MoqHao Campaign Uses Apple iCloud and VK to Target Apple IDs and Android Devices

Dec 5, 2024 · Original article ↗

Summary

Researchers traced a Japanese delivery-themed smishing campaign to MoqHao. It served localized Apple ID phishing pages to iOS users and a malicious Android APK, using Apple iCloud, VK, and dynamic DNS infrastructure.

Key points

The campaign began with a Japanese SMS claiming a missed package delivery and linking to a shortened URL.
The link served a localized Apple ID phishing page to iPhone users; the page captured credentials before redirecting users to Apple's legitimate account page.
Android users were directed to download a malicious APK disguised as a Chrome update.
The APK was distributed through legitimate Apple iCloud infrastructure, while DuckDNS domains and multiple redirects supported delivery.
The malware queried a VK profile to obtain its command-and-control address, then contacted a server on port 28899.
Researchers associated the campaign with MoqHao, also known as Wroba and XLoader, and the Roaming Mantis group.

Article Details

Attack Vectors: Japanese-language SMS phishing (smishing) delivered a shortened link that redirected users to mobile-specific malicious content.
iOS users were shown a localized Apple ID phishing page that captured credentials.
Android users were served a malicious APK disguised as a Google Chrome update, downloaded from an iCloud-hosted URL.
The malware retrieved its C2 address from a VK profile page and then communicated with the C2 server.
Defensive Notes: Treat unsolicited delivery-notification messages and unfamiliar links with caution.
Avoid downloading apps from links in unsolicited messages; use trusted app stores.
Use reputable mobile security software to help detect and block malicious activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`jwvijnxshs[.]duckdns[.]org`	Malicious infrastructure used to redirect users and deliver the APK.
DOMAIN	`nhcwtnidxz[.]duckdns[.]org`	Apple ID phishing infrastructure hosting a credential-stealing page.
DOMAIN	`zmptwh[.]hvhrg[.]xyz`	Malicious redirect infrastructure used in the campaign's payload-delivery chain.
IPV4	`103[.]80[.]134[.]11`	IP address resolving to the Apple ID phishing infrastructure.
IPV4	`91[.]204[.]226[.]166`	Malicious HTTP 404 and redirect infrastructure identified in the network observables.
IPV4	`91[.]204[.]226[.]171`	Server identified as downloading MoqHao from an iCloud account.
IPV4	`91[.]204[.]226[.]54`	MoqHao command-and-control server contacted by the malware on port 28899.
IPV4	`91[.]240[.]226[.]171`	IP address resolving to the malicious infrastructure used in APK delivery.
SHA256	`958c51388770404cf1ddb320263125b5694a0691c5c6755e21ea61db968bef63`	SHA-256 hash of the malicious APK disguised as a Chrome update.
URL	`hxxp[:]//m[.]vk[.]com/id730149630?act=info`	Malware-requested VK profile page used to obtain or obscure the C2 address.
URL	`hxxps[:]//cvws[.]icloud-content[.]com/B/Af0EuTgWpFmatpizAFV4JbyCGRaWAfRSlrRzELSIKdZnY571fbYBaccN/Chrome_up1732156036129[.]apk?o=AqmizYalfRfu35XmqKqHpY8BHoTn_7tIVbrU2toKX2p6&v=1&x=3&a=CAogmVM7aE69-Xg4frwc9xGuEqKPcWhKETM-8QdFv2Y86O4SaxD2maTytDIY9vb_87QyIgEAUgSCGRaWWgQBaccNaiXytrCUgu-AX1Yxl4C2BCLtIRTzOCvFvHZdZeJ3oCq2s2SLNwOJciWfZaTWZet7wNA1XMTDo4MCN4VvZQKrWDhnAksqNeoeDkG2iDbD&p=122&s=myCbWNxTHqFARpZHuE0J01eS9CE`	Specific iCloud-hosted URL used to distribute the malicious APK.
URL	`hxxps[:]//t[.]co/MQN7PEGZn2`	Shortened URL included in the smishing message that initiated the malicious redirect chain.