Faced with financial doubts and concerns, it’s no surprise that people are looking for alternatives to make their money go further. This leads users with little investment experience to become interested and take their first steps. ESET, a leading company in proactive threat detection, warns that scammers are taking advantage of this curiosity or need with increasingly sophisticated scams on social media. It also warns that AI-powered scams produce fake ads, deepfakes, and promises of profits that seek to deceive even the most cautious users.

“Could you distinguish between a real investment ad and a fake one? It’s becoming increasingly difficult to do so. Threat actors today have various tactics to make their scams more credible, including deepfake videos generated with artificial intelligence. While there are many tactics, techniques, and procedures (TTPs) associated with this type of fraud, most begin with malicious or deceptive ads circulating on social media. They are often used as a lure to trick the victim, either into providing personal information or directly directing them to an investment scam,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

According to the FBI, investment scams have been the main source of income for cybercriminals for several years. At last count, they earned nearly $6.6 billion, and that’s just from crimes reported to the federal government. This figure dwarfs the $2.8 billion earned by the second-largest scam, business email compromise (BEC).

An example of this type of campaign was identified in June 2025, when Instagram ads impersonated legitimate banks. Some used tempting offers, such as high-interest accounts, in an attempt to persuade the victim to click and enter their banking information. In other cases, they used deepfake Instagram stories featuring banking investment strategists to collect personal information and/or lure them into WhatsApp groups about investment scams. A 2024 campaign spread a fake video of Lionel Messi to promote supposed investments through an app that promised high returns.

Also in 2024, ESET observed the Nomani Trojan campaign. The ad content and the phishing websites they linked to were designed to impersonate local news outlets and other organizations. Or, it could be a generic financial-themed visual with frequently changing names like “Quantum Bumex, Immediate Mator, or Bitcoin Trader.” Some of the characteristics of the Nomani campaign (and other similar campaigns) include:

• Highly localized content to attract specific regional victims.
• Distribution via fake ads on Facebook, Instagram, X, YouTube, as well as Messenger and Threads.
• Deepfake video testimonials potentially using celebrities, often displayed in low-quality videos and with unnatural keyword repetition.
• Use of fake and hacked accounts to run the ads (including, in one case, an actor with 300,000 followers).
• Shared templates and callbacks pointing to the same hosting infrastructure.

In this campaign, according to ESET, the intended objective is to persuade the victim to provide their personal information, which the scammers use to contact them directly. They use this method to trick them into signing up for an investment scam, taking out a loan, or even installing remote access software on their device. ESET observed a 335% increase in Nomani threats between H1 and H2 2024, and blocked more than 8,500 related domains.

While these techniques seem like clear indicators of fraud, they can be much more difficult to detect, especially if you are looking for opportunities to alleviate financial pressures. ESET states that the continued effectiveness of these types of scams, such as fraudulent financial ads, is due to the following:

• Times are tough, and the prospect of quick and easy financial gain is attractive.
• Attention spans are decreasing, especially on mobile devices, so warning signs may not be detected in time.
• Many people are unfamiliar with the latest threat TTPs, such as the use of deepfake videos, which makes them more vulnerable.
• Many of these threats are localized, use legitimate (hijacked) accounts, and can appear at the top of search results.
• Banks’ traditional anti-fraud mechanisms often don’t work if the manipulation is also carried out socially via telephone to invest in a fraudulent scheme.

Investment scams are very common, and ESET points out that it’s necessary to pay attention to these warning signs

• Flashy ads (which may leverage legitimate brands) offering returns that are too good to be true or unusually high interest rates.
• Celebrity endorsements are often the hook to give the product a certain legitimacy. Always check if the endorsement is legitimate.
• Videos that don’t look entirely right, for example, with visual glitches, poor audio and video synchronization, low resolution, or robotic or overly polished voices.
• Pressure to act quickly and secure the investment.
• Guaranteed return on investment.

They also advise staying alert to warning signs, resisting the temptation to click on ads about finance or investments, even if they appear to be promoted by legitimate brands and individuals, searching online for reviews of a specific investment plan or group to verify their authenticity, not investing in financial products without having thoroughly researched them and understanding how they work, ignoring any unsolicited third-party offers, never sharing personal and/or financial information after clicking on an online ad, and always checking the information circulated with the supposedly issuing entity through official channels. Finally, use security software on all your devices from a trusted provider like ESET, which will help block scams.

“In times of economic uncertainty, it’s understandable that we look for alternatives to improve our financial situation. But scammers are exploiting this very need with increasingly sophisticated tactics. Therefore, being wary of what’s easy, recognizing the warning signs, and protecting your personal data is essential to avoid falling for this type of scam,” concludes the ESET researcher. ESET invites you to learn more about cybersecurity by visiting:  https://www.welivesecurity.com/es/.

For other useful preventive information, it is also available in Venezuela:  https://www.eset.com/ve/, and on its social media channels @eset_ve. Also, available on Instagram (@esetla) and Facebook (ESET).

Bitfinance.News

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Investor scams on social media are on the rise with the help of artificial intelligence apareció primero en Bitfinance.

The world of video games has changed its income dynamics: it is no longer enough to buy the game, but now a range of possibilities opens up for users to acquire certain items to progress or obtain benefits, which has a second or dangerous side that grew after the pandemic and that many families are already dealing with: gambling.

In the context of Gamer’s Day, August 29, ESET, a leading company in proactive threat detection, analyzes the world of betting and video games, the addiction it can generate in children and adolescents, and the role of influencers They benefit when users lose. In addition, it shares what measures countries are taking in response to this situation and what actions mothers and fathers can take to help and guide their children.

“Not many years ago, video games used to be a one-time purchase: that already guaranteed the complete experience. But currently, companies in the industry often offer their users video games for free, with “loot boxes” and other in-game transactions being the most important source of income,” says Camilo. Gutiérrez Amaya, Head of the ESET Latin America Research Laboratory.

“LOOT BOXES” are a specific monetization dynamic that is represented in products that can be purchased at some specific stage of a game. They can hide elements or rewards highly valued by the communities. Of course, they have a cost and their content is random. They acquired such an important status that an economy even emerged based on them, and they can even be used to bet on third-party sites.

Something that began as a game, over time, became a great concern for parents and even governments because its casino-style betting format to obtain and market them encourages addictive consumer spending. This is also enhanced by the great accessibility that mobile devices allow and the little (or no) control that exists regarding the age of majority of users on these platforms.

Child and adolescent gambling

The consequences can be very serious: from generating an addictive habit in users, such as debt for large sums of money, often unknown to the parents themselves. Thus, child and adolescent gambling addiction emerges as a gambling addiction in minors, which manifests itself in compulsive behaviors in video games and online betting, among others.

Beyond this, large video game franchises such as Candy Crush, Fornite, FIFA, League of Legends, or Final Fantasy continue to launch titles whose income to offset the cost of developing the game itself depends largely on “loot boxes.” or microtransactions. So much so that recent studies estimate that by 2025 “loot boxes” will generate more than $20 billion.

“The “loot box” mechanics literally work like any casino: the user must replenish the account with monetary funds, then place their bet, and finally wait for the graphics to spin to find out if they won or lost. This is how the service that video games have offers alarming similarities with the characteristics of an online casino: in fact, they imitate roulette and even slot machines,” adds the ESET researcher. The fundamental difference between casinos and the dynamics proposed by video games is that the latter do not have a gaming license from any official body and, in many cases, they do not offer reliable verification that prevents those under 18 years of age from placing their bets. . It is worth remembering that it is illegal for a minor to place bets.

The link between video games and betting is, in certain cases, enhanced by the figure of influencers, who play a key and at the same time ambiguous role in the growth of this problem. This is because many of them promote betting platforms or give recommendations that, directly or indirectly, lead their followers to make bets that logically can end in losing money.

What stands out within this dynamic is that there are several influencers who receive payments and commissions from these betting platforms, but based on the money losses of their followers. The conflict of interest is as clear as it is controversial, influencers have a financial incentive for their followers to lose money instead of earning it.

A serious problem

A real example of this was what happened in 2016 with YouTubers TmarTn and Syndicate, who promoted Counter Strike skin betting sites and were accused of not disclosing that they had their financial interests in the pages they promoted. In both cases they earned money from visits to each of their videos, but also from users’ losses on the betting sites they promoted and which they even owned.

To counteract this trend, many countries have taken this scenario as a serious problem, and that is why they have begun to enact laws and regulations against the operation of sites that operate in a gray zone, without official license or adequate controls.

In Argentina, for example, the government of the city of Buenos Aires sent letters to a large number of influencers because they advertised on their social networks for online gambling platforms.

In the United States, for their part, they took concrete actions to regulate young people’s access to online betting sites. In fact, there are laws that force these websites to implement more advanced age verification technologies and others that limit the amount of money that can be bet.

Another case is that of the United Kingdom, a country in which the Betting Commission implemented very strict regulations that aim to limit the advertising of games of chance and access to minors, while in Spain they prohibit the access of minors to the loot boxes to prevent addictive behavior and in Australia reforms were introduced whose main objective is to have stricter controls on the identity of users to also prevent the development of future addictions.

To accompany the little ones in their interactions on the Internet, the first step is not to underestimate the underlying problems between video games and gambling. Recent studies suggest that “loot box” purchases and similar habits can lead to children and adolescents developing future gambling and other severe problems.

Support and advice

To avoid this, ESET shares concrete actions that can be implemented to accompany and advise children in the midst of this worrying scenario:

• Have conversations with children/teenagers about their online activities and interests.
• Provide information about what gambling addiction is and its consequences.
• Carry out a joint analysis of betting advertisements, so that they can make good decisions and incorporate good habits.
• Encourage them to carry out recreational activities, without the mobile device.
• As older people, set an example and give balanced use to devices.

Contact coordinates with ESET in Venezuela: https://www.eset.com/ve/. Also, their social networks: Instagram (@esetla) and Facebook: (ESET).

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Betting on video games: a worrying trend on children and adolescents apareció primero en Bitfinance.

ESET, a leading company in proactive threat detection, identified a phishing campaign aimed at mobile users that targeted bank customers. This novel criminal technique installs a phishing application from a third-party website without the user having to allow the installation of applications, it affects both iOS and Android users. Most of the cases known at the moment have occurred in the Czech Republic, and applications were directed to the Hungarian bank OTP Bank and the Georgian bank TBC Bank.

The ESET research team identified a series of phishing campaigns targeting mobile users that used three different URL delivery mechanisms: automated voice calls, SMS messages, and social media malvertising.

Voice call delivery was done via an automated call that warned the user about an outdated banking application and asked them to select an option on the keypad. After pressing the correct button, a phishing URL was sent via SMS.

The initial approach by SMS was carried out by indiscriminately sending messages to Czech telephone numbers. The message sent included a phishing link and a text for victims to perform social engineering and visit the link.

The spread through malicious ads was done by registering ads on Meta platforms such as Instagram and Facebook. These ads included a call to action, such as a limited offer for users to “download an update below.” This technique allowed threat actors to specify the target audience by age, gender, etc. The ads then appeared on the victims’ social networks.

After opening the URL delivered in the first stage, Android victims were faced with a high-quality phishing page that imitated the official Google Play Store page for the targeted banking app, or an imitation website of the app.

From there, victims are asked to install a “new version” of the banking app. Depending on the campaign, clicking the install/update button initiates the installation of a malicious application from the website, directly on the victim’s phone, either in the form of a WebAPK (Android users only), or as a Progressive Web App (PWA) for iOS and Android users. The highlight of this instance is that it bypasses traditional browser warnings to “install unknown apps”: this is the default behavior of Chrome’s WebAPK technology, which is abused by attackers.

The process is a little different for iOS users, as an animated pop-up tells victims how to add the phishing PWA to their home screen. The popup copies the look of native iOS messages. In the end, iOS users are not warned about adding a potentially harmful app to their phone.

Upon installation, victims are asked to enter their internet banking credentials to access their account through the new mobile banking application. All information provided is sent to the attackers’ C&C servers.

The malicious ads included a mashup of the bank’s official mascot (blue chameleon), as well as bank logos and text promising a financial reward for installing the app or warning users that a critical update had been released.

All stolen login information was recorded through a backend server, which then sent the banking login details entered by the user to a Telegram group chat. HTTP calls to send messages to the threat actor’s group chat were made through the official Telegram API. As mentioned by ESET: this technique is not new and is used in several phishing kits.

Warning

“Because two drastically different C&C infrastructures were used, we have determined that two different groups are responsible for the spread of phishing applications. More imitation apps will surely be created, since after installation it is difficult to separate legitimate apps from phishing ones. All sensitive information found during our investigation was quickly sent to the affected banks for processing. We also coordinate the dismantling of multiple phishing domains and C&C servers,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Laboratory.

Contact coordinates with ESET in Venezuela: https://www.eset.com/ve/. Also, their social networks: Instagram @esetla) and Facebook: (ESET).

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Malicious banking applications: New phishing against Android and iOS users apareció primero en Bitfinance.

Today, IT infrastructure, platforms and software are more likely to be offered as a service in a traditional on-premises setup. This is very attractive to small and medium-sized companies (SMEs), when compared to the majority, since it allows them to compete on equal terms with larger rivals, with more business agility and rapid scalability, without excessive investment. Thus, ESET, a leading company in proactive threat detection, warns that digital transformation also entails risks regardless of the size of the company and shares key security tips to take into account to avoid errors.

“53 % of SMBs surveyed in a recent report say they spend more than $1.2 million annually on the cloud, up from 38 % last year. Furthermore, security (72 %) and regulatory compliance (71 %) are the second and third most cited challenges by the SMEs surveyed. The first step in addressing these challenges is to understand the top mistakes smaller businesses make with their cloud deployments. In any case, these are not just mistakes that SMEs make in the cloud, larger companies with more resources are sometimes guilty of forgetting the essential ones. By eliminating these blind spots, your organization can take great steps towards optimizing its use of the cloud, without exposing itself to potentially serious financial or reputational risks”, comments Camilo Gutiérrez Amaya, head of the ESET Latin America Research Laboratory.

The 7 main cloud security mistakes that SMEs (and not so SMEs) make, according to ESET

1. No multifactor authentication (MFA): Static passwords are inherently insecure, and not all companies follow a strong password creation policy. Passwords can be stolen in several ways, such as phishing, brute force methods, or simply guessing. That is why it is necessary to add another layer of authentication (two-key or two-factor). MFA will make it much more difficult for attackers to access applications in your users’ SaaS, IaaS, or PaaS accounts, mitigating the risk of ransomware, data theft, and other potential outcomes. Another option is to switch to alternative authentication methods, such as authentication without password, whenever possible.
2. Placing too much trust in the cloud provider: Many IT managers believe that investing in the cloud effectively means outsourcing everything to a trusted third party. This is only partly true: there is a shared responsibility model between the provider and the customer, for securing the cloud. The type of service – SaaS, IaaS or PaaS – will determine what should be taken into account. While most of the responsibility falls on the provider, it is worth investing in additional third-party controls.
3. Not making backups: Never assume that the cloud service provider (for example, for file storage/sharing services) has your back. You should think about the worst case scenario: a system failure or a cyberattack on your provider. It’s not just data loss what will impact your organization, but also the downtime and hit to productivity that could follow an incident.
4. Not patching regularly: If you don’t patch, you expose your cloud systems to vulnerability exploitation. This, in turn, could lead to malware infections, data leaks, and much more. Patch management is a security best practice that is as important in the cloud as it is in other systems.
5. Cloud disruption: Cloud service providers are an innovative bunch, but the sheer volume of new features and capabilities they release in response to customer feedback can end up creating an incredibly complex cloud environment for many SMEs. This makes it more difficult to know which configuration is the most secure. The most common mistakes are configuring cloud storage so that any third party can access it and not blocking open ports.
6. Failing to monitor cloud traffic: Rapid detection and response are critical if signals are to be detected early, to contain an attack before it has a chance to impact the organization. This makes continuous supervision essential. It is worth thinking that it is not a question of “whether” the cloud environment will be breached, but “when”.
7. Don’t encrypt your company’s crown jewels: No environment is 100 % breach-proof. So what happens if a bad actor manages to access your most sensitive internal data or highly regulated employee/customer personal information? Encrypting them at rest and in transit will ensure that they cannot be used even if they are obtained.

Experts advise

From ESET, they assure that the first step to address these security risks in the cloud is to understand what the responsibilities are and what areas the provider will be in charge of. It’s a matter of deciding whether to rely on cloud-native security controls or to enhance them with additional third-party products. Therefore, they advise the following:

• Invest in third-party security solutions to improve cloud security and protection of email, storage and collaboration applications. In addition to the security features built into cloud services offered by leading service providers in the world cloud
• Add extended or managed detection and response (XDR/MDR) tools to drive rapid incident response and breach containment/remediation
• Develop and implement an ongoing risk-based patching program based on strong asset management (i.e. knowing what cloud assets you have and ensuring they are always up-to-date)
• Encrypt data at rest (at the database level) and in transit to ensure its protection. This will also require effective and continuous data detection and classification
• Define a clear access control policy; require strong passwords, MFA, principles of the least privilege, and IP-based restrictions/allow access lists for specific IPs
• Consider adopting a zero trust approach, which will incorporate many of the above elements (MFA, XDR, encryption) along with network segmentation and other controls

“Many of the measures above are the same best practices that one would expect to deploy in on-premise systems as well, with some details that will be different. The most important thing is to remember that cloud security is not only the responsibility of the provider and that control must be taken to prevent cyber risks” concludes Gutiérrez Amaya from ESET.

For more details on computer security, you can visit the ESET portal: https://www.welivesecurity.com/es/

Bitfinance.News

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada SMEs: 7 common mistakes when using cloud services apareció primero en Bitfinance.

“It is important to note that each instance of a SpyLoan application, regardless of its origin, behaves identically. If users download an app they will experience the same features and face the same risks, regardless of where they got the app from. It does not matter if the download comes from a suspicious website, from a third-party application store or even from Google Play: the behavior of the application will be the same in all cases,” explains Camilo Gutiérrez Amaya, Head of the Research Laboratory from ESET Latin America.

Since early 2023, researchers at ESET, a leading proactive threat detection company, have observed an alarming growth in deceptive Android applications that present themselves as legitimate personal loan services, promising quick and easy access to funds. These services are actually designed to scam users by offering them loans with high interest rates backed with misleading descriptions, while collecting their victims’ personal and financial information to blackmail them and ultimately obtain their funds.

ESET products recognize these applications using the detection name SpyLoan, which refers directly to their spyware functionality combined with loan claims.

Such apps were previously available on Google Play but are currently marketed through social media and SMS messages, and can be downloaded from scam websites and third-party app stores. As a partner of the Google App Defense Alliance, ESET identified and reported to Google 18 SpyLoan applications that had more than 12 million downloads on Google Play and 17 of them were subsequently removed. The last app identified by ESET is still available on Google Play, but since its developers changed its permissions and functionalities, it is no longer detected as a SpyLoan app.

According to ESET telemetry, the executors of these apps operate mainly in Mexico, Indonesia, Thailand, Vietnam, India, Pakistan, Colombia, Peru, Chile, Philippines, Egypt, Kenya, Nigeria and Singapore. All of these countries have various laws that regulate private loans, not only their types, but also the transparency of their communication. Any detection outside these countries could be related to smartphones that have, for various reasons, access to a phone number registered in one of these countries.

How SpyLoan apps work

“There are several reasons for the rapid growth of SpyLoan applications. One of them is that its developers are inspired by successful FinTech services, which take advantage of technology to offer agile and easy-to-use financial services. FinTech applications and platforms are known for disrupting the traditional financial sector by offering convenience in terms of accessibility, allowing people, in a user-friendly manner, to perform various financial activities anytime, anywhere, using only their smartphones. On the contrary, the only thing that SpyLoan applications alter is trust in technology, financial institutions and similar entities,” says Gutiérrez Amaya, from ESET Latin America.

Once a user installs a SpyLoan app, they are asked to accept the terms of service and grant broad permissions to access sensitive data stored on the device. The app then requests user registration, which is typically done by verifying the one-time password via SMS to validate the victim’s phone number. These registration forms automatically select the country code, based on that of the victim’s phone number, ensuring that only people with phone numbers registered in the target country can create an account.

Once the phone number is verified, users access the loan application function of the application. To complete this process, users are forced to provide a large amount of personal information, including address details, contact information, proof of income, bank account information, and even upload photos of the front and back of their documents identity, and even a selfie.

SpyLoan applications pose a significant threat by stealthily extracting a wide range of personal information from unsuspecting users: they are capable of sending sensitive data to their command and control (C&C) servers. Data that is usually leaked includes the list of accounts, call logs, calendar events, device information, lists of installed applications, local Wi-Fi network information, and even information about the files on the device. Additionally, contact lists, location data and SMS messages are also vulnerable.

Legit vs. Malicious Loan Apps: How to Tell Them Apart

ESET shares a series of recommendations that users can use to protect themselves:

– Go to official sources: Android users should avoid installing lending apps from unofficial sources and third-party app stores, and stick to trusted platforms like Google Play, which apply app review processes and security measures. Although this does not guarantee complete protection, it does reduce the risk of encountering fraudulent loan applications.

– Use a security app: A reliable security app for Android protects the user from malicious lending apps and malware. Security apps provide an additional layer of protection by scanning and identifying potentially harmful apps, detecting malware, and warning users about suspicious activity.

– Review scrutiny: When downloading apps from Google Play, it is important to pay close attention to user reviews. It is crucial to be aware of fake positive reviews. Borrowers should focus on negative reviews and carefully evaluate concerns raised by users, as they can reveal important information such as extortion tactics and the actual cost charged by the loan provider.

– Privacy Policy and Data Access Review: Before installing a loan app, users should read its privacy policy, if available. This document often contains valuable information about how the application accesses and stores sensitive information. However, scammers can use misleading clauses or vague language to trick users into granting unnecessary permissions or sharing personal data. During installation, it is important to pay attention to the data to which the application requests access and ask whether the requested data is necessary for the functionality of the loan application.

To learn more about computer security, we invite you to visit the ESET news site: https://www.welivesecurity.com/es/investigaciones/app-prestamos-espian-usuarios-android/.

Conexión Segura, your podcast with timely verified information about computer security in the world, can be heard at: https://open.spotify.com/show/0Q32tisjNy7eCYwUNHphcw.

With information and image provided by ESET and Comstat Rowland Comunicaciones Estratégicas Integrales

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada ESET: Malicious loan apps for Android multiplied in 2023 apareció primero en Bitfinance.