Steal-It Campaign Uses OnlyFans Models as Lures

Custom PowerShell scripts are being deployed against geofenced targets in Australia, Belgium, and Poland to exfiltrate data.

A sophisticated cyber campaign is using images of OnlyFans models and geofencing to target specific victims across Australia, Poland, and Belgium, using custom PowerShell scripts to steal data.
According to a recent report from Zscaler ThreatLabz, the campaign, called Steal-It, is likely the work of APT28, also known as
Fancy Bear
, researchers said.
After establishing an initial foothold with customized PowerShell Nishang Start-CaptureServer scripts, the Steal-It cyberattack abuses the Mockbin API endpoint generating tool to exfiltrate data, including NTLM hashes and command output, the report explained.
These operations use customized PowerShell scripts, designed to pilfer crucial NTLM hashes before transmitting it to the Mockbin platform,
the researchers said
. The initial phase of the campaign involves the deployment of LNK files concealed in zip archives, while ensuring persistence within the system through strategic utilization of the StartUp folder.
The Fancy Bear threat group gained notoriety following its role in the 2016 US election interference and similarly used images of women as lures for
cyberattacks against a Ukrainian energy facility
earlier this month.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Steal-It Campaign Uses OnlyFans Models as Lures