Attackers are using breached customer records to create convincing invoice scams and fraudulent payment links. GajIPS detects access to the campaign’s fake invoice and payment infrastructure.
Severity: Medium | Priority: 3
In October 2026, SOCRadar disclosed Operation Master, a cybercrime operation run by an actor known on underground forums as “masterblack”. Between April and mid-September 2026, the actor broke into enterprise networks, stole customer and billing databases, sold part of the data on criminal forums, and fed the rest into an automated invoice-fraud platform.
To get in, the actor exploited vulnerabilities in VPN gateways, web applications and code repositories, ran SQL injection against business web applications, and attacked Microsoft 365 accounts with phishing and password spraying. Once inside, they escalated privileges, moved to other systems and copied data out of the network. SOCRadar also found that the actor relied heavily on AI coding assistants to write the intrusion and data-theft tools.
The stolen data powered the invoice-fraud platform. It sent more than 2.4 million email, SMS and WhatsApp messages carrying over 622,000 personalised invoice links, aimed at consumers and businesses in Brazil. Recipients were sent to fake invoice pages impersonating real companies and asked to pay through Pix, Brazil’s instant payment system, with the money going to the criminals. The platform recorded almost 170,000 interactions, and the fraudulent invoices were worth about R$38.9 million. It went offline in mid-September, but the operators may rebuild it on new infrastructure.
If GajIPS detects this campaign in your network, a user has opened a link to one of the platform’s fake invoice pages or payment services. Identify the user and ask whether they made a payment, or entered personal or payment details, on the page. If they made a payment, contact the bank or payment provider immediately to report the fraud and try to recover the funds, and report it to the police. If they entered personal details, watch for follow-up fraud using that information. Find the message that delivered the link and remove it from other recipients’ inboxes.
These messages were personalised with real customer data stolen in network intrusions, so they can look genuine. Remind staff to check any unexpected invoice or payment request directly with the company that supposedly sent it, using contact details they already have rather than links in the message.