Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts

Summary: Group-IB researchers documented Sniper Dz campaigns targeting Middle East and North Africa users through fake Facebook accounts impersonating politicians, public figures, and organizations, promoting offers such as free mobile internet packages, financial compensation, and government subsidies that redirected victims through intermediary sites to phishing and traffic monetization infrastructure. The campaigns route users through link-aggregation services like Linkbio and Linktree, then obtain browser notification permissions using a VAPID public key seen across campaigns impersonating Algerian telecom providers and investment scams, and add back-button hijacking with 10 fake history states plus tab-under redirection before sending victims to a traffic distribution system for premium-rate call scams, premium SMS subscription fraud, and investment scams.
Key Takeaway: The same VAPID key appearing across otherwise distinct campaigns indicates a shared push-notification ecosystem rather than independent infrastructure, and once a user clicks Allow, the operators can keep delivering scams through browser notifications long after the original post is gone.

Read the original at The Hacker News ↗

Topics: Fraud & Scams
Related: ArcticRAT Cybercrime Gang Profiles Victim Finances With AI Cyber Risks · Nov 13, 2026
Three People Arrested for AI-Enhanced Impersonation Fraud Cyber Risks · Nov 11, 2026
Medicare scam calls, texts and ads: What to watch for this Open Enrollment Cyber Risks · Oct 14, 2026