Yvan Franco ✊🏻🇻🇪

🚨🇻🇪 ALERT: Malicious actors are carrying out a phishing campaign impersonating the "Cashea" application to steal credentials and identity documents, which are then sent to a Discord channel. VECERT has identified a fraudulent infrastructure that uses a mobile webpage designed to look like Cashea, aiming to deceive users and collect sensitive information. Routine monitoring detected the threat; the attackers are currently developing a sophisticated malicious application designed to steal data from users registered with the legitimate Cashea app. The following Indicator of Compromise (IoC) was identified: casheave(.)wasmer.app The actors are using the "Wasmer" platform to create a subdomain and distribute the malicious link, which is already active. Analysis of the JavaScript code revealed instructions detailing how the application functions and where the stolen data is sent. Anatomy of the attack: 📱 When the link is opened on a mobile device, the victim encounters an interface that mimics the workflow of a financial application: 1️⃣ It requests the email address associated with the account. 2️⃣ It requests a 6-digit PIN or numeric password. 3️⃣ It requests a phone number and state/region. 4️⃣ It requests photographs of the front and back of the user's national ID card. 🔬 What does the JavaScript reveal? The code does not perform a legitimate login process. It includes a configuration setting: SEND_ON_LOGIN = true This indicates that as soon as the victim enters their email and PIN, the data is immediately transmitted to the operators—even before the rest of the form is completed. 📤 The JavaScript utilizes a transmission function via `fetch()` and `FormData`—a standard web technique for sending form data and files. In this instance, the information is prepared and sent to a Discord webhook—a remote channel controlled by the operators behind the campaign. 🛰️ In simple terms: 👤 The victim enters their personal information into a fake webpage. 📦 The browser bundles email, PIN, phone number, status, and files. 📨 The site automatically sends this data to a remote webhook. 💬 Operators can receive the logs and images via a Discord channel. 🪪 The code also handles the attachment of original photographs taken via the device's camera, including the front and back of identity documents. Furthermore, it manages file sizes, performs image conversion, and includes retry logic for uploads in case the server rejects a file that is too large. ⚠️ This indicates that the campaign was designed to capture high-quality, usable images, rather than just low-quality screenshots. 🔎 There are references to checking the edges of documents and detecting blurry photos. This allows operators to request clearer images of the identity document. 🚨 Potential consequences: 🔓 Unauthorized account access attempts 🎭 Identity theft 📲 Scams via SMS, WhatsApp, phone calls, or email 🔁 Abuse of account recovery processes 💳 Financial fraud or the creation of fake profiles 📂 Sale, exchange, or reuse of stolen documents ✅ Recommendations for users: • Do not enter your email, PIN, phone number, or photos of your identity document via links received in messages, on social media, or through advertisements. • Access the service only through the official application or via cashea .app. • If you have already entered your information, immediately change your PIN and any passwords reused across other services. • Review your account activity, linked devices, and recovery settings. • Report the suspicious link to Cashea through their official channels. #Venezuela #Cashea #Phishing #Cybersecurity #DigitalFraud #IdentityTheft #Discord #OSINT #CTI #VECERT