FakeSecurity
FakeSecurity is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 11 MITRE ATT&CK techniques.
- Techniques
- 11
- Exploited CVEs
- No CVE data
- First seen
- Dec 7, 2020
- Last seen
- Dec 7, 2020
- Record updated
How They Operate · MITRE ATT&CK.
11 techniques across 6 of 14 tacticsReconnaissance·
Resource Development·
Initial Access3
T1204.002
User Execution: Malicious File
User Execution: Malicious File
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Persistence·
Privilege Escalation·
Defense Evasion1
T1027
Obfuscated Files or Information
Obfuscated Files or Information
Credential Access3
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
T1056.004
Input Capture: Credential API Hooking
Input Capture: Credential API Hooking
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credentials from Password Stores: Credentials from Web Browsers
Discovery·
Lateral Movement·
Collection1
T1113
Screen Capture
Screen Capture
Command and Control1
T1102.001
Web Service: Dead Drop Resolver
Web Service: Dead Drop Resolver
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Raccoon Stealermalware
- Mephistophilustool
Campaigns.
- FakeSecurity 2020 Stealer and Sniffer CampaignDec 2020
Indicators Of Compromise.
TLP:AMBER137 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout FakeSecurity.
A cybercriminal threat group known for deploying JavaScript web sniffers against e-commerce websites, particularly Magento-based storefronts, as well as distributing information stealers and RATs.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.