Group-IB traces ASOS's rogue push alert to a renamed gaming-trade Telegram account

The account behind the channel now goes by Xuanyewen (@xuanyegroup). Group-IB found it previously ran as JohnCZ (@JohnCzwartacki) and Moon Transfers (@NFTmoonstock), names mostly used for gaming-item trading ^[3]. Anastasia Tikhonova, Group-IB's global head of threat research, drew a narrow conclusion from the renames ^[2]. "That suggests an identity set up or reorganized around this incident. It does not tell us who controls it, how experienced they are or how access was gained, and we have no evidence on the entry route," she said ^[4].

The access on record is the ability to send a push message carrying an outside link to ASOS customers ^[2]. Tikhonova said that "being able to send a notification shows access to a customer-messaging channel, not possession of a customer database" ^[12]. The channel's administrator also says payment information is not affected, a point where attacker and company agree ^[9][8]. ASOS says its website and app are running normally ^[10].

That leaves the entry route as the question with operational value. Team Cymru's Will Thomas assessed the incident as likely a software-as-a-service platform compromise ^[16]. He listed four possible routes: a helpdesk socially engineered into a password reset, an API key in exposed website JavaScript, credentials reused from infostealer logs, or a flaw introduced by a vibe-coding developer. He said which one was used is "unclear right now" ^[17].

Thomas said FulcrumeSec, ExfilSquad, Scattered Spider and Lapsus$ have used those techniques against UK organizations over the last couple of years ^[18]. The overlap is in method. Group-IB's work does not show who controls the Xuanyewen account ^[4], so no crew is attached to this incident on the public evidence.

Tikhonova said attackers go after the platforms and integrations companies depend on "because one point of access reaches a long way," and that retailers are particularly exposed ^[13]. "The systems retailers use to talk to their customers, often run by third parties, carry as much trust as the data platform behind them and deserve the same monitoring," she said ^[14].

Arctic Wolf's Nick Dyer cited ASOS's roughly 17 million customers as the possible scale of a breach, while saying it is not known whether users were compromised ^[15].