Ankura CTIX FLASH Update - October 25, 2022

Ransomware/Malware Activity

Phishing Campaign Using Over Two Hundred Typosquatted Domains to Impersonate Twenty-Seven Brands

A mass phishing campaign has recently been identified that is utilizing approximately 200 typosquatted domains. Through this campaign, the threat actor responsible is intending to have victims download various Android and Windows malware. Cyble researchers discovered that the domains are being disguised as popular Android application stores and download portals for multiple platforms, utilizing six (6) typosquatted domains. This portion of the phishing campaign is focused on deploying "ERMAAC", a banking trojan that targets banking accounts and cryptocurrency wallets. BleepingComputer identified a larger portion of the campaign that involves over ninety (90) domains impersonating twenty-seven (27) brands including Google Play, PayPal, Microsoft Visual Studio, TikTok, Notepad+, MetaMask, and more. This portion of the campaign focuses on