Full Report
Scams like Classiscam automate fake websites to steal financial data, exploiting digitalization’s rise in developing countries, making fraud both effective and hard to detect. In this blog, we dissect the inner working of the scam and its prevalence in Central Asia.
Analysis Summary
# Tool/Technique: Classiscam
## Overview
Classiscam is a sophisticated Scam-as-a-Service (SaaS) affiliate program that automates the creation of phishing websites. Its primary purpose is to steal financial data and PII from users of classified advertisement platforms, logistics services, and marketplaces. The framework leverages Telegram bots to streamline the operations of "workers" (low-level scammers), making high-volume fraud accessible to individuals with minimal technical skills.
## Technical Details
- **Type:** Scam-as-a-Service Framework / Phishing Automation Tool
- **Platform:** Web-based (cross-platform), typically targeting mobile users via social engineering and messaging apps.
- **Capabilities:** Automated phishing page generation, Telegram-based C2 and notifications, real-time balance checking, and bypass of 3D Secure protocols.
- **First Seen:** Approximately 2019; significantly expanded into Central Asia (Kazakhstan, Uzbekistan) by 2023.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning (used by bots to identify targets)]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel (Data sent via Telegram bots)]
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication (Telegram API)]
## Functionality
### Core Capabilities
- **Automated Phishing Generation:** Users can generate unique phishing URLs through Telegram bots by simply providing a link to a legitimate marketplace listing.
- **Marketplace Impersonation:** Templates mimic popular local brands in Central Asia (e.g., OLX, CDEK, and national postal services).
- **Payment Interception:** Phishing pages include forms for credit card details (PAN, expiry, CVV) that transmit data in real-time to the attacker.
### Advanced Features
- **OTP/3D Secure Bypass:** The framework includes modules to prompt victims for One-Time Passwords (OTP) in real-time, allowing attackers to authorize fraudulent transactions immediately.
- **Telegram C2 Integration:** Administrative bots manage "mammoths" (victims), track successful "logs" (stolen data), and handle the distribution of profits to affiliates.
- **Geo-fencing/Anti-Analysis:** Some variants redirect users based on IP address to prevent analysis by security researchers outside the target region.
## Indicators of Compromise
- **File Hashes:** N/A (Web-based/Server-side scripts)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- `t[.]me/Classiscam_bot` (and various iterations)
- Phishing domains often use keywords: `delivery-pay[.]info`, `olx-dostavka[.]kz`, `post-kz[.]top`, `uz-post[.]com` (Note: These are defanged examples).
- **Behavioral Indicators:**
- Communications shifting from official marketplace platforms to Telegram or WhatsApp.
- Redirects to domains that look like official delivery services but contain typos or unusual TLDs (.top, .info, .site).
## Associated Threat Actors
- **Classiscam Affiliates:** A decentralized network of thousands of "workers" managed by "admins" (developers and money handlers).
## Detection Methods
- **Signature-based detection:** Monitoring for known Classiscam phishing URL patterns and HTML snippets unique to the framework's templates.
- **Behavioral detection:** Identifying rapid redirections from social media apps to newly registered domains (less than 30 days old) containing financial keywords.
- **YARA rules:** Detection of specific strings within the HTML source code of phishing pages, such as common variable names used in the Classiscam admin panels.
## Mitigation Strategies
- **Prevention measures:** Implement DMARC/SPF/DKIM to prevent email spoofing and use web filters to block newly registered domains.
- **Hardening recommendations:** Use official marketplace messaging systems; avoid third-party messengers for transactions. Encourage the use of virtual cards with spending limits for online shopping.
- **User Awareness:** Educate users that legitimate platforms will never require a CVV to *receive* a payment.
## Related Tools/Techniques
- **Telekopye:** A similar Telegram-based toolkit targeting European marketplaces.
- **Robin Banks:** A phishing framework used for large-scale financial credential theft.
- **Social Engineering:** The primary delivery mechanism for the phishing links.