Researchers at the security firm F6 have identified more than 360 fraudulent domains imitating government portals and news outlets to target users in Uzbekistan, Belarus and Tajikistan with offers of state financial assistance or government-backed passive income. The campaign's mechanism is a two-stage identity harvest: sites promise payouts, in one Uzbek example weekly payments of 15 million Uzbek sums, roughly US$1,300, and ask initially for little more than a name and telephone number; once those details are submitted, scammers telephone the victim posing as a personal manager, either demanding a commission or processing fee before the money can be released, or pushing for more personal data. The more sophisticated sites imitate regional news portals and publish fabricated stories about assistance programmes before routing readers to questionnaires, and some instruct victims to install a mobile application supposedly needed to register or verify identity — an application F6 describes as malware capable of giving attackers control of the device and, potentially, of stealing money from accounts. Victims are also asked for passport scans as part of the supposed verification step, which F6 notes can then be used for further fraud including taking out loans in the victim's name, and mirrors the identity-document trade this digest has tracked through the Nexus driver-licence marketplace and the IDScan confirmation of 11 September. F6 says it has not identified the group behind the campaign and does not know how many people have fallen victim. The structural point is that the authority brand is the entire exploit: no vulnerability is required, only a facsimile of a government payout page convincing enough to elicit a passport scan from someone who believes they are owed money.

• Source article