ShadowParasite
- First seen
- 2025-11-01 00:00:00
- Last seen
- 2026-09-10 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Related IoCs
- 9 (9 malicious)
- Last IoC activity
- 2026-10-05 02:24:49
- Profile updated
- 2026-09-18 05:31:23
Targeted industries: energy-and-utilities financial-services technology-and-telecommunications transportation-and-logistics
Targeted regions: country_code:co
Context
ShadowParasite is a financially motivated eCrime actor, named and profiled by Lumu, that has been running a payment-fraud operation against people in Colombia since at least November 2025. Instead of sending lures, it puts counterfeit payment pages for well-known Colombian utilities, telecom carriers, financial institutions and other billers in front of victims through search engines. It first publishes harmless informational sites about each brand (rates, payment guides, common questions), leaves them online for months so they gain ranking without raising alarms, and only then swaps in the fraudulent portal. Victims either pay by scanning QR codes for Colombia's Bre-B instant-payment system, which send the money to collection accounts registered as merchants, or are handed to a second fake site that mimics their bank's login. That banking panel covers fifteen Colombian banks and digital wallets from one codebase with per-brand styling, and asks for online banking credentials, the one-time token delivered by app or SMS, full card details and, for some entities, live facial photos and video. By September 2026 the operation had used close to 300 domains, about half of them under the .st TLD, rotated in batches across roughly thirty autonomous systems, mostly bulletproof or abuse-tolerant hosting, and usually placed behind Cloudflare from the day they were registered.
Detection coverage
- 4 Sigma rules
Malware & tools used
- SEO Poisoning (attack-pattern)
- Domains (attack-pattern)
- Virtual Private Server (attack-pattern)
- Hide Infrastructure (attack-pattern)
- Impersonation (attack-pattern)
- Malicious Link (attack-pattern)
- Multi-Factor Authentication Interception (attack-pattern)
- Financial Theft (attack-pattern)