INJ3CTOR3 Malware Steals FreePBX Credentials to Enable Fraudulent Calls Even After Server Cleanup

INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft, letting attackers keep billing unauthorized calls to victims even after infected servers are cleaned.

September 2026 artifacts described in the supplied research show the installer targeting 17 configuration files containing telephony, database, management, and mail-relay secrets.

The change separates the attacker’s revenue stream from its foothold. Previously, the JOMANGY webshell originated calls through the compromised PBX.

Stolen SIP trunk credentials now potentially let operators authenticate directly to carriers from external infrastructure, unless providers enforce source-IP restrictions.

The updated k.php installer contains two base64-encoded command sequences, each issuing 17 curl uploads to /hima_data/index.php on separate staging servers.

Three cron beacons execute the installer every minute, repeatedly attempting to export configuration files throughout an infection.

Targets span FreePBX, Issabel, and Elastix layouts. They include SIP and PJSIP configuration, manager.conf for Asterisk Manager Interface credentials, platform configuration holding database passwords, and Postfix’s sasl_passwd for outbound SMTP authentication access.

This makes remediation sequencing critical: rotating passwords while persistence remains active exposes replacement secrets to the same collection routine.

Administrators must establish a clean environment before completing rotation, including carrier-side trunk credentials.

The researchers identified upload commands in recovered code but did not capture live exfiltration or obtain a victim list. The findings therefore demonstrate collection capability, not a confirmed count of stolen accounts.

Plain-text download commands now reference 160[.]119[.]69[.]4, while encoded persistence commands retain 45[.]95[.]147[.]178.

Credential uploads target both. Reviewing only readable cron entries would therefore miss surviving communication paths.

INJ3CTOR3 Malware

Cyble Researchers said that, the underlying JOMANGY panel remains largely unchanged, but build-specific watermarks replace the previously shared identifier.

JOMANGY and ZenharR also share a rotated MD5 authentication gate, weakening detection based exclusively on earlier indicators.

Cyble’s May JOMANGY investigation documented six mutually reinforcing persistence channels, including cron polling, shell-profile injection, immutable backups, watchdog processes, protected webshell copies, and a PHP executor. A surviving component can restore the infection.

The campaign builds on years of PBX abuse. Check Point’s 2020 investigation linked INJ3CTOR3 to CVE-2019-19006 exploitation and manual retrieval of Asterisk credentials.

Unit 42 subsequently documented related Elastix activity and ZenharR tooling, while Fortinet analyzed EncystPHP in January 2026.

The September installer writes an Apache .htaccess rule that routes whitespace-prefixed requests to config.php.

Laboratory requests containing encoded spaces or tabs reached the webshell, while access logs recorded the requested URI rather than the executing filename.

The panel can also create a privileged FreePBX session through the application’s ampuser class and setAdmin(), meaning an administrator password reset does not neutralize that access path.

Separately, laboratory testing demonstrated that trunks written directly into Asterisk configuration can operate without appearing in FreePBX’s database-backed console.

Researchers did not observe this campaign deploying such a trunk; the result establishes a visibility gap, not confirmed attacker behavior.

Defenders should isolate affected systems, block both staging addresses, and investigate outbound HTTP POSTs to /hima_data/.

Recovery requires rebuilding or comprehensively removing persistence, then replacing exposed secrets.

Carrier monitoring should flag unfamiliar registration addresses, premium-rate destinations, unusual concurrency, and abnormal spending.

Compare Asterisk’s active endpoints and registrations against FreePBX records, and inspect custom configuration directly. Server cleanup alone cannot invalidate credentials already copied elsewhere.

Indicators of Compromise

Value	Type	Context
45[.]95[.]147[.]178	IPv4	Staging host since April
160[.]119[.]69[.]4	IPv4	Second staging host and credential collector, new
hxxp://45[.]95[.]147[.]178/hima_data/index.php	URL	Credential upload endpoint
hxxp://160[.]119[.]69[.]4/hima_data/index.php	URL	Credential upload endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.