GoldFactory Coretax impersonation fraud campaign
Campaign
Summary
Hide ▲
Show ▼
The GoldFactory-linked fraud campaign now threatens Indonesian taxpayers at scale, with estimated losses of $1.5m to $2m. It ran from July 2025 and intensified in January 2026 during tax filing season. The operation used Coretax impersonation to push victims toward fraudulent app installs. The goal was to harvest device access and move money through banking fraud.
Related Happenings
CallPhantom Google Play fraud campaign targeting Android users in India and Asia-Pacific
Campaign
First: 08.05.2026 18:08
Last: 08.05.2026 18:08
Sources 1
About this happening:
The **CallPhantom** fraud campaign pushed **28 fake call-history Android apps** through the **Google Play Store**, causing **financial loss** for users who paid for fabricated dat...
CallPhantom Google Play fraud campaign targeting Android users in India and Asia-Pacific
CampaignAbout this happening: The **CallPhantom** fraud campaign pushed **28 fake call-history Android apps** through the **Google Play Store**, causing **financial loss** for users who paid for fabricated dat...
Cloud phone fraud-enablement ecosystem and darknet resale channels
Threat Actor Meta
First: 25.03.2026 18:05
Last: 25.03.2026 18:05
Sources 1
About this happening:
**Cloud phone platforms** have become a **fraud-enablement ecosystem** that lets criminals rent realistic mobile devices, abuse **pre-verified bank accounts**, and move stolen fun...
Cloud phone fraud-enablement ecosystem and darknet resale channels
Threat Actor MetaAbout this happening: **Cloud phone platforms** have become a **fraud-enablement ecosystem** that lets criminals rent realistic mobile devices, abuse **pre-verified bank accounts**, and move stolen fun...
UNC6353 and UNC6691 Coruna iOS exploit campaign
Campaign
First: 04.03.2026 21:06
Last: 04.03.2026 21:06
Sources 1
About this happening:
The **Coruna** iOS exploit campaign spread through **watering-hole** and **fake finance/crypto** lures, extending reach from **iPhone users** to **crypto users**. **UNC6353** used...
UNC6353 and UNC6691 Coruna iOS exploit campaign
CampaignAbout this happening: The **Coruna** iOS exploit campaign spread through **watering-hole** and **fake finance/crypto** lures, extending reach from **iPhone users** to **crypto users**. **UNC6353** used...
Boniface Mwangi hit by cyberattack
Incident
First: 18.02.2026 19:30
Last: 18.02.2026 19:30
Sources 1
About this happening:
Boniface Mwangi suffered a **forensic extraction** incident while his **Samsung** phone was in **Kenyan police custody**, creating a risk that private messages and other sensitive...
Boniface Mwangi hit by cyberattack
IncidentAbout this happening: Boniface Mwangi suffered a **forensic extraction** incident while his **Samsung** phone was in **Kenyan police custody**, creating a risk that private messages and other sensitive...
ZeroDayRAT mobile spyware targeting Android and iOS
Malware Activity
First: 10.02.2026 16:00
Last: 10.02.2026 16:00
Sources 1
About this happening:
**ZeroDayRAT** is a newly documented **mobile spyware** operation targeting **Android and iOS** devices, creating broad risk for persistent surveillance and financial abuse. It ca...
ZeroDayRAT mobile spyware targeting Android and iOS
Malware ActivityAbout this happening: **ZeroDayRAT** is a newly documented **mobile spyware** operation targeting **Android and iOS** devices, creating broad risk for persistent surveillance and financial abuse. It ca...
Timeline
-
19.02.2026 17:30 2 articles · 3mo ago
GoldFactory Coretax impersonation fraud campaign
Initial DisclosureIn **July 2025**, the operation emerged as a **Coretax**-themed lure that directed victims to install fraudulent mobile apps. By **January 2026**, it had escalated during the tax filing period into a broader phishing, impersonation, and vishing chain.
Show sources
- Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia — www.infosecurity-magazine.com — 19.02.2026 17:30
- Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia — www.infosecurity-magazine.com — 19.02.2026 17:30