Group-IB uncovers over 600 hijacked Instagram accounts used to spread financial phishing in Indonesia

Group-IB, one of the global leaders in cybersecurity, headquartered in Singapore, uncovered a novel and extensive scam campaign targeting both Instagram and banking users in Indonesia, which aims to gain access to their bank accounts. As part of the ongoing brand-protection efforts, the company’s Digital Risk Protection unit identified more than 600 hijacked Instagram accounts used to spread phishing links to fake websites disguised as login pages of mobile banking applications for one of Indonesia’s leading financial institutions. Group-IB’s Digital Risk Protection solution, a module of the company’s Unified Risk Platform, unveiled and blocked over 1,000 affiliated fraudulent domains used to spread phishing content at the requests of the impersonated organisation. As new domains appear regularly, the Group-IB team continues to monitor the infrastructure and block violations shortly after the detection. Users are advised to stay vigilant, use Multi-Factor Authentication (MFA) for their accounts and treat with suspicion any pages that ask for their banking credentials or payment details.