Threats Tagged 'scam'

With the introduction of charges/taxes on certain items posted from outside the EU, threat actors appear to be leveraging the situation to send fraudulent SMS and email messages impersonating postal services in an attempt to harvest payment details and personal information. The campaign is already being observed targeting Irish users, and I'd like to highlight this activity publicly as part of a LinkedIn post around our Brand Protection, Threat Intelligence, and Domain Takedown capabilities.

MediumCampaignIreland#customs#taxes#smishing

The article exposes a sophisticated scam targeting Minecraft players through fake 'grief-free' server communities. The SugarSMP website, promising a safe gaming experience, was found to distribute malware-infected mod packs. The malware, named Spark stealer, steals sensitive data including Discord tokens, browser credentials, and crypto wallet information. The threat actors employ social engineering tactics to maintain their fake community's reputation and remove warnings about their activities. Multiple similar websites were discovered, all hosting various types of malware. The scam's persistence mechanisms and social engineering techniques are detailed, along with remediation steps for affected users.

MediumMalwareUnited StatesUnited KingdomGermany+10#minecraft#scam#mod packs

A recent scam involves fake Tesla websites advertised through Google paid ads, targeting potential customers interested in preordering the Optimus robot. These fraudulent sites mimic Tesla's official website design and offer non-existent preorders for various Tesla products, including the Optimus robot. The scam aims to collect $250 non-refundable deposits and potentially steal credit card information. Multiple fake domains have been identified, with some already taken offline. The fraudulent sites lack login functionality and may redirect users to fake authentication pages. Tesla is likely monitoring and requesting takedowns of these sites. The scam exploits the anticipation surrounding Tesla's future products and may go unnoticed until expected delivery dates.

MediumCampaignGermanyUnited KingdomFrance+7#tesla#phishing#fake websites

A series of cryptocurrency scams have been uncovered where threat actors distribute malicious smart contracts disguised as trading bots to drain user wallets. The campaign has stolen over $900,000 US and employs multiple obfuscation techniques to conceal the attacker's wallet address. Leveraging aged YouTube accounts and curated comment sections, the scams create a false sense of legitimacy. The smart contracts, written in Solidity, use various methods to hide the attacker's Externally Owned Account. Distribution occurs through YouTube videos explaining the contracts as trading arbitrage bots, with some videos showing signs of being AI-generated. The most successful scam yielded approximately $902,000 US from a single attacker address.

MediumCampaignGermanyUnited KingdomFrance+3#cryptocurrency#solidity#obfuscation

A phishing campaign exploiting the aftermath of a military conflict between Israel and Iran has been identified. The scam, using a fake domain 'lineageembraer.online', offers evacuation flights from Tel Aviv to New York on an Embraer Lineage 1000E business jet. The website presents unrealistic pricing and logistical details, aiming to steal personal and financial information from individuals seeking to flee the region. The operation uses fear and urgency tactics, offering seats at $2,166 USD, significantly below market rates for similar flights. The scheme involves a PDF with instructions hosted on a Shopify CDN, raising further suspicions. The campaign demonstrates how threat actors exploit crisis situations to target vulnerable individuals.

MediumCampaignIsraelUnited KingdomGermany+3#middle east crisis#aviation#identity theft

A new injection campaign has been identified that exploits third-party JavaScript to redirect mobile users to a Chinese adult-content Progressive Web App (PWA) scam. The attack specifically targets mobile devices, injecting a viewport meta tag and an ad overlay with click-hijacking functionality. The scam utilizes PWAs to increase user retention and bypass basic browser protections. The compromised websites are disguised as novel reading platforms, with the malicious code now being encrypted. The attack flow involves an initial loader script, which triggers the redirect on mobile devices while ignoring desktop visits. The payload script ensures mobile rendering, creates an overlay with deceptive elements, and opens the scam site in a new tab upon interaction.

MediumCampaignGermanyFranceUnited Kingdom+5#pwa#click-hijacking#mobile