GoldFactory Coretax impersonation fraud campaign
Campaign
Summary
Hide ▲
Show ▼
The GoldFactory-linked fraud campaign now threatens Indonesian taxpayers at scale, with estimated losses of $1.5m to $2m. It ran from July 2025 and intensified in January 2026 during tax filing season. The operation used Coretax impersonation to push victims toward fraudulent app installs. The goal was to harvest device access and move money through banking fraud.
Related Happenings
GitBait phishing campaign targeting Mexican banks
Campaign
H score20
First: 17.06.2026 17:00
Last: 17.06.2026 17:00
Sources 1
About this happening:
A **long-running GitBait phishing campaign** is stealing **banking credentials** from customers of **Mexican financial institutions**, using **GitHub Pages** and **SheetBest** to...
GitBait phishing campaign targeting Mexican banks
CampaignAbout this happening: A **long-running GitBait phishing campaign** is stealing **banking credentials** from customers of **Mexican financial institutions**, using **GitHub Pages** and **SheetBest** to...
CallPhantom Google Play fraud campaign targeting Android users in India and Asia-Pacific
Campaign
H score34
First: 08.05.2026 18:08
Last: 08.05.2026 18:08
Sources 1
About this happening:
The **CallPhantom** fraud campaign pushed **28 fake call-history Android apps** through the **Google Play Store**, causing **financial loss** for users who paid for fabricated dat...
CallPhantom Google Play fraud campaign targeting Android users in India and Asia-Pacific
CampaignAbout this happening: The **CallPhantom** fraud campaign pushed **28 fake call-history Android apps** through the **Google Play Store**, causing **financial loss** for users who paid for fabricated dat...
Cloud phone fraud-enablement ecosystem and darknet resale channels
Threat Actor Meta
H score28
First: 25.03.2026 18:05
Last: 25.03.2026 18:05
Sources 1
About this happening:
**Cloud phone platforms** have become a **fraud-enablement ecosystem** that lets criminals rent realistic mobile devices, abuse **pre-verified bank accounts**, and move stolen fun...
Cloud phone fraud-enablement ecosystem and darknet resale channels
Threat Actor MetaAbout this happening: **Cloud phone platforms** have become a **fraud-enablement ecosystem** that lets criminals rent realistic mobile devices, abuse **pre-verified bank accounts**, and move stolen fun...
UNC6353 and UNC6691 Coruna iOS exploit campaign
Campaign
H score42
First: 04.03.2026 21:06
Last: 04.03.2026 21:06
Sources 1
About this happening:
The **Coruna** iOS exploit campaign spread through **watering-hole** and **fake finance/crypto** lures, extending reach from **iPhone users** to **crypto users**. **UNC6353** used...
UNC6353 and UNC6691 Coruna iOS exploit campaign
CampaignAbout this happening: The **Coruna** iOS exploit campaign spread through **watering-hole** and **fake finance/crypto** lures, extending reach from **iPhone users** to **crypto users**. **UNC6353** used...
Boniface Mwangi hit by cyberattack
Incident
H score13
First: 18.02.2026 19:30
Last: 18.02.2026 19:30
Sources 1
About this happening:
Boniface Mwangi suffered a **forensic extraction** incident while his **Samsung** phone was in **Kenyan police custody**, creating a risk that private messages and other sensitive...
Boniface Mwangi hit by cyberattack
IncidentAbout this happening: Boniface Mwangi suffered a **forensic extraction** incident while his **Samsung** phone was in **Kenyan police custody**, creating a risk that private messages and other sensitive...
Timeline
-
19.02.2026 17:30 2 articles · 4mo ago
GoldFactory Coretax impersonation fraud campaign
Initial DisclosureIn **July 2025**, the operation emerged as a **Coretax**-themed lure that directed victims to install fraudulent mobile apps. By **January 2026**, it had escalated during the tax filing period into a broader phishing, impersonation, and vishing chain.
Show sources
- Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia — www.infosecurity-magazine.com — 19.02.2026 17:30
- Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia — www.infosecurity-magazine.com — 19.02.2026 17:30