:** Use Threat Intelligence to stay updated on the specific libraries (like Cleave.js) used in phishing kits.
- **For Users:** Never click links in SMS messages regarding payments; always navigate directly to the official website via a browser.
- **Technical Defense:** Configure security gateways to inspect the final destination of redirected links, particularly those using AMP or URL shorteners.