Fraudsters Offering Free Mobile Phone Airtime

In July 2010, several phishing sites were observed to be spoofing social networking brands. This in itself is nothing new, but this time the sites were posting fake offers for free online mobile phone airtime top-ups. The phishing pages displayed the icons for a number of popular cellular service providers in India. Upon entering login credentials on the phishing site, the page displayed certain steps for the user to follow to obtain the fake offer:

First, the customer is asked to select the amount of airtime recharge in rupees, which should not exceed Rs 500 per day. Then, after selecting the amount, the phishing site generates a Java code. The user is then prompted to use the Java code whenever he or she requires a free mobile recharge. The page states that the Java code has to be entered on the address bar after logging in to the social networking site. If the user applies the code after logging in to the legitimate site, the browser pops up a set of message boxes asking for the user’s cell number and other details. The final message box states that the recharge was successful:

However, in reality, the Java code performs a series of malicious activities that ultimately send messages to people in the user’s friend list. The user also (continue reading...)