VeatyMalware
- Whisper
Last reported 2 days ago, by Help Net Security5 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1684Social Engineering
“Phantom Deal profile: Gen Digital has stumbled upon a cybercrime group that poses as executives who use WhatsApp social-engineering to trick victims into investing or acquiring fake companies.”
- T1056.001Keylogging
“Spyroid is a sophisticated RAT-as-a-service tool sold to cybercriminals, offering capabilities including keylogging, screen capture, file management, social media account interception, and full device remote control.”
- T1111Multi-Factor Authentication Interception
“T1111”
- T1539Steal Web Session Cookie
“T1539”
- T1557Adversary-in-the-Middle
“T1557”
- T1566.002Spearphishing Link
“T1566.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Say a few words, and a rigged AI asks for $5,000“Here’s the good news: the Whisper backdoor is fragile.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“New Prince of Persia infrastructure: Whisper security researchers have spotted new backend infra and domains linked to Prince of Persia (Infy) APT operations.”
-
Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana“Las respuestas verbales de la víctima son transcritas en tiempo real por OpenAI Whisper, que envía la transcripción de vuelta a GPT-4o-mini para generar respuestas de seguimiento adecuadas al contexto.”
-
Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking“The victim’s spoken responses are transcribed in real time by OpenAI Whisper, which feeds the transcript back to GPT-4o-mini to generate contextually appropriate follow-up responses.”
-
Exploring the Future of Security with ChatGPT“Recently, OpenAI announced APIs for engineers to integrate ChatGPT and Whisper models into their apps and products.”
Indicators in its reports
named in the reports above- spyroid[.]netin 2 reports
- 196.251.84[.]11in 2 reports
- callbalonx[.]infoin 2 reports
- 85.31.235[.]109in 2 reports
- hxxps://phishing-domain[.]xyz/12345%E2%80%9Din 2 reports
- phishing-domain[.]xyzin 2 reports
- aclaraciones-digital[.]onlinein 2 reports
- soporte-aclaracion[.]xyzin 2 reports
- balonx[.]onlinein 2 reports
- panelbalonxfs[.]xyzin 2 reports
- idscan[.]netin 1 report
- kibana.alert.rule[.]namein 1 report
- 17.0.4[.]31in 1 report
- crypto[.]newsin 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.