Tuesday, July 16, 2024

SIM Swap Attack Let Hackers Port a Telephone Number to a New SIM to Hack WhatsApp & Bypass 2FA

Cybercriminals are actively performing SIM swap Attacks in various countries to bypass 2 Factor Authentication and to compromise the various social media apps including WhatsApp by porting a victim’s telephone number to a new SIM card.

This widespread attack caused financial damages, stolen credentials, and capture OTPs to bypass victims’ online accounts.

There are various fraud centers and thousands of operators are working around the world to seamlessly port a telephone number to a new SIM with a high success ratio.

In this case, Countries like Brazil and Mozambique have a high rate of SIM swap fraud using various social engineering techniques, and phishing attacks.

Successful attempts of this attack let fraudsters take control of customers’ phone numbers in order to receive mobile money transactions or to collect the home banking OTPs to complete a transfer of funds or steal users’ money.

Fraudulent actors often target high profiles including politicians, ministers, governors, and businessmen using SIM Swap Attacks to access their sensitive online accounts even bank transactions.

An organized gang alone in Brazil was able to SIM swap 5,000 victims and also steal more than US$50,000 from Businessman’s bank account.

How does this Organised cybercrime work

Cyber crooks initially collect various information from victims using phishing attacks, buy information from Undergrounds markets, and obtain information from data breaches.

Later they will execute a well-planned operation to convince the telephone company to port the victim’s phone number to the fraudster’s SIM by impersonating the victim and claiming they have lost their phone and changed the number into a new SIM card.

Soon after this successful activation, targeted victims will lose the connection and the new network connection will be allocated to the fraudster’s SIM card.

“This could allow intercepting any one-time passwords sent via SMS or telephone calls made to the victim; all the services that rely on an SMS or telephone call authentication can then be used “

According to Kaspersky research, “We have found that some of the processes used by mobile operators are weak and leave customers open to SIM swap attacks. For example, in some markets in order to validate your identity, the operator may ask for some basic information such as full name, date of birth, the amount of the last top-up voucher, the last five numbers called, etc. Fraudsters can find some of this information on social media or by using apps such as TrueCaller to get the caller’s name based on the number. “

Sometimes these attacks are executed via insider threats, with cybercriminals paying nearly $15 to $20 to the ISP breach operators for the activation process.

Price for SIM swap

There are many Brazilian underground markets operating for this SIM swap process and they demand different prices based on the targets.

for example, a SIM swap for a famous celebrity or a politician can cost thousands of dollars and also advertise in a closed Facebook community. the following price is stats in the Bazilian underground market.

SIM Swap

Cloning the Social Media Apps Like WhatsApp

An Attack called Whatsapp cloning let criminals load WhatsApp and all the victim’s chats and contacts after a SIM swap.

Later they Start the conversation with the WhatsApp contact and cite an emergency and ask for money.

In some cases, criminals use this SIM Swap attack to feign a kidnapping situation, asking for urgent payment.

“Some of the attacks targeted companies, with executives supposedly contacting their financial departments asking for funds, when in fact it was fraudsters using WhatsApp accounts hijacked in a SIM swap “

WhatsApp users need to activate 2FA using a six-digit PIN on their device that protects Whatsapp with another layer of security and is hard to bypass.

You can follow us on LinkedinTwitter, and Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself self-updated.

Various SIM Swap Attacks in the Recent Past

First SIM Swapping Hacker Convicted, Gets 10 Years in Prison

SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested

Hacker Group Stolen $5 Million Through SIM Swapping Hacks

21-year-old man Stole $1 Million Within Seconds Through SIM-swapping Hacks

Mumbai Businessman Loses Rs. 1.86cr After Getting 6 Missed Calls


Latest articles

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles