Overwatch Data

Excited to share insights at FS-ISAC's call on fraud this Thursday alongside Ryan Reeves. We'll be discussing strategies to combat anti-detect browsers, crucial tools in ATO, breaches, and ransomware attacks. While powerful tools for obfuscating identities, these browsers also present an opportunity for detection of such threats in near real-time. We're excited to present our latest research and findings.

Tobias shares a summary of our joint report with the press. What I found particularly interesting was how financially motivated threat actors were equally excited about targeting e-commerce and digital businesses as they were about traditional banks and payment processors. AI dramatically lowered the threshold.

?? ???????????????????? ???? ???? ?????????????????? ?????????????????? ?????????? – ?????? ???? ??????????? ?? The financial sector is on the frontline of a new wave of AI-driven cyber threats and fraud. I joined Sky News Australia to discuss the findings of a recent Overwatch Data & Protostar Strategy report on how generative AI is being weaponised against financial institutions. We discussed: ?? ????-???????????? ??????????: ? Criminal networks are using Generative AI to create synthetic identities, forge financial records, and generate deepfake videos that can bypass security verification. ? In Hong Kong, deepfake technology tricked a finance worker into wiring $25 million to criminals. ?? ????-?????????????? ???????????? ????????????????????????: ? AI-generated disinformation, deepfake videos of executives, and fabricated analyst reports are increasingly being used to manipulate markets. ? The AI-generated Pentagon explosion hoax (2023) briefly caused US stock market volatility before being debunked. ?? ?????? ???????????????????? ???????? ????????: ? Cybercriminals are leveraging rogue AI tools like ‘FraudGPT’ and ‘EvilGPT’—which offer sophisticated fraud capabilities for as little as $10 per month. ? Even mainstream AI platforms are being jailbroken to refine phishing attacks and generate malicious code. ?? ???????? ?????? ???? ????????? ? AI can be both the ?????????? ?????? ?????? ????????????—financial institutions must integrate AI-driven security solutions rapidly. ? ???????????? ?????????????????? ???? ????????????????—fraud thrives when trust is misplaced. ? ?????????????????????????? ???? ??????—financial firms, AI developers, and regulators must work together to counter AI-driven fraud and manipulation. The financial sector’s greatest asset is trust—but without action, AI-driven deception could erode it. Catch the full discussion in the comments below???

We at Overwatch Data are so thrilled to have worked on this report with Toby on the key threats of Gen Ai to the financial services sector. Big shout out to Daniele who helped uncover some of these fraud and cybercrime trends. I’ll be posting excerpts over the next week but get your free copy below!

It's Tax Season! And therefore tax fraud season. As you see in the posts below, often sellers post refund fraud methods to make money off of tax refunds. These are often for sale, or available as a bonus to users who bought other things from the seller or are part of their community. TaxFraudMethod enthusiasts include everything from small individual sellers to the largest groups. Often as you see the teaser is listed for free and more broadly available (for marketing) but for the full step by step instructions you have to either join a private channel/community or pay. #telegramtuesday #telegram #taxfraud

I want to set the records straight on the alleged 4 million credits cards that were dumped on the dark web by threat actor B1ack's Stash. There is too much breathlessness from the media and cyber security providers. I understand that the ecosystem is sometimes incentivized to amplify the urgency and danger but it's really not hepful. Threat actors love when we do their marketing for them and create panic without actually investigating. Here is what happened: B1ack's Stash claimed to offer 4 million credit cards to black tier members. Security outlets were quoted by media that over 1 million unique credit cards were released in a single dump, with approximately 192,174 from European financial institutions. What our investigation at Overwatch Data led by Jean-Yves and Ryan actually found: After deduplication, the actual February 21st release contains approximately 10,000 unique cards - significantly fewer than reported. The widely cited "1,018,014" figure appears to be the cumulative total of multiple dumps by this threat actor over the past 12 months, not a single massive breach as implied. This means, we're just counting outdated data to boost the total number. While any breach is concerning, and the old dumps still contains PII that could be leveraged for other attacks, accurate reporting allows for proportional response, prevents panic, and doesn't drive traffic towards threat actors.

I want to set the records straight on the alleged 4 million credits cards that were dumped on the dark web by threat actor B1ack's Stash. There is too much breathlessness from the media and cyber security providers. I understand that the ecosystem is sometimes incentivized to amplify the urgency and danger but it's really not hepful. Threat actors love when we do their marketing for them and create panic without actually investigating. Here is what happened: B1ack's Stash claimed to offer 4 million credit cards to black tier members. Security outlets were quoted by media that over 1 million unique credit cards were released in a single dump, with approximately 192,174 from European financial institutions. What our investigation at Overwatch Data led by Jean-Yves and Ryan actually found: After deduplication, the actual February 21st release contains approximately 10,000 unique cards - significantly fewer than reported. The widely cited "1,018,014" figure appears to be the cumulative total of multiple dumps by this threat actor over the past 12 months, not a single massive breach as implied. This means, we're just counting outdated data to boost the total number. While any breach is concerning, and the old dumps still contains PII that could be leveraged for other attacks, accurate reporting allows for proportional response, prevents panic, and doesn't drive traffic towards threat actors.

Excited to share that I'll be presenting Overwatch Data’s vision for automating threat intelligence at an upcoming webinar hosted by Carahsoft on March 18. Join me as we dive into how our AI agents are transforming OSINT, fraud, and cyber threat analysis—turning vast data into clear, actionable insights. Register now and see how we’re making security smarter - especially for government agencies. h/t Marty Gryski Jay Nielsen

Telegram C2 for malware? Sometimes telegram isn't just a place to discuss fraud methods or sell accounts/services but is actually part of the core attack infrastructure! Traditionally malware is controlled from a command and control web-server, but the easy of setting up a telegram channel makes it popular for all sorts of things that surface web or darkweb sites previously were used for. While servers are most common, command and control can be anywhere from file hosting services, to telegram in this case, to the bitcoin blockchain! ?? #TelergamTuesday #c2 #telegram