Darkweb Malware Phishing/Scam Trend

Security Issues in the Korean & Global Financial Sector in September 2026

Statistics on Malware Distributed to the Financial Sector

In Attack Stage 1, phishing (attacks that trick users into revealing information) had the highest rate at 2.1, Up from 1.8 The previous month.
In Attack Stage 2, “Dropper/Downloader” (a type that downloads additional malware) was the most common at 1.1, Though this was a decrease from 3.2 The previous month.
In Attack Stage 3, “Infostealer” (malware designed to steal information) had the highest rate at 0.3, Down from 0.4 The previous month.
For each type, phishing ranked first at 27.0%, Followed by dropper/downloader at 25.3% And backdoor (stealthy malware for remote access) at 13.5%.
The top three types accounted for approximately 66% of the total, and a multi-stage attack chain—progressing from the initial lure to the download of additional malware, followed by persistence and Information Theft—was prominent.

In terms of file types, HTML accounted for the largest share at 23.1%, Followed by PE (executable files) at 15.0%, LNK (shortcut files) at 8.5%, And ELF64 at 4.7%.
The high proportion of HTML indicates the continued use of HTML-based phishing pages and HTML smuggling (a technique that uses web documents to hide and deliver malicious files).
By file extension, html (31.8%), Exe (12.4%), Js (9.3%), And vbe (5.4%) Ranked among the top.
A Pareto distribution was observed among the top 10 file extensions, with these accounting for over 80% of the total. A large number of script-based extensions—such as js, vbe, vbs, bat, and hta—were identified, indicating an active trend toward executing scripts and the use of LOLBins (a technique that exploits legitimate tools).

Cases were confirmed where domestic account information, collected through Malware infections and phishing emails, was leaked to threat actors through the Telegram API (messenger integration feature).
Keywords such as “money transfer,” “receipt,” and “voicemail” were used to deceive users, and login pages were identified when malicious links or attached HTML files in the emails were executed.
The entered account IDs and passwords were leaked to the threat actors’ Telegram chat rooms; during September, the quantity of domestic financial sector accounts leaked via Telegram accounted for 1.4% Of the total.

Database Leakage Cases and Sales are increasing on the dark web and cybercrime forums; the leaked data can be used as a basis for identity theft, targeted phishing, and ransomware attacks.
On DarkForums, SpaceX posted what it claimed was 454M insurance contract data related to licindia.In.
The disclosed fields were reported to include insurance policy numbers, insurance types, customer names, addresses, cell phone numbers, email addresses, PAN numbers, and branch information.
On BreachForums, ShinyHunters claimed in a post titled “Truist Bank Database – Leaked, Download!” ” On DarkForums, claiming to share a database related to Truist Bank.
The claim stated that the data included account balances, dates of birth, email addresses, job titles, names, some credit card data, and phone numbers, and described it as containing 79,000 records.
On PwnForums, exfilsquad claimed to be releasing internal data related to Allstate.
The sample appeared to include names, cell phone numbers, email addresses, home addresses, candidate IDs, job posting numbers, application status, onboarding status, and internal account information.

LockBit 5.0 Posted Taspen Life, an Indonesian life insurance company associated with taspenlife.Com, as a victim.
The disclosed samples appeared to include insurance policies, premium receipts, tax return and payment documents, contract amendment requests, copies of identification cards, taxpayer identification number cards, and documents related to customers and corporations.
Qilin listed Inversiones Bolívar as an insurance-related company, but as of this writing, no samples or details regarding the scale of the breach have been confirmed.
Storm listed First Secure Bank and Trust, The State Bank, First Secure Community Bank, Insight Credit Union, and Johnson Investment Counsel as victims.
The disclosed file structure and sample documents were confirmed to include financial documents, tax records, loan and banking documents, insurance and contract materials, copies of identification documents, and spreadsheets related to accounts, transactions, and operations.
If these reports are true, they could lead to financial fraud, identity theft, account takeovers, BEC (Business Email Compromise), phishing attacks targeting customers, and further breaches.