Researchers at WithSecure (formerly known as F-Secure Business) have published a new report detailing their discovery of a network encouraging participation in fraudulent web-based apps posing as USDT (also known as Tether) crypto-currency investment schemes.
The network consists of thousands of videos, some of which received inauthentic engagement from hundreds of YouTube channels managed by a small group of scammers using Telegram for communication and running operations. The group, which researchers estimate to have around 30 members, uses automation to copy/paste comments for the videos in an attempt to legitimise the fraudulent apps to potential victims.
While the researchers found over 700 URLs hosting these fraudulent web apps served by the network, an analysis of associated crypto-currency wallets implicated the possible involvement of thousands more.
Potential investors successfully lured into participating in these scams would transfer money from an existing crypto-currency wallet to one of the apps. However, the researchers did not observe any transfers from the apps back to the wallets.
“This network seems to be targeting existing crypto-currency investors with low quality videos in different languages without localising them to reach different regions, so I’d say it’s a pretty opportunistic approach,” said WithSecure Intelligence Researcher Andy Patel. “Typically, this results in a large volume of small transactions. But as that volume increases, so do the odds of them getting lucky and finding someone able and willing to invest more substantial amounts.”
Crypto-currency scams aimed at defrauding potential investors have become a significant problem on the internet, particularly social media. According to the US Federal Trade Commission, 46 000 people have reported losing over a billion USD in crypto to scams between the beginning of 2021 and June 2022, with nearly half saying it started on a social media platform.*
Based strictly on the data WithSecure researchers collected during the latter half of 2022, they estimate the fraudulent apps they discovered were able to generate just over 100 000 USD in revenue from approximately 900 victims.
“I do not believe these particular scams are very profitable. However, they’ve clearly figured out how to game YouTube’s recommendation algorithms by using a fairly straightforward approach,” explained Patel. “Moderating social media content is a huge challenge for platforms, but the successful amplification of this content using pretty simple, well-known techniques makes me think that more could be done to protect people from these scams.”
The report, Analysis of YouTube USDT crypto scams, details the anatomy of the videos and apps behind these scams, analyses two associated scam apps in detail, explores the #usdtmining YouTube hashtag, describes the blockchain analysis methodology used on crypto wallets associated with the scams and presents recommendations for YouTube.
The full report is now available at https://labs.withsecure.com/publications/usdt-crypto-scams.
Share
WithSecure
WithSecure™, formerly F-Secure Business, is cyber security's reliable partner. IT service providers, MSSPs and businesses – along with the largest financial institutions, manufacturers, and thousands of the world's most advanced communications and technology providers – trust us for outcome-based cyber security that protects and enables their operations. Our AI-driven protection secures endpoints and cloud collaboration, and our intelligent detection and response are powered by experts who identify business risks by proactively hunting for threats and confronting live attacks. Our consultants partner with enterprises and tech challengers to build resilience through evidence-based security advice. With more than 30 years of experience in building technology that meets business objectives, we've built our portfolio to grow with our partners through flexible commercial models.
WithSecure™ Corporation was founded in 1988, and is listed on NASDAQ OMX Helsinki Ltd.