Group-IB Links ASOS Rogue Notification Account to Gaming Item Trading

Group-IB researchers have identified the Telegram account responsible for the unauthorized ASOS customer notification as having a history of gaming-item trading, according to Infosecurity Magazine. This attribution provides the first concrete link between the retail brand impersonation incident and specific online marketplace behaviors.

The discovery comes after the unauthorized notification was distributed to ASOS customers, raising concerns about account security and brand integrity. By tracing the digital footprint of the alert, analysts determined that the account used to send the rogue message was not created solely for this incident. Instead, the account showed previous activity centered around the trading of virtual items within gaming platforms. This connection suggests that the threat actor may be leveraging existing infrastructure or accounts established for other purposes to conduct phishing or social engineering campaigns against retail customers.

Context and Background

The attribution of the Telegram account highlights the evolving tactics used in social engineering attacks. Rather than creating new identities for each campaign, threat actors often repurpose accounts that have established histories of activity, such as trading virtual goods. This approach can help them blend in with legitimate user behavior or bypass initial detection mechanisms that look for brand-new accounts with suspicious activity spikes.

Infosecurity Magazine reported that the link was made by a Group-IB researcher, indicating that specialized cybersecurity firms are actively monitoring these types of cross-platform threats. The finding underscores the importance of holistic threat intelligence that looks beyond the immediate vector of an attack. In this case, the vector was a fake notification from a major fashion retailer, but the root of the actor’s online presence was tied to the gaming community. This intersection between retail phishing and gaming economies is a growing area of concern for security professionals, as it demonstrates how threat actors migrate between different digital ecosystems.

Who Is Affected

ASOS customers who received the unauthorized notification are the primary subjects of this incident. The rogue message was designed to mimic official communications from the online fashion retailer, potentially tricking recipients into clicking malicious links or revealing sensitive information. While the specific number of affected users has not been detailed in the available reporting, the distribution of such notifications typically targets a broad audience to maximize the chances of successful engagement.

The connection to gaming-item trading also implies that individuals active in online gaming communities may be at higher risk if they use the same credentials or communication channels across different platforms. Threat actors often harvest data from one sector, such as gaming, and leverage it to target users in another, such as retail. This cross-contamination of risk means that security professionals must consider the broader digital footprint of their users when assessing potential vulnerabilities.

What should you do?

Security teams should monitor for unusual account activity, particularly on communication platforms like Telegram, that deviates from established user behavior. Organizations should also educate users about the risks of clicking links in unsolicited notifications, regardless of the apparent sender. Verifying the authenticity of messages through official channels is a critical step in preventing successful social engineering attacks. Additionally, keeping an eye on threat intelligence reports can help identify emerging patterns, such as the repurposing of gaming accounts for retail phishing.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: ASOS

• Verify the source of any unexpected notifications by checking official company communications or logging into accounts directly rather than clicking links.
• Monitor account activity for signs of unauthorized access or unusual login locations, especially on platforms used for trading or communication.
• Enable multi-factor authentication on all critical accounts to add an extra layer of security against credential theft.
• Stay informed about emerging threat trends by following reputable cybersecurity news sources and threat intelligence reports.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is responsible for the fake ASOS notification?

A Telegram account linked to gaming-item trading was identified by Group-IB researchers as responsible for the unauthorized ASOS notification.

What was the Telegram account used for before the ASOS incident?

The account was previously engaged in trading gaming items, according to Infosecurity Magazine.

Did ASOS release a patch for this issue?

No fix or patch has been confirmed yet, as the issue involves a social engineering attack via external messaging platforms rather than a software vulnerability.