Pink Vishing & Global PhaaS Campaigns: OTX Credential Theft Analysis

Excerpt: Pink actor vishing, global smishing operations, and gaming credential theft target finance, telco, and education sectors.

Threat Summary

Recent OTX pulse data reveals a convergence of high-volume social engineering campaigns aimed at credential theft and data extortion. The primary threats include the Pink extortion cluster (CL-CRI-1147) utilizing vishing and fake IT helpdesk scams to bypass MFA and steal cloud data, a massive Smishing-as-a-Service (SmSaaS) operation leveraging "Error 524" decoys to target telecommunications and finance sectors, and a sprawling gaming-themed phishing ecosystem targeting children via Roblox and Minecraft offerwalls. While tactics vary—ranging from voice calls to SMS and deceptive web forms—the objective remains consistent: harvesting valid credentials for initial access, financial fraud, or data extortion.

Threat Actor / Malware Profile

Adversary: Pink (CL-CRI-1147)

Profile: An extortion-focused group specializing in social engineering.
Distribution Method: Vishing (Voice Phishing) and IT Helpdesk impersonation. The group contacts targets directly, posing as support staff to guide them through granting access.
Payload/Behavior: Unlike traditional malware droppers, Pink relies on "human-in-the-loop" execution. They trick users into resetting credentials or enrolling malicious devices (e.g., passkeys), effectively bypassing MFA controls.
C2/Exfiltration: Once access is gained, actors manually or scriptually exfiltrate sensitive data from cloud storage platforms (SharePoint, OneDrive) to threaten leakage.
Persistence: Persistence is achieved by compromising legitimate user accounts and creating backdoor mail rules or adding unauthorized devices to the trusted list.

Adversary: Unknown (Smishing & Gaming Phishing)

Profile: Large-scale credential harvesters, likely operating as Phishing-as-a-Service (PaaS) affiliates.
Distribution Method:
- Smishing: SMS messages directing victims to phishing pages hidden behind "Error 524" cloudflare proxy pages to evade detection.
- Gaming: Typosquatting domains (e.g., roblox-com.com) and offerwall schemes promising free in-game currency.
Payload/Behavior: Web-based credential harvesting forms. In the gaming campaigns, these forms also harvest personal identifiable information (PII) of minors and enroll them in fraudulent subscription services.
Infrastructure: Heavy use of disposable domains and specific IP infrastructure (e.g., 45.11.229.230).

IOC Analysis

The provided indicators consist primarily of network infrastructure, signaling a campaign that relies on social engineering delivery rather than malicious binaries.

Domains: A mix of typosquatted domains (targeting Roblox/Minecraft fans) and sophisticated phishing infrastructure mimicking legitimate IT services (Pink actor).
- Operationalization: SOC teams should block these domains at the DNS resolver (RPZ) and inspect SSL/TLS traffic for these SNI headers. The deploypasskey.com domains specifically suggest an attempt to hijack passkey registration flows.
IPv4: 45.11.229.230 is linked to the child-targeting gaming phishing infrastructure.
- Operationalization: Block inbound/outbound connectivity to this IP at perimeter firewalls.
Tooling: IOCs can be integrated into SIEM solutions (Splunk, Sentinel) via threat intelligence feeds (STIX/TAXII) or CSV lookup tables. Network Detection and Response (NDR) tools should be configured to alert on DNS requests to the listed TLDs.

Detection Engineering

YAML

---
title: Pink Actor Phishing Infrastructure Connection
id: 9b6c7d8e-1a2b-3c4d-5e6f-7g8h9i0j1k2l
status: experimental
description: Detects DNS queries or network connections to known domains used by the Pink extortion group for credential harvesting via fake helpdesk schemes.
references:
    - https://otx.alienvault.com/pulse/67891011/
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.credential_access
    - attack.social_engineering
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'deploypasskey.com'
            - 'passkeyadd.com'
            - 'passkeydeploy.com'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Suspicious Gaming Platform Typosquatting
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects DNS queries to suspicious domains resembling Roblox or Minecraft, indicative of child-targeted credential harvesting or subscription traps.
references:
    - https://otx.alienvault.com/pulse/12345678/
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.initial_access
    - attack.phishing
logsource:
    category: dns
    product: windows
detection:
    keywords:
        query|contains:
            - 'roblox'
            - 'minecraft'
    tlds:
        query|endswith:
            - '.com'
            - '.net'
            - '.pw'
            - '.ink'
    filters:
        query|contains:
            - 'roblox.com'
            - 'minecraft.net'
    condition: keywords and tlds and not filters
falsepositives:
    - Legitimate gaming traffic to misspelled domains
level: medium
---
title: Connection to Known Child Targeting Phishing IP
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects network connections to IP address 45.11.229.230 associated with Roblox/Minecraft credential harvesting campaigns.
references:
    - https://otx.alienvault.com/pulse/12345678/
author: Security Arsenal Research
date: 2026/07/05
tags:
    - attack.command_and_control
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|startswith: '45.11.229.230'
    condition: selection
falsepositives:
    - Unlikely
level: high


kql
// Hunt for Pink Actor infrastructure and Gaming Phishing domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("deploypasskey.com", "passkeyadd.com", "passkeydeploy.com", "roblox-com.com", "blox.ink", "bloxlink.net", "www-roblox.pw", "robiox.com.ua")
or RemoteIP == "45.11.229.230"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc


powershell
# Hunt for Pink and Gaming Phishing Indicators in Hosts File or DNS Cache
$MaliciousDomains = @(
    "deploypasskey.com"
    "passkeyadd.com"
    "passkeydeploy.com"
    "roblox-com.com"
    "blox.ink"
    "bloxlink.net"
    "bloxlink.site"
    "www-roblox.pw"
    "robiox.com.ua"
    "www.robiox.com.ua"
)
$MaliciousIP = "45.11.229.230"

Write-Host "Checking Hosts File for malicious entries..."
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $MaliciousDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[ALERT] Found entry for $Domain in hosts file." -ForegroundColor Red
        }
    }
}

Write-Host "Resolving suspicious domains..."
foreach ($Domain in $MaliciousDomains) {
    try {
        $Resolution = Resolve-DnsName -Name $Domain -ErrorAction SilentlyContinue
        if ($Resolution.IPAddress -contains $MaliciousIP) {
            Write-Host "[ALERT] $Domain resolves to malicious IP $MaliciousIP" -ForegroundColor Red
        }
    } catch {
        # Ignore resolution failures
    }
}
Write-Host "Hunt complete."

Response Priorities

Immediate (0-24h)

Block IOCs: immediately block all listed domains (deploypasskey.com, blox.ink, etc.) and the IP 45.11.229.230 on perimeter firewalls, secure web gateways, and DNS resolvers.
Hunt Compromise: Run the provided PowerShell script across critical endpoints to check for local host file tampering or active DNS cache entries pointing to malicious infrastructure.

Short Term (24-48h)

Identity Audit: Given the Pink actor's focus on MFA bypass and cloud theft, audit Office 365/Azure AD logs for "Passkey registered" events or anomalous "Reset Password" activities originating from unfamiliar ASNs or geolocations inconsistent with the user's baseline.
User Awareness: Issue a specific security advisory warning users about "IT Helpdesk" scams requesting passkey enrollment and smishing messages regarding delivery errors.

Long Term (1 Week+)

Architecture Hardening: Implement strict FIDO2/WebAuthn policies that require physical presence verification to prevent remote enrollment by attackers. Enable number matching for MFA push notifications to mitigate MFA fatigue attacks used by vishing gangs.
Web Filtering: Update web filtering categories to block "Gaming/Cheats" and "Newly Registered Domains" for segments handling sensitive data or BYOD environments prone to gaming traffic.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub