The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May. It has since analyzed artifacts collected from the operator's staging servers on 9 September 2026 and found that the implant now sends victims' SIP trunk, AMI,... Weiterlesen: INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud Aft…
Intelligence View
⚡ tsecurity.de Intelligence
INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup
The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1505TA0011 · Command and Control
Server Software Component
Mitigation: M1018 User Account Management
Quelle: Kontext-Klassifikation des Artikeltextes · Konfidenz 86%
Scan for webshell signatures with YARA/LOKI, check upload directories with php-malware-finder, harden file uploads and keep accounts least-privileged.
Command and Control
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
No reader ratings yet
Was this page helpful?
0
Powered by tsecurity.de
tsecurity.de Hub
Related story clusters & sources (vector AI)
9 sources
CVE-2026-109150 | WP PageNavi Style Plugin up to 1.4 on WordPress cross site scripting (EUVD-2026-117357)
8 more sources
VVulDB Updates2 hours agoCVE-2026-107787 | CatFolders Plugin up to 2.5.6 on WordPress Folder Maintenance Action authorization (EUVD-2026-117356) VVulDB Updates2 hours agoCVE-2026-107786 | CatFolders Plugin up to 2.5.6 on WordPress sql injection (EUVD-2026-117355) VVulDB Updates2 hours agoCVE-2026-107775 | Dokan Plugin up to 5.3.2 on WordPress authorization (EUVD-2026-117354) VVulDB Updates2 hours agoCVE-2026-107774 | Dokan Plugin up to 5.3.2 on WordPress Contact Form authentication spoofing (EUVD-2026-117353) VVulDB Updates4 hours agoCVE-2026-73996 | Masteriyo Plugin up to 2.3.2 on WordPress unrestricted upload (EUVD-2026-60810) VVulDB Updates4 hours agoCVE-2026-62041 | Ashok Dudhat Event Manager Plugin up to 3.4.1 on WordPress authorization (EUVD-2026-95728)
+2
7 sources
CVE-2022-4052 | Student Attendance Management System /Admin/createClass.php Id sql injection (EUVD-2022-51429)
6 more sources
VVulDB Updates3 hours agoCVE-2022-4053 | Student Attendance Management System createClass.php className cross site scripting (EUVD-2022-51430) VVulDB Updates2 hours agoCVE-2022-4088 | rickxy Stock Management System /pages/processlogin.php user/password sql injection (EUVD-2022-51459) VVulDB Updates2 hours agoCVE-2022-4089 | rickxy Stock Management System /pages/processlogin.php user cross site scripting (EUVD-2022-51460) VVulDB Updates5 hours agoCVE-2025-64070 | SourceCodester Student Grades Management System 1.0 Add New Subject Description cross site scripting VVulDB Updates5 hours agoCVE-2025-65881 | SourceCodester Zoo Management System 1.0 /classes/Login.php cross site scripting VVulDB Updates5 hours agoCVE-2025-65215 | SourceCodester Web-based Pharmacy Product Management System 1.0 add-supplier.php Name cross site scripting
5 sources
CVE-2023-53729 | Linux Kernel up to 6.5.3 soc qmi_encdec out-of-bounds (Nessus ID 376201 / WID-SEC-2025-2394)
4 more sources
VVulDB Updates2 hours agoCVE-2026-86561 | Red Hat Enterprise Linux lib vhost memory corruption (Nessus ID 376199) VVulDB Updates2 hours agoCVE-2026-86562 | Red Hat Enterprise Linux vhost toctou (Nessus ID 376199) BBSI Warn- und Informationsd…2 hours ago[NEU] [hoch] Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff VVulDB Updates5 hours agoCVE-2026-80948 | Linux Kernel up to 6.18.49/7.2.3 iwlwifi iwl_op_mode_dvm_start nvm_data/eeprom_blob memory leak (WID-SEC-2026-3321)
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/en/4303543/malware-threat-intel/inj3ctor3-malware-steals-freepbx-credentials-enabling-toll-fraud-after-cleanup/