Cryptocurrency Scams Target Asia, Combining Malvertising and Pig Butchering with Losses Up to ¥10 Million

A recent cryptocurrency scam campaign is targeting users across Asia, with a specific focus on Japan. This operation combines two fraud models: malvertising and "pig butchering."

By utilizing the reach of malicious advertising and the psychological manipulation of social engineering, cybercriminals are extracting significant sums from investors. Reports indicate financial losses reaching up to ¥10 million for individual victims.

The attack begins with malvertising, where threat actors post deceptive advertisements on social media platforms such as Facebook and Instagram. These ads often impersonate financial experts or promote "AI-driven" investment algorithms.

Upon clicking these ads, users are redirected to fraudulent websites that mimic legitimate investment platforms. These sites prompt victims to join chat groups on messaging apps like LINE, WhatsApp, or KakaoTalk by scanning a QR code.

Infoblox analysts identified the malware ecosystem after detecting numerous suspicious domains queried by users in Japan.

Once inside the messaging apps, victims are engaged by AI-driven bots. These bots build trust through continuous conversations, share fabricated success stories, and encourage small initial investments that seem to yield returns. Eventually, victims are persuaded to transfer larger sums, only to face demands for a "release fee" when attempting to withdraw funds.

Automated Engagement and Infrastructure

The campaign relies on automation to scale operations globally, employing Registered Domain Generation Algorithms (RDGAs) to rapidly generate thousands of domains. This strategy complicates efforts by security teams to block the scam effectively. Over 23,000 domains have been linked to this scam, using lookalike names for legitimacy.

Chat interactions show signs of AI assistance , such as instant responses and seamless language switching, allowing high-quality social engineering attacks without traditional labor constraints. The infrastructure suggests a "service" model that enables multiple attackers to launch simultaneous attacks using the same tools.

Verify the official accounts of financial experts before trusting social media ads. Be skeptical of investment opportunities promising unrealistic returns. Avoid clicking on links or scanning QR codes from unverified sources. Do not transfer cryptocurrency to individuals met solely through online chat groups.

Based on reporting by Cyber Security News.