Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia

Group-IB uncovered a sophisticated fraud campaign attributed to the GoldFactory cluster that impersonated Indonesia’s Coretax service to trick taxpayers into installing malicious Android APKs; the multi-stage attack combined phishing links, WhatsApp impersonation, vishing calls, and RATs (Gigabud.RAT, MMRat) to harvest credentials, record screens, perform account takeovers, and facilitate mule transfers, resulting in an estimated $1.5–2M nationwide impact and the discovery of 228 malware samples and 996 phishing URLs.