The campaign started last summer, but it has been escalating to involve more than 84 countries and 1,000 Facebook profiles now, according to Group-IB.
A large-scale scam campaign targeting Fb Messenger users all over the world has been detected by a threat hunting group.
There is evidence to suggest that users in over 80 countries in Europe, Asia, the Middle East and Africa region, North and South America may have been affected.
The alleged scam involves cybercriminals distributing ads promoting an allegedly updated version of Fb Messenger to harvest users’ login credentials.
This was disclosed by Group-IB’s analysts who recently discovered nearly 1,000 fake Facebook profiles employed in the scheme. Upon the discovery of this type of fraud, Group-IB had informed the social network, which has nothing to do with the fake posts, of the ongoing campaign.
Scam mechanics disclosed
By April this year, the number of such fraudulent Facebook posts inviting users to install “the latest Messenger update” has reached 5,700. To draw users’ attention, fraudsters had registered accounts with the names mimicking the real app — Messanger, Meseenger, Masssengar, etc., and used the official Facebook Messenger logo as their profile picture.
Furthermore, to facilitate the moderation process in Facebook and bypass its scam filters, scammers used shortened links created with the help of such services as linktr.ee, bit.ly, cutt.us, cutt.ly, and rb.gy. After clicking on the link that is supposed to lead to the download of the app’s updated version, the user finds themselves on a fake Facebook Messenger website with a login form, where they are asked to enter their credentials. Scammers used such platforms as blogspot.com, sites.google.com, github.io, and godaddysites.com to register fake Facebook Messenger login pages.
In order to excite users and make them follow the link, scammers endowed the app with some non-existent features like the possibility to find out who visited one’s profile and see the messages that were deleted; or the scam offered victims the shift to ‘Gold Messenger’. Scammers even used blackmailing to force users into downloading the app and pressured the latter with threats that if they did not sign up on the fake page, their account would be banned forever.
Staying vigilant
Group-IB’s analysts have found the scam ads targeted at users of at least 84 countries worldwide. In
Asia specifically, nearly 20 countries, including Indonesia, Malaysia, Singapore and Thailand have been affected. Victims risk having their personal data leaked and their FB messenger account hijacked. Scammers, in turn, are likely to use the compromised accounts to either blackmail victims, push them to pay a ransom to have access to their account restored, or further scale up the scheme using their stolen Facebook profile to distribute scam ads.
Group-IB’s head of Digital Risk Protection in Europe, Dmitriy Tiunkin, commented: “Living in the era of instant-everything, clicking on an attractive ad, proposal, or headline has become a natural human reflex. This didn’t come unnoticed by fraudsters who have been relentlessly feeding on users’ carelessness. It is up to brands to set things straight in this endless stand-off by ensuring that their name isn’t used to trick unsuspecting customers into a scam, with digital risk protection services serving as a silver bullet in this case.”
The firm advises social media users to stay vigilant and follow some basic cyber hygiene rules for avoiding cybercriminals’ traps.
