Using a mix of compromised social media accounts, social engineering, call center agents, and some convincing websites, this latest scam seeks to get victims to repeatedly “invest”.
I’ve seen plenty of great websites and brands impersonated, phishing kits that come complete with a set of web pages, but nothing to this magnitude has been seen before. First discovered by the security respond team over at Group-IB, this scam targets would-be investors in the UK, Belgium, Germany, the Netherlands, Portugal, Poland, Norway, Sweden, and the Czech Republic.
Using a mix of celebrity endorsements in fake articles claiming how the celebrity turned 250 Euros into 700 in just 3 days, with compromised Facebook and YouTube accounts to add credibility, victims are taken to fake investment sites where they are bombarded with success stories in an effort to get victims to not just pay the 250 Euro fee once, but continually.
Once victims register, they are contacted by a call center to walk them through the process of paying their initial “investment”. Once invested, the victims are given access to a fake investment dashboard, where they are updated on the monies their “investment” is making to get them to want to make additional deposits.
Source: Group-IB
This is about as sophisticated as a phishing scam can get; the time and energy invested in over 10,000 fake sites seems unfathomable – and yet, it’s the reality today. This is the reason why every single person – whether at home or at work – need to have their defenses up, interacting with anything and everything on social media, the web, and in email with a sense of suspicion. This is something that comes naturally to users within an organization that go through continual Security Awareness Training; they begin to understand that anything that seems too good to be true, isn’t, and that anything received unexpectedly should be treated as if it’s a scam first.
Here's how it works:
