Are you still watching? Streaming scammers hope so
One of the industries most greatly affected by the rapid shift to social distancing and working at home has been media and entertainment. While certain sectors like sports have suffered from the canceling of live events, others are benefiting from consumers spending more time at home. Streaming services, in particular, have seen a surge in membership as consumers look for at-home activities. Unfortunately, cyberattackers have recognized this heightened market demand and are seeking to capitalize on it through streaming scams.
This increase in demand has caused a subsequent increase in fraudulent streaming services, as well as scams related to streaming services. The ZeroFox Alpha Team has identified new scams that target streaming service users into disclosing their account information in exchange for the false promise of a free streaming service membership. Many of these scams are circulated on social platforms to increase visibility and the likelihood of victims falling for the “offer.”
WhatsApp Streaming Scam
One such viral scam circulating across WhatsApp claims to offer free streaming service membership to every user who enrolls in the program. It further claims that this is a limited-time and limited-quantity offer, in an attempt to better entice victims to disclose personal information. The WhatsApp message appears to be from one streaming service, preying off users’ vulnerability during the coronavirus pandemic and offering “free access” as an act of goodwill. Messaging apps are often used by scammers, because these apps are so popular. This gives attackers access to a large pool of potential victims.
In this case, the message contains a link that directs visitors to a site intended to appear similar to a legitimate streaming site. The page displays a message that reads “Due to the COVID-19 pandemic, we are giving away totally free access to our platform for the period of isolation, until the virus is contained.”
Don’t Fall for Fake Streaming Scams Sites
The site also displays the number of people who have already subscribed to the free offer to create a sense of both legitimacy and emergency and trick people to act upon it. This value is likely falsified, as this is a common tactic to prompt would-be victims to act quickly before the fraudulent offer expires.
By using similar branding, visuals and messaging to legitimate streaming sites, scammers are able to trick unsuspecting users looking for a good deal in a vulnerable moment.
Users who click through the offer are asked to answer a series of questions before being congratulated for winning the offer. The site then requests that victims share the scam offer with 10 different people via WhatsApp in order to activate the free subscription. In doing so, the scammers ensure they reach a wider audience.
After the victim has shared this scam, the website asks the users to enter their streaming account credentials. Upon doing so, users are redirected to the legitimate streaming site. By redirecting to the legitimate site, users will have no idea they have been scammed - until of course, they do not receive their free subscription or account credit. Scammers can then sell these account credentials online, or attempt to use them to log in to other accounts the user may own, creating a ripple effect for future account takeover attacks.
Avoid Streaming Scams
If a user’s account is hacked or their credentials are stolen, they may blame the legitimate streaming service. This can lead to customer dissatisfaction and ultimately a loss in revenue for the streaming service. With so many competing services and high customer acquisition costs, customer loyalty is key. Particularly during these vulnerable times, protecting streaming users should be a top priority for these service providers. While this particular scam site is no longer actively serving content, the ZeroFox Alpha Team is continuing to monitor this site and actively monitoring for other sites that could be stood up to conduct similar scams. If you are a user of a streaming service, make sure you are always logging in to the legitimate service and remember, if a deal seems too good to be true, it probably is.
Learn about other threats facing Media and Entertainment
Phishing sites and stolen account credentials are two major threats facing the media and entertainment space, as outlined in this blog. But other threats, such as sensitive and inappropriate content, impersonations and piracy are facing media and entertainment organizations across digital platforms as well. The ZeroFox Alpha Team released a digital threat report on the top risks facing the media and entertainment industry. Download the report and read the full findings here.