A Deceptive App Is Stealing Data from Indonesian Civil Servants and Retirees

CloudSEK researchers have identified a highly targeted mobile malware campaign in Indonesia aimed at stealing financial and personal data from civil servants and pensioners, with attackers impersonating PT Dana Tabungan dan Asuransi Pegawai Negeri (Persero), commonly known as TASPEN. According to CloudSEK, the campaign uses a malicious Android application masquerading as an official TASPEN portal, with a phishing website at taspen.[.]ahngo[.]cc that mimics branding and slogans.

The malware can steal banking credentials, intercept OTPs from SMS, and capture biometric data through facial video recording, while the attack lifecycle includes a fake app download, data harvesting, and exfiltration to attacker‑controlled C2 servers such as rpc.syids[.]top/x/login. The attackers are said to leverage weaponised Google Play buttons for direct downloads and to present iOS users with a “System is being upgraded” message to hinder reporting.

The report notes linguistic artefacts such as the Chinese error string 获取数据失败 – “Failed to fetch data,” suggesting a Chinese-speaking threat actor behind the operation.