Azeri Banks Corner Fake AV, Pharma Market
Summary: Researchers at UC Santa Barbara found that three of the most popular fake antivirus affiliate services processed tens of millions of dollars in payments through Bank Standard and the International Bank of Azerbaijan. UCSD researcher Damon McCoy, who has been making test buys at dozens of fake AV sites, said the BestAV and Gagarincash programs moved from Bank Standard to the International Bank of Azerbaijan within the past month, and that the only widespread fake AV program not using Azerbaijani banks was the Liza Moon brand, which used a Ukrainian bank.
What's compelling: Tens of millions of dollars in fake antivirus payments ran through two Azerbaijani banks, and McCoy's conclusion was that these institutions had cornered the market on processing for this trade - a concentration that card networks and acquiring partners would have had visibility into.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026