Infoblox has uncovered a large-scale mobile banking fraud operation tied to scam compounds in Southeast Asia, including Cambodia’s notorious K99 Triumph City. The findings, developed in collaboration with Chong Lua Dao, reveal a sophisticated Android banking trojan targeting users across at least 21 countries.
The malware, delivered through fake banking and government apps, is part of a “malware-as-a-service” platform that registers around 35 spoofed domains monthly. Countries such as Indonesia, Thailand, Spain, and Türkiye have seen the highest activity.
“These aren’t random one-off scams. They’re factory lines. For years we knew these scam compounds existed, and suspected malware distribution at the sites, but this is a firm confirmation,” said Dr. Renée Burton, VP of Infoblox Threat Intel.
Once installed, the trojan gives attackers full control of victims’ devices. It can capture biometric data during fake KYC processes, intercept SMS one-time passwords, and silently access mobile banking apps to execute fraudulent transactions—effectively bypassing standard security measures.
He further added, “We now know that beyond the social engineering associated with so-called pig butchering scams, the compounds are being used to run sophisticated operations that steal banking credentials and allow threat actors to spy on victims.”
Security experts warn that these operations go beyond traditional scams, operating as industrial-scale fraud networks. The research highlights the urgent need for banks, fintech firms, and governments to strengthen mobile security beyond basic biometrics and SMS-based authentication to counter rising cross-border cyber threats.
