Scammers have duped Indian investors to the tune of $130 million, by luring them to invest in fake crypto exchanges using techniques like phishing and identity thefts spread through social media, according to a report.
According to an investigation conducted by cyber security firm CloudSEK, malicious schemes involving multiple payment gateway domains and Android-based applications have been used to lure unsuspecting individuals into a “mass gambling scam.”
How the scam works
The report states that the scam, divided into seven phases, starts with threat actors creating multiple fake domains impersonating crypto trading platforms with the word “CloudEgg” in them.
CoinEgg is a crypto exchange based in the UK, offering trading services for digital cryptocurrency assets.
“The sites are designed to replicate the official website’s dashboard and user experience,” the company said.
The attackers then create a female profile on social media to approach a victim and forge a friendship. The victims are then influenced into investing in cryptos and start trading.
"The profile also shares $100 credit, as a gift to a particular crypto exchange, which in this case is a duplicate of a legitimate crypto exchange," the report states.
Initial significant profits bolster the victim’s morale into investing bigger amounts, with promises of higher returns.
Once the victim adds their own money to the fake crypto exchange, their accounts are frozen and the victim cannot withdraw their funds.
Further, when victims take to social media to complain about losing their money, the same or new threat actors reach out to them under the guise of investigators.
"To retrieve the frozen assets, they request victims to provide confidential information such as ID cards and bank details, via email. These details are then used to perpetrate other nefarious activities," the report warned.
Investors should trade after confirming legitimacy of websites
Rahul Sasi, CEO of CloudSEK said investors should only trade after installing the exchange's official app from Playstore or Appstore and only after confirming the legitimacy of the official websites by verifying their social media accounts should they make an investment.
“In the long run, it is crucial for cryptocurrency exchanges, Internet service providers (ISPs), and cybercrime cells to work together to spread awareness and combat danger groups,” he said.
