Executive Summary
The 'Motions Vics' threat group is executing a sophisticated hybrid phishing campaign targeting customers of international banks, including Arbuthnot Latham, Nedbank, and Investec. The attack combines domain impersonation with social engineering via phone calls. Attackers lure victims to fraudulent login portals that mimic legitimate banking sites, where credentials and MFA tokens are harvested in real-time.
Technically, the campaign is notable for using the Telegram Bot API as a Command and Control (C2) mechanism. Credential data is sent directly from the victim's browser to a Telegram 'supergroup' monitored by actors named Daemon, Kakarot, and TheGoldenGoatS. The group also utilizes a 'Live Chat' feature on their phishing sites to distribute legitimate AnyDesk binaries, facilitating full device takeover via remote desktop access. The infrastructure appears to be managed via a Telegram bot interface that interacts with an aaPanel-hosted backend.