- infoblox:blogs/category
Scams Using Fake Celebrity Endorsements Target EU Countries
This report describes a series of scam campaigns that we have been tracking, in which threat actors compromise social media accounts, redirect victims and solicit their contact information, and then attempt to convince them to deposit funds with fake trading companies.
Author: Stelios Chatzistogias
Summary
This report describes a series of scam campaigns that we have been tracking, in which threat actors compromise social media accounts, redirect victims and solicit their contact information, and then attempt to convince them to deposit funds with fake trading companies. This series of campaigns uses a form of a celebrity endorsed scam, a method first seen in 2020,1 and uses a “Meta” coin theme. The campaigns stand out in terms of the media platforms the actors utilize as well as how they stage their attacks. Specifically, the campaigns use Facebook sponsored ads in combination with fake LinkedIn profiles and multiple domains with the same fake content translated into different languages.
Background
Remote working as a result of the global Covid-19 pandemic has significantly changed our daily routines. Many people now spend more time at home or connecting virtually through devices, and the amount of digital advertising conducted through social media platforms has increased to match this trend. All of this has led online fraudsters to take advantage of these changes. According to the Federal Trade Commission,2 the total dollar amount reported as lost to fraud from criminal actors using social media as the contact method in 2021 was $770 million, followed by the use of websites or apps at $554 million, and phone calls at $546 million.
Investment scams have evolved, and the actors have become more advanced in their tactics to convince victims to supply private information and credit card details. The scammers’ techniques can involve compromised social media accounts, redirects via multiple social media platforms, and short-lived, randomly generated domains for landing pages, as is the case with the campaigns we will describe in this report.
Campaigns Analysis
The “Meta” coin theme used in these campaigns intentionally conflates two separate services: Facebook’s Meta and Inblock’s Metacoin cryptocurrency. Mark Zuckerberg is rebranding Facebook to Meta3 as part of his strategy to create Metaverse: an AI and virtual reality platform. Separately, the founders of the Hong Kong–based company Inblock created Metacoin: a cryptocurrency that is based on hyperledger technology and that has improved security features based on IBM’s LinuxOne platform.4
Although Metacoin and the Meta services are not related, the scam campaigns in this report use the logo from Facebook’s Metaverse platform and the name Metacoin from Inblock’s cryptocurrency, likely in an attempt to make the delivered web content appear legitimate. The fake “Meta” coin campaigns have been initialized by a compromised Facebook account under the name SoulCircuit.5 SoulCircuit is actually a group that consists of two DJs/musicians: Tom Moore and Dan Timcke,6 from the UK.7 Their compromised Facebook profile page has almost 600K followers, and is being used to distribute scam-sponsored ads for the fake “Meta” coin cryptocurrency. Another interesting feature of the campaigns is that the attackers seem to be targeting people from specific countries, namely Greece, Italy, and Spain, based on the languages used in the campaigns and the use of pictures and names of actual prime ministers from those countries.
The campaigns consist of five stages. The actor uses different social media platforms to lure and then redirect the victim, eventually leading them to a short-lived domain that seems to be either fully or partially randomly generated. Once a user shows interest and supplies some initial information (name and mobile phone number), they are again redirected to fake trading websites that present requests for a deposit via a credit card or a transfer from other cryptocurrency accounts.
Figure 1: Stages of the attack
Stage 1: Sponsored Facebook Ads Through SoulCircuit’s Compromised Account
In the first stage of the attack, the actor places “Meta” coin ads on SoulCircuit’s Facebook main wall. The screenshot in Figure 2 below is from a campaign targeting Greek-speaking individuals or groups. Some of the obvious signs that the campaign is a scam is the fact that there is no punctuation in capital Greek letters. On the other hand, the fact that the account allegedly has a large number of followers (594k) can lead a user to believe this ad is legit. The image on the right-hand side of Figure 2 shows the caption’s text translated into English. Upon clicking the Learn more button, a user is redirected to a LinkedIn page, which we consider Stage 2.
Stage 2 – LinkedIn Posts
Clicking the Learn More button opens a LinkedIn page that claims that this new cryptocurrency was invented by Meta and presents fake reviews on it (Figures 3 through 5 below), allegedly made by the Prime Minister of Greece Konstantinos Mitsotakis and other famous Greek individuals.
The LinkedIn profile that posted the fake article about “Meta” coin belongs to a “Rachelle Young” (Figure 6 below), who appears to be a financial analyst from the U.S. State of Colorado and whose profile has more than 500 connections. The recent activity is relevant and of interest because the profile’s owner has posted the same article translated into the same three different languages.
Figure 6: A fake LinkedIn profile posting the same “Meta” coin article in multiple languages
The activity tab on her profile shows that this activity has been going on for weeks.
Figure 7: Continuous LinkedIn activity
The actor has posted articles in languages besides Greek and has used photos and stories tailored to those other countries. For example, the screenshots below show altered photos and narratives allegedly relating to Mario Draghi (an Italian public official) and Dietrich Mateschitz (an Austrian businessman).
Stage 3 – Landing Pages and Randomly Generated Domains
These fake news articles contain links to two different domains that have the same content, including design and graphs, but they are in two different languages, as shown in Figures 10 and 11 below.
Figure 10: Altered YouTube image that points to scam website
Figure 11: Altered YouTube image that points to scam website
The scam websites embedded in the code of the YouTube images above, are 365coinmode and 365graphiccoin. Both sites host the same page translated into different languages, which is shown in Figures 12 and 13 below. Following them, Figure 14 shows the English language version.
Figure 12: Landing page on 365coinmode[.]com, in Greek
Figure 13: Landing page on 365graphiccoin[.]com, in Italian
Figure 14: Landing page on 365graphiccoin[.]com, in English
Stage 4: Personal Information Gathering
The goal of this particular stage of the campaigns is not to steal any credit card details, but instead to have the victims complete a form with their names and phone numbers. The victims then get redirected to fake trading company websites, such as spartan-trade[.]com and networkfsi[.]com, which ask the victims to make financial deposits. Reports from Greece and the U.K. indicate that the actors use the contact information the victims provided to get in touch with them if they do not make the deposit as requested, in the next stage of the attack, described below.8,9 The scammers try to convince the victims that the campaign is being conducted by a legitimate investment company.
Original text (Greek)
Translated text (English)
Figure 15: A form for creating a fake account for “Meta” coin
Stage 5: Money theft
After providing personal details, a victim gets redirected to a fake but visually appealing website. In our tests, we were redirected to Spartan Trading, a fake trading website. It was registered on 5 July 2022 and contains the aforementioned deposit page where a victim is asked to choose an amount of money to deposit. As of this writing, the available payment options are cryptocurrencies and credit cards. The screenshots below illustrate how the cryptocurrency payment system works.
Figure 16: Fake trading website
The screenshots in Figures 18 through 21 below show the credit card payment system on the scam website.
Figure 18: IpassPay option
Figure 19: Deposit page
Figure 20: Billing Info
Figure 21: Credit card detail request page
Domain Analysis
All domains that serve the landing pages are registered to Namecheap and resolve to the same IP address, 45[.]63[.]119[.]177, which belongs to Constant Company LLC: a hosting provider that offers global automated cloud infrastructure. In turn, Constant LLC is a parent company for Vultr, which happens to offer free $100 vouchers for using the platform. This arrangement is a springboard for attackers who have automation in place to deploy and set up scam domains and to operate them cost-free. The screenshots in Figures 22 and 23 below show the landing pages belonging to Constant and Vultr, that are used to advertise their automated cloud infrastructure and the $100 promotion for new users.
Figure 22: Constant LLC’s landing page
Figure 23: Vultr $100 promotional offering
Prevention and Mitigation
These malvertising scams have the following features in common:
- The name of the domain involved in a scam is irrelevant to the scam’s theme.
- The text of the initial advertisement on Facebook is automatically translated to several languages.
- Typos are easy to spot.
- The parties that own the LinkedIn profiles used in the scams claim to be financial advisors.
- None of the YouTube videos or links to popular domains redirect to any popular domains.
- The faces appearing on the websites are edited or the photos are unrelated and have been taken from other articles.
- There is no phone number or address of the company. Often, these scams are set up from abroad.
Indicators of Compromise
The table below provides a list of the IOCs relevant to our recent findings, which can also be found in our GitHub repository.10
Endnotes
- https://blog.confiant.com/fake-celebrity-endorsed-scam-abuses-ad-tech-to-net-1m-in-one-day-ffe330258e3c
- https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/01/social-media-gold-mine-scammers-2021
- https://knowledge.insead.edu/marketing/why-facebook-rebranding-itself-meta#:~:text=Mark%20Zuckerberg%2C%20founder%20of%20Facebook,phase%20in%20the%20digital%20world.
- https://www.ibm.com/case-studies/inblock-blockchain-ibm
- https://www.facebook.com/SoulCircuitMusic/
- https://www.discogs.com/artist/3961188-SoulCircuit
- https://soundcloud.com/soulcircuitmusic
- https://www.santander.co.uk/about-santander/media-centre/press-releases/santander-warns-about-celebrity-endorsed-crypto-scams
- https://www.ellinikahoaxes.gr/2022/09/01/scam-metacoin-cryptocurrency/
- https://github.com/infobloxopen/threat-intelligence/tree/main/cta_indicators