Full Report
Behind the scenes of targeted scams
Analysis Summary
# Tool/Technique: Targeted Survey & Giveaway Scams (Classiscam Evolution)
## Overview
This technique involves highly personalized, multi-stage fraudulent schemes that leverage the reputation of well-known brands to deceive users. Unlike broad "spray and pray" phishing, these targeted scams utilize redirection chains, device fingerprinting, and social engineering (surveys, fake job offers, or VPN upgrades) to steal financial credentials or personal data.
## Technical Details
- **Type:** Technique / Fraud-as-a-Service (FaaS) Infrastructure
- **Platform:** Web-based (Cross-platform: Windows, Android, iOS)
- **Capabilities:** Device fingerprinting, geo-fencing, automated content generation, C2 integration for data exfiltration, and brand impersonation.
- **First Seen:** Variations have been active for years, with significant evolution in automated "Classiscam" kits noted since 2019-2020.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (Distributed via social media, SMS, or compromised accounts)
- **[TA0007 - Discovery]**
- **[T1082 - System Information Discovery]** (Fingerprinting browser and OS to deliver specific payloads)
- **[TA0011 - Command and Control]**
- **[T1071.001 - Application Layer Protocol: Web Protocols]** (Use of HTTPS for exfiltrating victim data)
- **[TA0006 - Credential Access]**
- **[T1556 - Modify Authentication Process]** (Fake login portals and payment gateways)
## Functionality
### Core Capabilities
- **Brand Hijacking:** Automated generation of landing pages using logos and styling of trusted brands (Apple, Samsung, major banks, or logistics companies).
- **Social Engineering Bait:** Use of surveys, "prizes," and fake job offers to incentivize user engagement.
- **Data Harvesting:** Forms designed to collect PII (Personally Identifiable Information) and full credit card details (PAN, CVV, Expiry).
### Advanced Features
- **Traffic Filtering (TDS):** Traffic Direction Systems ensure only valid victims (based on IP or device type) see the scam, while researchers or bots are redirected to benign sites.
- **Account Takeover (ATO) Automation:** Stolen credentials are used to compromise legitimate accounts, which are then used to propagate the scam to the victim's contacts.
- **Evasive Redirection:** Multiple hops through compromised sites or URL shorteners to bypass automated security filters.
## Indicators of Compromise
- **File Names:** `vpn_upgrade.apk` (example for Android-based baits), `survey_rewards.html`.
- **Network Indicators:**
- `free-gift-promo[.]online`
- `update-vpn-security[.]com`
- `survey-rewards-winner[.]top`
- *(Note: These are representative examples of the domain naming conventions used by these actors).*
- **Behavioral Indicators:** High frequency of redirects within a single browser session; scripts executing `navigator.userAgent` checks immediately upon page load.
## Associated Threat Actors
- **Classiscam groups** (Large-scale organized fraud affiliates).
- Various unnamed cybercrime syndicates specializing in Brand Abuse and Digital Risk.
## Detection Methods
- **Signature-based detection:** Scanning for specific HTML patterns or scripts used in known scam kits.
- **Behavioral detection:** Identifying rapid URL redirections and the presence of "anti-debugging" scripts that hide content from non-mobile user agents.
- **YARA rules:** Targeting specific strings found in fraud kits, such as unique variable names in the payment processing JavaScript.
## Mitigation Strategies
- **Prevention measures:** Implement DRP (Digital Risk Protection) to monitor for domain typosquatting and unauthorized brand use.
- **Hardening recommendations:**
- For users: Enable Multi-Factor Authentication (MFA) on all accounts and use virtual cards with transaction limits.
- For brands: Implement DMARC/SPF/DKIM to prevent email spoofing and monitor social media for fraudulent advertisements.
## Related Tools/Techniques
- **Classiscam:** The automated Telegram-based bot system for creating scam pages.
- **Typosquatting:** Registering domains similar to legitimate brands.
- **Smishing:** Delivering these targeted links via SMS.