Group-IB Links Fake Indonesian Coretax Apps to GoldFactory Fraud Campaign
Summary
Group-IB linked fake Coretax apps distributed through phishing, WhatsApp and vishing to GoldFactory, Gigabud.RAT and MMRat. It estimated nationwide losses and operating costs at $1.5m–$2m and identified 228 malware samples and 996 phishing URLs.
Key points
- Group-IB said the campaign began in July 2025 and intensified during Indonesia’s January 2026 tax-filing period.
- Fraudsters impersonated Coretax through phishing sites, WhatsApp messages and vishing calls to distribute malicious APKs.
- The apps enabled remote device access; the reported attack chain included screen recording, credential and OTP theft, account takeover and fund transfers through mule networks.
- Investigators linked the campaign to the GoldFactory cluster and identified Gigabud.RAT, MMRat and 228 new malware samples.
- The infrastructure impersonated more than 16 brands, and investigators found 996 phishing URLs generated through a centralized framework.
- Group-IB estimated nationwide losses and associated operating costs at $1.5m–$2m; it attributed low fraud success among its protected clients to layered detection.
Article Details
- Event Type
- Fraud campaign impersonating Indonesia’s Coretax tax platform to distribute malicious Android apps through phishing, WhatsApp impersonation, and vishing.
- Impact
- The campaign enabled unauthorized device access and banking transactions. The nationwide financial impact was estimated at $1.5m to $2m, based on a potential pool of 67 million Indonesian taxpayers and a reported device-compromise rate of 0.025%. Group-IB reported a 0.027% fraud success rate among malware-compromised devices at financial institutions it protected. The investigation identified 228 new malware samples and 996 phishing URLs.
MITRE ATT&CK
Threat Actors
Malware
Vendors
Products
Countries
IndonesiaA sophisticated fraud campaign exploiting Indonesia’s official Coretax tax platform has caused an estimated nationwide financial impact of $1.5m to $2m.Philippines(MaaS) model capable of expanding into other countries, including Thailand, Vietnam, the Philippines and South Africa.South Africamodel capable of expanding into other countries, including Thailand, Vietnam, the Philippines and South Africa.Thailandsuggesting a malware-as-a-service (MaaS) model capable of expanding into other countries, including Thailand, Vietnam, the Philippines and South Africa.Vietnama malware-as-a-service (MaaS) model capable of expanding into other countries, including Thailand, Vietnam, the Philippines and South Africa.
Industries
AirlinesThe infrastructure behind the scheme was also used to impersonate more than 16 trusted brands spanning government services, airlines, pension funds and energy providers.EnergyThe infrastructure behind the scheme was also used to impersonate more than 16 trusted brands spanning government services, airlines, pension funds and energy providers.GovernmentThe infrastructure behind the scheme was also used to impersonate more than 16 trusted brands spanning government services, airlines, pension funds and energy providers.Pension fundsThe infrastructure behind the scheme was also used to impersonate more than 16 trusted brands spanning government services, airlines, pension funds and energy providers.