Group-IB Details Sniper Dz Scam Funnel Targeting MENA Users

Summary

Group-IB linked Sniper Dz to Facebook impersonation scams targeting MENA users. The reported funnel abuses browser notifications, history manipulation and tab-under redirects to route victims to premium-rate, SMS and investment scams.

Key points

Group-IB linked fraudulent Facebook accounts impersonating public figures, politicians and organizations to fake offers targeting users in the Middle East and North Africa.
The reported funnel routes users through link-aggregation services before directing them to phishing and monetization infrastructure.
Landing pages prompt users to allow browser notifications; researchers observed the same VAPID public key across telecom impersonation and investment scam campaigns.
Pages reportedly inject 10 fake browser-history states and use tab-under redirects to keep steering users through operator-controlled destinations.
A traffic distribution system selects among premium-rate call scams, premium SMS subscriptions and investment scams based on factors including device, location and carrier.
The article reports that Sniper Dz was taken down in an INTERPOL-led operation.

Article Details

Attack Vectors: Fraudulent Facebook accounts impersonate politicians, public figures, and trusted organizations to promote fake offers and lure users into scam funnels.
Embedded links route victims through intermediary pages on Linkbio and Linktree before sending them to phishing and monetization infrastructure.
Pages prompt users to allow browser notifications and subscribe them to a push notification system.
Pages manipulate browser history with 10 fake history states and use tab-under redirects to keep victims moving through operator-controlled destinations.
A traffic distribution system routes victims to premium-rate call scams, premium SMS subscription fraud, or investment scams based on factors including device type, location, and mobile carrier.