By 
The Chinese-speaking threat actors behind Smishing Triad were found impersonating the United Arab Emirates Federal Authority for Identity and Citizenship to send malicious SMS messages to gather sensitive information from residents and foreigners in the country.
The new fraudulent campaign operated through malicious SMS messages, claimed to be from the General Directorate of Residency and Foreigners Affairs.
The Resecurity team discovered the threat and promptly notified UAE law enforcement agencies and cybersecurity entities to mitigate potential risks associated with identity theft.
The Smishing Triad which was first documented by the cybersecurity company in September 2023, was previously known for posing as US, UK and EU postal providers. It has now shifted its tactics to focus on UAE residents.
The group utilizes malicious links sent via SMS or iMessage to victims’ mobile devices, and use URL-shortening services like Bit.ly.
The phishing messages, observed on both Apple iOS and Google Android devices, lack sender information, possibly utilizing Caller ID or underground SMS spoofing services.
Victims reported receiving such messages after updating their residence visas, suggesting potential access to private channels through third-party data breaches, business email compromises (BEC) or dark web databases.
Upon clicking the link, victims are redirected to a fake webpage resembling the UAE General Directorate of Residency and Foreigners Affairs website, where personal information and credit card details are stolen.
The attackers used RSA encryption in HTTP responses to complicate timely analysis. According to Resecurity, a China-based organization controls critical domain names employed in fraudulent campaigns.
The attackers also used geolocation filtering, allowing the phishing form to appear only for UAE IP addresses and mobile devices.
In order to protect against these evolving threats, Resecurity recommends heightened cybersecurity awareness and the implementation of identity protection programs.
Image Credits : The Fintech Times
