Real-time OTP theft, dressed as a traffic fine

A fake fine with a real sense of urgency

In mid-September 2026 the FRSC issued a public alert about fraudulent SMS messages telling recipients a new road-traffic offence had been recorded against them, and directing them to lookalike websites. The messages lean entirely on urgency:

What makes this cluster worth a full teardown is not the lure — it is what sits behind the link. The kit turns a one-shot phishing page into an interactive, operator-driven fraud session capable of defeating one-time-password protection. The sections below reconstruct the victim journey, the kit's client and server components, and the infrastructure, then set out detection opportunities and indicators.

From SMS to a scripted payment session

The full chain compresses a familiar smishing opening into a payment-fraud endgame. The victim never leaves what looks like a single official portal, while an operator watches every field arrive in real time.

Five screens, one continuous session

Reconstructed from the client bundle's UI strings and captured traffic, the flow walks the victim from a plausible "lookup" into card and OTP entry, wrapped in reassurance screens designed to keep them waiting while the operator acts.

The waiting screens do the heavy lifting: strings such as Waiting for bank authorization…, Please go to your bank app to confirm the authorization, and The session is about to expire, please complete the verification now manufacture exactly the window an operator needs to submit the stolen card and consume the live OTP.

A control plane, not a form

Client analysis (index-99e75bee.js, a 428 KB Vue/Vite bundle) plus intercepted HTTP/2 and WebSocket traffic reveal a two-layer server and a live operator channel sitting between victim and back office.

Front-end & session model

The SPA is a modern Vue 3 / Vite build loaded from the distinctive asset root /wd122_ng_etc_fctevreg/ — a string that folds together FRSC's 122 hotline, the ng country code, and the impersonated fctevreg brand. Each victim is issued a UUIDv4 session token carried redundantly as a cookie, a URL query parameter, and both X-Token and Token headers.

The live control channel

A Socket.IO WebSocket at wss://<host>/ws?token=<uuid> carries the session. Field values are pushed as the victim types: one capture showed an in-progress plate KJA-12BA streamed to /qoBOHeLPyu/api/input before the final submitted KJA-123BS. Result events (otpValid, customOtpValid, appValid, verifyCode) mark each stage for the operator.

The operator console

The session-init response returns a custom configuration whose keys map directly to operator controls:

These let the operator, mid-session, reject a card and demand another, re-request the OTP under a fresh pretext, or ask for a billing address to satisfy a bank check — the toolkit of real-time authentication defeat.

Automatic card enrichment

Submitted cards are enriched by BIN before they even reach the operator's queue — issuer, scheme, type and country are resolved server-side (e.g. BIN 539983 → Guaranty Trust Bank, Nigeria, Mastercard debit), letting the operator triage the most valuable cards first.

Back-end fingerprint

Responses carry Server: GoFrame HTTP Server — a Go framework of Chinese origin — behind a Caddy front (Via: 1.1 Caddy). The randomised API base path /qoBOHeLPyu/ is per-deployment, a deliberate hedge against path-based scanning.

A lookalike cluster around a real brand

The campaign typosquats a genuine service. The malicious domains cluster around variants of the real fctevreg.com portal, while the kit itself redirects aborted sessions to the authentic site to appear credible and to shake off analysis sandboxes.

Registration is deliberately opaque. The one lookalike with public WHOIS, fctevreg.cam, was registered on 15 September 2026 through Singapore-based registrar Gname.com with full privacy protection and a Hong Kong locality, on shared nameservers (a5.share-dns.com / b5.share-dns.net) that let the operators shuffle sites quickly. The .eu.cc hosts are third-level subdomains with no independent registration record at all.

A sold kit, a regional operator

Assessment: moderate confidence that this is a Chinese-language phishing-kit product run by a separate affiliate operator, consistent with the industrialised smishing-as-a-service ecosystem behind large "Smishing Triad"-style operations.

• Developer language. Internal page and step labels are in Chinese while only the English front-end is shown to victims — e.g. 首頁輸入 (homepage input), 查询页 (query page), 填卡页 (card-entry page), 验证码 (verification code), 车牌号 (plate number). Developer and operator are clearly different parties.
• Toolchain. The GoFrame backend is a Chinese-authored framework, reinforcing Chinese-speaking development.
• Productisation. Per-victim tokenisation, a configurable operator console, built-in BIN enrichment, randomised API paths and multi-country plate templates (a South African ABC 123 GP example ships alongside the Nigerian one) are hallmarks of a rented kit, not a bespoke build.
• Operator vs developer. The country:"NG" config and FRSC-specific asset path indicate an affiliate deployment aimed at Nigeria; the ZA template shows the same kit is deployed elsewhere.

Limits. Registrant data is privacy-protected and the infrastructure uses low-cost shared and subdomain services, so open-source personal attribution is not feasible. The strongest lead for law enforcement is the outbound money trail — a UAE merchant descriptor on the fraudulent card leg — reachable only through the bank and card scheme.

Real-time OTP defeat, real losses

Because the operator relays a valid card and a live OTP in the same session, standard one-time-password protection is neutralised: the fraudulent authorisation carries a genuine bank OTP. In one publicly reported case a victim lost ~₦364,574 to an international card purchase with a Dubai (UAE) merchant descriptor minutes after entering details. The plate-entry step also manufactures a convincing "specific offence" even where the operators hold no prior data on the victim.

Pivots for mapping the cluster

All hunts below are passive. Do not authenticate to, probe, or interact with the operator console or any exfil channel — that is unauthorised access, tips off the operator, and taints evidence. Document and refer.

Response actions

• Takedown. Report the malicious host and lookalikes to the .eu.cc subdomain service, the hosting provider behind the resolved IP, and the relevant registrars (Gname.com for fctevreg.cam). Exclude the legitimate domains.
• Blocklists. Submit URLs to Google Safe Browsing and APWG (reportphishing@apwg.org), plus telco/browser blocklists.
• Notify the impersonated parties. FRSC (national line 122) and the FCT DRTS — so both can extend their own advisories and flag the abuse of their live portal as an evasion redirect.
• Notify affected banks. Share the flow, the BIN(s), and the UAE merchant descriptor with fraud teams (e.g. GTBank per the observed BIN).
• For victims. If card details or an OTP were entered, contact the issuer immediately to block the card and dispute the charge; preserve the SMS and screenshots; stop engaging with the sender.