Unmasking ShadowParasite: The Invisible Cyber Fraud Network Hijacking Everyday Payments

A sophisticated cybercriminal operation, tracked as ShadowParasite, is targeting Colombian citizens through a wide-scale payment fraud scheme. The operation leverages search engine optimization (SEO) to position fraudulent utility payment portals above legitimate services. Once users engage with these sites, they are steered through a multi-stage harvesting process that captures sensitive banking credentials, multi-factor authentication tokens, and, in some instances, live facial biometric data.
The infrastructure is highly resilient, utilizing "bulletproof" hosting and Cloudflare proxies to obscure backend servers. While the operation employs a diverse array of domains and IP addresses, a significant portion of the activity is concentrated within a small number of autonomous systems. The monetization occurs via both direct credential theft and the use of QR codes on the Bre-B platform, which are linked to formally registered merchant accounts. The expansion into biometric data collection marks a significant escalation in the threat actor's capabilities and the potential long-term risk to victim identity security.

* A threat actor named ShadowParasite operates a payment fraud network in Colombia.
* The operation utilizes 288 domains and 246 IPv4 addresses across 29 autonomous systems.
* Attackers create fake utility payment portals and use SEO techniques to rank them in search engines.
* Fraudulent sites impersonate 47 different brands across 10 industrial sectors.
* Victims are prompted to enter online banking credentials for 15 different Colombian financial institutions.
* The system captures identification numbers, banking passwords, six-digit dynamic tokens, and credit/debit card details.
* Some portals capture live facial biometric data via photo and video.
* Payments are processed through the Bre-B platform using QR codes associated with registered merchants.
* 168 identified IPv4 addresses belong to Cloudflare AS13335.
* Datacamp Limited (AS212238) hosted 115 of the identified domains.
* The domain airepagos[.]st has been active since December 8, 2025.
* The domain habi-pagar[.]st was registered on June 13, 2026.

The strongest version of this narrative is a detailed technical forensic reconstruction of a regional threat actor. The analysis provides high-granularity evidence—including specific AS numbers, domain rotation patterns, and deobfuscated code findings—to move the actor from "undocumented" to "profiled."
However, the structure follows a classic vendor-led intelligence pattern. By framing the threat through a "constellation" of infrastructure and assigning a cinematic name like "ShadowParasite," the narrative transforms a criminal operation into a distinct "adversary." This shift in framing—from describing a set of techniques to profiling a "threat actor"—is often used to establish the necessity for specialized intelligence services. The narrative creates a sense of an evolving, sentient enemy ("capabilities have expanded," "warming-up process") to justify a proactive defense posture.
Patterns detected: ARC-0052 Authority Game, ARC-0012 Fear Appeal
The root cause is the professionalization of threat intelligence. When cybersecurity research is produced by vendors, the "discovery" of a new actor serves as a proof-of-concept for the vendor's detection capabilities. This echoes the historical pattern of "naming and shaming" APTs, where the branding of the attacker becomes as important as the mitigation of the threat.
The implications are a further erosion of trust in digital public infrastructure. When the "entry point" is the search engine itself, the fundamental mechanism for finding information is weaponized. This places a heavy cognitive burden on the user to verify every URL, effectively penalizing the non-technical population.
Bridge Questions:
1. How does the use of formally registered merchant accounts for QR payments expose weaknesses in the "Know Your Customer" (KYC) protocols of the payment networks?
2. If the "warming-up" process for domains is detectable, what systemic changes to search engine indexing could neutralize this SEO poisoning?
Counterstrike Scan: A coordinated campaign would use this data to create a moral panic about "invisible" digital predators to force a rapid transition to a specific proprietary security suite. The content here is largely technical and descriptive, matching a standard intelligence report rather than an influence operation.