Inside the Global “MaaS” Engine of the K99 Scam Compound

Infoblox Threat Intel and partner NGO Chong Lua Dao exposed an industrial-scale Android banking trojan MaaS linked to the K99 Triumph City scam compound in Sihanoukville, Cambodia. The operation uses multilingual social-engineering lures and fake government sites to install malicious APKs that escalate permissions, capture biometrics via spoofed KYC overlays, exfiltrate credentials and data, and enable real-time surveillance and financial fraud across at least 21 countries; infrastructure is resilient and rapidly rotated through dozens of domains monthly, and the campaign is supported by forced labor at the compound.