A wave of phishing campaigns across the Middle East and North Africa exposes a sophisticated, centralized fraud ecosystem operating under the SniperDz banner.
What initially appeared as isolated Facebook and Instagram scams fake offers for free mobile data, government subsidies, and compensation are linked to a turnkey Push-Notification-as-a-Service (PNaaS) and Phishing-as-a-Service (PhaaS) affiliate platform that streamlines large-scale impersonation, credential theft, and traffic monetization.
Analysts traced dozens of fraudulent social accounts impersonating politicians, telecom operators, and trusted brands.
These accounts led victims to link-aggregation services such as Linktree and Linkbio, which acted as intermediary reputation buffers.
From those decoy pages users were funneled through multi-stage redirection chains into SniperDz-controlled infrastructure.
The platform’s library contains some 80 phishing templates cloning more than 30 global brands PayPal, Facebook, Instagram, Netflix, Steam, and major telcos enabling low-skill operators to deploy credible lures quickly.
Group-IB analysts identified multiple fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations.
Beyond credential harvesting, the SniperDz ecosystem monetizes traffic through multiple vectors. The final funnel stage frequently requests browser notification permission using a consistent VAPID public key observed across campaigns.
Once granted, push subscriptions provide persistent access to victims for unsolicited promotions, scams, and affiliate offers.
Hackers Exploit SniperDz PhaaS
Group-IB’s identification of a recurring VAPID key serves as an infrastructure fingerprint, linking otherwise disparate campaigns to the same notification backend and enabling clustering of malicious activity.
To build trust, scammers impersonate well-known telecom providers such as Algérie Télécom, promoting fake offers that promise free mobile data, internet packages, or other exclusive benefits.
Technical techniques used to retain and exploit users are notable for their stealth and persistence. Cloaking logic suppresses malicious content for detected crawlers or researchers, returning benign error pages instead.
The landing pages incorporate browser history manipulation that injects fake entries, creating a “back-button prison.” Tab-under scripts and delayed redirects keep victims inside the fraud flow even after they attempt to leave.
These combined methods maximize conversion rates for premium-rate calls, premium SMS subscriptions, investment scams, and affiliate payouts.
Monetization is dynamically tailored: the traffic distribution engine assesses device type, geolocation, and mobile carrier, then routes users to the highest-value offer whether a carrier-billed premium call, recurring SMS subscription, or a lead-generation form for follow-on fraud.
Group-IB located clusters of interconnected domains and hosting resources over 900 suspicious domains with shared IPs (for example 65.60.9[.]236, 108.178.23[.]118, 184.154.10[.]254) tied to the same hosting provider, reinforcing evidence of a centralized platform.
The campaign’s operational tradecraft also abuses high-reputation services as a concealment layer. By routing users through legitimate link-in-bio pages, actors reduce the likelihood of automated detection on social platforms and amplify reach through feeds and sponsored content.
Localized social engineering increases credibility; several pages were hardcoded in Arabic and mimicked regional telecom branding to maximize trust among MENA users.
Defenders can use the publicly reported indicators and the recurring VAPID key to cluster related activity and prioritize takedowns.
Group-IB’s Threat Intelligence Portal documents the SniperDz actor profile and associated domains; customers can access deeper telemetry and indicators.
Remediation steps for users include revoking suspicious notification permissions via browser site settings and reporting impersonating social accounts.
This investigation underscores a shift: phishing-as-a-service platforms like SniperDz are evolving into full-stack traffic-brokering ecosystems that weaponize browser features and trusted services to evade controls and scale revenue.
Effective disruption will require coordinated takedowns of hosting infrastructure, blocking of identified VAPID endpoints, and sustained platform policing of link-aggregation abuse to cut off the funnels these operations exploit.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
