Beeline Subscribers Targeted in Mass SIM Hijacking via Remote eSIM Issuance
Beeline subscribers have reported mass attempts to hijack their mobile numbers through the remote issuance of eSIM cards. According to Kommersant FM, fraudsters needed only one careless confirmation from the user to complete the attack.
The scheme appeared highly convincing: a system-level prompt appeared on the smartphone screen requesting login to the operator's personal account. This was neither an SMS nor a standard push notification. Once the confirmation button was pressed, a message followed about the issuance of a virtual SIM card. The physical SIM was simultaneously blocked, transferring control of the number to the attackers.
One victim was Kommersant FM editor-in-chief Vladislav Viktorov. IT specialist Alexander Baulin suggested the attack might involve a breach of the operator's infrastructure, but Beeline did not confirm this version.
The company informed Kod Durova about a coordinated attack on mechanisms for remote SIM issuance and replacement. Over several days, fraudsters changed tactics and sent thousands of requests. Beeline claims the attack was repelled and successful hijackings remained isolated. Affected subscribers are receiving assistance to restore service.
According to the operator, similar attacks since the beginning of the year have affected the entire telecom market. Subscribers are advised not to confirm operations they did not initiate, not to share SMS codes, and to contact support immediately for suspicious requests.
Number hijacking goes beyond sudden loss of network signal. With control of the SIM, fraudsters can attempt to restore access to banking applications, Gosuslugi, and other services. Users should therefore read any system notification carefully, as one accidental tap can hand the number to an unauthorized party.
Related articles
Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.
Bank Transfer Comments Such as 'Bribe' or 'To the Common Pot' Risk Triggering Compliance Reviews
Lawyer Meri Valishvili warned that casual or joking comments added to bank transfers can prompt automated compliance checks and account restrictions. Systems scan payment descriptions for terms like 'bribe', 'kickback', or 'to the common pot' without assessing humorous intent. No single public list of flagged phrases exists, as each bank independently configures its monitoring algorithms. Even routine descriptions such as 'for manicure' or 'utilities payment' may raise flags when combined with regular amounts or recurring patterns. Valishvili advises private individuals to omit unnecessary comments and to reference specific contract numbers and dates when a transfer has legal significance. For group collections, she recommends using bank-provided tools that clearly state the purpose of the payment.