Ankura CTIX FLASH Update - July 30, 2024

Malware Activity

GXC Team Cybercrime Group Harnesses AI for Vishing

Researchers at Group-IB have been tracking sophisticated phishing campaigns associated with the cybercrime group "GXC Team" which has targeted customers of financial institutions since January 2023. The GXC Team operation is notable as it bundles an AI-powered Phishing-as-a-Service (PhaaS) platform with Android malware designed to steal one-time passwords (OTPs). GXC Team advertises their criminal services in dark web forums and private telegram channels, selling their phishing kit and malware bundle for $500 per month. GXC Team-linked campaigns have targeted users of over thirty-six (36) Spanish banks and thirty (30) institutions worldwide including cryptocurrency exchanges in the United States. Researchers have identified at least 250 phishing domains linked to these campaigns. The attacks typically begin with a smishing (SMS-phishing) message impersonating the victim's financial institution,