Threat Intel
Industrialized MaaS Drives Fake Coretax App Fraud in Indonesia
During Indonesia’s tax season, attackers pushed a counterfeit Coretax mobile application using a shared malware‑as‑a‑service platform. The infrastructure enables rapid brand abuse and phishing, targeting taxpayers and financial institutions. Defenders should block known malicious domains, monitor for Coretax app impersonations, and harden endpoint detection.
What Happened
During Indonesia’s tax season, attackers pushed a counterfeit Coretax mobile application. The campaign is powered by a shared malware‑as‑a‑service (MaaS) infrastructure that distributes malicious binaries, phishing payloads, and brand‑abuse scripts across multiple targets.
Impact
Taxpayers, tax‑related businesses, and financial institutions are the primary victims. The malware can harvest credentials, install backdoors, and spread brand‑abuse content that mimics official Coretax communications.
What to Do
- Block all domains and IPs listed in the latest Group‑IB malware reports that are linked to the Coretax MaaS.
- Deploy endpoint detection and response (EDR) solutions that flag the known binary signatures and suspicious process behaviors.
- Educate users to verify the authenticity of the Coretax app via official app stores and the government’s tax portal.
- Enable multi‑factor authentication for all tax‑related services.
Mitigation Recommendations
Integrate threat‑intelligence feeds that include the MaaS command‑and‑control nodes. Apply network segmentation to isolate tax‑processing systems. Conduct regular phishing simulation tests focused on brand‑abuse scenarios.
Related articles
Fraudulent Trading Apps Targeting iOS and Android via UniApp Framework
Group‑IB uncovered a large‑scale fraud campaign that distributed counterfeit trading applications on iOS and Android. The malicious apps were published through official app stores and phishing sites using the UniApp framework. Defenders should verify app authenticity, monitor for duplicate app listings, and block associated domains.
Read briefing
Shopify Shop App Fake Refund Scam Targets Users – Immediate Defensive Actions
A phishing‑style scam is exploiting the Shopify Shop app by sending fake refund requests that appear legitimate. Merchants risk approving non‑existent refunds, leading to financial loss. Defenders should verify refund authenticity, update the app, enforce 2FA, and monitor for suspicious activity.
Read briefing
Passkey‑Themed Phishing Drives Microsoft 365 Data Breaches
Extortion gangs tied to ShinyHunters, Helix and others are exploiting the hype around passkeys and single sign‑on to trick corporate employees into revealing Microsoft 365 credentials. By impersonating IT help desks and using custom phishing domains, attackers capture session tokens through adversary‑in‑the‑middle and device‑code flows, then exfiltrate data from Office 365. Microsoft’s latest research maps the post‑compromise activity and highlights the need for tighter MFA enforcement.
Read briefing
Real‑Time Fraud Intelligence Stops APP Fraud Before Losses
Group‑IB’s real‑time intelligence network intercepted APP fraud attempts before account activation, stopping mule accounts during the warm‑up phase. Defenders can integrate the Unified Risk Platform to detect and block suspicious accounts early, protecting merchants and users.
Read briefing