KUALA LUMPUR: A software developer has been creating phishing login screen of well-known brands and email providers before selling them on the dark web.
Malaysian police got wind of the illicit activities after being alerted by their Australian counterparts.
Checks revealed that the software developer was linked to a syndicate selling phishing templates, scripts and related products that could be downloaded online for US$100 (RM468) each.
Purchases can be made via credit cards and bitcoins.
The syndicate was crippled following a series of raids in four states on Nov 6.
Inspector-General of Police Tan Sri Razarudin Husain said the raids were made in Sabah, Selangor, Kuala Lumpur and Perak simultaneously.
Eight suspects, including a 36-year-old mastermind from Sabah, were arrested, he said.
“We also seized two laptops, two cars, four servers, nine mobile phones, 11 bank ATM cards, some jewellery and nearly RM1mil in 11 e-wallet accounts,” he said.
Phishing is a scam to trick individuals into giving personal information and login credentials or installing malware.
Razarudin said according to police investigations, the syndicate was also linked to two investment schemes involving losses of more than RM1.2mil.
“Police received 37 reports in connection with the two investment scams. We believe the suspect was selling these phishing templates to other groups.
“Further investigations led us to discover a total of 1,038 login and password credentials,” he said, adding that the syndicate would sell these credentials on the dark web.
He said police believed the syndicate started operation in 2015 but became more active last year.
“The syndicate was believed to have created the phishing templates of the Australian government websites and the e-banking sites of overseas institutions.
“We are cooperating with the Australian Federal Police and the Federal Bureau of Investigation (of the United States) to investigate further the syndicate’s activities,” he said yesterday.
