InfoSecBulletin Cybersecurity for mankind
A global smishing scam dubbed “Error524” is hitting many countries, including Bangladesh. BGD e-Gov CIRT said, this scam uses Phishing-as-a-Service (PhaaS) tools to send SMS messages with harmful links.
These links redirect victims to highly convincing phishing websites designed to steal:
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Personal information
Banking credentials
Payment card data
This campaign is a big threat to both organizations and individuals because it uses automation and pretends to be trusted services.
Threat Overview:
Active since late 2025, the Error524 campaign uses:
Shortened malicious URLs, Cloud-based infrastructure, Domain rotation, evasion techniques and so on.
Attackers mimic trusted services such as:
Financial institutions, Government portals, providers, Logistics & delivery services, Retail and loyalty programs.
Impact on Bangladesh
Bangladesh is among the targeted countries, making several sectors vulnerable:
Sector Risk
Financial Services Banking credential theft
Government Services Fake citizen portals
Telecommunications SMS spoofing & distribution
Logistics/Delivery Fake parcel notifications
E-commerce Reward/payment scams
Potential consequences:
Financial fraud
Identity theft
Data breaches
Loss of public trust
Attack Methodology
- Smishing Distribution
Victims receive fraudulent SMS messages with lures such as:
Delivery updates
Unpaid toll/fine alerts
Account verification requests
Reward offers
2. Phishing Redirection
Users click a link → redirected to fake websites
Pages closely mimic real platforms.
3. Data Collection
Victims are tricked into submitting:
Login credentials
Personal identification info
Card details
One-time passwords (OTP)
4. Data Exfiltration
Stolen data is sent via:
WebSocket channels
HTTP POST requests
Centralized phishing servers
Technical Analysis
Infrastructure Characteristics
CDN masking (Cloudflare) to hide origin servers
Hosting on cloud platforms (Tencent, Alibaba)
Bulk domain registrations
Suspicious TLDs: .top, .ink, .bond, .click, .vip, .icu
Evasion Techniques:
Geofencing: Targets specific countries (including Bangladesh)
CAPTCHA filtering: Blocks security scanners
Fake Error Pages: Displays “Error 524” to avoid detection
Device Fingerprinting: Detects sandbox environments
Indicators of Compromise (IOCs)
Malicious Domains (Examples)
americanexpress-bonus306[.]ink
fullcopechilex[.]top
telcoe[.]shop
portalcity[.]top
Suspicious IPs
47.82.154[.]2 (Alibaba Cloud)
43.165.6[.]36 (Tencent Cloud)
154.81.166[.]17 (Credential harvesting)
MITRE ATT&CK Mapping
The Error524 smishing campaign shows that SMS phishing attacks are getting smarter. Bangladesh is one of the target locations, so both groups and people need to take steps to stay safe and be alert to reduce risks.
