Threat actors are using the Hajj season to spread online scams, coax pilgrims into parting with their personal information and run fake websites.
Hajj is a significant event for Muslims around the world. Pilgrims often save for years to able to pay for the travel, prompting threat actors to launch fake websites targeting unsuspecting individuals planning to make the pilgrimage.
The tactics used by threat actors include creating fake websites masquerading as pilgrimage agencies offering attractive packages to entice people. Since the pilgrimage can be a costly affair, threat actors use the lure of discounts to lure individuals.
Threat actors have also been found to use social media platforms to promote fake Hajj packages and entice people with attractive offers.
(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)
Researchers have also detected multiple fraudulent resources impersonating Nusuk, the digital platform that facilitates planning, booking, registration and payment for the pilgrimage, Resecurity shared in a blog post.
Researchers have identified phishing websites, located at nusuksa [.com], which follow the same layout as the original website. However, when users access it, they are directed to a payment interception form, which is designed to steal sensitive information.
The digital platform currently caters to pilgrims in Europe, the Americas, and Australia.
Threat actors have also been found mimicking the official messaging on behalf of Saudi leadership to increase trust in fake websites and social media pages. These resources have been found to lure pilgrims into sharing personally identifiable data (PII) under the guise of free Hajj applications. This information can be used to commit identity theft, fraud or is sold by cybercriminals on the dark web.
AI facilitates convincing text for fake websites
Threat actors have been found using AI to create convincing texts in Arabic, disseminating Hajj season-related messages. AI is also being used to generate human-like content in audio and images to create deceiving messages that could be used to trick victims.
Authorities in Saudi Arabia, the city of London Police has issued advisories for pilgrims advising them to cautious of fake online resources, use only official ministry accounts and to report any fraudulent activities. Pilgrims are also advised to verify the legitimacy of travel arrangements and tour operators before sharing personal information or tranfering funds.
