Validin Python SDK for Threat Monitoring

Keypoints

Validin released a beta Python SDK for building API-driven enrichment and monitoring workflows.
The SDK supports bulk enrichment, Lookalike searches, and campaign tracking at scale.
Validin used the SDK internally to monitor a mobile smishing campaign with carrier-themed lures.
The campaign impersonated major brands including T-Mobile, AT&T, and Verizon.
Malicious links led victims to fake rewards sites designed to collect payment-card details.
Many of the related domains showed DGA-like naming patterns and were registered through Gname.com Pte. Ltd.
The tooling is open source, available in beta, and intended to help analysts automate secondary and tertiary checks.

MITRE Techniques

[T1566.002] Spearphishing Link – Victims received phishing texts containing malicious links that led to a fake rewards website (‘claiming that their T-Mobile rewards points were about to expire with a malicious link to redeem points’).
[T1566] Phishing – The campaign used fraudulent text messages sent from email addresses to lure victims into clicking the malicious URLs (‘a phishing text from an icloud[.]com email address’).
[T1583.001] Domains – Adversary resource development via registered domains used for the campaign (‘many of these domains shared the registrar Gname.com Pte. Ltd.’).
[T1608.003] Relay of LLM-generated or Other Content? – Not mentioned.
[T1587.001] Malware – Not applicable in the article; no malware was described.
[T1583.006] Web Services – The campaign used hosted web infrastructure for lure pages and payment collection (‘hosted the same kit’ and ‘fake T-Mobile rewards website’).
[T1036] Masquerading – The fake site impersonated carrier rewards pages to appear legitimate (‘fake T-Mobile rewards website’).

Indicators of Compromise

[Domains] Campaign infrastructure and lure domains – t-mobile[.]vgyva[.]icu, att[.]yguaf[.]icu, verizon[.]cfgqv[.]icu, and other similar domains
[Domains] Additional carrier-themed domains found by regex/lookalike searching – t-mobile[.]cfdlrw[.]icu, t-mobile[.]fxcmsx[.]icu, verizon[.]celiq[.]icu, and 2 more domains
[URL] Fake rewards/payment page used in the campaign – https[:]//att[.]aocxi[.]icu/pay, t-mobile[.]vgyva[.]icu/pay
[Email domain] Initial phishing lure source – icloud[.]com
[Banner hash] Pivot indicator used to find related infrastructure – 558ef579a9adebb562d2b5f3fbdeeac3
[Registrar] Domain registration context for related indicators – Gname.com Pte. Ltd.
[File/package] SDK installation artifact mentioned in setup – validin-sdk

SHARE THIS STORY