When calling the fake support numbers, the scammers will try and trick the caller into installing ConnectWise ScreenConnect to gain remote access to the caller's device.
From there they can steal data and deploy additional payloads in the background.
The following domains are associated with this campaign: dghelp[.]top, molatorimax[.]icu, and n9back366[.]stream.
BleepingComputer /
npub1j7…v7hg2
2024-11-01 17:58:02
in reply to nevent1q…heyz
Author Public Key
npub1j7dz37jrwqhehe8ydzpk5kcjpnzzv53h7s54lj62nv5w9fcar34suv7hg2Published at
2024-11-01 17:58:02Event JSON
{
"id": "0103f0720613342a239fee8856b3136774c1771d231d26734bbf17c29725b859",
"pubkey": "979a28fa43702f9be4e468836a5b120cc4265237f4295fcb4a9b28e2a71d1c6b",
"created_at": 1730483882,
"kind": 1,
"tags": [
[
"e",
"2d5f38d1a87872b5a5d721183d4e127d4712182035b50e405c812848c31ed7bc",
"wss://relay.mostr.pub",
"reply"
],
[
"proxy",
"https://infosec.exchange/users/BleepingComputer/statuses/113408991741728778",
"activitypub"
]
],
"content": "When calling the fake support numbers, the scammers will try and trick the caller into installing ConnectWise ScreenConnect to gain remote access to the caller's device.\n\nFrom there they can steal data and deploy additional payloads in the background.\n\nThe following domains are associated with this campaign: dghelp[.]top, molatorimax[.]icu, and n9back366[.]stream.",
"sig": "f866c08dadd5edd6d2c0647ca1d7189ed24d75b831ecf5dda9c2056e87d1a22309650be509dc9700d4e9819bf92b04e387d073a2f1c989800dd737962cd185fd"
}