Researchers found a large scam campaign using hundreds of fake government and news websites in Uzbekistan, Belarus, and Tajikistan. The sites lure people with promises of government-backed cash payments or passive income, then collect phone numbers and other personal data for follow-up calls/emails. Victims are pushed to pay “fees,” share documents, or install a malicious mobile app that can give attackers control of the device.
Researchers at F6 uncovered a large scam operation using more than 360 fraudulent domains built to imitate official government and regional news websites across Uzbekistan, Belarus, and Tajikistan. The sites lure visitors with promises of government financial assistance or passive income through supposed government-backed programs. Victims are initially asked for minimal information, typically just a name and phone number, to check eligibility for a payout.
Once that data is submitted, scammers escalate the contact by phone or email, often posing as a personal manager assigned to the victim's case. From there, the campaign follows a familiar social engineering escalation: requests for a commission or processing fee to release the funds, collection of additional personal information including passport scans, and in some cases instructions to install a mobile application supposedly required for identity verification. That application is actually malware capable of giving attackers control over the device.
The campaign leans heavily on trust in government institutions and, in more sophisticated cases, trust in familiar news sources. Some fake sites go beyond a simple landing page and mimic regional news outlets, publishing fabricated stories about government assistance programs before funneling readers into a questionnaire. This added layer of legitimacy makes the eventual request for personal details feel like a natural next step rather than a red flag.
The low initial ask (just a name and phone number) also lowers resistance. Once someone has taken that first small step, they are more likely to continue engaging with follow-up calls, fee requests, and document submissions.
Organizations should remind employees and customer-facing teams that legitimate government programs do not require upfront fees to release funds, and that unexpected payout offers should be verified through official government channels rather than links in an email or website. Any request to install an unfamiliar app tied to a financial benefit should be treated as a likely malware attempt and escalated to IT or security. Because the campaign specifically uses fake news content to build credibility, awareness training should also cover how to distinguish legitimate news sources from lookalike sites pushing readers toward personal data forms.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Researchers at F6 identified more than 360 fraudulent domains imitating government and news websites in Uzbekistan, Belarus, and Tajikistan.
They promise eligibility for government financial assistance or passive income through supposed government-backed programs, asking initially for just a name and phone number.
Scammers follow up by phone or email, often posing as a personal manager, and may ask for a commission or processing fee, additional personal details like passport scans, or installation of a mobile app that is actually malware.
Treat unsolicited government payout offers as suspicious, verify claims through official government channels, never pay a fee to receive a promised payment, and avoid installing 'verification' apps tied to such offers.
Imagine a website that looks like an official Uzbekistan or Belarus government portal, telling you you’re eligible for weekly cash payments. Researchers found more than 360 of these fake government and news sites across Uzbekistan, Belarus, and Tajikistan. First they ask for just your name and phone number, then a 'personal manager' calls to help you claim the money. On the call, they push you to pay a 'commission fee,' send passport scans, or install a mobile app that secretly gives them control of your device, this all started from that one fake news or government page. If you see a site promising government-backed weekly payouts, stop. Don’t click through, go to the official government portal you already know, or call our security team to check it first.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
