Malware Targets FreePBX Servers to Steal SIP Credentials for Phone Fraud

Attackers focusing on FreePBX-based phone servers have upgraded their toolset so they can steal credentials that allow fraud to continue even after an infected system is rebuilt.

The campaign, tracked as INJ3CTOR3, now harvests configuration files that contain SIP trunk secrets, database credentials, administrative backdoor passwords, and mail-relay logins — extending the impact beyond the compromised host.

This escalation builds on an earlier wave of abuse in which fraudsters used victims’ own PBX systems to place unauthorized calls. While previously described six-layer persistence techniques let the malware survive removal attempts, the theft of carrier credentials gives attackers an alternate way to charge calls to the victim’s account.

Researchers at Cyble Research & Intelligence Labs discovered the updated components while examining artifacts taken from the operation’s staging servers in September 2026. In an analysis published October 28, they describe an installer that is configured to upload 17 files on a repeating schedule. The team recovered the upload commands but did not observe live exfiltration nor determine how many victims were affected.

How the updated attack works

The revised installer contains two groups of encoded commands, each directing configuration uploads to a different staging server. The malware installs scheduled tasks that run the installer every minute, repeatedly exposing secrets for the duration of the infection.

That behavior means simply changing passwords before removing the malware can hand new credentials right back to the attacker. The targeted files cover configurations from FreePBX, Issabel, Elastix, Asterisk and Postfix.

Specifically, the collectors focus on SIP and PJSIP authentication settings, Asterisk Manager Interface (AMI) credentials, database passwords, and outbound mail authentication details — exposing both the telephony services and supporting infrastructure.

SIP trunk credentials are especially valuable because they authenticate a business’s connection to its telephony carrier. If the carrier does not restrict trunk registration to approved IP addresses, stolen credentials let attackers register from another host and place calls without touching the original PBX — calls that may not appear in logs on a cleaned server.

The operation still uses the JOMANGY and ZenharR webshells to execute remote commands and access telephony functions. Prior FreePBX webshell exploitation has shown how attackers combine administrative access, backdoor accounts and outbound calling to monetize compromised VoIP infrastructure.

Cyble also observed modifications intended to evade older detection rules: webshell watermark strings now vary across builds and the webshell authentication-gate hash has changed. The core persistence techniques remain largely the same, including scheduled downloads, login-triggered actions, protected backup files and multiple webshell copies that can restore deleted components.

Detection and recovery: rotate credentials and remove persistence

A normal-looking FreePBX dashboard should not be taken as proof that a server is clean. In lab testing, Cyble demonstrated that an Asterisk trunk can be created directly in configuration files and carry calls without appearing in the FreePBX console — although the researchers did not see this campaign planting such a trunk in the wild.

The malware also alters web-server rewrite rules so requests containing encoded whitespace can reach a webshell without the file name appearing in access logs. The takeover script clears logs and shell histories, reducing the artifacts available for post-incident reconstruction.

Effective recovery requires isolating the system, preserving evidence, removing all persistence mechanisms, and only then rotating any credentials that may have been exposed. Previous guidance for FreePBX zero-day compromises likewise emphasizes fully restoring systems from a trusted image and replacing system, trunk, extension and other account secrets rather than relying on patching alone.

Administrators should work with their carriers to replace trunk credentials, retain registration and billing records for investigation, restrict allowed source IPs for trunks, and apply spending limits where the carrier supports them.

Monitoring should include detection of unexpected SIP registrations, calls to premium-rate destinations, anomalous call concurrency, and outbound configuration uploads. Cyble recommends rebuilding compromised systems from a trusted image as the most reliable recovery approach.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, [.] in place of .) to prevent accidental resolution or hyperlinking. Re-fang only inside controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.