Phishing Takedown: Viber Brand Impersonation

Investigated an active phishing campaign on social media that impersonated the Viber brand to deceive users into surrendering credentials and personal data. Through social engineering, I extracted a full confession from the threat actor.

A coordinated phishing operation was using Viber's brand identity across social media platforms to lure victims. The campaign was sophisticated enough to bypass casual inspection, using cloned visual assets and convincing social engineering tactics.

I conducted the full offensive and defensive cycle on this case:

Reconnaissance & OSINT: Mapped the phishing infrastructure, identified domains, hosting providers, and the social media distribution network behind the campaign.

Social Engineering: Engaged directly with the threat actor using counter-social-engineering techniques. Built rapport, applied pressure at the right moments, and successfully extracted a full self-admission of guilt. This became a critical piece of evidence in the case.

Technical Analysis: Deconstructed the phishing kit, analyzed payload delivery mechanisms, and traced the attack chain from initial contact to credential harvesting.

Threat Intelligence: Correlated indicators of compromise (IoCs) across multiple sources to build a complete picture of the operation.

Coordination: Worked at a European level to report findings and support the takedown of the fraudulent infrastructure.

The phishing operation was disrupted. The threat actor's own confession, obtained through social engineering, served as direct evidence. The case contributed to broader cybercrime enforcement efforts at the European level. Specific details remain confidential due to the nature of the investigation.

Kali Linux served as the primary platform, but the approach was tool-agnostic. Whatever the situation demanded: network analysis, reverse engineering, OSINT frameworks, social engineering, or custom scripts. The methodology followed a structured red team/blue team cycle: attack surface mapping, exploitation analysis, defensive recommendations, and coordinated disclosure.