Executive Summary

Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.

Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding activity, and continuously changing phishing content, indicating active campaign management.

Impressions

The latest GhostBat RAT variant represents a significant evolution in both delivery and post-compromise capabilities. The malware now abuses the Android Accessibility Service to support Ghost Overlay and broader PIN/key-input capture targeting financial applications used across India.

Ghost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik. It replays the same touches into the legitimate application, allowing the malware to capture PIN information without presenting a conventional phishing interface. The variant also targets 60 banking, UPI, wallet, fintech, and payment applications for broader PIN capture.

Modus Operandi

GhostBat RAT has diversified its loader architecture, with at least six observed delivery mechanisms, while the latest build uses libnetbridge.so and multiple cryptographic and custom container stages. Firebase Remote Config further enables operators to dynamically modify C&C infrastructure and malware functionality after installation.

Key Takeaways

• GhostBat RAT continues to target Android users in India via mParivahan- and eChallan-themed smishing campaigns, using phishing pages and public hosting platforms to distribute malicious APKs.
• Our investigation uncovered GhostX, a broader operator-controlled ecosystem that supports phishing, device management, backend configuration, and the distribution of the GhostBat RAT.   
• The latest GhostBat RAT variant abuses the Android Accessibility Service, including the Ghost Overlay technique to intercept PIN entry in legitimate Google Pay and MobiKwik applications.   
• The malware also implements broader PIN/key-input capture targeting 60 Android applications associated with India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.   
• GhostBat RAT’s delivery layer has evolved through multiple loader and dropper implementations, with the latest libnetbridge.so loader employing several transformations, including encryption, compression, and custom container stages, before recovering the final payload.   
• Firebase Remote Config enables dynamic C&C and feature management, allowing operators to modify backend infrastructure and selected malware capabilities without rebuilding or redistributing the APK.

Overview

In October 2025, Cyble identified GhostBat RAT being distributed through MiningDropper and targeting Android users in India.

We have since continued to track related activity and investigate malicious applications impersonating India’s mParivahan and eChallan services. This research uncovered a broader Android threat ecosystem that we track as GhostX, along with significantly evolved variants of GhostBat RAT.

The most recent GhostBat RAT variant demonstrates a notable increase in capability and operational flexibility. It uses Firebase Remote Config to dynamically manage command-and-control (C&C) infrastructure and to enable or disable individual malware modules without requiring APK redistribution.

This variant also implements a sophisticated Ghost Overlay technique targeting legitimate Google Pay and MobiKwik PIN-entry interfaces. Instead of displaying a conventional fake login page, the malware places transparent accessibility overlays over the legitimate application’s keypad, records the victim’s touch selections, and replays the same interaction into the genuine application.

Additionally, the malware implements a PIN-capture capability through keylogging, targeting 60 Android applications across India’s banking, UPI, wallet, fintech, and digital payment ecosystem.

The malware’s delivery and packing mechanisms have evolved considerably across the samples analyzed. We identified at least six distinct loader or dropper implementations, including:

• Native AES-CBC-protected APK containers
• Custom SPKZ/SPK1 payload formats
• Java-based in-memory DEX loaders
• Remote APK downloaders
• Multi-stage XOR/AES loaders
• A newer native libnetbridge.so loader using multiple cryptographic, transformation, compression, and custom container stages before recovering the final payload

This diversification suggests continued investment in defeating static detection and complicating automated malware extraction.

GhostBat RAT is primarily distributed via smishing messages that contain malicious links. When victims follow these links, they are redirected to phishing pages that impersonate either the legitimate Parivahan service or a Google Play-style application download page and are encouraged to install a fraudulent mParivahan APK (see Figures 2 and 3).

During our investigation, we also repeatedly observed GitHub repositories and GitHub-hosted assets being used to distribute malicious APKs, providing attackers with readily available public hosting infrastructure.

Discovery of the GhostX Ecosystem

The GhostX investigation began with the discovery of multiple Android applications impersonating India’s mParivahan and eChallan ecosystem.

Samples were collected from phishing infrastructure and public GitHub repositories containing APKs named or presented as mParivahan, vehicle-challan, traffic-enforcement, or other related government applications.

Initial static analysis revealed that many of these APKs were only first-stage loaders. Their visible DEX code offered limited functionality, while the actual malware payload was either concealed within encrypted assets or retrieved later.

After unpacking the applications to their final payloads, we identified multiple custom C&C infrastructures, Firebase projects, and overlapping Android surveillance and financial-fraud capabilities.

A major breakthrough came from the analysis of a NextGen mParivahan sample whose unpacked payload contained the Firebase project identifier:

ghostx-panel

The exposed Firebase backend provided significantly greater visibility into the operator’s infrastructure and control workflow. The database contained structures including:

• clients
• bot_users
• admins
• admin_logins
• settings
• All_Users
• Verify_Device

Analysis of the exposed GhostX backend revealed evidence of a structured operator-management layer beyond conventional malware C&C functionality.

The database contained administrator and user records with role and account-status fields, a global session identifier, bot-user mappings, and dedicated admin_logins records containing device fingerprints, timestamps, and online status (see Figure 4).

These artifacts indicate that GhostX incorporates an authentication and session management framework for operator-side access and management of compromised devices.

The presence of distinct user, administrator, and bot-user roles suggests a multi-operator, service-oriented architecture. It raises the possibility that GhostX could support a Malware-as-a-Service-style operating model.

During continued monitoring of the exposed infrastructure, we observed that SMS lure content, phishing URLs, vehicle registration numbers, and recipient phone numbers were repeatedly changing, indicating active operator-side campaign management rather than a static or abandoned database (see Figure 5).

Similar eChallan-themed messages were also observed being received by users in the wild, further supporting the campaign's operational nature (see Figure 6).

One of the phishing URLs exposed through the GhostX infrastructure subsequently led us to a previously unseen GhostBat RAT variant, providing a direct investigative link among the backend control ecosystem, active phishing operations, and the malware's continued evolution.

These findings led us to assess that GhostX is not a single Android malware family or standalone application. Instead, GhostX represents a broader operator-controlled ecosystem encompassing phishing infrastructure, backend services, Firebase-based configuration and command mechanisms, device-management functionality, and malware distribution.

GhostBat RAT represents the Android implant operating within this ecosystem, with individual variants continuing to evolve across both delivery mechanisms and post-compromise capabilities.

Technical Analysis

Evolution of Droppers and Loaders

GhostBat RAT has undergone continuous changes in its delivery and payload-protection mechanisms.

Across the samples analyzed during the GhostX investigation, we identified multiple loader and dropper implementations designed to conceal the underlying malware payload, complicate static analysis, and reduce the effectiveness of hash- and signature-based detection.

Although the recovered payloads demonstrate overlapping capabilities for surveillance, financial theft, and device control, the mechanisms used to deliver and recover them vary considerably across samples.

Earlier variants relied on comparatively straightforward native loaders that decrypted embedded APK payloads using AES-CBC. Subsequent variants of Ghostbat RAT introduced XOR-encrypted custom containers, SPKZ/SPK1 packaging, split-APK delivery, dynamically loaded DEX components, and Java-based in-memory loaders.

One variant moved away from embedded payload delivery entirely. It operated as a remote downloader, retrieving a second-stage APK from remote infrastructure, validating its SHA-256 hash, and installing it through Android's package installation framework.

The most recent variant analyzed introduces a substantially more complex native loader implemented in libnetbridge.so. This loader combines multiple transformations, encryption, compression, and custom container stages before recovering the final GhostBat RAT payload.

This diversification indicates continued modification of the delivery layer while broadly retaining the malware's post-compromise objectives. Consequently, detections that focus only on the outer APK, the encrypted asset name, or a single unpacking routine are unlikely to provide durable coverage.

The GhostBat RAT loaders/droppers variants we observed are listed below:

The most recent GhostBat RAT sample introduced a significantly more complex native unpacking mechanism.

Unlike earlier variants that relied primarily on Java-based loaders or comparatively straightforward XOR/AES routines, this variant stores the encrypted payload inside an opaque application asset, assets/isti52q4, while most of the unpacking logic is implemented in the native library libnetbridge.so.

The visible application code does not directly expose the final malicious functionality. Instead, execution transitions to the native loader, which processes the embedded asset through several sequential stages of transformation and decryption (see Figure 8).

The first stage processes content within the encrypted asset file and derives values required for subsequent decoding. The resulting data is then passed through an RC4-like transformation before being processed through AES-256-GCM. This layered approach prevents the encrypted asset from being recovered using simple XOR or direct AES key extraction techniques that worked against earlier GhostBat RAT loaders.

Following successful decryption, the loader recovers an MSZ1-formatted intermediate object that is decompressed using zlib. The decompressed data contains an MSP1 container that packages the final Android application components.

The recovered payload consists of a split-APK application, including base.apk and split_config.dex.apk.

The executable malware code is primarily contained within the recovered split configuration DEX.

Unlike earlier samples, where the encrypted payload could be identified directly from ZIP headers or standard APK structures, the latest loader hides the final application behind several custom transformations before any recognizable Android package becomes available.

This significantly increases the effort required for automated unpacking and reduces the effectiveness of simple asset-scanning techniques.

Advanced GhostBat RAT Payload

GhostBat RAT has evolved from an Android SMS and information stealer into a modular remote-access and Banking Trojan.

Across the analyzed variants, the malware demonstrates capabilities for device profiling, SMS interception, remote SMS transmission, call-forwarding manipulation, payment-data theft, accessibility-based PIN capture, Firebase-driven command delivery, dynamic C&C configuration, and remote tunnelling.

In the new GhostBat RAT variant, we observed the introduction of Android Accessibility Service abuse, a technique commonly associated with modern Android Banking Trojans.

Earlier GhostBat RAT variants that we analyzed did not possess these capabilities during this investigation. The new variant uses Accessibility Service to monitor foreground applications, identify PIN-entry contexts, interact with application interfaces, and support two distinct credential-theft mechanisms: Ghost Overlay and targeted PIN/key-input capture.

Once Accessibility Services access is granted, the malware monitors the foreground application and compares it against configured target lists. These targets can be managed through Firebase Remote Config, allowing operators to selectively activate credential-capture functionality when a targeted banking, UPI, wallet, or payment application is in use.

Ghost Overlay

The most notable capability introduced in this variant is the Ghost Overlay technique.

Unlike conventional Android overlay attacks that display a fake login or payment page over the legitimate application, GhostBat RAT does not need to replace the victim's banking interface. Instead, it places transparent accessibility overlay regions directly over the real PIN keypad displayed by the targeted application.

The feature is controlled through Firebase Remote Config using:

ghost_overlay_enabled

ghost_overlay_packages

The default Ghost Overlay configuration targets the following Android packages:

com.mobikwik_new

com.google.android.apps.nbu.paisa

com.google.android.apps.nbu.paisa.user

When the malware detects one of these applications in the foreground and identifies a PIN-related activity, it creates a transparent keypad grid using Android’s TYPE_ACCESSIBILITY_OVERLAY. The overlay contains 12 touch regions matching the layout of a typical numeric PIN pad (see Figures 11 and 12):

When the victim taps a digit on the legitimate Google Pay or MobiKwik PIN keypad, the transparent Ghost Overlay intercepts the touch event before it reaches the underlying application.

The malware maps the touch coordinates to the corresponding keypad value and appends the resulting digit to an internal buffer used to reconstruct the PIN.

To avoid interrupting the payment flow or alerting the victim, GhostBat RAT temporarily releases the affected overlay region and uses AccessibilityService.dispatchGesture() to reproduce the same tap at the corresponding screen coordinates (see Figure 13).

As a result, the legitimate application receives the expected input and continues operating normally, while the malware records the victim's PIN in parallel.

The same mechanism handles DEL and OK interactions, allowing the GhostBat RAT to update the captured digit sequence and detect when the PIN entry process has completed. This intercept-and-replay behavior enables the malware to observe PIN entry without presenting a fake Google Pay or MobiKwik interface.

Once collected, the PIN is stored with metadata identifying the capture source as ghost_overlay and is subsequently queued for exfiltration over C&C “hxxps://api.cloudsettle[.]org/pin-data” (see Figure 14).

This technique is considerably stealthier than a conventional phishing overlay because the victim remains within the genuine financial application's interface throughout the interaction. GhostBat RAT effectively operates as an invisible intermediary, intercepting the victim's keypad interaction, recording the selected digits, and replaying those same touches into the legitimate application in near real time.

Targeted Keylogging and PIN Capture

In addition to the Ghost Overlay capability, the new GhostBat RAT variant implements a broader accessibility-based PIN/key-input capture mechanism targeting applications across India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.

Unlike the Ghost Overlay feature, which is specifically designed to intercept keypad touches in Google Pay and MobiKwik via transparent overlay regions, this functionality relies on Android Accessibility Service events to monitor user interactions across a much larger set of targeted applications.

The default pin_target_packages configuration includes 60 Android package identifiers for financial applications used across India (see Figure 15).

The target set includes applications associated with Google Pay, PhonePe, Paytm, MobiKwik, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance, Samsung Pay, and several other banking and payment services. The complete list of targeted Android packages is provided in the Targeted Application List section.

Once Accessibility Service is granted, GhostBat RAT monitors foreground activity and determines whether the currently running application(s) match an entry in pin_target_packages. The malware then evaluates the surrounding application and screen context before treating observed numeric input as potentially sensitive PIN information.

The malware also uses configurable PIN-length boundaries, pin_min_digits, and pin_min_digits to determine whether the reconstructed numeric sequence is consistent with an expected PIN.

Unlike Ghost Overlay, the broader keylogging mechanism does not rely on a transparent keypad overlay. Instead, GhostBat RAT uses Accessibility Service events and UI context to identify and reconstruct PIN-like input across a wider set of targeted financial applications, giving the malware substantially broader coverage within India’s banking and digital payment ecosystem.

The analyzed variant contains a dedicated worker responsible for handling captured PIN information, “PinUploadWorker”. Captured PINS are locally queued before being transmitted to the endpoint “/pin-data”.

The introduction of this capability substantially expands the financial targeting of GhostBat RAT. Earlier variants primarily relied on SMS interception, OTP theft, phishing interfaces, and call-forwarding manipulation.

The new variant can also monitor user interactions within legitimate financial applications and capture PIN-like input via Accessibility Service abuse.

Command and Control Infrastructure

The latest GhostBat RAT variant uses a multi-channel command-and-control architecture that combines a conventional HTTPS backend with Firebase services and a configurable WebSocket tunnel.

Compared with earlier variants, which relied more heavily on hardcoded infrastructure, the new implementation provides greater operational flexibility by allowing the attacker to modify backend addresses and enable or disable selected malware capabilities remotely.

In the analyzed sample, the default C&C infrastructure was configured as hxxps://api[.]cloudsettle[.]org. The malware communicates with this backend via multiple REST API endpoints that handle device registration, SMS collection, call log collection, command acknowledgement, PIN data submission, service state reporting, and other post-compromise functionality.

Endpoint	Purpose
/sms/batch	Uploads batches of SMS messages collected from the infected device
/sms/new	Sends newly received SMS messages to the C&C in near real time
/sms/delivery-status	Reports the delivery or failure status of remotely sent SMS messages
/call-logs/batch	Uploads collected call-log records in bulk
/call-logs/new	Sends newly observed call-log entries to the C&C
/devices/sim-info	Sends SIM and telephony-related information from the infected device
/devices/update-token	Registers or updates the device's Firebase Cloud Messaging token
/devices/service-status	Reports the operational status of malware services running on the device
/commands/ack	Acknowledges receipt or execution of commands issued by the C&C
/commands/call-forward/status	Reports the result or current state of call-forwarding operations
/ping-response	Responds to C&C ping requests and confirms that the infected device is online
/upload-response	Returns the result or status of generic upload or command operations
/pin-data	Uploads captured PIN-related data, including Ghost Overlay and broader PIN-capture records
/live-keylog/status	Reports or manages the operational state of the live keylogging functionality

One of the major changes in the latest GhostBat RAT variant is the use of Firebase Remote Config as an additional control layer. The analyzed payload is associated with the Firebase project andromeda-d389d and retrieves remotely managed configuration values that control both infrastructure and malware functionality.

Of particular interest is the base_url parameter, which allows the operator to replace the active REST backend without modifying or redistributing the APK. Therefore, api.cloudsettle.org represents the observed/default backend for this sample rather than a permanently fixed C&C address.

A similar dynamic C&C approach was observed during the GhostX investigation. An earlier NextGen mParivahan sample associated with the ghostx-panel Firebase project retrieved its backend configuration from Firestore using the app_config/network document and the baseUrl field.

In addition to the newly introduced Accessibility Service abuse, Ghost Overlay, targeted PIN capture, and dynamically configurable C&C functionality, GhostBat RAT continues to exhibit several core behaviors documented in our earlier research.

These include collecting SMS messages from compromised devices, monitoring newly received messages for banking- and OTP-related content, stealing UPI credentials through fraudulent mParivahan payment interfaces, and registering compromised devices with attacker-controlled infrastructure.

Earlier GhostBat RAT variants also used Telegram bots for device registration and operator notification, while selected dropper chains contained cryptocurrency-mining functionality alongside the information-stealing payload.

These previously documented capabilities remain important to the overall GhostBat RAT operation; however, the latest variants significantly expand the malware's financial-theft and remote-control functionality.

Rather than repeating the earlier functionality in detail, this analysis focuses on newly observed capabilities and architectural changes, particularly Accessibility Service abuse, Ghost Overlay PIN interception, broader targeting of financial applications, dynamic Firebase-based configuration, and evolving loader and C2 mechanisms.

Conclusion

The latest GhostBat RAT activity highlights continued evolution across both delivery mechanisms and post-compromise capabilities. The investigation into mParivahan- and eChallan-themed malware exposed the broader GhostX ecosystem, linking phishing infrastructure, backend control, and evolving GhostBat RAT payloads.

The introduction of Accessibility Service abuse, Ghost Overlay, broader PIN capture, and Firebase-driven dynamic configuration significantly expands the malware’s financial-theft capabilities while making the operation more adaptable. Combined with continuously evolving loaders and active phishing activity, GhostBat RAT remains a threat to Android users, particularly across India’s banking, UPI, and digital payment ecosystem.

Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.

CRIL’s analysis of this campaign has been selected for the upcoming Association of Anti-Virus Asia Researchers (AVAR) conference, where these findings will be showcased.

Our Recommendations

We have listed essential cybersecurity best practices that form the first line of defense against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms like the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you're certain of an app's legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities that malware exploits.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Procedure
Initial Access	Phishing (T1660)	GhostBat RAT is distributed through smishing messages containing malicious links that redirect victims to fake mParivahan/eChallan or Google Play-style pages used to deliver the malicious APK.
Persistence	Event Triggered Execution: Broadcast Receivers (T1624.001)	GhostBat RAT uses a boot-triggered Broadcast Receiver to restart its malicious services and workers after device reboot, allowing the implant to resume background activity.
Defense Evasion	Masquerading: Match Legitimate Name or Location (T1655.001)	GhostBat RAT masquerades as legitimate mParivahan/eChallan applications and uses government-themed names, icons, and interfaces to deceive victims.
Defense Evasion	Obfuscated Files or Information: Software Packing (T1406.002)	GhostBat RAT uses multiple encrypted and packed loader mechanisms, including AES-CBC, XOR, SPKZ/SPK1, encrypted DEX stages, and the libnetbridge.so multi-stage loader to conceal the final payload.
Defense Evasion	Download New Code at Runtime (T1407)	One observed GhostBat RAT delivery variant remotely downloads a second-stage APK, validates the payload, and installs it after the initial dropper executes.
Defense Evasion	Input Injection (T1516)	GhostBat RAT abuses AccessibilityService.dispatchGesture() to replay intercepted PIN-keypad touches into legitimate Google Pay and MobiKwik applications as part of the Ghost Overlay technique.
Credential Access	Abuse Accessibility Features (T1453)	The latest GhostBat RAT variant abuses Android Accessibility Service to monitor targeted financial applications, identify PIN-entry contexts, capture sensitive input, and support Ghost Overlay activity.
Credential Access	Input Capture: Keylogging (T1417.001)	GhostBat RAT uses Accessibility Service events to capture PIN/key-input activity from targeted financial applications. The default configuration targets 60 Android banking, UPI, wallet, fintech, and payment applications.
Credential Access	Input Capture: GUI Input Capture (T1417.002)	Selected GhostBat RAT variants use fraudulent payment interfaces to capture UPI PINs, payment-card details, and other financial information entered by victims.
Credential Access	Access Notifications (T1517)	Selected GhostBat RAT variants register a notification-listener service to monitor notifications generated by other applications, potentially exposing OTPs and other sensitive information.
Discovery	System Information Discovery (T1426)	GhostBat RAT collects device information including Android version, device model, manufacturer, identifiers, and other system metadata.
Discovery	Software Discovery (T1418)	GhostBat RAT can enumerate applications installed on the compromised device and uses package information to identify targeted banking and financial applications.
Collection	Protected User Data: SMS Messages (T1636.004)	GhostBat RAT collects historical SMS messages and monitors newly received messages, including OTPs, banking alerts, and other sensitive message content.
Collection	Protected User Data: Call Log (T1636.002)	GhostBat RAT collects call-history information and uploads historical and newly observed call-log records through its C2 infrastructure.
Impact	SMS Control (T1582)	GhostBat RAT can receive attacker-defined SMS jobs and send messages through the infected device's SIM, allowing compromised devices to be used for remotely controlled SMS transmission and potentially further smishing activity.
Impact	Call Control (T1616)	GhostBat RAT can manipulate and query call forwarding using USSD-based operations and report the forwarding state to its C2 infrastructure.
Command and Control	Application Layer Protocol: Web Protocols (T1437.001)	GhostBat RAT communicates with its backend through HTTPS REST APIs and uses Firebase Cloud Messaging for command delivery. The latest variant also contains a configurable secure WebSocket communication channel.

The post The GhostX Ecosystem: Forged in Transit, Licensed to Deceive appeared first on Cyble.

Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve — phishing pages and fake executive profiles often do their damage within hours of going live, while manual removal can take days. A managed takedown program pairs continuous, verified monitoring with pre-authorized removal (in-certain cases), cutting the exposure window from days to hours. This matters most for consulting and professional services firms, where a spoofed domain or fake executive profile can compromise the client trust the business is built on.

How UNC3753 targeted US professional services firms in 2026

Between January and May of 2026, Google's Mandiant threat intelligence team tracked a financially motivated extortion campaign — attributed to a group known as UNC3753, or "Luna Moth," or "Silent Ransom Group" — working its way through dozens of professional, legal, and financial services organizations across the United States. The approach was almost old-fashioned. A benign-looking email about a data migration or an unpaid invoice, a follow-up phone call from someone posing as IT support, and a request to install "remote monitoring" software to fix the problem. No exploit. No malware dropped on day one. Just a firm's own trust in its brand and its people, turned against it.

It's a useful — if unsettling — reminder of why brand and executive impersonation isn't a side issue for professional services firms. It's often the entry point.

How much does phishing and impersonation actually cost US businesses

The scale of the problem, in dollar terms, is no longer subtle. The FBI's Internet Crime Complaint Center logged just over one million complaints in 2025 — the highest volume in the program's history — with phishing and spoofing making up roughly a fifth of all reports. Losses tied to phishing alone roughly tripled year-over-year, and business email compromise, which almost always starts with an attacker impersonating someone the victim trusts, accounted for over $3 billion in reported losses on its own. The mechanics of that damage matter too: the overwhelming majority of BEC losses move through wire transfer or ACH, rails that are fast, largely irreversible, and unforgiving of a slow response.

Put those two facts together and a pattern emerges. Impersonation attacks — of a brand, a partner, an executive, a vendor invoice — aren't rare or exotic. They're the default opening move. And once the fraudulent domain, profile, or listing is live, the clock the defender is racing isn't measured in days. It's measured in hours, sometimes less, before money moves or credentials are harvested.

Why are consulting and professional services firms specifically targeted?

Professional services firms occupy a strange position in the threat landscape. They're rarely the most technically fortified target, but they're consistently one of the most valuable ones. A consulting firm doesn't just protect its own data — it holds engagement records, financial models, and confidential strategy documents belonging to dozens of clients across industries. About 29% of U.S. law firms reported having experienced a security breach at some point, according to the ABA's most recent Legal Technology Survey — up from 25% just two years earlier. The same dynamic applies to consultancies. The firm is a single point of entry into a much larger web of client relationships.

That's precisely the exposure described in Cyble's case study of a U.S. consulting organization managing highly sensitive engagement data, confidential client information, and a large, distributed workforce operating across the country. As the case study describes it, the firm's brand, executives, and digital infrastructure were frequent targets specifically because of the trust clients placed in them as an advisor. Senior partners were likely of being impersonated through fake social profiles and spoofed domains. Fraudulent job postings and phishing campaigns leaned on the firm's own credibility to look legitimate. The attacker doesn't need to breach the firm's network if a client can be convinced, through a look-alike domain or a cloned executive profile, to simply hand over what the attacker wants.

That's the mechanism UNC3753 exploited nationally in 2026, and it's the exact exposure this consulting firm was trying to close.

Also read: Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors

What is the "whack-a-mole" problem in brand protection?

Here's where most brand protection programs quietly fail, and it isn't a detection problem — it's a speed problem.

A typical manual takedown workflow looks something like this: someone on the security or marketing team spots a phishing page or a fake LinkedIn profile impersonating a partner. They file an abuse report with the registrar or the platform. They wait. Maybe they follow up. Eventually, the page comes down — but by then, a new one has often already gone live, sometimes registered by the same actor under a slightly different domain.

This was exactly the challenge the consulting firm faced before its engagement with Cyble. Identifying and removing phishing pages, fraudulent job postings, and impersonating domains was, in the case study's own words, reactive and resource-intensive, leaving the brand exposed for longer than the firm considered acceptable. It's a program that looks active — tickets filed, pages eventually removed — while the actual window of exposure, the hours where a client or job candidate could act on the fake page, stays wide open. Volume of takedowns filed is an easy number to report. Speed of resolution is the number that actually protects anyone.

What does managed takedown response actually involve

The shift the case study describes isn't just "faster takedowns" — it's a change in the operating model, from reactive point-solution to continuous, managed coverage. Three pieces work together in the deployment:

• Brand and Executive Monitoring continuously scans for phishing domains, fraudulent job postings, and impersonation attempts using the firm's name, alongside dedicated monitoring of senior leadership profiles across social platforms — catching the fake partner LinkedIn account or spoofed domain before it's had time to circulate.
• Verification before escalation means the security team isn't drowning in unconfirmed alerts. Threats are validated as genuine before they ever reach someone's desk, which is what separates consolidated intelligence from just another noisy dashboard.
• Managed Takedown Services then handle the actual removal — confirmed phishing pages, impersonating domains, and fraudulent listings — without the internal team having to individually chase registrars and platforms one abuse ticket at a time.

The outcome is a meaningfully shortened window between detection and removal — turning a slow, manual, ticket-by-ticket grind into something closer to continuous coverage. That's the real distinction between a takedown service and a takedown program: one reacts when someone happens to notice a fake page; the other is built to notice, verify, and resolve on a timeline that assumes attackers move fast, because they do.

Why client trust is the real asset at risk

For a consulting firm, the financial cost of an impersonation attack is rarely the headline risk. The deeper cost is what it does to the relationship a firm's entire business is built on. When a client, a job candidate, or a prospective hire can't tell the difference between a legitimate email from the firm and a spoofed one, the firm's advisory credibility — the thing it's actually selling — starts to erode. That's a slower, quieter kind of damage than a wire fraud loss, but for a professional services firm, it may be the more expensive one.

The lesson from both the national threat data and this specific engagement is the same – brand and executive impersonation isn't a marketing nuisance to be cleaned up occasionally. It's a live attack surface, moving at a speed that manual, ad hoc takedown processes were never built to match. Firms that treat it that way — with continuous monitoring, verified alerts, and managed resolution — are the ones that keep the exposure window measured in hours instead of days.

---

Frequently asked questions (FAQs)

What is a brand impersonation takedown service?

A brand impersonation takedown service identifies fraudulent domains, phishing pages, fake social media profiles, and impersonating job listings that misuse a company's name or logo, then works with registrars, hosting providers, and platforms to have that content removed.

How long does it take to take down a phishing site?

Timelines vary by registrar and hosting provider, but manual, ticket-based takedown requests commonly take days to resolve. Managed takedown programs that pre-verify threats and maintain direct relationships with providers can shorten that window to hours.

Why do manual takedown processes fail against brand impersonation?

Manual processes fail because they're reactive: a person has to notice the fake page, file a report, and wait for a third party to act, while attackers can register replacement domains faster than any single report gets resolved. The volume of tickets filed can look productive even while the actual exposure window stays open.

What's the difference between takedown volume and takedown speed?

Takedown volume measures how many fraudulent pages were reported or removed over time. Takedown speed measures how quickly a live threat is detected, verified, and taken down after it appears. Speed is the metric that actually limits damage, since most harm from a phishing page happens in its first hours online.

How can consulting and professional services firms protect executives from impersonation?

Dedicated executive monitoring tracks senior leaders' names and likenesses across social platforms and the web to catch fake profiles, spoofed communications, and impersonation attempts early, ideally paired with managed takedown so confirmed threats are removed without requiring the executive or internal team to handle it themselves.

---

Sources:

FBI Internet Crime Complaint Center, 2025 Internet Crime Report;
Cyble, "How Cyble Delivered Unified Multi-Layered Threat Intelligence to a U.S. Consulting Organization";
Google/Mandiant, "Ongoing Targeted Campaign Against US Law Firms" (2026);
American Bar Association Legal Technology Survey.

The post Brand Impersonation Takedown: From Whack-a-Mole to Managed Response appeared first on Cyble.

Executive Summary 

The FIFA World Cup 2026 has become more than a global sporting event. It has evolved into a large-scale cybercrime opportunity exploited by threat actors through a coordinated ecosystem of fraudulent domains, social media channels, messaging platforms, pirated streaming services, and dark web activity. Since May 2026, Cyble Research and Intelligence Labs (CRIL) has identified nearly 4,000 domains impersonating FIFA-related brands, ticketing platforms, streaming services, and fan-facing resources. 
 
Operation FanTrap reveals how threat actors are building end-to-end fraud operations designed to attract, engage, and monetize football fans worldwide. Victims are lured through fake ticket offers, VIP access schemes, counterfeit hospitality portals, and unauthorized streaming platforms. Evidence also shows victims being redirected to private communication channels such as Telegram and WhatsApp, where payment fraud, credential theft, and identity harvesting occur. 
 
CRIL’s investigation also identified growing dark web activity linked to the tournament, including claims of football-sector identity data leaks and discussions around ticket resale opportunities. While the authenticity of some leak claims remains under investigation, their circulation highlights the increasing convergence of fan-targeted fraud, identity theft, and cyber-enabled financial crime. 
 
The campaign demonstrates how major international events create a scalable environment for cybercriminal operations. Through multilingual targeting, extensive infrastructure deployment, and diversified monetization strategies, threat actors are transforming global sporting events into sustained cybercrime ecosystems. 

Key Takeaways 

• Operation FanTrap is a coordinated investigation into the broader fraud ecosystem exploiting global interest in FIFA events 

• Nearly 4,000 FIFA-themed domains were identified supporting phishing, ticket fraud, VIP scams, streaming lures, and brand impersonation. 

• The websites used a multilingual infrastructure to maximize victim reach, with a particularly strong focus on Chinese-speaking audiences. 

• Telegram and WhatsApp function as transaction layers where victims are moved from public-facing infrastructure into private fraud workflows. 

• Pirated streaming platforms serve as credential theft and payment fraud funnels rather than simple copyright violations. 

• Dark web discussions and alleged football-sector identity leaks create opportunities for targeted social engineering and secondary monetization. 

Campaign overview 

Parameter	Observed Value
Campaign Codename (CRIL)	Operation FanTrap
Monitoring Window	May 2026 – June 2026 (ongoing)
Dominant Fraud Categories	Ticket scam, VIP access fraud, pirate streaming, phishing
Primary Target Demography	Chinese-speaking fans, Korean fans, Latin American fans
Dark Web Activity	Forum-based ticket resale fraud; identity data leak claims

The FIFA World Cup 2026 will span the US, Canada, and Mexico, with a 48-team format and global broadcast reach. CRIL's monitoring uncovered significant spikes in malicious domain registrations mapped to specific attack themes, demonstrating how threat actors rapidly adapted their infrastructure to capitalize on tournament-related interest. 

Anatomy of the FIFA 2026 Fraud Ecosystem 

Domain Patterns - The Fraud Ecosystem 

Threat actors leveraged ticketing, VIP access, official branding, and live streaming to broaden their victim pool. Examples of these domain patterns are shown in the table below. 

Domain Pattern	Example Domains	Count	Fraud Category
zh-[term]-fifa.com	zh-worldcuphub-fifa.com, zh-nowlive-fifa.com	541	Chinese-language phishing/streaming
cn-[term]-fifa.com	cn-vpn-fifa.com, cn-setting-fifa.com	372	Chinese-language credential/VPN phishing
[term]-worldcup-fifa.com	play-worldcup-fifa.com, vip-worldcup-fifa.com	413	Brand impersonation
[term]-wc-fifa.com	cctv-maiqiu-fifa-wc.com, ssl-cn-fifa-wc.com	391	Ticketing/streaming fraud
fifa-ticket-[term].com	fifa-ticket-26.com, fifa-freetickets.*.top	10+	Ticket scam
fifa-vip-[term].com	fifa-vip-huya.com, fifa-vip-wcplay.com	84	VIP/premium access fraud
official-[term]-fifa.com	official-live-fifa.com, official-2026-fifa.com	87	Brand authority impersonation
live-[term]-fifa.com	vip-live-fifa.com, web-live-fifa.com	219	Pirate streaming
maiqiu variants	chn-maiqiu-fifa-worldcup.com, cctv-maiqiu-fifa.com	51	Chinese ticket-buying fraud

The extensive use of zh-, cn-, and Chinese-language World Cup labels such as shijiebei, pankou, and maiqiu highlights a deliberate focus on Mandarin-speaking audiences. This targeting extends beyond traditional ticket fraud to encompass betting platforms, media-themed credential theft, piracy lures, prize scams, and counterfeit merchandise. This signals a persistent and organized fraud ecosystem designed to capitalize on China's large football fanbase and strong demand for World Cup-related content and services. 

Dark Web Intelligence 

We also identified a growing ecosystem of ticket resale fraud on Telegram and WhatsApp, as well as pirated streaming lures. Both are actively used to monetize fan interest and facilitate fraud, credential harvesting, and other malicious activity. 

Resell Traps on Messaging Services. 

Monitoring of deep- and dark-web sources identified numerous advertisements and reseller communities promoting FIFA World Cup tickets via Telegram and WhatsApp. Fraudsters frequently use these platforms because they facilitate private, direct communication while limiting oversight and accountability.  

Threat actors often establish credibility through fabricated testimonials, forged purchase confirmations, edited screenshots, recycled ticket images, and scripted customer-support interactions. However, such indicators of legitimacy can be easily manufactured and should not be considered proof of ticket ownership or delivery capability. Additionally, the closed nature of these channels enables attackers to create a sense of urgency, collect payments, and disengage victims with minimal traceability. 

The example below illustrates a Telegram-based ticket resale advertisement identified during monitoring, highlighting the use of unofficial and potentially fraudulent sales channels. 

The pirated stream trap: free football, expensive consequences 

Pirated streaming sites exploit fans seeking free access to World Cup matches, using geo-restrictions, subscription costs, and broadcast limitations as bait. Rather than delivering live streams, many function as fraud and malware distribution platforms, employing fake video players, deceptive download prompts, browser notification prompts, and fraudulent free-trial offers to harvest credentials, payment information, and user data.  

To evade detection, we identified domains that avoid FIFA- or World Cup-related keywords in domain names. These links are promoted through fan forums, Discord servers, Telegram channels, and WhatsApp groups, lending credibility to malicious infrastructure. 

Examples identified during monitoring include: 

• footybite[.]vc 

• epicsports[.]in 

• footballnewslive[.]online 

• totalsportek[.]online 

• sportshub[.]fan 

• streameast[.]im 

The risk is beyond legal or copyright concerns. For many fans, the real danger lay in the broader cybersecurity ecosystem surrounding these platforms. Pirated streaming sites and services often acted as data collection points, quietly harvesting email addresses, passwords, payment details, phone numbers, and device information. 

Unofficial streaming apps and APK files added another layer of risk. They frequently requested excessive permissions, delivered intrusive ads, tracked user activity, and in some cases, served as entry points for malware. What seemed like a convenient way to watch a match could quickly turn into a channel for data exposure and system compromise. 

Ticket Scams and VIP Access Fraud  

Forum-based ticket promotions added another layer of risk to World Cup scams by combining resale listings with the appearance of community trust. Sellers often seemed more credible than random social media accounts, as consistent posting, forum history, and visible profile activity created a sense of legitimacy. However, this credibility could be misleading. Fans should remain cautious, as an active profile did not guarantee ticket authenticity, official authorization, secure payments, or a successful transfer—even within seemingly trusted communities. 

Identity and PII leak claims  

CRIL also observed forum discussions about leaked football-related identity data, highlighting how World Cup–related cybercrime can extend beyond fan scams into the broader football ecosystem. For example, one post titled “150k+ football passports leaked weeks before FIFA World Cup” claimed that passport scans and personal details of over 150,000 AFC and Al Nassr FC players and coaches had been exposed. The alleged leak included sensitive information such as full names, passport numbers, scans, dates of birth, nationalities, player roles, club affiliations, email addresses, contracts, AFC IDs, and even match or venue details.  

Such claims require independent forensic verification before a confirmed breach status can be assigned. Regardless of authenticity, the circulation of this data in the pre-tournament window confirms threat actors are actively seeking to monetize football-sector identity assets. If the record set is genuine, it enables targeted spear-phishing against club staff, agent impersonation in transfer fraud, contract manipulation, and abuse of venue access credentials. 

Connecting the Ecosystem – Attack Lifecycle 

By correlating our findings and research, we reconstructed the end-to-end attack chain used by threat actors. The analysis demonstrates how these seemingly independent activities are strategically aligned around the global popularity of FIFA events, enabling attackers to exploit fan enthusiasm, urgency, and trust. Together, these components form a coordinated FIFA-themed fraud ecosystem designed to attract victims, harvest sensitive information, facilitate financial fraud, and generate sustained criminal revenue.

The stages are as follows: 

• Stage 1 – Infrastructure Preparation: Registration of FIFA-themed domains and supporting online assets. 
• Stage 2 – Victim Acquisition: Promotion through search engines, social platforms, forums, messaging communities, and streaming portals. 
• Stage 3 – Engagement and Conversion: Fake ticket sales, VIP packages, hospitality offers, and streaming access are used to build trust. 
• Stage 4 – Data Collection: Harvesting of credentials, payment information, personal identifiers, and communication details. 
• Stage 5 – Monetization: Fraudulent payments, resale scams, credential abuse, phishing campaigns, and potential resale on the dark web of collected information. 

Conclusion 

Operation FanTrap demonstrates how global sporting events have evolved into highly attractive targets for organized cybercriminal activity. Rather than relying on isolated phishing campaigns or opportunistic scams, threat actors are building interconnected ecosystems that combine malicious infrastructure, social engineering, messaging platforms, streaming lures, and dark web activity to maximize financial returns. 

The nearly 4,000 domains identified by CRIL represent only one layer of a broader operation designed to exploit fan enthusiasm, event urgency, and global online engagement. Ticket scams, VIP access fraud, streaming lures, and alleged football-sector identity leaks collectively illustrate how attackers are diversifying their monetization strategies throughout the tournament lifecycle. 

As the FIFA World Cup 2026 continues, organizations, broadcasters, ticketing providers, and fans should view these activities not as isolated incidents but as components of an active and evolving cybercrime ecosystem. Continuous monitoring, rapid infrastructure disruption, dark web visibility, and proactive user awareness will remain critical to reducing risk throughout the tournament. 

CRIL will continue tracking this cluster and updating IoCs as new infrastructure emerges. All indicators are submitted to Cyble's threat feeds and accessible to Vision platform customers. Fan-facing brands, ticketing platforms, and event organizers should treat this as an active threat and prioritize domain monitoring and takedown workflows throughout the tournament. 

Recommendations 

Based on the findings presented above, CRIL recommends the following actions for immediate consideration by security teams and organizations: 

• Implement keyword-aware domain monitoring that flags FIFA, tournament branding, and language-prefix patterns (zh-, cn-, kr-) as compounding risk signals alongside registrar identity, TLD, and domain age. 

• Build takedown workflows that account for Cloudflare-proxied infrastructure — abuse requests must target the underlying origin, not the CDN layer, to be operationally effective. 

• Integrate campaign-cluster pivoting from confirmed IoCs into threat hunting workflows, using shared IP subnets and registrar concentration as primary pivot axes. 

• Apply multi-platform fraud funnel awareness: detection should extend beyond domains to Telegram and WhatsApp channels used for off-platform transaction completion. 

• For ticketing platforms and official broadcasters: issue proactive fan advisories confirming that legitimate ticket transactions will never be negotiated via private messaging apps or unverified resale portals. 

• Revise security awareness materials to teach structural URL interpretation — with specific focus on identifying lookalike FIFA domains that embed official terminology in subdomains or hyphenated strings rather than the root registered domain. 

• Monitor dark web forums for emerging data leak claims targeting football organizations, and treat leaked PII — particularly passport and contract data — as an active social engineering enabler requiring targeted victim notification. 

The need for a proactive cyberdefense stance 

The current threat landscape includes a multitude of Social Engineering campaigns. Security teams need more than reactive controls to keep ahead of these. 

Solutions such as Cyble Vision deliver operational intelligence that enables defenders to stay ahead of adversaries through early detection, campaign-level visibility, and infrastructure mapping. 

Cyble Vision specifically empowers security teams to move beyond isolated detection, providing the strategic insight needed to anticipate threats, monitor adversary activity, and respond with precision at every stage of the attack lifecycle. Security teams can take necessary preventive action with the help of: 

• Real-Time IOC Monitoring 
  Enable continuous tracking of indicators tied to adversary infrastructure before they reach end users. 

• Credential Phishing Infrastructure Mapping 
  Map attacker-controlled infrastructure, including fake authentication portals, dynamic exfiltration endpoints, and backend logic designed to capture credentials. 

• Brand and Executive Impersonation Monitoring 
  Detect domain spoofing and impersonation attempts targeting internal functions such as HR and Finance—often used to increase trust and exploit user familiarity. 

• Deep and Dark Web Visibility 
  Surface chatter, leaked credentials, and phishing toolkits from deep/dark web sources, offering early insight into attacker preparation and target selection. 

• Global Targeting Intelligence 
  Track phishing activity across global regions—including North America, EMEA, and APAC—as well as over 70 industry sectors, providing defenders with contextual understanding of targeting patterns. 

• Threat Actor Attribution and TTP Correlation 
  Associate infrastructure, techniques, and behavioral patterns with known threat actors, empowering security teams to prioritize response based on adversary capability and intent. 

MITRE ATT&CK® Techniques 

Tactic	Technique ID	Technique Name
Resource Development	T1583.001	Acquire Infrastructure: Domains
Resource Development	T1583.006	Acquire Infrastructure: Web Services
Resource Development	T1585.001	Establish Accounts: Social Media Accounts
Initial Access	T1566.002	Phishing: Spearphishing Link
Credential Access	T1056.003	Web Portal Capture
Command and Control	T1102	Web Service
Impact	T1657	Financial Theft

Indicators of Compromise (IOCs) 

The IOCs have been added to this GitHub repository. Please review and integrate them into your Threat Intelligence feed to enhance protection and improve your overall security posture. 

The post Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem appeared first on Cyble.