CyberDakait Android Banking Trojans + Firefox Crypto-Wallet Impersonators: OTX Pulse Analysis — Enterprise Detection Pack

Three concurrent OTX pulses published 2026-10-27/28 paint a consistent picture: financially-motivated threat actors are industrializing credential and secret theft across three distinct delivery surfaces — mobile banking, browser extensions, and business email — with shared tradecraft around social engineering, evasion, and resilient exfiltration infrastructure.

Pulse 1 — Browser Extension Wallet Drainers: Three malicious Firefox extensions impersonating the Phantom, Jupiter, and Bitget cryptocurrency wallets were observed harvesting recovery seed phrases and private keys. The operators used Unicode homoglyph substitution to make extension names visually indistinguishable from legitimate wallet software, and routed stolen secrets to brand-named subdomains under the bonto[.]io domain (phantom.bonto.io, jupiter.bonto.io, bitget.bonto.io). The Phantom impersonator uses a two-stage architecture: a lightweight loader pulls configuration from https://phantom.bonto.io/config before fetching the full theft payload — a hallmark of modular malware designed to survive takedowns and delay analysis.

Pulse 2 — CyberDakait Banking Trojan Cluster: Group-IB's research (surfaced via OTX) details a sustained campaign by the financially-motivated threat cluster CyberDakait, active since July 2025, deploying seven distinct Android malware families — GhostBat, GhostGrab, cyb3rx, d-passive, d-shine, tenxen, appkjl, godz, d-miner, XMRig, and BTMOB — against Indian financial services customers. Distribution relies on coordinated smishing and vishing: victims receive SMS messages and phone calls impersonating bank representatives, and are coerced into sideloading trojanized "security" or "card protection" apps. The cluster combines credential theft and overlay banking fraud with cryptojacking (XMRig miners pointed at pool.fud2026.com:9000), monetizing compromised devices twice. Infrastructure includes serviceshelp.online, cardsprotection.in, and the fud2026.xyz / fud2026.com hosting cluster — the "FUD" naming (Fully UnDetectable) is consistent with malware-as-a-service crypter branding.

Pulse 3 — Bid-Lure Credential Phishing: A business email compromise campaign uses "Project Bid Invitation" lures with password-protected PDF attachments to defeat automated email scanning. The PDF displays a fake OneDrive "shared document" button that redirects victims through compromised German infrastructure (lastingonlineexperiences.de subdomains, including an impersonated legitimate laser-technology firm) to Microsoft login spoofing pages. The inclusion of an Indonesian gambling domain (slotpastimaxwin50jt.online) in the redirect chain indicates commodity phishing-kit infrastructure being resold or co-located.

Collective assessment: All three operations share a single objective — bulk credential and secret acquisition feeding dark web credential markets. Seed phrases and private keys enable immediate, irreversible theft; banking credentials enable fraudulent transfers; corporate Microsoft 365 credentials enable BEC, invoice fraud, and resale to initial access brokers. The convergence of homoglyph spoofing, scanning-evasion (protected PDFs), impersonation social engineering, and multi-stage C2 demonstrates mature, profit-driven operators rather than opportunistic actors.

Threat Actor / Malware Profile

CyberDakait (Android Banking Cluster)

• Attribution: Financially-motivated threat cluster, tracked by Group-IB, targeting India's financial services sector since July 2025.
• Distribution: Coordinated smishing (SMS phishing) and vishing (voice phishing) — victims are contacted by fake bank representatives warning of account compromise and instructed to install a "security verification" app, typically via a direct APK sideload link on domains such as serviceshelp.online and cardsprotection.in.
• Payload behavior: The seven families blend banking trojan functionality — SMS interception (2FA/OTP theft), overlay injection over legitimate banking apps, keylogging, and screen capture — with XMRig-based cryptojacking. Families like d-miner and godz monetize idle device CPU through Monero mining against pool.fud2026.com:9000 and pool-proxy.fud2026.com:9000 on port 9000.
• C2 communication: HTTPS/HTTP to the fud2026.com and fud2026.xyz infrastructure (e.g., aptabase.fud2026.xyz, accessor.fud2026.com). The proxy pool architecture (pool-proxy.fud2026.com) suggests mining traffic laundering to obscure wallet attribution.
• Persistence: Android Accessibility Service abuse is the near-universal persistence and privilege model for this family class; the trojans request Accessibility permissions during install, granting them the ability to read screen content, inject taps, and prevent uninstallation.
• Anti-analysis: "FUD" infrastructure naming implies crypter/packer services; vishing-based delivery bypasses Play Store static review entirely; password/pin-gated APK delivery pages can evade crawler-based takedown.

Firefox Wallet Impersonators (bonto.io Cluster)

• Distribution: Mozilla Add-ons store submission under homoglyph-spoofed names mimicking Phantom, Jupiter, and Bitget wallets.
• Payload behavior: Two-stage design — the loader extension fetches runtime configuration from https://phantom.bonto.io/config, then retrieves the theft module. The second stage hooks wallet creation/import flows to capture seed phrases and private keys, exfiltrating them to the brand-matched bonto.io subdomain.
• Anti-analysis: Deferred second-stage download defeats store-review static analysis (the submitted loader contains no obvious theft logic); Unicode homoglyphs defeat both automated name-matching and casual user inspection.

Bid-Lure Phishing Kit

• Distribution: Email with password-protected PDF (evades sandbox detonation — no password, no execution); lure theme is "Project Bid Invitation" targeting procurement/engineering professionals.
• Redirect chain: Fake OneDrive button in PDF → compromised .de host (mm-lasertechnik.lastingonlineexperiences.de, nbpn.lastingonlineexperiences.de/nasa.php) → Microsoft 365 credential harvester; email address passed via GET parameter (?email=) to pre-fill the phishing form, increasing credibility.
• Anti-analysis: Password-protected attachments, compromised-legitimate-host staging, and URL parameterization that requires the original email value to render correctly.

IOC Analysis

The indicator set across these pulses is infrastructure-heavy (hostnames, domains, URLs) with a smaller set of file hashes — a typical profile for campaign takedown reporting rather than endpoint malware triage.

SOC workflow guidance:

1. Network indicators first — the domains/hostnames have the longest detection shelf-life. Feed them into DNS firewall, SWG, and EDR custom intelligence lists. Watch for wildcard coverage: block *.bonto.io and *.fud2026.com at the apex where policy permits.
2. Historical hunting — query DNS/proxy telemetry back at least 90 days (CyberDakait has been active since July 2025).
3. Decode and pivot — URL indicators containing base64-looking path segments (e.g., /1Dmw9/) can be decoded with CyberChef; the ?email= parameter pattern is a high-fidelity hunt artifact for phishing kit traffic.
4. Mobile gap — desktop-centric SOC tooling will not see the Android trojans. Coordinate with MDM/mobile threat defense (MTD) to push the C2 domains to on-device VPN/DNS filtering for corporate-managed and BYOD devices.

Detection Engineering

---
title: Firefox Crypto Wallet Impersonator C2 - Bonto.io Exfiltration
id: 8f3a2c1e-9b4d-4e7a-a1c2-3d4e5f6a7b8c
status: experimental
description: Detects network connections to bonto.io infrastructure used by malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to exfiltrate seed phrases and private keys.
references:
    - https://socket.dev/blog/firefox-wallet-impersonators
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - '.bonto.io'
    selection_firefox:
        Image|contains:
            - 'firefox'
    condition: selection_domain
falsepositives:
    - Unlikely; bonto.io has no known legitimate use in enterprise environments
level: high
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.t1056.001
date: 2026/10/28
---
title: XMRig Cryptomining Pool Connection - CyberDakait fud2026 Infrastructure
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network connections to CyberDakait cryptojacking pool infrastructure on port 9000, associated with the d-miner/godz Android trojan families and XMRig monetization.
references:
    - https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'fud2026.com'
            - 'fud2026.xyz'
    selection_port:
        DestinationPort: 9000
    condition: selection_domain or selection_port
falsepositives:
    - Legitimate mining operations (rare in enterprise); validate against approved software inventory
level: high
tags:
    - attack.impact
    - attack.t1496
date: 2026/10/28
---
title: Phishing Kit Redirect - Lastingonlineexperiences.de Credential Harvester
id: 7e8f9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b
status: experimental
description: Detects web requests to compromised German infrastructure hosting Microsoft 365 credential phishing pages delivered via password-protected PDF bid-invitation lures, including the telltale ?email= pre-fill parameter.
references:
    - https://cofense.com/blog/locked-and-loaded-phishing-through-fake-bids-and-protected-documents
author: Security Arsenal Threat Intelligence
logsource:
    category: proxy
    product: zeek
detection:
    selection_host:
        cs-host|contains:
            - 'lastingonlineexperiences.de'
            - 'slotpastimaxwin50jt.online'
    selection_uri:
        cs-uri-query|contains: 'email='
    selection_uri_path:
        cs-uri-stem|contains:
            - 'nasa.php'
            - '/1Dmw9/'
    condition: selection_host or (selection_uri and 1 of selection_uri*)
falsepositives:
    - Legitimate traffic to the compromised parent domain (lastingonlineexperiences.de) prior to compromise - scope alerts to the listed URI patterns where possible
level: high
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.t1078
date: 2026/10/28

// Security Arsenal - CyberDakait / Bonto.io / Bid-Phish Unified Hunt
// Searches 90 days of network telemetry for all OTX pulse infrastructure
let Lookback = 90d;
let IOCs = dynamic([
    "bonto.io",
    "phantom.bonto.io",
    "jupiter.bonto.io",
    "bitget.bonto.io",
    "serviceshelp.online",
    "cardsprotection.in",
    "fud2026.xyz",
    "fud2026.com",
    "lastingonlineexperiences.de",
    "slotpastimaxwin50jt.online"
]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (IOCs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
    | extend Source = "DeviceNetworkEvents";
let EmailUrlHits =
    UrlClickEvents
    | where TimeGenerated > ago(Lookback)
    | where Url has_any (IOCs)
    | project TimeGenerated, AccountUpn, Url, UrlChain, Workload, IsClickedThrough
    | extend Source = "UrlClickEvents";
union NetworkHits, EmailUrlHits
| sort by TimeGenerated desc;

# Security Arsenal - Credential Theft Campaign IOC Hunt
# Sweeps endpoints for OTX pulse indicators: network connections, browser extension
# artifacts, and DNS cache evidence of bonto.io / fud2026 / phishing infrastructure.
# Run elevated. Output: CSV to $env:TEMP\OTX_Hunt_Results.csv

$iocHosts = @(
    'bonto.io','phantom.bonto.io','jupiter.bonto.io','bitget.bonto.io',
    'fud2026.com','fud2026.xyz','pool.fud2026.com','pool-proxy.fud2026.com',
    'aptabase.fud2026.xyz','accessor.fud2026.com',
    'serviceshelp.online','cardsprotection.in',
    'lastingonlineexperiences.de','slotpastimaxwin50jt.online'
)
$iocHashes = @(
    '311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9',
    '9ca705d6466d4d71c3fb0cae5097933afe1de1bc139d53bb63565a52dc9ebccb',
    'c9281ea6828b9de4443ac56361ac29da'
)
$results = @()

Write-Host '[*] Checking active and historical network connections...' -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $rdns = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop -DnsOnly).NameHost
    } catch { $rdns = $null }
    if ($rdns) {
        foreach ($ioc in $iocHosts) {
            if ($rdns -like "*$ioc*") {
                $results += [PSCustomObject]@{
                    Type='NetworkConnection'; IOC=$ioc; Detail="$($_.LocalAddress):$($_.LocalPort) -> $rdns ($($_.RemoteAddress):$($_.RemotePort)) State=$($_.State) PID=$($_.OwningProcess)"
                }
            }
        }
    }
}

Write-Host '[*] Checking DNS client cache for indicator resolutions...' -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | ForEach-Object {
    foreach ($ioc in $iocHosts) {
        if ($_.Entry -like "*$ioc*") {
            $results += [PSCustomObject]@{
                Type='DNSCache'; IOC=$ioc; Detail="Entry: $($_.Entry) -> $($_.Data)"
            }
        }
    }
}

Write-Host '[*] Checking Firefox profiles for suspicious extensions...' -ForegroundColor Cyan
$ffProfiles = Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Directory -ErrorAction SilentlyContinue
foreach ($p in $ffProfiles) {
    $extDir = Join-Path $p.FullName 'extensions'
    if (Test-Path $extDir) {
        Get-ChildItem $extDir -ErrorAction SilentlyContinue | ForEach-Object {
            $sus = $false
            foreach ($term in @('phantom','jupiter','bitget','wallet')) {
                if ($_.Name -like "*$term*") { $sus = $true }
            }
            if ($sus) {
                $results += [PSCustomObject]@{
                    Type='FirefoxExtension'; IOC='wallet-impersonator'; Detail="$($_.FullName) (LastWrite: $($_.LastWriteTime))"
                }
            }
        }
    }
}

Write-Host '[*] Hash-matching files in user download directories...' -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -lt 50MB } | ForEach-Object {
        try {
            $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
            if ($iocHashes -contains $h) {
                $results += [PSCustomObject]@{ Type='FileHash'; IOC=$h; Detail=$_.FullName }
            }
        } catch {}
    }

Write-Host '[*] Checking scheduled tasks and Run keys for persistence anomalies...' -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskPath -notlike '\Microsoft*' -and ($_.Actions.Execute -match 'powershell|cmd|wscript|mshta|rundll32')
} | ForEach-Object {
    $results += [PSCustomObject]@{ Type='SuspiciousTask'; IOC='persistence-check'; Detail="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }
}
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' -and $_.Value -match 'AppData|Temp' } | ForEach-Object {
            $results += [PSCustomObject]@{ Type='RunKey'; IOC='persistence-check'; Detail="$rk :: $($_.Name) = $($_.Value)" }
        }
    }
}

if ($results.Count -gt 0) {
    $out = "$env:TEMP\OTX_Hunt_Results.csv"
    $results | Export-Csv -Path $out -NoTypeInformation
    Write-Host "[!] $($results.Count) findings written to $out" -ForegroundColor Red
    $results | Format-Table -AutoSize
} else {
    Write-Host '[+] No indicators found on this host.' -ForegroundColor Green
}

Response Priorities

Immediate (0-4 hours)

• Block all IOC infrastructure at DNS resolver, secure web gateway, and EDR network layer: *.bonto.io, *.fud2026.com, *.fud2026.xyz, serviceshelp.online, cardsprotection.in, the listed lastingonlineexperiences.de subdomains, and slotpastimaxwin50jt.online.
• Retro-hunt proxy, DNS, and firewall logs for the past 90 days against all listed hostnames and domains; escalate any hits to incident response.
• Push file hashes (311c4997...f30e9, 9ca705d6...ebccb, c9281ea6...29da) to EDR blocklists.
• Run the PowerShell hunt script across endpoints prioritized by user role: finance, procurement (bid-lure targets), and any users with crypto-wallet browser extensions.
• MDM/MTD push: distribute the CyberDakait C2 domains to mobile threat defense platforms; audit managed devices for sideloaded apps and Accessibility Service permissions granted to non-whitelisted packages.

24 Hours

• Credential exposure assessment: All three campaigns steal secrets. For any host or user with confirmed infrastructure contact: force password resets (Microsoft 365/Entra ID, banking portals), revoke active sessions and refresh tokens, and audit sign-in logs for anomalous geographies (particularly logins following any ?email= phishing kit hit).
• Crypto asset response: For users who installed any wallet extension matching the Phantom/Jupiter/Bitget impersonators, treat seed phrases and private keys as fully compromised — keys must be rotated to new wallets immediately; assume any delay equals theft.
• India-facing banking exposure: Notify treasury/finance teams with Indian banking relationships; enable step-up authentication on wire transfers pending completion of mobile device audits.
• Email security tuning: Add detection for password-protected PDF attachments from external senders with procurement-themed subjects ("bid", "RFP", "invitation to tender"); flag for sandboxing with provided-password extraction or user-report workflows.

1 Week

• Browser extension governance: Deploy an enterprise browser extension allowlist policy (Firefox Enterprise policy / Chrome ExtensionInstallAllowlist). Uncontrolled extension installation is the root enabler of the bonto.io campaign.
• Android sideloading controls: Enforce MDM policy blocking APK installation from unknown sources on corporate devices; for BYOD with financial app access, require MTD enrollment.
• DMARC/anti-BEC hardening: Verify DMARC enforcement (p=reject) and enable impersonation protection for executive and finance personas; add banner warnings for external email containing OneDrive/share links.
• Detection onboarding: Promote the Sigma and KQL content above into production with a 30-day tuning window; add ?email= GET-parameter alerting to proxy analytics as a durable phishing-kit behavior detection.
• Threat intel integration: Subscribe to the AlienVault OTX pulses referenced here for automated IOC ingestion, with a 90-day lookback validation pass before expiry.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub