New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims
May 06, 2025
Deepfake / Online Fraud
Cybersecurity researchers have lifted the lid on two threat actors that orchestrate investment scams through spoofed celebrity endorsements and conceal their activity through traffic distribution systems (TDSes). The activity clusters have been codenamed Reckless Rabbit and Ruthless Rabbit by DNS threat intelligence firm Infoblox. The attacks have been observed to lure victims with bogus platforms, including cryptocurrency exchanges, which are then advertised on social media platforms. An important aspect of these scams is the use of web forms to collect user data. "Reckless Rabbit creates ads on Facebook that lead to fake news articles featuring a celebrity endorsement for the investment platform," security researchers Darby Wise, Piotr Glaska, and Laura da Rocha said . "The article includes a link to the scam platform which contains an embedded web form persuading the user to enter their personal information to 'register' for the investment opportunity....