InfoSecBulletin Cybersecurity for mankind
Hackers are targeting PNB MetLife insurance customers by using fake payment gateways to steal personal information and redirect victims to fraudulent UPI transactions. The scam takes advantage of PNB MetLife’s trusted image by creating fake mobile payment sites that look like real premium payment services.
Malicious pages collect policy numbers and customer information without checking their validity and quickly send the data to attackers.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The phishing operation mainly spreads via SMS, but it can also use email and social media.
Security researcher Anurag Gawande found several types of a phishing scheme during his threat-hunting efforts. He discovered that attackers used free hosting platforms, especially EdgeOne Pages, to quickly set up and change malicious sites.
The campaign shows a shift in financial fraud tactics, evolving from basic credential theft to complex operations that involve data theft and direct payment manipulation.
The attack starts slowly but soon intensifies as victims follow fake payment steps. After capturing initial details, the phishing page moves to collecting payment amounts and then offers UPI payment options.
This slow process creates false confidence while collecting various information from unaware customers. This threat is dangerous because it uses real payment apps for fraudulent transactions.
The scheme uses real UPI apps like PhonePe, Paytm, and Google Pay instead of fake payment processors, which lowers victim suspicion and raises chances of financial theft.
The sleek interface hides a complex data theft system using the Telegram Bot API. When victims enter their information, the phishing page covertly sends this data to Telegram channels controlled by the attacker instead of a real payment processing system.
An investigation revealed that multiple Telegram bots and operator accounts are involved in a phishing scheme. The bots “pnbmetlifesbot” and “goldenxspy_bot” gather information from victims, while accounts like “darkdevil_pnb” and “prabhatspy” track and obtain the stolen data.
