Critical Scam Alert: famgateway.online Malware & Fake Clone Domain Advisory

Security and user trust are the core pillars of FamGateway. As our non-custodial UPI platform continues to grow across India, malicious actors have begun creating fraudulent copycats to exploit developers, students, and merchants. We have detected an active, malicious phishing and malware distribution network operating at the domain famgateway.online.

This urgent threat advisory outlines the mechanics of the attack, identifies the threat actor, and provides actionable steps to protect your credentials and devices.

1. Attack Anatomy: How the Scam Operates

The fraudulent website at famgateway.online is not an actual payment gateway. Our security research team analyzed the source code and network activity of the clone domain, identifying three dangerous threat vectors:

• Malicious Ad-Injection & Redirect Chains: Visiting the clone triggers aggressive redirect loops that cycle users through deceptive pop-unders, adult advertisements, and unauthorized push notification prompts.
• Forced Executable (.exe) Downloads: The site attempts to trick unsuspecting users into downloading fake "FamGateway Desktop Integrator" or "API Tools" packaged as Windows executables. These files contain trojans designed to steal browser cookies, Discord tokens, and crypto wallet keys.
• Phishing for Google App Passwords: The clone presents fake input forms prompting users to enter their 16-character Google App Passwords. Because the clone has no backend payment engine, submitted credentials are leaked directly to the attacker's database.

2. Threat Actor Identification: Telegram Handle @michalecodex

Our threat intelligence investigation has linked the infrastructure and promotion of famgateway.online to a malicious operator active on Telegram under the handle @michalecodex.

Aryan Gupta (Aryanispe) and the official FamGateway staff will never initiate unsolicited direct messages selling source code, asking for credentials, or forcing you through ad-shortened links. Additionally, newly surfaced clones such as famgateway.shop (which mimics our UI to hijack API orders) are actively reported for upstream registrar and hosting termination.

3. Technical Checklist: How to Verify the Real FamGateway

Whenever you access FamGateway to manage checkouts, create payment links, or review API keys, perform these three verifications:

1. Inspect the Full URL: Ensure the domain in your browser address bar is exactly https://famgateway.in. Beware of subtle typosquatting (such as famgateway-in.com or famgateway.online).
2. Verify the SSL Certificate: Click the padlock icon in your browser to verify that the TLS certificate is issued to famgateway.in via Cloudflare Enterprise Edge.
3. Check Government MSME Standing: Verify that the platform displays the official Government of India Udyam Registration: UDYAM-BR-28-0050000 under entity ARYANISPE.

4. Immediate Remediation Steps If You Were Targeted

If you or someone in your developer network interacted with famgateway.online or @michalecodex, take the following steps immediately:

• Revoke Google App Passwords: Go to myaccount.google.com/apppasswords and delete any App Passwords created during that timeframe.
• Terminate Active Sessions: In your Google Account Security tab, select "Sign out of all other sessions" to invalidate stolen cookies.
• Scan Device Storage: Run a full system scan using Windows Defender or Malwarebytes to detect and quarantine any dropped payloads.
• Switch to Biometric Passkeys: Enable hardware-level FIDO2 Biometric Passkeys on your authentic FamGateway account.

Frequently Asked Questions (FAQ)

Conclusion

By staying vigilant, verifying URLs, and relying only on official communication channels, developers can protect their digital assets from malicious threat actors. FamGateway remains dedicated to maintaining an impenetrable, MSME-certified payment ecosystem for all Indian builders.

Return to Official FamGateway Portal →

Back to Homepage →