Android Banking Trojan Linked to Cambodia Scam Center Enables Surveillance and Financial Fraud

Apr 10, 2026 · Original article ↗

Summary

Infoblox and Chong Lua Dao analyzed an active Android banking-trojan MaaS operation linked by technical and insider evidence to Cambodia’s K99 Triumph City compound. The malware steals credentials and biometrics and enables banking fraud.

Key points

Lure sites impersonating government agencies, banks and other organizations trick victims into downloading a malicious Android APK.
The trojan enables remote monitoring, SMS and call interception, credential theft, camera and microphone access, data exfiltration, and installation of additional software.
Operators can use fake KYC overlays to capture facial biometrics and intercepted SMS one-time codes to access victims’ banking accounts.
Researchers identified hundreds of lure domains and observed about 35 new domain registrations per month; the infrastructure remains active and changes its lures.
Exposed command-and-control infrastructure revealed country-segmented operator panels and workflows for managing infected devices and customizing malware.
Technical findings, recovered evidence and testimony from rescued workers link the operation to K99 Triumph City in Cambodia; researchers assess that an unknown Chinese-speaking MaaS administrator serves multiple scam centers.
The malware dates back to at least 2023, and newer samples use runtime decryption to conceal command-and-control details, indicating continued development.

Article Details

Attack Vectors: Victims are contacted by phone using eyeBeam to impersonate government officials, then moved to Zalo and directed through a link or QR code to targeted lure pages.
Lure sites impersonate government services, banks, airlines, and other organizations and prompt victims to download a malicious Android APK. Base64-encoded JavaScript retrieves the APK in chunks while displaying a fake progress bar.
The APK presents fake login screens and social-engineering overlays, requests extended permissions, and enables surveillance, credential harvesting, SMS and call interception, and biometric capture.
Operators use harvested credentials, intercepted SMS one-time passcodes, and captured facial-recognition data to access victims’ online banking accounts and transfer funds.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`alafrica[.]xyz`	C2 domain used by the MaaS administrator.
DOMAIN	`alperu[.]top`	C2 domain used by the MaaS administrator.
DOMAIN	`avianca[.]sxjgo[.]cc`	Targeted lure domain listed as impersonating legitimate organizations or government services and used to download the malicious APK.
DOMAIN	`cedula-registraduria-gov[.]org`	Targeted lure domain impersonating Colombia’s National Civil Registry.
DOMAIN	`dkhth[.]com`	Targeted lure domain listed as impersonating legitimate organizations or government services and used to download the malicious APK.
DOMAIN	`egov[.]nbsvgo[.]cc`	Targeted lure domain shown in use for a Philippine government impersonation campaign.
DOMAIN	`googleplay[.]djppajakgoid[.]com`	Targeted lure domain impersonating Indonesia’s Directorate General of Taxes.
DOMAIN	`idphil[.]net`	Targeted lure domain impersonating the Philippines Department of Information and Communications Technology.
DOMAIN	`immigration-kr[.]net`	Targeted lure domain impersonating the South Korean Immigration Bureau.
DOMAIN	`lx-yindu[.]top`	Malicious domain used to impersonate the Supreme Court of India.
DOMAIN	`ngovbr[.]cc`	Targeted lure domain listed as impersonating legitimate organizations or government services and used to download the malicious APK.
DOMAIN	`nmxgo[.]cc`	Targeted lure domain impersonating the South African Police Service.
DOMAIN	`openbank-es[.]com`	Targeted lure domain impersonating Openbank Spain.
DOMAIN	`orbiixtrade[.]com`	Malicious domain used in a cryptocurrency investment scam impersonating Thailand’s Orbix trading platform.
DOMAIN	`orgo[.]cc`	Targeted lure domain impersonating an organization and used to download the malicious APK.
DOMAIN	`rycnair[.]com`	Targeted lure domain listed as impersonating legitimate organizations or government services and used to download the malicious APK.
DOMAIN	`safeapk[.]xyz`	Host of the MaaS administrator’s custom APK management platform.
DOMAIN	`sss[.]oiago[.]cc`	Targeted lure domain used to direct a Philippine victim to install the malicious APK.
DOMAIN	`vnwd[.]top`	C2 domain used by the MaaS administrator.
DOMAIN	`vsgo[.]cc`	Targeted lure domain used to impersonate organizations and distribute the malicious APK; later repurposed to impersonate the Philippines government.
IPV4	`103[.]214[.]169[.]197`	C2 server used by the MaaS administrator.
IPV4	`18[.]167[.]169[.]60`	C2 server used by the MaaS administrator.
IPV4	`38[.]47[.]52[.]4`	C2 server used by the MaaS administrator.
SHA256	`39ea88f852b25d3c55d605464a3440bd250a577e3e21f52d1eaf94d15aad5b82`	Hash of a malicious APK sample.
SHA256	`4338ab77d05aeacd7eac5acbe9eed5568778c8e3e9499562816805b54b4d1a6a`	Hash of a malicious APK sample.
SHA256	`4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc`	Hash of a malicious APK sample.