The Dark Side of Convenience: The Lounge Pass Scam Targeting Indian Travelers

BANGALORE — Imagine the convenience of accessing a serene airport lounge, a sanctuary away from the hustle and bustle of the terminal. But what if this simple desire becomes a gateway to a cybersecurity nightmare?

Recently, CloudSEK’s Threat Research Team uncovered a sophisticated scam that has ensnared unsuspecting air travelers across India. Over 450 passengers have fallen victim, losing more than Rs 9 lakhs (approximately $11,000) due to a fake app masquerading as “Lounge Pass.” This alarming situation highlights the growing threat of cyber fraud targeting travelers seeking comfort and convenience.

The Genesis of the Scam: A Traveler’s Nightmare

The scam first came to light through a viral post on X (formerly Twitter), where a passenger recounted their harrowing experience of losing over Rs 87,000 at Bangalore Airport after using the fraudulent “Lounge Pass” app. This incident prompted CloudSEK’s Threat Research Team to launch a thorough investigation, revealing that what initially appeared to be an isolated incident was, in fact, part of a larger, organized operation affecting hundreds of passengers nationwide.

Key Highlights of the Scam

• 450 Victims: Between July and August 2024, approximately 450 air travelers unknowingly installed the fake “Lounge Pass” app on their Android devices.
• INR 9 Lakhs Lost: The scammers utilized intercepted SMS messages to steal over INR 9 lakhs within a matter of weeks.
• Widespread Impact: The fake app was primarily circulated through WhatsApp messages, leading users to malicious websites such as loungepass[.]in, loungepass[.]info, and loungepass[.]online.

Unraveling the Scam: How It Worked

This scam was particularly cunning as it exploited a traveler’s desire for convenience. Unlike traditional financial scams that impersonate banking apps, the attackers targeted a service commonly used by air travelers—airport lounge access. Here’s a detailed look at how the scammers ensnared their victims:

Step-by-Step Modus Operandi

1. Distribution Through WhatsApp: Scammers disseminated links to download the fake “Lounge Pass” app via WhatsApp messages, directing users to malicious domains.

2. Installation of Fake App: Unsuspecting users downloaded the app, unknowingly granting it dangerous permissions, including access to read their SMS messages.

3. Stealing Sensitive Information: The app silently intercepted incoming SMS, capturing crucial information like One-Time Passwords (OTPs) and financial alerts.

4. Transmitting Stolen Data: The intercepted SMS data was automatically forwarded to the scammers’ Firebase server.

5. Financial Theft: Using the stolen OTPs and other sensitive data, the scammers gained unauthorized access to the victims’ accounts, swiftly draining their funds.

CloudSEK’s Investigation: Uncovering the Technical Details

CloudSEK’s team delved deep into the app’s code and unearthed a complex scheme. By reverse-engineering the fake “Lounge Pass” app, researchers found that it requested excessive permissions, allowing it full access to SMS messages.

A significant breakthrough occurred when they discovered a major flaw in the scammers’ operation: an exposed Firebase endpoint. This vulnerability enabled CloudSEK to trace the intercepted data, analyze the scale of the scam, and track the stolen funds.

Anshuman Das, a researcher at CloudSEK, expressed concern, stating, “The fact that 450 travelers have already fallen victim and over Rs 9 lakhs have been stolen is deeply concerning. This is just one fraudulent app that we have found; the possibility of thousands of similar fake apps being in operation cannot be denied. It is critical that travelers remain cautious and only install apps from official sources.”

The Unique Threat of This Scam

What sets this scam apart from typical banking fraud is its focus on a specific, niche behavior—airport lounge access. Many travelers, especially those rushing to catch flights, tend to rely on apps for quick access to lounges, often bypassing due diligence. The scammers exploited this vulnerability, creating an app that appeared legitimate but was, in reality, a front for financial theft.

Safety First: CloudSEK’s Recommendations for Secure Travel

To ensure the safety of air travelers, CloudSEK has released a set of guidelines:

Travel Safety Recommendations

• Download Apps from Trusted Sources: Only download lounge or travel apps from the Google Play Store or Apple App Store. Check the developer’s credentials, ratings, and user reviews before installing.

• Avoid Scanning Random QR Codes: Steer clear of scanning QR codes found at airports, lounges, or on WhatsApp. If in doubt, consult official airport staff or use authorized sources.

• Restrict SMS Permissions: Never grant SMS access to travel or lounge apps. Genuine apps should not require permission to read your SMS messages.

• Use Official Booking Channels: Book lounge access through official sources like banks, credit card offers, or the airport’s website. Booking directly at the lounge counter is also a safe choice.

• Monitor Financial Activity: Activate banking alerts, review account statements regularly, and report any unusual transactions immediately. Check the permissions of apps installed on your device and remove those that seem suspicious.

CloudSEK strongly advises travelers to be cautious and avoid downloading apps shared through unsolicited messages or unfamiliar channels. Although the fraudulent domains have been reported, the threat of similar scams remains high.

Conclusion

As the world becomes increasingly digital, the convenience of accessing services like airport lounges can come at a cost. The “Lounge Pass” scam serves as a stark reminder of the vulnerabilities that exist in our quest for convenience. By staying informed and vigilant, travelers can protect themselves from falling victim to such scams, ensuring that their journeys remain safe and enjoyable.

For more updates and information on cybersecurity, follow The420.in on Telegram, Facebook, Twitter, LinkedIn, Instagram, and YouTube.