Group-IB, a global threat hunting and adversary-centric cyber intelligence company that specializes in investigating and preventing hi-tech cybercrimes, has detected a large-scale scam campaign targeting Facebook Messenger users all over the world. Group-IB Digital Risk Protection (DRP) analysts have found evidence proving that users in over 80 countries in Europe, Asia, the MEA region, North and South America might have been affected. By distributing ads promoting an allegedly updated version of Facebook Messenger, cybercriminals harvested users’ login credentials. Group-IB’s DRP analysts have discovered nearly 1,000 fake Facebook profiles employed in the scheme. Upon the discovery of this type of fraud, Group-IB informed the social network, which has nothing to do with the fake posts, of the ongoing campaign.
It is noteworthy that this scam first came into the spotlight of Group-IB DRP in the summer of 2020, with DRP analysts based in different regions — Asia and Europe — having detected traces of the same fraudulent campaign. Since then it has been growing progressively in scope. In April, the number of Facebook posts inviting users to install “the latest Messenger update” reached 5,700. To draw users’ attention, fraudsters registered accounts with the names mimicking the real app — Messanger, Meseenger, Masssengar, and etc. — and used Facebook Messenger official logo as their profile picture.
Image 1 Facebook ad promoting a Facebook Messenger update
To facilitate the moderation process in Facebook and bypass its scam filters, scammers used shortened links created with the help of such services as linktr.ee, bit.ly, cutt.us, cutt.ly, and rb.gy. After clicking on the link that is supposed to lead to the download of the app’s updated version, the user finds themselves on a fake ..
Support the originator by clicking the read the rest link below.
