Follow us on Google News
A Pakistan-based cybercrime network has been linked to one of the largest credential theft and malware delivery campaigns uncovered in recent years, according to cybersecurity intelligence firm CloudSEK.
Family-Run Syndicate Linked to Global Malware Spread
The operation, allegedly managed by family-linked individuals in Bahawalpur and Faisalabad, leveraged global demand for pirated software to infect millions of devices. CloudSEK’s investigation found that the syndicate used malicious WordPress websites, promoted through search engine optimisation (SEO) poisoning, forum spam, and paid ads, to distribute cracked versions of popular tools such as Adobe After Effects and Internet Download Manager.
Data Protection and DPDP Act Readiness: Hundreds of Senior Leaders Sign Up for CDPO Program
Inside the downloaded password-protected archives, malware variants like Lumma Stealer, Meta Stealer, and AMOS were embedded. The campaign reportedly ran through 5,239 registered affiliates and almost 3,900 distribution sites, generating 449 million clicks and more than 1.88 million confirmed installations.
Payment records showed that affiliates received commissions mainly via Payoneer (67%) and Bitcoin (31%), with the highest earners taking nearly half of the total payout pool. In 2020 alone, more than $130,000 (Rs. 1.1 Crore) was paid over five months.
The network was traced to two interconnected pay-per-install services: InstallBank.com (operational from 2018 until August 2025) and SpaxMedia, later rebranded as Installstera.com. Hundreds of long-term and short-lived domains were maintained to avoid takedowns. A significant investigative breakthrough came when the operators themselves were infected by an infostealer, exposing their internal credentials, payment logs, and links between individuals, domains, and financial accounts.
Surge in Cyberattacks Ahead of India’s Independence Day
The findings coincided with a reported spike in cyberattacks against Indian government agencies and critical infrastructure ahead of India’s 79th Independence Day on August 15, 2025. Over 4,000 incidents targeted sectors including defence, finance, and administration.
Threat groups from Pakistan, China, and other regions, including APT36 and APT41, were identified in coordinated campaigns involving phishing, spoofed domains, fake mobile apps, and social engineering. The timing of these attacks suggests a strategic attempt to cause disruption during a national event.
CloudSEK recommends targeted domain seizures, coordinated action with payment processors, search engine de-indexing, and public awareness drives to combat ongoing and future threats.
