Spotting Crypto Scams Using Pyramid Schemes

Once upon a time, in the realm of digital finance, a group of cunning researchers from Unit 42 stumbled upon an insidious plot. This tale unravels a grand scheme in which thousands of counterfeit cryptocurrency investment platforms were scattered across the vast expanse of the internet, infiltrating both websites and mobile applications. Herein lies the narrative of how these crafty villains meticulously crafted, marketed, and possibly reaped rewards from these deceptions, employing a variety of tactics to ensnare unsuspecting victims and revealing the sheer magnitude of their operation.

Image may be NSFW.
Clik here to view.

In this treacherous campaign, the rogues cleverly disguised themselves as reputable brands, well-established cryptocurrency platforms, and even prominent organisations, all to entice their prey. The uniform appearance of these websites and apps hinted at a sophisticated toolkit employed to churn out these scams en masse.

As our story unfolds, evidence begins to mount, suggesting that a single villain masterminded these nefarious activities. The plot thickens with the discovery that many domains were consistently registered in Singapore, often utilising registrars known for their lax policies and showcasing repetitive patterns of fictitious registrant names. These domains further concealed their whereabouts by using complimentary HTTPS certificates and domain fronting through a popular public cloud service.

Image may be NSFW.
Clik here to view.

The targets of this digital deceit were primarily found in the East African and Asian regions. Here, the scammers built sizable communities on Telegram channels and groups to engage with their victims. They baited users with promises of impossibly high returns on investments, operating much like Ponzi schemes by urging participants to bring in more recruits through multi-level affiliate programs.

But fear not, for those aligned with Palo Alto Networks find solace in this tale. The threats woven into this narrative are thwarted by the protective embrace of their Next-Generation Firewall’s Advanced WildFire, Advanced URL Filtering, and Advanced DNS Security subscriptions. Thus, the story concludes with a glimmer of hope for those shielded by such vigilant guardianship.

In a recent investigation, the diligent researchers at Unit 42 stumbled upon a clandestine operation responsible for fabricating a multitude of fraudulent crypto investment platforms. These deceptive platforms have cunningly infiltrated the digital realm, finding their way into both websites and mobile applications. Our tale unveils the meticulous methods by which these cyber villains craft, market, and potentially profit from this elaborate web of investment deceptions.

The reach of these scam platforms extends far and wide, accessible through online portals and Android-based apps. Each platform’s website conveniently hosts a link to its corresponding mobile application. However, these apps remain conspicuously absent from official app stores, likely as a strategy to dodge detection and avoid being shut down by authorities.

A particularly insidious tactic employed by these platforms is fraudulent impersonation. They artfully adopt themes that resonate with the public—be it a renowned brand, a prestigious organization, a famous location, or even a current trending event. This ruse is designed to ensnare unsuspecting victims, coaxing them into signing up and investing, only to fall prey to their deceit.

Image may be NSFW.
Clik here to view.

The analysis uncovered a staggering array of impersonations by these threat actors. They masquerade as an assortment of familiar entities, including:

– Prominent banks
– Popular retail chains
– Leading technology firms
– Prestigious luxury brands
– Well-known e-commerce platforms
– Established cryptocurrency exchanges

In total, we identified over 50 distinct themes that were hijacked across these deceitful sites. For illustrative examples, one may refer to Figure 1 within the article. Moreover, these platforms don’t shy away from leveraging major global events—such as the much-anticipated Paris 2024 Olympics—to draw in more unsuspecting users. A comprehensive list of the hostnames associated with these fraudulent websites can be found in the Indicators of Compromise (IoC) section located at the conclusion of our narrative.

Image may be NSFW.
Clik here to view.
In the world of online investment platforms, there are tales spun with promises of riches that seem almost too good to be true. These platforms have a knack for enticing potential investors, luring them in with the siren song of remarkably high returns on their initial investments. Picture this: a moment from one such platform, presenting an enticing offer—a daily return on investment for all to see. Imagine being drawn in by the allure of the “VIP1” package, which boasts a daily profit of $3 on just an $11 principal. It sounds incredible, doesn’t it? A daily return on investment (ROI) of 27% that, compounded over time, promises an annual ROI soaring to at least 2,650%. Such numbers defy belief and should immediately set alarm bells ringing.

Image may be NSFW.
Clik here to view.

But how do these platforms justify such extraordinary claims? They weave intricate stories to make their high-return promises seem legitimate. Here, we find a note detailing the invention of an AI-powered intelligent bot. This bot is said to harness the magic of arbitrage, deftly trading across various crypto marketplaces to generate profits. It’s a story crafted to captivate and convince.

Yet, beneath these tales lies a darker narrative—one that bears the hallmarks of a classic Ponzi scheme. Each platform unveils a multi-layered affiliate program, a website where affiliates earn commissions by recruiting new members through special invitation links or codes.

As you navigate these enticing stories and captivating figures, remember to tread carefully. For beneath the veneer of legitimacy, these tales often conceal a far more sinister reality.

In affiliate marketing, the commission system operates on a tiered basis. At the top of this structure, the highest rewards are reserved for those who directly bring in recruits. These first-level recruits are signed up by the affiliates themselves, who enjoy the most substantial commissions. As one moves further down the hierarchy, the commissions become less generous. This happens when those initially recruited transform into affiliates themselves, bringing in their own recruits and thus continuing the cycle.

Such a setup bears a striking resemblance to what is commonly known as a pyramid scheme. In these schemes, earnings largely depend on the recruitment of new members rather than any real investment in products or business endeavours. It’s suspected that these affiliates take full advantage of social media’s vast reach to spread the word about these schemes, as we shall explore further.

Enter the realm of video-sharing platforms, where these dubious enterprises find fertile ground for promotion. In each clip, viewers are met with an invitation link or an affiliate code, which heavily implies that the vloggers behind these videos hold positions as top-tier affiliates, profiting from their recruitment efforts.

The potential influence of such scam platforms is significant, driven by their extensive user base. The actual scope of their popularity is often reflected in the membership figures of their related Telegram channels. Many of these channels boast memberships in the tens of thousands.

The Telegram channel has amassed over 29,000 members and is linked to a fraudulent crypto investment site known as nmxquantify[.]com.

Image may be NSFW.
Clik here to view.
In the realm of digital espionage, our telemetry data unveiled a shadowy group of threat actors focusing their malevolent efforts on unsuspecting internet users scattered across the vibrant landscapes of East Africa and the bustling territories of Asia. This revelation was further bolstered by our painstaking manual review of numerous videos, which revealed that a majority of content creators had honed their craft to captivate audiences hailing from these specific regions.

Enter the notorious Scam Toolkit—a digital Pandora’s box. Upon dissecting a multitude of websites, we uncovered striking resemblances, pointing to the handiwork of a singular scam toolkit designed for mass production. This ingenious piece of software seemingly requires only rudimentary inputs, such as brand names and images, to churn out both websites and mobile applications with remarkable efficiency.

As we delved deeper into the web design, a pattern emerged—a consistent layout adorned each site. A slideshow invariably graced the top of each homepage, followed by a tempting array of investment opportunities. Below lay an assortment of buttons, serving as gateways to company profiles, mobile apps, wallet recharges, and avenues for money withdrawal.

Image may be NSFW.
Clik here to view.

The mystery didn’t end there. The sleuthing uncovered shared structural elements within the HTML framework of these sites—precisely, the ubiquitous Document Object Model (DOM) element tagged as data-v-*. This pointed us towards a familiar front-end JavaScript framework known as Vue.js, which had become a topic of discussion in tech circles like Stack Overflow.

Turning our attention to mobile applications, we discovered that all scrutinised apps were crafted for Android devices. Each app ingeniously incorporated the original website via a web view—a clever move likely intended to minimise development efforts for the creators of this elusive scam toolkit.

Yet, a question lingered in the air—why distribute these mobile apps? While the purpose remained shrouded in ambiguity, the apps themselves raised eyebrows with their demands for sensitive permissions such as Android. Permission.READ_EXTERNAL_STORAGE and Android. permissionCAMERA. The necessity of these permissions for mere web view apps seemed dubious at best. Though the potential for misuse was apparent, our investigation uncovered no tangible evidence of such nefarious activity.

Thus unfolds the tale—a narrative woven with intrigue and deception in the digital age, where every click could lead deeper into the labyrinthine world of cyber threats.

Image may be NSFW.
Clik here to view.

Once upon a time, in the vast realm of the internet, there existed a peculiar phenomenon involving mobile applications on various websites. These apps adhered to a particular naming pattern that mirrored the platform’s website name. On each platform that was examined, the location of these applications followed a distinct format: API.[name].[tld]/[name].apk.

Take, for instance, the curious case of a platform known as teslamall66[.]vip. The app associated with this site could be found nestled at hxxps[:]//API.teslamall66[.]vip/teslamall66.apk. Such consistent and notable similarities in the design of these deceptive crypto websites and their accompanying mobile apps strongly suggested the presence of a toolkit designed to produce these sites on a grand scale. The following chapter delves into the intriguing possibility that a singular, shadowy figure might be orchestrating this entire operation.

The question lingered: Was there a lone mastermind behind this elaborate campaign? There was a noticeable surge in the registration of new domains beginning in June 2024. With a bit of detective work, the team estimated the dates when these domains were first registered by examining passive DNS records, as WHOIS records for most domains were unavailable during the investigation.

Image may be NSFW.
Clik here to view.

There was an upward trend in domain registrations from June to December 2024, bearing the logos of Palo Alto Networks and Unit 42 as a testament to their investigative prowess. The daily number of newly registered domains between June 6, 2024, and December 31, 2024: on average, about 15 domains sprang into existence each day. Moreover, the majority of these domains (82%) found their origins in Singapore, utilising registrars known for their lenient registration policies. This was evident from the fictitious names used during registration, such as “Sophia” (14%), “Abe” (4%), and “Sophie” (3%). The continuous stream of new domain registrations and the repeated use of fabricated names hinted at an automated process for domain creation.

Interestingly, the enigmatic threat actor also secured a few domains through reputable registrars, employing paid privacy services to cloak the true identity of the registrants. Like many other malicious sites, these deceitful crypto websites took advantage of free HTTPS certificates—digital credentials that safeguarded website traffic through encryption.

And so, the story continued, unravelling the intricate web woven by an unseen hand in the digital shadows.

In the bustling world of cybersecurity, Palo Alto Networks stands as a vigilant guardian, offering its clientele exceptional protection against the digital threats highlighted in this narrative. This formidable defencee is achieved through their cutting-edge Next-Generation Firewall, which is bolstered by Advanced WildFire, Advanced URL Filtering, and Advanced DNS Security subscriptions.

Image may be NSFW.
Clik here to view.

Imagine, if you will, a scenario where you’ve encountered a potential breach or face an urgent cybersecurity issue. Fear not, for the dedicated Unit 42 Incident Response team is but a call away. Reach out to them at:

Image may be NSFW.
Clik here to view.

– In North America, simply dial the toll-free number +1 (866) 486-4842 (that’s 866.4.UNIT42).
– In the UK: connect via +44.20.3743.3660.
– Across Europe and the Middle East: reach them at +31.20.299.3130.
– In Asia: contact them through +65.6983.8730.
– For Japan: use +81.50.1790.0200.
– In Australia: call +61.2.4062.7950.
– And in India: dial 00080005045107.

Moreover, Palo Alto Networks extends its insights to fellow members of the Cyber Threat Alliance (CTA). This collaboration enables CTA members to swiftly implement protective measures for their clients and systematically thwart malevolent cyber actors. Further exploration is encouraged to delve deeper into the workings of the Cyber Threat Alliance.

As you navigate the intricate realm of cybersecurity, know that Palo Alto Networks is committed to safeguarding your digital journey with unwavering diligence and expertise.

Secure browsing

When it comes to staying safe online, using a secure and private browser is crucial. Such a browser can help protect your personal information and keep you safe from cyber threats. One option that offers these features is the Maxthon Browser, which is available for free. It comes with built-in Adblock and anti-tracking software to enhance your browsing privacy.

Maxthon browser Windows 11 support

Maxthon Browser is dedicated to providing a secure and private browsing experience for its users. With a strong focus on privacy and security, Maxthon employs strict measures to safeguard user data and online activities from potential threats. The browser utilises advanced encryption protocols to ensure that user information remains protected during internet sessions.

Image may be NSFW.
Clik here to view.

In addition, Maxthon implements features such as ad blockers, anti-tracking tools, and incognito mode to enhance users’ privacy. By blocking unwanted ads and preventing tracking, the browser helps maintain a secure environment for online activities. Furthermore, incognito mode enables users to browse the web without leaving any trace of their history or activity on the device.

Maxthon’s commitment to prioritising the privacy and security of its users is exemplified through regular updates and security enhancements. These updates are designed to address emerging vulnerabilities and ensure that the browser maintains its reputation as a safe and reliable option for those seeking a private browsing experience. Overall, Maxthon Browser offers a comprehensive set of tools and features aimed at delivering a secure and private browsing experience.

Maxthon Browser, a free web browser, offers users a secure and private browsing experience with its built-in Adblock and anti-tracking software. These features help to protect users from intrusive ads and prevent websites from tracking their online activities. The browser’s Adblock functionality blocks annoying pop-ups and banners, allowing for an uninterrupted browsing session. Additionally, the anti-tracking software safeguards user privacy by preventing websites from collecting personal data without consent.

By utilising Maxthon Browser, users can browse the internet confidently, knowing that their online activities are shielded from prying eyes. The integrated security features alleviate concerns about potential privacy breaches and ensure a safer browsing environment. Furthermore, the browser’s user-friendly interface makes it easy for individuals to customise their privacy settings according to their preferences.

Maxthon Browser not only delivers a seamless browsing experience but also prioritises the privacy and security of its users through its efficient ad-blocking and anti-tracking capabilities. With these protective measures in place, users can enjoy the internet while feeling reassured about their online privacy. Using a secure browser like Maxthon can provide a sense of security in an otherwise uncertain digital landscape.

In addition, the desktop version of Maxthon Browser works seamlessly with their VPN, providing an extra layer of security. By using this browser, you can minimise the risk of encountering online threats and enjoy a safer internet experience. With its combination of security features, Maxthon Browser aims to provide users with peace of mind while they browse.

Maxthon Browser stands out as a reliable choice for users who prioritise privacy and security. With its robust encryption measures and extensive privacy settings, it offers a secure browsing experience that gives users peace of mind. The browser’s commitment to protecting user data and preventing unauthorised access sets it apart in the competitive web browser market.