Fake Bank Support Sites Deliver Remote-Access Tools in Phone-Led Fraud Campaign
Summary
Lab539 reports an active phone-led fraud campaign using cloned bank support pages to trick customers into installing remote-access tools. The researchers say the campaign has used more than 380 domains and report that two abused signing certificates were revoked.
Key points
- Lab539 says the campaign has been active since at least March and links more than 380 registered domains to fake support sites and related infrastructure.
- The sites impersonate banks and financial services firms, including Barclays, HSBC, Lloyds, Revolut and Santander.
- Fraudsters reportedly guide callers to click added buttons on cloned pages and enter verification codes; how victims are first contacted remains unclear.
- The Live Chat button triggers an AnyDesk installer, while Verify Call delivers verify_call.exe, an installer for ScreenConnect with added functionality to disable some security tools and escalate privileges.
- A FraudReport.zip attack chain uses a genuine Microsoft Defender component alongside a malicious mpclient.dll to load attacker-controlled code, then runs a ScreenConnect installer.
- Researchers say verify_call.exe and mpclient.dll were signed with certificates assigned to Botania Games, but whether the company is connected to the attacks is unclear.
- Lab539 reported both certificates to their issuers on Oct. 9, and says they were revoked; the researchers caution that revocation does not prevent malware downloads or execution.
Article Details
- Attack Vectors
- Fraudsters use cloned bank support pages and phone-led social engineering to persuade banking customers to click added buttons and provide verification codes.
- The Live Chat button prompts victims to download and enable a legitimate AnyDesk installer, granting attackers one-time remote access.
- The Verify Call button delivers verify_call.exe, which installs ScreenConnect and includes functionality to deactivate some security tools and escalate privileges.
- FraudReport.zip contains a genuine Microsoft Defender component and a malicious mpclient.dll that is loaded by trusted Microsoft-signed software, followed by a ScreenConnect installer.
- Defensive Notes
- Lab539 reported the two abused signing certificates to their certificate authorities on October 9; the certificates were revoked. The report cautions that revocation does not prevent malware downloads or Windows execution.
- Bank customers should be wary of instructions from callers to click buttons on support pages, provide verification codes, or install remote-support software.
MITRE ATT&CK
T1204.002 · Malicious FileVictims are persuaded to download and execute verify_call.exe or the contents delivered through FraudReport.zip.T1219 · Remote Access ToolsThe campaign uses AnyDesk and ScreenConnect to provide attackers with remote access to victims' systems.T1562.001 · Disable or Modify ToolsThe verify_call.exe installer includes functionality designed to deactivate some security tools.T1574.002 · DLL Side-LoadingThe FraudReport.zip chain uses a malicious mpclient.dll loaded by trusted Microsoft-signed software.
People
Malware
mpclient.dllFraudReport.zip. "That archive used a genuine Microsoft Defender component alongside a malicious mpclient.dll, allowing the attacker-controlled DLL to be loaded by trusted Microsoft-signed software," and thenverify_call.exeThe Verify Call button delivers a file called verify_call.exe that purports to be a "ShieldWall Defender" tool but which is an installer for remote-support tool ScreenConnect, bundled with additional functionality
Products
AnyDeskand potentially empty bank accounts, steal data or perform other malicious tasks remotely (see: AnyDesk Confirms Systems Hacked, Triggers Password Reset).Microsoft Defender Antimalware Platformsophisticated attack chain delivered a file called FraudReport.zip. "That archive used a genuine Microsoft Defender component alongside a malicious mpclient.dll, allowing the attacker-controlled DLL to be loaded byScreenConnectthat purports to be a "ShieldWall Defender" tool but which is an installer for remote-support tool ScreenConnect, bundled with additional functionality designed to deactivate some security tools and to escalate