InfoSecBulletin Cybersecurity for mankind
Hackers are targeting PNB MetLife insurance customers by using fake payment gateways to steal personal information and redirect victims to fraudulent UPI transactions. The scam takes advantage of PNB MetLife’s trusted image by creating fake mobile payment sites that look like real premium payment services.
Malicious pages collect policy numbers and customer information without checking their validity and quickly send the data to attackers.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
The phishing operation mainly spreads via SMS, but it can also use email and social media.
Security researcher Anurag Gawande found several types of a phishing scheme during his threat-hunting efforts. He discovered that attackers used free hosting platforms, especially EdgeOne Pages, to quickly set up and change malicious sites.
The campaign shows a shift in financial fraud tactics, evolving from basic credential theft to complex operations that involve data theft and direct payment manipulation.
The attack starts slowly but soon intensifies as victims follow fake payment steps. After capturing initial details, the phishing page moves to collecting payment amounts and then offers UPI payment options.
This slow process creates false confidence while collecting various information from unaware customers. This threat is dangerous because it uses real payment apps for fraudulent transactions.
The scheme uses real UPI apps like PhonePe, Paytm, and Google Pay instead of fake payment processors, which lowers victim suspicion and raises chances of financial theft.
The sleek interface hides a complex data theft system using the Telegram Bot API. When victims enter their information, the phishing page covertly sends this data to Telegram channels controlled by the attacker instead of a real payment processing system.
An investigation revealed that multiple Telegram bots and operator accounts are involved in a phishing scheme. The bots “pnbmetlifesbot” and “goldenxspy_bot” gather information from victims, while accounts like “darkdevil_pnb” and “prabhatspy” track and obtain the stolen data.
