Hired Hand: Group-IB uncovers wide-scale phishing campaign that sees scammers mimic KSA manpower provider

(MENAFN- Active DMC) Dubai, 09.11.2022 — Group-IB, one of the global leaders in cybersecurity, has today published its research into a wide-scale phishing scheme that sees scammers impersonate one of the leading manpower agencies in the Kingdom of Saudi Arabia (KSA). In total, analysts from the Group-IB Computer Emergency Response Team (CERT-GIB) and Digital Risk Protection Team based at the company’s Threat Intelligence and Research Center in Dubai, UAE analyzed more than 1,000 rogue domains created to impersonate the manpower provider in question as part of a long-term scam campaign.

Group-IB analysts uncovered how one individual claimed to be offering more than 100 domain names that contained a logical connection to, or a variation of, the brand name in question. In line with Group-IB’s zero-tolerance policy towards cybercrime, Group-IB analysts notified the Saudi Computer Emergency Response Team (CERT-SA), a fellow OIC-CERT member, of their findings to assist their regional partners in taking any relevant action to combat this scheme.

A full breakdown of the scheme can be found in a new Group-IB blog post.

Scam in action

In 2021, more than $55 billion was stolen from victims as a result of scams, according to a Global State of Scam Report that Group-IB contributed to. The need to combat scammers is all the more pertinent given that recent Group-IB research found that scams accounted for 57% of all financially motivated cybercrime, and, according to the Global Anti Scam Alliance, the number of scams is growing more than 10% year on year. The same report also revealed that users in Saudi Arabia are targeted by the most phishing scams in the Middle East.

Domain spoofing, known as the faking of a website or email domain to make malicious sites or emails look credible, has long been a tactic of cybercriminals across the globe, and we are seeing new schemes appearing with alarming regularity. This past July, Group-IB uncovered more than 270 domain names that mimicked over a dozen postal and logistics brands across the Middle East in a separate scam campaign.

However, the postage scam scheme identified by Group-IB has been dwarfed in size by a new wide-scale domain and website spoofing campaign targeting users in Saudi Arabia. Over the past 16 months, Group-IB analysts analyzed more than 1,000 rogue domains linked to a single Saudi company – a leading manpower agency that offers businesses assistance in hiring employees for the construction and services sector, and individuals can also procure the services of domestic workers through the agency. The latter of these two groups is the target of this scam campaign.

The campaign, which was launched in April 2021, appeared to peak in March 2022, when more than 200 new domains spoofing the agency in question were registered with hosting providers. Group-IB analysts believe that the surge in new domains registered in early 2022 could be a sign that a growing number of internet users had fallen victim to this scheme. As seen in other examples around the world, scammers often double down on a certain tactic once it starts to generate them money.

A full breakdown of the scheme’s timeline can be found below:

In April 2022, when the phishing campaign surged, financial bodies in Saudi Arabia warned of a sharp increase in financial fraud in the country in the preceding year. Group-IB analysts assume that the subsequent reduction in the number of new domains registered per month imitating the manpower provider has followed in the wake of warnings to users by financial authorities in Saudi Arabia, government institutions, and the brand itself. However, the creation of 32 new spoof domains in September 2022 alone shows that scammers are still attempting to impersonate the company.

According to Group-IB’s findings, the driving factor for this scam scheme is an unholy alliance between scammers and spoof domain brokers. This alliance sees the brokers purchase the rights to dozens of domain names containing a typographical or phonetic variation of the attacked brand, and offer them for sale at a low price to scammers.

Imitation – the sincerest form of flattery

The URLs and the design of the scam pages created as part of this campaign are intended to convincingly imitate the manpower provider in question and trick users into entering their credentials for banking services and online government portals. The scammers can harvest both login information and two-factor authentication (2FA) codes to gain access and complete fraudulent transactions.

The scam campaign, which rests on multiple layers of social engineering, starts with the scammers placing advertisements on social media sites such as Facebook and Twitter, and the Google search engine. Group-IB analysts discovered more than 40 individual advertisements for this scheme on Facebook alone.

Figure 1: An example of a Facebook advert created by the scammers (left) that contains a link to launch a WhatsApp conversation (right) in which the cybercriminals implore victim to click URL to phishing webpage.

From there, the victims begin interacting with the scammers via SMS or WhatsApp communication, and a full breakdown of an average victim journey can be found below:

The phishing pages created by the scammers contain the official logo of the targeted brand as a means of building legitimacy in the eyes of the victims.

Figure 2: Phishing page containing the logo of the brand (blurred) to make it look legitimate.

Upon landing on the homepage of the phishing site, the victim is directed to click the large green button that has “apply” written on it. Once they do this, they are transferred to a second page where they are requested to enter their personal information.



Figure 3: Phishing page where users are asked to fill in their name, phone number, address and national ID number. After filling in the requested data, the user has to click on apply.

After entering their personal information and clicking “apply”, the victims are redirected to a page that asks them to select the nationality of the domestic worker they wish to hire.

Figure 4: After clicking apply, the victims are transferred to the next phishing page, where they are asked to choose the nationality of the domestic worker they want to request.

The next stage of the scam sees victims choose the type of domestic service they require (e.g., hourly, in-house).

Figure 5: Phishing site containing the range of domestic worker services the scammers purport to be offering to users.


Once they have completed these steps, the victim is transferred to a page on which they are asked to pay a small processing fee of 50 or 100 SAR (approximately $13 or $27). In fact, this transaction will not take place, as it is merely a ploy for the scammers to harvest credentials, but the victims are presented with the choice of making this fake transaction either via bank payment or a Saudi government portal.

Figure 6: Users are presented a choice, either via bank payment or card transaction, to pay what they believe to be a 50 or 100 SAR processing fee, although this transaction, which isn’t credited, is a ploy to steal users’ login details.

Irrespective of how the victim chooses to make the fake payment, they are sent either to a page emulating 11 regional banks or a website impersonating a Saudi government portal. The likelihood of the victim of being directed to the fake bank page or the fake portal page appeared to be random. In both cases, the victim’s login credentials and two-factor authentication (2FA) code are harvested by the scammers.

Figure 7: Phishing page on which the victim is prompted to make the fake processing payment via one of 11 leading regional banks.

Figure 8: After clicking on the image of the bank of their choice, the victim is asked to enter their login and password.


Figure 9: Phishing page mimicking a Saudi governmental portal asking for the two-factor authentication code, which the user receives once the scammers attempt to log in to the real governmental portal using the credentials harvested in the previous step.

Once the victim enters their data, the threat actors harvest the victim’s login credentials and 2FA code, which can be used to gain access to the victim’s bank or governmental portal account and begin making fraudulent transactions until the account is emptied.

Interestingly, the domain names identified by Group-IB in this scam campaign are registered with the same popular and affordable hosting providers as seen in many other phishing schemes. This underlines how fraudsters worldwide are utilizing similar tactics, such as launching domains with cheap, easy-to-register, and stable hosting providers, to target victims across the globe.

“The primary goal of this research is to raise public awareness in the Middle East of the latest phishing attacks, and to call for internet users to remain vigilant as threat actors continue to convincingly, and with increased regularity, impersonate some of the region’s largest organizations. Scammers are becoming increasingly resourceful and collaborative, and spoof domain brokers are coming to the assistance of cybercriminals. We encourage companies and organizations to monitor for signs of brand abuse, and we also urge internet users to remain vigilant so that they do not become victims of scams such as this,” Mark Alpatskiy, CERT-GIB Senior Analyst, said.

In order to prevent further phishing attacks using spoof domains, companies and organizations should monitor for signs of brand abuse across the internet, including on social media which is often used by scammers to advertise their phishing pages. Group-IB’s Digital Risk Protection solution helps firms and organizations secure their digital assets by continuously and automatically monitoring millions of online resources where brand or intellectual property may be present.

Internet users are urged to show caution and always check the URL domain of the page they are accessing and verify it to see if it is the official website before entering any personal or payment details. Another recommendation is to maintain communication with online chat services or call centers of the official company or organization.



About Group-IB
Group-IB is one of the leading solutions providers dedicated to detecting and preventing cyberattacks, identifying online fraud, investigating high-tech crimes, and protecting intellectual property. The company’s Threat Intelligence and Research Centers are located in the Middle East (Dubai), Asia-Pacific (Singapore), and Europe (Amsterdam).
Group-IB’s Unified Risk Platform is an ecosystem of solutions that understands each organization’s threat profile and tailors defenses against them in real-time from a single interface. The Unified Risk Platform provides complete coverage of the cyber response chain. Group-IB’s products and services consolidated in Group-IB’s Unified Risk Platform includes Group-IB’s Threat Intelligence, Managed XDR, Digital Risk Protection, Fraud Protection, Attack, Surface Management, Business Email Protection, Audit & Consulting, Education & Training, Digital Forensics & Incident Response, Managed Detection & Response, and Cyber Investigations.
Group-IB’s Threat Intelligence system has been named one of the best in its class by Gartner, Forrester, and IDC. Group-IB’s Managed XDR, intended for proactively searching for and protecting against complex and previously unknown cyber threats, has been recognized as one of the market leaders in the Network Detection and Response category by KuppingerCole Analysts AG, the leading European analyst agency, while Group-IB itself has been recognized as a Product Leader and an Innovation Leader. Gartner has named Group-IB a Representative Vendor in Online Fraud Detection for its Fraud Protection.
In addition, Group-IB was granted Frost & Sullivan’s Innovation Excellence award for Digital Risk Protection (DRP), an Al-driven platform for identifying and mitigating digital risks and counteracting brand impersonation attacks, with the company’s patented technologies at its core. Group-IB’s technological leadership and R&D capabilities are built on the company’s 19 years of hands-on experience in cybercrime investigations worldwide and over 70,000 hours of cybersecurity incident response accumulated in our leading DFIR Laboratory, High-Tech Crime Investigations Department, and round-the-clock CERT-GIB.
Group-IB is an active partner in global investigations led by international law enforcement organizations such as Europol and INTERPOL. Group-IB is also a member of the Europol European Cybercrime Centre’s (EC3) Advisory Group on Internet Security, which was created to foster closer cooperation between Europol and its leading non-law enforcement partners.
Group-IB's experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB's mission is to protect its clients in cyberspace every day by creating and leveraging innovative solutions and services.

MENAFN09112022004341011474ID1105155838