sniperdz

Executive Summary

SniperDz is identified as a phishing campaign targeting users across the Middle East and North Africa through fraudulent Facebook accounts impersonating trusted figures. The operation leverages push notifications, browser history manipulation, and redirection via third-party services like Linktree and Linkbio to evade detection. SniperDz provides over 80 phishing templates mimicking global brands for financial gain.

Goals & Targeting

SniperDz's primary goal appears to be financial gain through phishing, investment scams, and fraudulent monetization. The targeting of sectors such as financial services, communications, and entertainment reflects a focus on industries with high customer engagement and sensitive data. The geographic concentration in Algeria suggests an initial operational focus within the Middle East and North Africa region, potentially expanding based on success.

SniperDz operates a sophisticated 'Push-Notification-as-a-Service' (P-Naas) and 'Phishing-as-a-Service' (PaaS) platform, enabling attackers to carry out large-scale phishing campaigns. The group uses falsified Facebook accounts to impersonate politicians, public figures, and trusted organizations to spread fake offers such as free mobile internet packages or financial compensation. Victims are directed to malicious links using legitimate-looking third-party services like Linktree and Linkbio to bypass detection mechanisms. The platform offers over 80 phishing templates designed to mimic more than 30 global brands across various sectors, including financial services, social media, streaming, and gaming. Monetization techniques include browser notification abuse, premium SMS subscriptions, investment scams, and affiliate marketing. Analysis has identified over 900 suspicious domains linked to shared hosting infrastructure and the reuse of a single VAPID public key across multiple campaigns, indicating operational persistence and potential association with larger threat networks.

Key Capabilities

• Phishing template creation and distribution
• Browser notification abuse for malicious intent
• History manipulation (back-button prison technique)
• Premium SMS subscriptions and investment scams
• Affiliate marketing for monetization
• Use of third-party link aggregation services to avoid detection

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

SniperDz's campaigns involve large-scale phishing operations targeting individuals through social media platform impersonation. The use of shared infrastructure and recurring identifiers like VAPID keys suggests operational persistence and resourcefulness. Campaign patterns include the rapid deployment of new domains, frequent updates to phishing templates, and a focus on exploit techniques that evade detection. Notable past operations involve investment scams and premium service hijacking, targeting both individual consumers and corporate entities.

IOC Patterns

• Spear-phishing campaigns originating from fraudulent Facebook accounts
• Browser notifications leading to malicious domains
• Redirection through legitimate-looking services like Linktree and Linkbio
• Shared hosting infrastructure with high domain count
• Recurring VAPID public keys associated with push notification campaigns

Recommended Actions

• Implement multi-factor authentication (MFA) for critical accounts to mitigate credential theft risk.
• Monitor social media channels for suspicious activity and impersonation attempts targeting organizational figures or employees.
• Use browser extensions or policies blocking unauthorized push notifications as a defense against push-based attacks.
• Set up DMARC, BIMI, and SPF records for domain authentication to prevent email spoofing and phishing.
• Regularly audit and update third-party service integrations for vulnerabilities and suspicious activity.

Suggested Tags