Exclusive: The largest mobile malware marketplace identified by Resecurity in the Dark Web

guest · Jan 9, 2023

By Pierluigi Paganini - December 5, 2022

“In the Box” dark web marketplace is leveraged by cybercriminals to attack over 300 financial institutions (FIs), payment systems, social media and online-retailers in 43 countries

Resecurity, the California-based cybersecurity company protecting major Fortune 500 companies, has identified a new underground marketplace in the Dark Web oriented towards mobile malware developers and operators. The marketplace is known as “InTheBox”, and has been available for cybercriminals in the TOR network from at least the start of May 2020, however since then it has transformed from a cybercriminal service operating privately into the largest marketplace known today for it’s sheer number of unique tools and so called WEB-injects offered for sale.
Click to expand...

According to the experts from Resecurity, the identified “In The Box” marketplace may now proudly be called the largest and most significant catalyst for banking theft and fraud involving mobile devices. The significance of findings is highlighted by the quality, quantity and spectrum of the available malicious arsenal.

Currently, cybercriminals are offering over 1,849 malicious scenarios for sale, designed for major financial institutions, ecommerce, payment systems, online retailers, and social media companies from over 45 countries including the U.S, the U.K, Canada, Brazil, Colombia, Mexico, Saudi Arabia, Bahrain, Turkey, and Singapore. The supported organizations targeted by cybercriminals include Amazon, PayPal, Citi, Bank of America, Wells Fargo, DBS Bank, etc. During November 2022 the actor arranged a significant update of close to 144 injects and improved their visual design.
Click to expand...

Resecurity: "In The Box" - Mobile Malware Webinjects Marketplace

November 25, 2022
With the rapid growth of fraudulent activity in a post-pandemic world, the bad actors continue to upgrade their tooling to attack customers of major financial institutions (FIs), e-commerce platforms and online marketplaces. According to collected statistics in Q4 2022 during DFIR engagements conducted on Fortune 500 companies by Resecurity®, cybercriminals are especially successful when attacking mobile apps and leveraging gained access for further unauthorized access and financial theft.
Click to expand...

guest · Feb 1, 2023

Over 1,800 Android phishing forms for sale on cybercrime market
By Bill Toulas @billtoulas - February 1, 2023

A threat actor named InTheBox is promoting on Russian cybercrime forums an inventory of 1,894 web injects (overlays of phishing windows) for stealing credentials and sensitive data from banking, cryptocurrency exchange, and e-commerce apps.
Click to expand...

The overlays are compatible with various Android banking malware and mimic apps operated by major organizations used in dozens of countries on almost all continents.

Being available in such numbers and at low prices, allows cybercriminals to focus on other parts of their campaigns, development of the malware, and to widen their attack to other regions.
InTheBox provides up-to-date injects for hundreds of apps, researchers at threat intelligence company Cyble discovered.
Click to expand...

According to Cyble's analysis, as of January 2023 InTheBox lists the following web inject packages, updated as recently as October 2022:

814 web injects compatible with Alien, Ermac, Octopus, and MetaDroid for $6,512

495 web injects compatible with Cerberus for $3,960

585 web injects compatible with Hydra for $4,680

For those who don't want to buy entire packages, InTheBox also sells web injects individually for $30 each. The shop also allows users to order custom injects for any malware.
Click to expand...

Cyble says that InTheBox's injects can check the validity of the credit card numbers entered by victims using the Luhn algorithm, which helps Android malware operators filter out invalid data.
Finally, the stolen data is converted into string value and sent to a server controlled by the operator of the Android banking trojan.

InTheBox has been selling web injects for Android malware since February 2020, constantly adding new pages that target more banks and financial apps.
Click to expand...

Cyble: ‘InTheBox’ Web Injects Targeting Android Banking Applications Worldwide

January 31, 2023
Technical Analysis of the Web Injects in Android Botnet Operations
Cyble Research and Intelligence Labs (CRIL) has been observing the activities of the Threat Actor/Group dubbed ‘InTheBox’, predominantly active on a Russian language cybercrime forum. This Threat Actor has been expanding their inventory at their Tor-based online shop with ready-to-sale web injects that are compatible with various Android banking malware at inexpensive prices and lucrative discounts.

They offered injects intended to target retail banking, mobile payment services, cryptocurrency exchanges, and mobile e-commerce applications operated by major organizations in Australia, Brazil, India, Indonesia, Japan, Kuwait, Malaysia, Philippines, Qatar, Saudi Arabia, Singapore, Thailand, United States and various other countries in Europe and Asia.
Click to expand...

This blog provides a comprehensive overview of the shop, the standard framework of the web injects on offer, and its indicators of compromise, observed in the usage of these web injects in recent Android malware operations.
Click to expand...

Log in or Sign up

Exclusive: The largest mobile malware marketplace identified by Resecurity in the Dark Web

guest Guest

guest Guest

Log in or Sign up

Exclusive: The largest mobile malware marketplace identified by Resecurity in the Dark Web

guest Guest

guest Guest

Useful Searches