UPDATES
threat
UPDATES
GCC
Group-IB has uncovered a sophisticated cyber-fraud operation exploiting legitimate government payment portals across the Gulf Cooperation Council( GCC), resulting in confirmed losses exceeding US $ 2 million.
The investigation revealed that cybercriminals are using stolen credit cards to settle genuine government bills, traffic fines and utility payments at heavily discounted rates, allowing them to convert stolen funds into seemingly legitimate payments.
Between October 2025 and August 2026, Group-IB’ s Fraud Protection team identified approximately 300 related incidents across several major retail banks. A validated subset involving 80 compromised cards and three government institutions resulted in confirmed losses of US $ 2.01 million.
According to Group-IB, the scheme exploits weaknesses in identity verification and account recovery processes rather than directly bypassing banking security controls. Fraudulent transactions successfully passed 3D Secure authentication after attackers gained control of victims’ mobile numbers and banking accounts.
The operation begins with phishing campaigns promoted through Google Search advertisements targeting GCC users. Investigators identified more than 400 phishing resources using 10 different impersonation patterns to imitate government portals and insurance services.
GLOBAL
Infoblox Threat Intelligence has identified the continued activity of Help TDS, a long-running malicious traffic distribution system linked to Hotejka, a Russian-language affiliate programme believed to be a rebrand of ROI777.
Active since at least April 2017, the operation redirects victims from compromised websites, malicious advertisements, social media and spam campaigns to fraudulent technical support call centres. Unlike conventional tech support scams focused on unnecessary services or credit card fraud, Help TDS attempts to persuade victims to install remote desktop software, potentially giving attackers extensive access to compromised devices.
In June 2026, Infoblox researchers traced an attack chain to a fraudulent call centre, where an individual posing as a support representative helped remove a browser lock before directing researchers to download UltraViewer, a legitimate remote desktop application that could have enabled unauthorised access.
The operation has also demonstrated considerable infrastructure resilience. Since April 2026, Hotejka has used Cloudflare Pages to generate hundreds of malicious pages daily.
Over six months, Infoblox identified more than 20,000 associated domains and approximately 10,000 additional pages apparently used for phishing or decoy purposes.
Researchers can now identify related domains approximately seven days before they become operational. According to Infoblox, exposure among its cloud customers declined from a peak of 4 % on a single day to less than 0.5 % in September 2026.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 35