Hackers Upgrade INJ3CTOR3 Malware to Steal SIP Credentials for Persistent Phone Fraud
Attackers are enhancing their INJ3CTOR3 malware to steal critical SIP credentials and configuration files from FreePBX servers, enabling ongoing phone fraud even after system rebuilds.
A sophisticated campaign targeting FreePBX phone servers has seen its associated malware, INJ3CTOR3, significantly upgraded. The latest iteration now focuses on exfiltrating configuration files that contain vital SIP trunk passwords, database credentials, management secrets, and mail relay logins. This expanded scope allows attackers to maintain their phone fraud operations by leveraging stolen carrier credentials, even if the compromised server itself is rebuilt.
The INJ3CTOR3 operation builds upon previous tactics that involved placing unauthorized calls through victims' own phone systems. While earlier versions employed a complex six-layer persistence mechanism designed to survive removal attempts, the current evolution adds a new layer of resilience by stealing the very credentials that authenticate a business's connection to its telephone provider. Unless carriers restrict access to approved IP addresses, these stolen SIP trunk credentials can be used from an attacker-controlled machine to place calls, leaving no trace on the supposedly cleaned server.
Researchers from Cyble Research & Intelligence Labs identified these enhancements while analyzing artifacts from the operation's staging servers in September 2026. Their analysis revealed an installer configured to repeatedly upload 17 files. The malware utilizes scheduled tasks that run the installer every minute, ensuring continuous exposure of secrets as long as the infection persists. This aggressive re-uploading means that changing passwords before fully removing the malware could inadvertently hand over new credentials directly to the attacker.
The targeted configuration files span multiple popular VoIP platforms, including FreePBX, Issabel, Elastix, Asterisk, and Postfix. Beyond SIP and PJSIP authentication settings, the malware also seeks Asterisk Manager Interface credentials, database passwords, and outbound mail authentication details, effectively compromising both the calling services and their supporting infrastructure.
To evade detection, the attackers have also made changes to their webshells, including varying watermarks between builds and altering the password-gate hash. While the core persistence mechanisms, such as scheduled downloads, login triggers, protected backup files, and multiple webshell copies, remain largely unchanged, these modifications aim to weaken older detection rules.
Investigators are warned that a seemingly normal FreePBX dashboard is not a reliable indicator of a clean system. The malware can modify web-server rewrite rules to direct requests containing encoded whitespace to a webshell without logging the file access. Furthermore, the takeover script actively clears logs and command histories, significantly hindering incident reconstruction efforts.
Effective recovery requires a multi-faceted approach. Systems must be isolated, evidence preserved, and persistence mechanisms removed before any credentials are rotated. Researchers strongly recommend rebuilding affected systems from a trusted image as the most reliable recovery method. Coordination with telephone carriers to replace trunk secrets, restrict allowed source addresses, and monitor for unusual activity is also crucial.