Colombia: LUMU Detects ShadowParasite

LUMU identified a digital fraud operation in Colombia called ShadowParasite, which impersonated companies and payment portals using malicious infrastructure. According to Semana's coverage of the analysis, the operation expanded from 51 to 288 domains, added 246 IP addresses and 29 autonomous systems, and also involved 47 impersonated brands and seven related payment gateways.

What was ShadowParasite doing?

ShadowParasite set up fake sites to trick users who were trying to pay or access online services. Semana reported, based on LUMU's findings, that some of those portals asked for passwords, authentication codes and card data inside fraudulent banking pages.

The same coverage attributed to LUMU the identification of code used to impersonate 15 financial institutions. Of that group, six entities, according to the report cited by Semana, included mechanisms to capture biometric data through photos or videos.

How are Bre-B lures being used?

Infobae Colombia reported digital identity impersonation campaigns that use the Bre-B name in text messages about supposed key registrations or pending transfers. Those SMS messages lead to fraudulent links that ask for credentials, verification codes or other personal data.

Noticias RCN, citing findings by Kaspersky researchers, described a similar method based on links that simulate pending digital key registrations or transfers that would require acceptance. According to that coverage, the links can lead to pages that mimic banking portals and request credentials.

Publimetro Colombia quoted Banco de la República as saying that Bre-B transfers do not require recipient acceptance and that key registration is only done through each financial institution's official app or website. The same publication said Bogotá's District Security Secretariat warned about messages that simulated Bre-B payments and sought passwords and security codes, recommending that users verify transactions in the official app and report suspicious messages.

La FM also described the use of text messages and pages that imitate banking portals to ask for personal or financial information, with lures tied to blocks, pending transfers or problems with a digital key.