SIM Swap Attack Let Hackers Port a Telephone Number to a New SIM to Hack WhatsApp & Bypass 2FA

Cybercriminals are actively performing SIM swap Attacks in various countries to bypass 2 Factor Authentication and to compromise the various social media apps including WhatsApp by porting a victim’s telephone number to a new SIM card.

This widespread attack caused financial damages, stolen credentials, and capture OTPs to bypass victims’ online accounts.

There are various fraud centers and thousands of operators are working around the world to seamlessly port a telephone number to a new SIM with a high success ratio.

In this case, Countries like Brazil and Mozambique have a high rate of SIM swap fraud using various social engineering techniques, and phishing attacks.

Successful attempts of this attack let fraudsters take control of customers’ phone numbers in order to receive mobile money transactions or to collect the home banking OTPs to complete a transfer of funds or steal users’ money.

Fraudulent actors often target high profiles including politicians, ministers, governors, and businessmen using SIM Swap Attacks to access their sensitive online accounts even bank transactions.

An organized gang alone in Brazil was able to SIM swap 5,000 victims and also steal more than US$50,000 from Businessman’s bank account.

How does this Organised cybercrime work

Cyber crooks initially collect various information from victims using phishing attacks, buy information from Undergrounds markets, and obtain information from data breaches.

Later they will execute a well-planned operation to convince the telephone company to port the victim’s phone number to the fraudster’s SIM by impersonating the victim and claiming they have lost their phone and changed the number into a new SIM card.

Soon after this successful activation, targeted victims will lose the connection and the new network connection will be allocated to the fraudster’s SIM card.

“This could allow intercepting any one-time passwords sent via SMS or telephone calls made to the victim; all the services that rely on an SMS or telephone call authentication can then be used “

According to Kaspersky research, “We have found that some of the processes used by mobile operators are weak and leave customers open to SIM swap attacks. For example, in some markets in order to validate your identity, the operator may ask for some basic information such as full name, date of birth, the amount of the last top-up voucher, the last five numbers called, etc. Fraudsters can find some of this information on social media or by using apps such as TrueCaller to get the caller’s name based on the number. “

Sometimes these attacks are executed via insider threats, with cybercriminals paying nearly $15 to $20 to the ISP breach operators for the activation process.

Price for SIM swap

There are many Brazilian underground markets operating for this SIM swap process and they demand different prices based on the targets.

for example, a SIM swap for a famous celebrity or a politician can cost thousands of dollars and also advertise in a closed Facebook community. the following price is stats in the Bazilian underground market.

An Attack called Whatsapp cloning let criminals load WhatsApp and all the victim’s chats and contacts after a SIM swap.

Later they Start the conversation with the WhatsApp contact and cite an emergency and ask for money.

In some cases, criminals use this SIM Swap attack to feign a kidnapping situation, asking for urgent payment.

“Some of the attacks targeted companies, with executives supposedly contacting their financial departments asking for funds, when in fact it was fraudsters using WhatsApp accounts hijacked in a SIM swap “

WhatsApp users need to activate 2FA using a six-digit PIN on their device that protects Whatsapp with another layer of security and is hard to bypass.

You can follow us on Linkedin, Twitter, and Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself self-updated.