Largest Mobile Malware Darkweb Marketplace Discovered Having Over 1900 Injection Scripts

The “InTheBox” marketplace, which recently emerged on the Dark Web and is intended only for operators of mobile malware, has been uncovered by the Resecurity Hunter team.

Since then, the key actor has been privately providing webinjects development services for other cyber criminals. However, after establishing enough credibility, the actor scaled it to a fully productized automated marketplace.

The report states that the automation enables other malicious actors to create orders for the most recent webinject for use in developing mobile malware.

As a result, “InTheBox” offers customized development solutions for those using proprietary or “private” mobile malware, which is not frequently available for sale or rental. 

The most popular malware families that enable webinjects right now are Alien, Cerberus, Ermac, Hydra, Octopus (also known as “Octo”), Poison, and MetaDroid.

“To facilitate successful credentials interception, the bad actors use so-called “Webinjects” – customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it’s rendered on a web browser”, according to Resecurity.

Particularly, in contrast to what is actually being sent by the server, webinjects can change what the user sees on his or her browser.

Researchers added sating the market for mobile banking malware has become very mature over the past few years, and the majority of Dark Web actors have turned from selling it to possibly renting or using it privately.

Webinjects normally cost between $50 to $200 each inject, depending on how well-liked the FI is. This is less expensive than mobile malware itself. It also includes basic support and possible customization in case the mobile app changes.

The cost of mobile malware varies, and with the recent change to renting and private operations, the monthly inject may exceed $5,000 or use a leveraged commission-based model with payments from successful thefts split between the malware operator and developers.

Insights of the “InTheBox” Darkweb Marketplace

On the TOR network, the bad actor known as “inthebox” unveiled a brand-new webinjects marketplace. The market offers several webinject templates for various mobile malware families that can be used individually or in combination to successfully carry out data theft.

• Template “Authorization data”
• Template “Ask only PIN”
• Template “With Credit Card data”
• Template “With Credit Card data + ATM PIN”
• Template “Ask Full Data”

Cybercriminals can now create an infinite amount of webinjects during the subscription period due to a new InTheBox tariff called “unlim.” 

Further, by streamlining the processes involved in malware customization, this model makes it possible to reduce manual and human contact with marketplace operators.

Additionally, there are regional divisions in the marketplace, with a heavy emphasis on U.S. and U.K. companies, internet services, and financial institutions.

“Once the victim has been successfully infected and credentials have been delivered to a C2C Server, mobile malware enabled operators to execute various commands to manage the victim and to perform actions on their devices for further successful theft”, Resecurity

Hence, “In the Box” may be regarded as the biggest and most likely the only one in its marketplace category offering high-quality webinjects for well-known mobile malware types. Cybercriminals already use “In the Box” to attack more than 300 financial institutions (FIs), payment systems, social media, and online stores in 43 countries.

Penetration Testing As a Service – Download Red Team & Blue Team Workspace