The Anti-virus Times

Friday, April 6, 2018

Nowadays the World Wide Web is an unending stream of news. Information appears so quickly that we often just don't have time to verify its credibility. Naturally, scammers take advantage of that.

On March 29, 2018, an operational failure occurred with the messenger Telegram. Pavel Durov, the company's founder, tweeted that the disruption was caused by a power outage in a European data center.

In less than 90 minutes, pages faking Pavel Durov's Twitter account design began popping up. On behalf of Telegram's creator, the impostors offered users the opportunity to participate in a cryptocurrency lottery as a way of apologising to them. To participate, users had to transfer 0.5-5 Ethereum units to the specified wallet.

The scammers' scheme proved to be a success. In several hours they managed to collect tens of thousands of US dollars’ worth of the cryptocurrency from gullible users.

Despite the fact that news about the fake Twitter pages quickly found its way to the websites of media outlets, the scammers kept posting fake lottery announcements even the next day.

The crooks employed bots to promote their posts on Twitter. The posts were also supplemented with fake comments from users who had ostensibly received their "compensation".

Now that the dust has settled, let's take a closer look at what happened.

On the right, you can see a screenshot of the genuine Pavel Durov page and on the left one of the fakes. As you can see, the scammers' page looks like a rather crude fabrication. However, that didn't prevent the fraudsters from achieving their goal.

Account information is the first thing to give away the ruse. Looking through the profile for just a few seconds is enough to understand that it has nothing to do with Pavel Durov.

For example, you can notice that the account was created in December 2017, and since then only one tweet—the one about the lottery announcement—had been posted. Other similar accounts were even created that very day, March 29.

There is also a noticeable difference in the page’s design. Apparently, the scammers took screenshots and copied the profile photo repeatedly for their fake pages, so the image's quality deteriorated quickly (but many users weren't daunted by that fact).

Even if despite all this, you are still inclined to regard the account as legitimate; take a closer look at the site. The page the link points to contains no information about the Telegram lottery but rather has the distinctive features of a pyramid scheme.

This story is a perfect example of a successful social- engineering scam. Taking advantage of an unusual situation and users' desire to make some extra money, the scammers instantly saw an opportunity and quickly served up a website link to gullible users. The site was created on March 26, which means it wasn’t meant to be used for the Telegram-related scam.