Disneyland Malware Team: It’s a Puny World After All
Summary: A Russian-speaking financial cybercrime group calling itself the Disneyland Team has been operating dozens of Punycode-based phishing domains through much of 2022, using non-Latin characters to make fake bank sites render as near-identical copies of real ones. Hold Security analysts gained access to the group's web control panel, which shows domains spoofing U.S. Bank, Ameriprise, Emirates NBD, Charles Schwab and PNC, used alongside the Gozi 2.0/Ursnif Windows banking malware already installed on victims' machines.
What you should know: The fake site relays the victim's session to the real bank and forwards multi-factor prompts to the attackers, so a correct password and a working MFA challenge are not proof the person logging in is the customer. The group's panel also lets operators stall a victim for up to two hours with fake messages while accounts are drained.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026