Traffic Broker Uses Localized Brand-Themed Lures to Funnel Users to Scams
Summary
Researchers identified a traffic-broker operation using hundreds of short-lived, localized promotional sites that impersonate familiar brands to attract mobile users and route traffic to downstream scams, including pig-butchering schemes and Telegram account hacking.
Key points
- The infrastructure uses hundreds of short-lived sites on disposable domains, including .xyz, .top, and .cn.
- Researchers identified more than 300 impersonated brands across 100 countries; the brands serve as lures, not necessarily as campaign targets.
- Promotional pages are localized by language, region, holidays, and local events to appear credible and urgent.
- The phishing kit filters visitors based on their platform and browser-window dimensions, potentially limiting what URL-scanning engines can observe.
- Researchers say mobile messaging apps such as WhatsApp, Telegram, and Messenger are used to distribute the lures.
- The broker monetizes and routes collected traffic to downstream actors, with reported destinations including pig-butchering scams and Telegram account hacking.
Article Details
- Attack Vectors
- Localized promotional and giveaway-themed phishing lures impersonate familiar brands to attract users and increase engagement.
- Mobile messaging platforms, including WhatsApp, Telegram, and Messenger, are reported to disseminate the campaign.
- The phishing pages check the visitor's platform and window dimensions to filter out non-mobile users, making some URL scanning engines ineffective.
- Victim traffic is harvested, profiled, monetized, and routed to downstream actors, with redirects to pig-butchering scams or Telegram account hacking.
Products
Messengerenables us to confidently conclude that mobile-based messaging platforms like WhatsApp, Telegram, and Messenger actively disseminate this campaign.Telegramis then routed to downstream threat actors, and finally redirecting them to the pig butchering scams or Telegram account hacking.WhatsAppineffective. This behavior enables us to confidently conclude that mobile-based messaging platforms like WhatsApp, Telegram, and Messenger actively disseminate this campaign.
Countries
IndiaIndia & South Asia: Most heavily targeted with lures themed around Republic Day, Independence Day, and government subsidies, localized across major Indian languages and abusing brands like Paytm, PhonePe, GPay, SBI,IranMiddle East & Iran: Lures closely aligned with Islamic holidays like Ramadan and Eid, impersonating Digikala, Snapp!, Qatar Airways, and regional banks, delivered in Persian, Arabic, and Urdu.MaldivesSri Lanka & Maldives: Campaigns centered on Independence Day narratives, telecom rewards, and national banks, impersonating brands such as Dialog, SLTMobitel, SriLankan Airlines, and Dhiraagu in Tamil, Sinhala, andSri LankaSri Lanka & Maldives: Campaigns centered on Independence Day narratives, telecom rewards, and national banks, impersonating brands such as Dialog, SLTMobitel, SriLankan Airlines, and Dhiraagu in Tamil, Sinhala, and
Industries
Airlinesreference well-known local and international organizations across banking, telecommunications, retail, airlines, utilities, and digital payment ecosystems. Importantly, the brands observed are not the end targetsBankingsites leverage brand-themed lures that reference well-known local and international organizations across banking, telecommunications, retail, airlines, utilities, and digital payment ecosystems. Importantly, the brandsDigital paymentsRetaillures that reference well-known local and international organizations across banking, telecommunications, retail, airlines, utilities, and digital payment ecosystems. Importantly, the brands observed are not the endTelecommunicationsbrand-themed lures that reference well-known local and international organizations across banking, telecommunications, retail, airlines, utilities, and digital payment ecosystems. Importantly, the brands observed areUtilitieswell-known local and international organizations across banking, telecommunications, retail, airlines, utilities, and digital payment ecosystems. Importantly, the brands observed are not the end targets themselves but