Full Report
A deep dive into Classiscam: automated scam as a service designed to steal money and payment data
Analysis Summary
# Tool/Technique: Classiscam
## Overview
Classiscam is a sophisticated, non-conventional "Scam-as-a-Service" operation. It utilizes an automated platform—primarily managed via Telegram bots—to orchestrate large-scale phishing campaigns. Its purpose is to automate the theft of funds and payment card data from users of classifieds, delivery services, and rental platforms by generating localized fraudulent pages on the fly.
## Technical Details
- **Type**: Scam-as-a-Service (SaaS) / Phishing Framework
- **Platform**: Web-based (cross-platform), managed via Telegram
- **Capabilities**: Automated phishing page generation, real-time balance checking, OTP (One-Time Password) interception, and multi-lingual localization.
- **First Seen**: Approximately 2019 (gained significant traction in 2020-2021).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.003 - Phishing: Spearphishing Service]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery] (Scanning for brand assets)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel] (Stealing card data via Telegram bots)
- **[TA0042 - Resource Development]**
- [T1583.001 - Establish Accounts: Social Media Accounts]
- [T1584.001 - Compromise Infrastructure: Domains]
## Functionality
### Core Capabilities
- **Automated Page Generation**: Scammers use Telegram bots to input a product link from a legitimate site (e.g., eBay, Leboncoin). The bot generates a unique, localized phishing URL that mimics the legitimate platform's layout.
- **Payment Processing Emulation**: The tool creates fake "payment" or "refund" forms to harvest Credit Card Numbers (PANs), CVV codes, and expiration dates.
- **Communication Management**: Provides templates for "workers" to lure victims from official platform chats to external messengers (WhatsApp, Telegram).
### Advanced Features
- **OTP Interception**: Real-time interaction allows scammers to prompt victims for 2FA/OTP codes while they are on the phishing site, enabling immediate unauthorized transactions.
- **Balance Checking**: Some variants include scripts to verify the victim's bank account balance to ensure the transaction will go through.
- **Worker Hierarchy & Payouts**: The framework includes an administrative back-end to track the success of "workers" and automatically distribute stolen funds (minus a commission for the developers/admins).
## Indicators of Compromise
- **File Hashes**: *N/A (Primarily cloud/script-based infrastructure)*
- **File Names**: *N/A*
- **Network Indicators**:
- `t[.]me/` (Specific Telegram bot handlers used for generation)
- `dhl-traking[.]com` (Defanged example)
- `olx-delivery[.]site` (Defanged example)
- `ebay-payment[.]info` (Defanged example)
- **Behavioral Indicators**:
- Immediate redirection from official marketplace chats to WhatsApp/Telegram.
- Presence of "Customer Support" chat windows on suspicious payment pages that ask for bank balances.
## Associated Threat Actors
- **Classiscam Groups**: A decentralized network of "Workers," "Callers," and "Admins." These groups are often Russian-speaking but operate globally across Europe, APAC, and the Middle East.
## Detection Methods
- **Signature-based detection**: Tracking known fraudulent domain naming conventions (e.g., appending "-delivery" or "-pay" to legitimate brand names).
- **Behavioral detection**: Identifying the use of automated Telegram API calls for creating web forms and exfiltrating data.
- **AI-Driven Monitoring**: Utilizing Digital Risk Protection (DRP) to scan for newly registered domains using brand keywords and trademarked logos.
## Mitigation Strategies
- **For Brands**: Proactive monitoring of underground forums and Telegram channels for brand mentions; rapid takedown of fraudulent domains.
- **For Users**:
- Never move communication outside the official platform’s chat system.
- Verify URLs using WHOIS tools; new domains (less than 6 months old) are high-risk.
- Use Virtual Cards with spending limits for online marketplaces.
## Related Tools/Techniques
- **Telekopye**: A similar Telegram-based toolkit for scamming.
- **Vishing**: Often used in conjunction with Classiscam to "verify" transactions over the phone.
- **OTP Bypass Bots**: Specialized tools integrated into the scam workflow to automate the collection of 2FA codes.