A large-scale campaign involving over 200 phishing and scam websites has stolen users' personal data through fake Google Ads investment schemes, impersonating genuine brands.
See also: Ukraine links phishing targeting armed forces to Belarusian hackers
This scam relies on the abuse of Google Ads and SEO to lure victims to hundreds of fake websites targeting the Indian audience.
The campaign was uncovered by Singapore-based security firm CloudSEK .
According to analysts Ankit Dobhal and Aryan Singh, the phishing operation in question has caused financial losses of up to $1,000,000, originating from tens of thousands of victims.
The Indian government recently introduced favorable policies to boost the growth of the country's electric vehicle sector.
Over 400 EV startups have already launched in the country, while existing automakers are also aggressively expanding their operations in this direction.
Fraudsters have recognized these conditions as fertile ground for fraud, creating hundreds of websites attempting to exploit this new situation, from August 2021 to the present.
Additionally, CloudSEK reports that it has identified a shift in the focus of phishing actors during this period, abandoning banking and financial lures in favor of EVs.
See also: An ongoing phishing campaign targets Citibank customers
Malicious users ensure a steady stream of potential victims by abusing Google Ads, stuffing their fake websites with keywords, and imitating well-known brands like Revolt and Ather.
In many cases, malicious users simply copy the content, style, layout, and all images of the legitimate website and create clones.
In other cases, they build entirely fictional markets using generic words like “ebike” to offer supposed products from multiple brands.
Visitors to these websites are instructed to enter their full names, contact numbers, email addresses, and physical address to register with the platforms.
Once they complete the registration, the scammers ask them to pay the fee required to become an EV dealer or purchase a product on the site. Unfortunately, victims also give their bank/payment details to the scammers at this step.
Although threat analysts discovered 200 active phishing domains, they warn that new sites are constantly being created by hackers.
In terms of impact, researchers observed around 100 to 200 users signing up to these sites per day and estimated the total financial losses at INR 40-80 million ($500,000 – $1,000,000).
See also: Phishing method bypasses MFA with remote access software
Consumers can ensure they are on the official EV dealer portal by using India's e-AMRIT database and confirming the relationship between URLs and legally registered markets.
As for the affected businesses, reporting the phishing websites won't cause much trouble for the malicious users. Instead, report them to Cyber Crime Cell to help track down their operators.
