{
  "name": "GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware",
  "slug": "gxc-team-unmasked-the-cybercriminal-group-targeting-spanish-bank-users-with-ai-powered-phishing-tools-and-android-malware",
  "description": "Group-IB discovered a Spanish-speaking criminal group, GXC Team, offering a sophisticated AI-powered phishing-as-a-service platform targeting Spanish bank customers. The group specialized in developing phishing kits, Android malware, and AI-powered scam tools. Their malicious Android app, disguised as a banking application, was designed to intercept OTP codes, affecting users of over 36 Spanish banks and 30 institutions worldwide. Despite not being highly sophisticated, GXC Team's innovative features, such as bundling phishing kits with the Android malware and an AI-powered voice caller, made them a severe threat to banking security in Spain.",
  "published": "2024-07-29T10:03:10+00:00",
  "created_at": "2024-07-29T10:03:10+00:00",
  "modified_at": "2024-07-29T10:34:14+00:00",
  "created_at_opencti": "2024-07-29T10:03:10+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-29",
    "android",
    "banking",
    "phishing",
    "spain"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.incidencia-404.com"
      },
      {
        "id": "",
        "name": "www.es-enter.com"
      },
      {
        "id": "",
        "name": "www.direct-cuentas.com"
      },
      {
        "id": "",
        "name": "www-laboraikutxa.com"
      },
      {
        "id": "",
        "name": "www-bancasabadell.com"
      },
      {
        "id": "",
        "name": "www-banca-sabadell.com"
      },
      {
        "id": "",
        "name": "unicajabanco.es-info.su"
      },
      {
        "id": "",
        "name": "openbank.es-clientes.su"
      },
      {
        "id": "",
        "name": "santander.esp-aviso.com"
      },
      {
        "id": "",
        "name": "santander-empresas.grupo-inicios.com"
      },
      {
        "id": "",
        "name": "lng-direct.es-miparticulares.com"
      },
      {
        "id": "",
        "name": "laboralkutxa.es-usuarios.online"
      },
      {
        "id": "",
        "name": "laboralkutxa.es-users.com"
      },
      {
        "id": "",
        "name": "ing.home-html.com"
      },
      {
        "id": "",
        "name": "ing.direct-usuario.com"
      },
      {
        "id": "",
        "name": "dg.esmas.online"
      },
      {
        "id": "",
        "name": "deutschbank.es-infos.su"
      },
      {
        "id": "",
        "name": "caixaenginyers.es-cuentas.su"
      },
      {
        "id": "",
        "name": "bancosantander.es-web.su"
      },
      {
        "id": "",
        "name": "bancobbva.es-online.su"
      },
      {
        "id": "",
        "name": "bancaminos.tuscaminos.com"
      },
      {
        "id": "",
        "name": "bancamarch.es-acceso.su"
      },
      {
        "id": "",
        "name": "banca.grupocajarural-esp.com"
      },
      {
        "id": "",
        "name": "arquiabanca.es-accesos.su"
      },
      {
        "id": "",
        "name": "z-sms.online"
      },
      {
        "id": "",
        "name": "usuario-e.com"
      },
      {
        "id": "",
        "name": "uk-lives.su"
      },
      {
        "id": "",
        "name": "tuscamino.com"
      },
      {
        "id": "",
        "name": "tuscaminos.com"
      },
      {
        "id": "",
        "name": "targobank-verificaciones.com"
      },
      {
        "id": "",
        "name": "targobank-verificacion.com"
      },
      {
        "id": "",
        "name": "supportfbappeal.com"
      },
      {
        "id": "",
        "name": "seguridad-mibbva.com"
      },
      {
        "id": "",
        "name": "seguridad-eurocaja.com"
      },
      {
        "id": "",
        "name": "seguridad-mi-abanca.com"
      },
      {
        "id": "",
        "name": "renta4banconets.club"
      },
      {
        "id": "",
        "name": "renta4banconet.club"
      },
      {
        "id": "",
        "name": "r4banconet.club"
      },
      {
        "id": "",
        "name": "opensbank.com"
      },
      {
        "id": "",
        "name": "movil-abanca.online"
      },
      {
        "id": "",
        "name": "mioficina-es.com"
      },
      {
        "id": "",
        "name": "micorreos-notificacion.com"
      },
      {
        "id": "",
        "name": "micorreo-notificacion.com"
      },
      {
        "id": "",
        "name": "micorreo-aviso.com"
      },
      {
        "id": "",
        "name": "mibanca-bankinter.com"
      },
      {
        "id": "",
        "name": "mi-satander.com"
      },
      {
        "id": "",
        "name": "mi-sabadell.com"
      },
      {
        "id": "",
        "name": "mi-laboralkutxa.com"
      },
      {
        "id": "",
        "name": "mi-laboraikutxa.com"
      },
      {
        "id": "",
        "name": "mi-kutxabank.com"
      },
      {
        "id": "",
        "name": "mi-evobanco.com"
      },
      {
        "id": "",
        "name": "mi-deutschebank.com"
      },
      {
        "id": "",
        "name": "mi-deustsche-bank.com"
      },
      {
        "id": "",
        "name": "mi-bankinter.com"
      },
      {
        "id": "",
        "name": "mi-caixabanca.com"
      },
      {
        "id": "",
        "name": "mi-bancsabadell.com"
      },
      {
        "id": "",
        "name": "mi-abanca.com"
      },
      {
        "id": "",
        "name": "libersbanknets.club"
      },
      {
        "id": "",
        "name": "liberbanksnet.club"
      },
      {
        "id": "",
        "name": "liberbankorg.club"
      },
      {
        "id": "",
        "name": "liberbanknets.club"
      },
      {
        "id": "",
        "name": "liberbankis.club"
      },
      {
        "id": "",
        "name": "liberbankiorg.club"
      },
      {
        "id": "",
        "name": "liberbankes.club"
      },
      {
        "id": "",
        "name": "liberbanconet.club"
      },
      {
        "id": "",
        "name": "laboraikuxta-usuarios.com"
      },
      {
        "id": "",
        "name": "laborakutxa-usuario.com"
      },
      {
        "id": "",
        "name": "laboraikutxa-web.com"
      },
      {
        "id": "",
        "name": "incidencia-404.com"
      },
      {
        "id": "",
        "name": "laboraikutxa-usuario.com"
      },
      {
        "id": "",
        "name": "hu-alert.online"
      },
      {
        "id": "",
        "name": "home-html.com"
      },
      {
        "id": "",
        "name": "hanseaticsbank-da.com"
      },
      {
        "id": "",
        "name": "hanseaticbank.su"
      },
      {
        "id": "",
        "name": "grupos-inicio.com"
      },
      {
        "id": "",
        "name": "grupocajarural-esp.com"
      },
      {
        "id": "",
        "name": "grupo-inicios.com"
      },
      {
        "id": "",
        "name": "f-fb-watch.com"
      },
      {
        "id": "",
        "name": "etherscamorg.club"
      },
      {
        "id": "",
        "name": "esp-avisos.com"
      },
      {
        "id": "",
        "name": "esp-aviso.com"
      },
      {
        "id": "",
        "name": "es-web.su"
      },
      {
        "id": "",
        "name": "es-usuarios.online"
      },
      {
        "id": "",
        "name": "es-users.com"
      },
      {
        "id": "",
        "name": "es-saldo.su"
      },
      {
        "id": "",
        "name": "es-registros.com"
      },
      {
        "id": "",
        "name": "es-online.su"
      },
      {
        "id": "",
        "name": "es-particular-es.com"
      },
      {
        "id": "",
        "name": "es-miparticulares.com"
      },
      {
        "id": "",
        "name": "es-miempresas.com"
      },
      {
        "id": "",
        "name": "es-live.su"
      },
      {
        "id": "",
        "name": "es-lives.su"
      },
      {
        "id": "",
        "name": "es-iniciar.online"
      },
      {
        "id": "",
        "name": "es-info.su"
      },
      {
        "id": "",
        "name": "es-infos.su"
      },
      {
        "id": "",
        "name": "es-html.com"
      },
      {
        "id": "",
        "name": "es-funcion.su"
      },
      {
        "id": "",
        "name": "es-funciones.su"
      },
      {
        "id": "",
        "name": "es-entra.online"
      },
      {
        "id": "",
        "name": "es-cuentas.su"
      },
      {
        "id": "",
        "name": "es-enter.com"
      },
      {
        "id": "",
        "name": "es-cuenta.su"
      },
      {
        "id": "",
        "name": "es-clientes.su"
      },
      {
        "id": "",
        "name": "es-actualizacion.su"
      },
      {
        "id": "",
        "name": "es-bsnacional.com"
      },
      {
        "id": "",
        "name": "es-accesos.su"
      },
      {
        "id": "",
        "name": "es-acceso.su"
      },
      {
        "id": "",
        "name": "eligecamino.com"
      },
      {
        "id": "",
        "name": "dispositivo-triodos.com"
      },
      {
        "id": "",
        "name": "direct-usuario.com"
      },
      {
        "id": "",
        "name": "direct-cuentas.com"
      },
      {
        "id": "",
        "name": "cancelar-recibos.net"
      },
      {
        "id": "",
        "name": "cornerbanks-ch.com"
      },
      {
        "id": "",
        "name": "cuenta-app.com"
      },
      {
        "id": "",
        "name": "cancelacion-transferencias.net"
      },
      {
        "id": "",
        "name": "caixaeginyers.com"
      },
      {
        "id": "",
        "name": "cajamar-verificacion.com"
      },
      {
        "id": "",
        "name": "caixabank-particular.com"
      },
      {
        "id": "",
        "name": "binacenow.com"
      },
      {
        "id": "",
        "name": "binacefull.net"
      },
      {
        "id": "",
        "name": "binacefull.biz"
      },
      {
        "id": "",
        "name": "binaceeasy.com"
      },
      {
        "id": "",
        "name": "be-ceca.com"
      },
      {
        "id": "",
        "name": "binacecoin.net"
      },
      {
        "id": "",
        "name": "bbvaempresa-es.com"
      },
      {
        "id": "",
        "name": "bbva-seguridad-es.com"
      },
      {
        "id": "",
        "name": "bbvacuentaonline.su"
      },
      {
        "id": "",
        "name": "bbva-atencion-cliente.com"
      },
      {
        "id": "",
        "name": "bankinter-banca.com"
      },
      {
        "id": "",
        "name": "bankinter-ingreso.com"
      },
      {
        "id": "",
        "name": "bancsabadell-esp.com"
      },
      {
        "id": "",
        "name": "bancosantander-empresas.net"
      },
      {
        "id": "",
        "name": "bancosantander-empresa.net"
      },
      {
        "id": "",
        "name": "bancasantander-es-empresa.com"
      },
      {
        "id": "",
        "name": "bancasantander-empresas.com"
      },
      {
        "id": "",
        "name": "bancasantander-empresa.com"
      },
      {
        "id": "",
        "name": "bancasantander-empresa-es.com"
      },
      {
        "id": "",
        "name": "bancasantander-app.com"
      },
      {
        "id": "",
        "name": "bancaminos.com"
      },
      {
        "id": "",
        "name": "bancaminos-es.online"
      },
      {
        "id": "",
        "name": "banca-laboraikutxa.com"
      },
      {
        "id": "",
        "name": "banca-deutsche.com"
      },
      {
        "id": "",
        "name": "banca-arquia.com"
      },
      {
        "id": "",
        "name": "aviso-laboralkutxa.com"
      },
      {
        "id": "",
        "name": "aviso-bbva.com"
      },
      {
        "id": "",
        "name": "au-myposts.com"
      },
      {
        "id": "",
        "name": "au-lives.su"
      },
      {
        "id": "",
        "name": "andbank.club"
      },
      {
        "id": "",
        "name": "antifraudes-es.com"
      },
      {
        "id": "",
        "name": "amazon-cuentas.com"
      },
      {
        "id": "",
        "name": "abanca-usuario.com"
      },
      {
        "id": "",
        "name": "e65c24d6e5f883ca02f79edc0bd4fdbd28dc130f11fdbca75b7fd26b2587bfa4"
      },
      {
        "id": "",
        "name": "e047f13914278ad4e5cc63d30cfdac56cf20f86d3a4cf26414001e9aed5f9875"
      },
      {
        "id": "",
        "name": "b1b0eb10002669be6b32792a196227f1d595e26b0039e719ef9357e2b8f5361b"
      },
      {
        "id": "",
        "name": "9c718529f37a6c3ea0b128a8c15a1d1950bb350a9b5039c770651b8b73393007"
      },
      {
        "id": "",
        "name": "ae2976f99876605df0e043ac62081af43426286ec5759dc3eca080e26cb16b97"
      },
      {
        "id": "",
        "name": "944f0568ce0394b4db3fd618d6f1a0c53f94712f91fa162a4f28b1f93ad9f18f"
      },
      {
        "id": "",
        "name": "492682f877607ee99df2ddd2bd5953fd727bdf6e19d397de9dbbafd582bcad75"
      },
      {
        "id": "",
        "name": "402544c3c74924c7a9f355108f474fd3b0d643a38aba45c933d880b1c2a206de"
      },
      {
        "id": "",
        "name": "2826a1c5ed1456ba00421ffdd4e331c691b39fc0334f4590eb860c38452d606b"
      },
      {
        "id": "",
        "name": "05a5cf0d0eb2a224d0326f2ac95a2d60ca9935d015070ed17439c2dd7a79d50c"
      }
    ],
    "intrusion_sets": [
      {
        "id": "622c766a-6314-4f6b-9435-8b3b8e2a1d40",
        "name": "GXC Team",
        "slug": "gxc-team"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Slovakia"
      },
      {
        "id": "",
        "name": "Spain"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.group-ib.com/blog/gxc-team-unmasked/",
    "https://otx.alienvault.com/pulse/66a784fec2978a9e25d73d95"
  ]
}