20 April 2021

Critical update: Facebook Messenger users hit by scammers in over 80 states

Group-IB, a global threat hunting and adversary-centric cyber intelligence company that specializes in investigating and preventing hi-tech cybercrimes, has detected a large-scale scam campaign targeting Facebook Messenger users all over the world. Group-IB Digital Risk Protection (DRP) analysts have found evidence proving that users in over 80 countries in Europe, Asia, the MEA region, North and South America might have been affected. By distributing ads promoting an allegedly updated version of Facebook Messenger, cybercriminals harvested users’ login credentials. Group-IB’s DRP analysts have discovered nearly 1,000 fake Facebook profiles employed in the scheme. Upon the discovery of this type of fraud, Group-IB informed the social network, which has nothing to do with the fake posts, of the ongoing campaign.

It is noteworthy that this scam first came into the spotlight of Group-IB DRP in the summer of 2020, with DRP analysts based in different regions — Asia and Europe — having detected traces of the same fraudulent campaign. Since then it has been growing progressively in scope. In April, the number of Facebook posts inviting users to install “the latest Messenger update” reached 5,700. To draw users’ attention, fraudsters registered accounts with the names mimicking the real app — Messanger, Meseenger, Masssengar, and etc. — and used Facebook Messenger official logo as their profile picture.

Image 1 Facebook ad promoting a Facebook Messenger update

To facilitate the moderation process in Facebook and bypass its scam filters, scammers used shortened links created with the help of such services as linktr.ee, bit.ly, cutt.us, cutt.ly, and rb.gy. After clicking on the link that is supposed to lead to the download of the app’s updated version, the user finds themselves on a fake Facebook Messenger website with a login form, where they’re asked to enter their credentials. Scammers used such platforms as blogspot.com, sites.google.com, github.io, and godaddysites.com to register fake Facebook Messenger login pages.

In order to excite users and make them follow the link, scammers endowed the app with some non-existent features like the possibility to find out who visited one’s profile and see the messages that were deleted or even offered to shift to Gold Messenger. Scammers even used blackmailing to force users into downloading the app and pressured the latter with threats that if they didn’t sign up on the fake page, their account would be banned forever.

Group-IB’s DRP analysts have found scam ads targeted at users in at least 84 countries worldwide, including Canada, the United States, France, Germany, Italy, Singapore, Malaysia, and South Africa. Users who fell victim to this scheme risk leaking their personal data and have their account hijacked. Scammers, in turn, are likely to use the compromised account to either blackmail the victim, pushing them to pay a ransom to have access to their account restored, or further scale up the scheme using the Facebook profile to distribute scam ads.

Internet has made people abandon critical thinking. Living in the era of instant-everything, clicking on an attractive ad, proposal, headline became a natural human reflex. This didn’t come unnoticed by fraudsters who have been relentlessly feeding on users’ carelessness. It is up to brands to set things straight in this endless stand-off by ensuring that their name isn’t used to trick unsuspecting customers into a scam, with digital risk protection services serving as a silver bullet in this case.

Dmitriy Tiunkin

Dmitriy Tiunkin

Head of Digital Risk Protection Europe at Group-IB

Group-IB calls on users to stay vigilant and follow some basic cyber hygiene rules that will help avoid getting into cybercriminals’ trap. One should always be cautious while following shortened links and raise a red flag if it leads to a poll or one-page blog. Never enter any personal data on websites to which you got from third-party resources even if they have logos of well-known brands. Enter your login credentials only on social network/service official website or official app. It is also worth paying attention to the domain of the page you visit — fraudsters often register domain names misspelling brand names, as it was the case with Facebook Messenger.

Group-IB is one of the leading providers of solutions dedicated to detecting and preventing cyberattacks, identifying online fraud, investigation of high-tech crimes and intellectual property protection, headquartered in Singapore. The company’s threat intelligence and research centers are located in the Middle East (Dubai), the Asia-Pacific (Singapore), Europe (Amsterdam), and Russia (Moscow).

Group-IB’s Threat Intelligence & Attribution system has been named one of the best in class by Gartner, Forrester, and IDC. Group-IB’s Threat Hunting Framework (earlier known as TDS) intended for the proactive search and the protection against complex and previously unknown cyberthreats has been recognized as one of the leaders in Network Detection and Response by the leading European analyst agency KuppingerCole Analysts AG, while Group-IB itself has been recognized as a Product Leader and Innovation Leader. Gartner identified Group-IB as a Representative Vendor in Online Fraud Detection for its Fraud Hunting Platform. In addition, Group-IB was granted Frost & Sullivan’s Innovation Excellence award for its Digital Risk Protection (DRP), an Al-driven platform for identifying and mitigating digital risks and counteracting brand impersonation attacks with the company’s patented technologies at its core.

Group-IB’s technological leadership and R&D capabilities are built on the company’s 18 years of hands-on experience in cybercrime investigations worldwide and 70,000 hours of cybersecurity incident response accumulated in our leading forensic laboratory, high-tech crime investigations department, and round-the-clock CERT-GIB. Group-IB is a partner of Europol.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to fight high-tech crime while protecting our clients in cyberspace and helping them achieve their goals. To do so, we analyze cyber threats, develop our infrastructure to monitor them, respond to incidents, investigate complex high-tech crimes, and design unique technologies, solutions, and services to counteract adversaries.

Report an incident

Get 24/7 incident response assistance from our global team

APAC: +65 3159-3798
Europe: +31 20 226-90-90
EMA: +971 4 508 1605

Thank you for the inquiry! We will contact you soon.
Cookies

We use cookies on the website to make your browser experience more personal, convenient and secure. You may block or manage the use of cookies, however, in some cases they’re essential to make this site work properly. Learn more about cookies in Group-IB Privacy And Cookies Policy.

 
Report an incident