CloudSEK Updates

A Chinese-speaking threat group is exploiting Indonesia’s state pension fund, TASPEN, to launch a sophisticated mobile malware campaign targeting senior citizens. Disguised as an official app, the spyware steals banking credentials, OTPs, and even biometric data, enabling large-scale fraud. Beyond financial loss, the attack erodes public trust, threatens Indonesia’s digital transformation, and sets a dangerous precedent for pension fund attacks across Southeast Asia.

A new ClickFix social engineering attack weaponizes AI summarizers. Threat actors hide malicious instructions in documents using CSS obfuscation and prompt overdose. This makes the code invisible to humans but fully readable to AI models. When a user summarizes the content, the AI-generated output delivers the malicious payload, tricking the user into executing ransomware. Organizations must implement content sanitization and user awareness to mitigate this risk.

CloudSEK uncovered an advanced cryptojacking campaign by threat actor TA-NATALSTATUS, active since 2020 and now escalating globally in 2025. The group exploits exposed Redis servers in the US, Europe, Russia, India, and beyond, hijacking root access to install miners, disable defenses, and wipe out rivals. Their stealth tactics—binary hijacking, obfuscation, and persistence mechanisms—turn servers into long-term mining assets. CloudSEK advises immediate remediation, reimaging, and securing Redis instances.

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive. The malware created persistence, evaded detection, and connected to a WebSocket C2 server (seemysitelive[.]store). Investigators urge blocking the C2 domain, scanning for indicators of compromise, and tightening email and endpoint defenses.

Ahead of India’s 79th Independence Day (August 2025), hacktivist groups and cybercriminals launched coordinated attacks targeting government, finance, and defense sectors. Fueled by the Pahalgam terror attack, threat actors from Pakistan, China, and others executed over 4,000 incidents, including phishing, fake websites, data breaches, and scams. APT groups like APT36 and SideCopy deployed credential theft campaigns. Citizens are urged to stay alert and report suspicious activity.

CloudSEK’s SVigil uncovered a misconfigured .git repository at a major roadside assistance and insurance vendor, exposing over 20GB of sensitive data tied to leading automotive brands. The leak included full source code, payment gateway tokens, cloud database credentials, and over 1 million PII records of customers and merchants. This flaw risked large-scale phishing, fraud, identity theft, and severe reputational damage across India’s automotive and insurance ecosystem.

Cybercriminals are exploiting the Raksha Bandhan festival globally with a surge of online shopping and phishing scams. They use fake websites, fraudulent gift offers, and imposter messages to trick victims into sharing personal data or making payments. To stay safe, experts advise verifying offers on official channels, using secure payment methods, and reporting fraud promptly to authorities like the National Cyber Crime Reporting Portal.

In July 2025, scammers in India used deepfake videos of influencer “Shweta Sharma” to run over 120 fake investment ads on Facebook and Instagram. The identity was stolen from real public figures, luring users to Telegram channels with false promises of fast stock market returns. Victims lost money in an ongoing cycle of payments. CloudSEK urges public awareness and legal action.

Cybercriminals targeted fans and teams at the 2025 Belgian Grand Prix (July 27, Spa-Francorchamps) with phishing emails, fake ticket sites, streaming scams, and counterfeit merchandise. The event’s popularity and reliance on tech made it a prime cyberattack target. A hacked official email in early 2024 led to major phishing campaigns. Fans and F1 teams are urged to follow strict cybersecurity practices to avoid scams and data theft.