DFRLab
Published in

DFRLab

Scammers use WhatsApp chain message about COVID-19 and fake profiles to harvest personal data in South Africa

Hong Kong-based marketing firm breathed new life into a tired “free voucher” scam by making it coronavirus-related

(Source:@jean_leroux/DFRLab)

The website

A screengrab of the WhatsApp message linking to the dubious website, indicating the deceptive logo and URL. (Source: @jean_leroux/DFRLab)
A screengrab from the source code of the page revealing the functions called when clicking the buttons. Clicking the “WhatsApp” button (red) pre-drafted a WhatsApp message to be forwarded to several contacts, whereas the “Continue” button (purple) would check if the post was shared enough before allowing a user to click through to www.sa-rewards.co.za. A third function (blue) was unused, and seems to be from a version of the site that used SMS messages. (Source: @jean_leroux/DFRLab)
A schematic representation of the flow of the campaign. (Source: @jean_leroux/DFRLab via Draw.io)
A screengrab from the source code of the www.sa-rewards.co.za website indicating that the site changed its display text to one of three grocery chains depending on the link you used to access it. (Source:@jean_leroux/DFRLab via SA-rewards.co.za)
Screengrabs from the www.woolworths.co.za-grocery.store website (left) imitating a Facebook comments section, and the accompanying source code (right). Note that these comments were hard-coded, and the profile pictures sourced programmatically from a website that generates fake profiles. (Source: @jean_leroux/DFRLab)
A reverse image search conducted on some of the profile pictures used by the fabricated Facebook comments section revealed that the same pictures saw extensive use. Multiple Twitter, Medium, WordPress and dating site accounts were found using these profile pictures. (Source: @jean_leroux/DFRLab)

--

--

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.