# MA-880.102022: MyCERT Alert - Scam Purportedly to Help B40 and M40 Families Targeting TNG eWallet Users

**Date:** 28 Oct 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-880.102022  
**Advisory ID:** MA-880.102022

---

**1.0 Introduction**
MyCERT observed lately that cybercriminals are using a fraudulent website that closely mimics an eWallet service login page to steal money from users' accounts, without users' knowledge.
In the campaign, threat actors attempt to steal financial credentials by using a fake website that poses as the Touch N Go (TNG) eWallet service, often outright replicating the original. In their effort, threat actors sent out fraud SMS mentioning a sum of RM500 purportedly to help B40 and M40 families in Malaysia has been credited to users' TNG eWallet. The message requests users to check their account balance and claims by clicking a website's link, embedded in the SMS. To lure potential victims, threat actors set up the fraudulent website using a domain name similar to a legitimate website, making users unsuspicious of the website.
**2.0 Impact**
Financial loss and disclosure of personal information to third parties and attackers.
**3.0 Other 
Below are references to similar incidents:
**•**[**MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme**](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
**•**[**MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant**](https://www.mycert.org.my/portal/advisory?id=MA-695.012018)
**•**[**MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK**](https://www.mycert.org.my/portal/advisory?id=MA-694.012018)
**4.0 Indicators of Compromise**
Below is information about the phishing campaign works in general:
At first, the victim receives a suspicious SMS that contains a link to a phishing website.
Figure 1: Sample SMS sent to victims containing the fraudulent website link
Once a victim clicks on the link, the victim is redirected to a webpage prompting for the victim's phone number, which is the primary credential used for logging into the Touch N Go eWallet account.
Figure 2: Screenshot of the fraudulent login page prompting for victims' phone number
Once the victim has entered the phone number into the login page, the victim is then prompted with the next page asking for the victim's TNG eWallet account 6-digit PIN number.
Figure 3: Screenshot showing the fraudulent website asking for victims' TnG eWallet 6-digit PIN number
URL of fake website: hXXps://touchngoimy[.]top/
The IP address of the fake website: 103.212.98.179
**5.0 Recommendations**
The application is meant to retrieve credentials and other information from victims which could be used for other malicious purposes.  MyCERT highly recommends the followings:
• Do not click on adware or suspicious URL sent through SMS/messaging services.
• Malicious programs could be attached to collect users' information.
• Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
• Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
• Do not root or 'Jailbreak' your phone.
• Contact relevant authorities such as Cyber999 for any inquiries and assistance needed 
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
1. MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
<https://www.mycert.org.my/portal/advisory?id=MA-790.072020>
2. MA-690.122017: MyCERT Alert - Fake PDRM Malicious APK
<https://www.mycert.org.my/portal/advisory?id=MA-690.122017>
3. MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant
<https://www.mycert.org.my/portal/advisory?id=MA-695.012018>
4. MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK
<https://www.mycert.org.my/portal/advisory?id=MA-694.012018>
5. <https://www.virustotal.com/gui/ip-address/139.162.61.96/relations>
6. <https://www.virustotal.com/gui/file/fc9d34436b4711d6f586903d07a99b089ca5aa61f931febd57abba9a7135d98d/relations>
7. <https://twitter.com/esetresearch/status/1526440685460672512?s=24&t=xveoIxTaZLIdhpnzy-YSag>
8. <https://www.welivesecurity.com/2022/04/06/fake-eshops-prowl-banking-credentials-android-malware/>
9. <https://notes.netbytesec.com/2022/05/scam-and-malicious-apk-targeting.html>