Financial InstitutionAPIWeb
Credential-stuffing takeover → cash-out
An injection / credential-stuffing login against this account is blocked; the account is flagged as taken-over, so the attacker's immediate cash-out is declined.
- Attack
- Attempt an injection login, then transfer ₦700k.
- Nemesis defense
- The blocked login flags the account; Omniguard declines the follow-up transfer (ATO → cash-out).
- Modelled on
- Account-takeover cash-outs following credential stuffing and injection login bypass.
Request — review or edit the fields, then run it
Recon step runs first: POST /api/login — on the protected app this is blocked and flags the actor.
Request that will be sent
POST /api/transfer
Content-Type: application/json
{
"dest": "0244553311",
"amount": 700000
}