Forest Global Training Partners

Cyber Risks · Krebs on Security

Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Summary: Researchers at SecAlliance have traced a 'ramp and dump' scheme in which Chinese-language phishing groups use mobile phishing kits sold on Telegram to take over brokerage accounts, liquidate existing positions, and buy large volumes of a foreign stock before selling once the price rises. The kits, including templates from a vendor called Outsider (previously known as Chenlun), spoof brokerage platforms such as Schwab via iMessage and RCS, collecting usernames, passwords, and SMS one-time codes; the FBI sought victim information on the scheme in February 2025.

What's compelling: FINRA describes the outcome for unsuspecting investors as a catastrophic collapse in share price with unrecoverable losses, and the fraudsters' own accounts sit on Chinese exchanges where local brokerages see nothing unusual. The scheme works because SMS and push-based one-time codes remain phishable at Schwab, Fidelity, and other platforms, while Vanguard's optional physical security key is the one second factor cited as unphishable.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related