skip to Main Content
Return to Infoblox Homepage

Infoblox Threat Intel

Savvy Seahorse

Savvy Seahorse is a DNS threat actor that specializes in investment scams that lure victims into creating accounts on fake investment platforms, making deposits into personal accounts, and then transferring these deposits to a bank in Russia. Savvy Seahorse delivers its campaigns through Facebook advertisements and incorporates fake ChatGPT and WhatsApp bots to urge users to enter personal information. It has spoofed legitimate companies such as Apple, Meta, Mastercard, Visa, and Google for investment opportunities.

  • Operating since: At least August 2021
  • Infoblox discovered: August 2022
  • Infoblox published: February 2024
  • Prevalence: Uncommon

Threat actor resources

Media Article

Bleeping Computer
February 28, 2024

Savvy Seahorse gang uses DNS CNAME records to power investor scams

A threat actor named Savvy Seahorse is abusing CNAME DNS records Domain Name System to create a traffic distribution system that powers financial scam campaigns.

Read more
Report

Infoblox Threat Intel
February 28, 2024

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

A persistent investment fraud actor who leverages DNS CNAME records as a traffic distribution system (TDS) to control access to their malicious content spread through Facebook ads.

Read more
Blog

Infoblox Threat Intel
February 28, 2024

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

DNS threat actors never cease to surprise us. Every day, we learn about creative, new campaigns they have devised to exploit victims. Investment scams are one of these.

Read more
Media Article

The Hacker News
March 5, 2023

Retrieving data. Wait a few seconds and try to cut or copy again

A new DNS threat actor dubbed Savvy Seahorse is leveraging sophisticated techniques to entice targets into fake investment platforms and steal funds.

Read more
Back To Top