{
  "name": "EXPOSED: OnlyFans Hack Gone Wrong - How Cyber Criminals Turn into Victims Overnight",
  "slug": "exposed-onlyfans-hack-gone-wrong-how-cyber-criminals-turn-into-victims-overnight",
  "description": "A sophisticated operation has been uncovered that turns aspiring OnlyFans hackers into victims. A user named Bilalkhanicom offered a tool to 'check' OnlyFans accounts on a hacking forum, which turned out to be a delivery system for Lummac stealer malware. This malware, developed by a threat actor known as 'Shamel' or 'Lumma', targets cryptocurrency wallets, 2FA browser extensions, and sensitive information. The malware connects to a GitHub account named 'UserBesty' to download additional payloads. The operation extends beyond OnlyFans, targeting Disney+, Instagram, and botnet aspiring hackers. The malware's architecture hints at potential geopolitical connections, with folder names suggesting global influences. Several recently created .shop domains serve as command-and-control servers for the malware.",
  "published": "2024-09-06T07:46:00+00:00",
  "created_at": "2024-09-06T07:46:00+00:00",
  "modified_at": "2024-09-06T07:48:13+00:00",
  "created_at_opencti": "2024-09-06T07:46:00+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-06",
    "lummac stealer",
    "onlyfans"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "traineiwnqo.shop"
      },
      {
        "id": "",
        "name": "stamppreewntnq.shop"
      },
      {
        "id": "",
        "name": "stagedchheiqwo.shop"
      },
      {
        "id": "",
        "name": "ponintnykqwm.shop"
      },
      {
        "id": "",
        "name": "millyscroqwp.shop"
      },
      {
        "id": "",
        "name": "locatedblsoqp.shop"
      },
      {
        "id": "",
        "name": "caffegclasiqwp.shop"
      },
      {
        "id": "",
        "name": "evoliutwoqm.shop"
      },
      {
        "id": "",
        "name": "condedqpwqm.shop"
      }
    ],
    "malware": [
      {
        "id": "0bcec58e-0808-477f-a9fb-ab68e20f41b2",
        "name": "Lummac stealer",
        "slug": "lummac-stealer"
      }
    ],
    "intrusion_sets": [
      {
        "id": "a8ca2a32-84d5-4343-b249-4f2fd02d197f",
        "name": "Bilalkhanicom",
        "slug": "bilalkhanicom"
      }
    ],
    "attack_patterns": [
      {
        "id": "8ed8c69f-39b7-445c-8efb-6d3470064374",
        "name": "T1010"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "b9a3b4f8-b9c0-4ed8-bf5e-bf759b9804d6",
        "name": "T1564"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "c1e3fabe-9e8b-4e8f-a1f8-bf23e234e770",
        "name": "T1485"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/66dacf5908285fb712140ae3"
  ]
}