🚀 CloudSEK has raised $19M Series B1 Round – Powering the Future of Predictive Cybersecurity
Read More
Identify and counter malicious links and phishing attempts effectively with CloudSEK XVigil Fake URLs and Phishing module, bolstering your defense against cyber threats
Schedule a DemoCategory:
Adversary Intelligence
**Type:
**Spear phishing
Industry:
IT
Region:
India
Highlight: Recent investigations that displayed impersonation of the CEO’s publicly available pictures as Whatsapp Profile Pictures as a social engineering tactic to convince the victim.
Figure 1: Whatsapp message received by employees
While investigating the incident for the modus operandi and likely Tactics, Techniques and Procedures we discovered the following:
Based on our experience in investigating similar incidents, we observed following:
Senior employees of the organization can be looked up from Linkedin. Threat actors then use popular Sales Intelligence or Lead Generation tools such as Signalhire, Zoominfo, Rocket Reach to gather PII information like emails, phone numbers, and more. These online databases of businesses have their methodologies for obtaining, verifying, and then selling the employees’ contact details of an entity.
SignalHire LinkedIn email extractor is a software built to help navigate through LinkedIn profiles and collect contact information of all people relevant to your business. The following are some examples of how senior employees' personal contact details can be extracted from Linkedin using SignalHire:
Figure 2: SignalHire information extraction from LinkedIn
CloudSEK’s flagship digital risk monitoring platform XVigil contains a module called “Underground Intelligence” which provides information about the latest Adversary, Malware, and Vulnerability Intelligence, gathered from a wide range of sources, across the surface web, deep web, and dark web.
While triaging the discussions on TOR-based (Dark Web) and surface web cybercrime forums/marketplace, our threat researchers discovered multiple posts related to the sale of databases of companies like signalhire that allegedly contain personal phone numbers of employees of various corporations.
Figure 3: Threat actors' posts on the cybercrime forum
The Conti ransomware first appeared as a sophisticated Ransomware-as-a-Service (RaaS) in 2019. The group uses multiple methods to distribute its ransomware. The most common one is phishing which includes spear-phishing campaigns and social engineering techniques to induce victims to submit more information or access credentials.
One of the tools used by the Conti group is gathering information from business information services like Zoominfo and Signalhire.
Figure 4:Source: INFOSECURITY MAGAZINE
Phishing attacks are no longer just about fake emails and shady links—they’re evolving into stealth operations that outsmart even the most advanced detection tools. In this blog, CloudSEK’s Threat Research Team reveals how modern phishers use geo-fencing, user-agent filtering, and other evasive tactics to stay hidden from traditional scanners. Backed by real-world examples and expert insights, we also show how CloudSEK’s XVigil platform, powered by its Fake Domain Finder (FDF) module, is uncovering what others miss. Read on to learn how today’s phishing campaigns are engineered to deceive—and how to fight back.
CloudSEK’s Threat Research Team uncovered a sophisticated scam targeting air travelers at Indian airports. The fraud involves a malicious Android application named Lounge Pass, distributed through fake domains like loungepass.in. This app secretly intercepts and forwards SMS messages from victims’ devices to cybercriminals, resulting in significant financial losses. The investigation revealed that between July and August 2024, over 450 travelers unknowingly installed the fraudulent app, resulting in a reported theft of more than INR 9 lakhs (approx. $11,000). The scammers exploited an exposed Firebase endpoint to store stolen SMS messages. Through domain analysis and passive DNS data, researchers identified several related domains spreading similar APKs. Key recommendations include downloading apps only from official stores, avoiding scanning random QR codes, and never granting SMS access to travel or lounge apps. Travelers should book lounge access through official channels and stay vigilant to protect their personal data. Stay updated on the latest scams and protect your travel data by following these guidelines.
Over recent months, the United States has faced a surge in cyber attacks, with ransomware incidents rising sharply from June to October 2024. Prominent groups, including Play, RansomHub, Lockbit, Qilin, and Meow, have targeted sectors such as Business Services, Manufacturing, IT, and Healthcare, compromising over 800 organizations. Major attacks included a breach of the City of Columbus by Rhysida ransomware and data leaks impacting Virginia’s Department of Elections and Healthcare.gov. Additionally, China’s "Salt Typhoon" espionage campaign is aggressively targeting U.S. ISPs, further complicating the cyber threat landscape. Hacktivist groups advocating pro-Russian and pro-Palestinian positions have also increased their attacks, affecting government entities and critical infrastructure. This report highlights the need for enhanced security protocols, regular audits, and public awareness initiatives to mitigate the growing cyber risks. Key recommendations include implementing multi-factor authentication, frequent employee training, and advanced threat monitoring to safeguard the nation's critical infrastructure and public trust.
Take action now
CloudSEK Platform is a no-code platform that powers our products with predictive threat analytic capabilities.
Digital Risk Protection platform which gives Initial Attack Vector Protection for employees and customers.
Software and Supply chain Monitoring providing Initial Attack Vector Protection for Software Supply Chain risks.
Creates a blueprint of an organization's external attack surface including the core infrastructure and the software components.
Instant Security Score for any Android Mobile App on your phone. Search for any app to get an instant risk score.
7
min read
While investigating phishing cases of various customers, CloudSEKs’ analysts identified a spear phishing campaign targeting multiple corporations.
Category:
Adversary Intelligence
**Type:
**Spear phishing
Industry:
IT
Region:
India
Highlight: Recent investigations that displayed impersonation of the CEO’s publicly available pictures as Whatsapp Profile Pictures as a social engineering tactic to convince the victim.
Figure 1: Whatsapp message received by employees
While investigating the incident for the modus operandi and likely Tactics, Techniques and Procedures we discovered the following:
Based on our experience in investigating similar incidents, we observed following:
Senior employees of the organization can be looked up from Linkedin. Threat actors then use popular Sales Intelligence or Lead Generation tools such as Signalhire, Zoominfo, Rocket Reach to gather PII information like emails, phone numbers, and more. These online databases of businesses have their methodologies for obtaining, verifying, and then selling the employees’ contact details of an entity.
SignalHire LinkedIn email extractor is a software built to help navigate through LinkedIn profiles and collect contact information of all people relevant to your business. The following are some examples of how senior employees' personal contact details can be extracted from Linkedin using SignalHire:
Figure 2: SignalHire information extraction from LinkedIn
CloudSEK’s flagship digital risk monitoring platform XVigil contains a module called “Underground Intelligence” which provides information about the latest Adversary, Malware, and Vulnerability Intelligence, gathered from a wide range of sources, across the surface web, deep web, and dark web.
While triaging the discussions on TOR-based (Dark Web) and surface web cybercrime forums/marketplace, our threat researchers discovered multiple posts related to the sale of databases of companies like signalhire that allegedly contain personal phone numbers of employees of various corporations.
Figure 3: Threat actors' posts on the cybercrime forum
The Conti ransomware first appeared as a sophisticated Ransomware-as-a-Service (RaaS) in 2019. The group uses multiple methods to distribute its ransomware. The most common one is phishing which includes spear-phishing campaigns and social engineering techniques to induce victims to submit more information or access credentials.
One of the tools used by the Conti group is gathering information from business information services like Zoominfo and Signalhire.
Figure 4:Source: INFOSECURITY MAGAZINE