Cybercriminals Launch Flood of Fake Forex Platforms to Harvest Logins

Fraudulent investment platforms impersonating legitimate cryptocurrency and forex exchanges have emerged as the primary financial threat across Asia, with organized crime groups operating at unprecedented scale.

These sophisticated scams leverage social engineering tactics to deceive victims into transferring funds to attacker-controlled systems, blurring the lines between legitimate trading and criminal enterprise.

The threat extends far beyond national borders. Recent investigations reveal that investment scams conducted through fake online platforms are rapidly proliferating throughout Vietnam and neighboring regions, with threat actors exploiting weak Know Your Customer (KYC) and Know Your Business (KYB) verification controls.

The scale of these operations became apparent in August 2025 when Vietnamese authorities dismantled a billion-dollar cryptocurrency scam involving the Paynet Coin platform, resulting in the arrest of 20 individuals charged with multi-level marketing violations and asset misappropriation.

Unlike traditional cybercrime, these investment scams operate through highly structured organizational hierarchies.

Contrary to assumptions about individual fraudsters, researchers have identified a distributed model involving multiple actors with distinct roles and responsibilities.

This architecture enables mass victimization across countries and languages while complicating investigation and takedown efforts.

The operational structure includes a central mastermind overseeing the entire fraud ecosystem, supported by specialized teams.

Target Intelligence operatives acquire stolen personal information from the dark web to identify high-potential victims with signs of wealth or investment interest.

Promoters create convincing personas on social media platforms including Facebook, TikTok, and Telegram, posing as successful entrepreneurs and financial experts.

Payment Handlers establish and manage bank accounts and digital wallets used to collect victim funds, exploiting weaknesses in financial verification systems.

Backend Operators design fake investment platforms, manage chatbot widgets, and integrate systems that display fabricated profits and fake dashboards.

The Manipulation Funnel

The scam follows a consistent victim manipulation flow designed to maximize extraction of funds. Initial contact occurs through social media or messaging applications, where scammers present themselves as successful investors.

When victims hesitate, scammers introduce additional personas—fake fellow investors, friends, or support staff—to simulate legitimate activity and build confidence in the platform’s credibility.

Once trust is established, scammers present high-return investment opportunities through convincing fake interfaces, promising guaranteed profits with minimal risk.

The platforms then display fabricated earnings to convince victims their investments are growing. Some victims receive small initial withdrawals to deepen trust.

Behind the polished interface of a fake trading platform is a highly organized operation with defined roles, structured workflows, and cross-functional teams.

Larger deposit requests follow, often citing fabricated excuses. When victims attempt full withdrawals or express doubt, scammers abruptly terminate communication and move to new targets.

Technical analysis reveals these campaigns depend on shared backend infrastructure rather than isolated throwaway sites.

Scam platforms gate entry through invitation or referral codes, restricting casual reconnaissance while binding each account to a specific promoter. This control mechanism ensures victim onboarding remains traceable within the fraud network.

Backend operations include chat-based onboarding systems powered by third-party services to screen pre-selected victims.

Monitor API endpoints involved for KYC form submissions and document uploads: Examples of such API requests are presented.

These chatbots deliver payment instructions including corporate bank accounts and cryptocurrency wallet addresses. Analysis of chatbot payloads reveals configuration data, registered service accounts, and linguistic patterns supporting attribution.

Exposed admin panels provide backend control points for managing victims and infrastructure, with recurring interfaces and code revealing shared centralized backends across multiple scam domains.

Regulatory Pressures Drive Adaptation

Vietnam’s Circular 17/2024 from the State Bank, effective July 1, 2025, imposed stricter corporate account requirements including biometric verification.

Even if the domain has already been taken down, archived scans often preserve the complete HTML and JavaScript, enabling analysts to reconstruct and study the original site structure.

Anticipating these controls, scam operators have established thriving black markets for forged business licenses, falsified legal documents, stolen identity cards, and even face-swap technology to bypass verification requirements at scale.

The evolution toward increasingly sophisticated social engineering and automated systems suggests emerging integration of generative AI into fraud infrastructure.

These developments highlight a critical need for coordinated international enforcement, stronger financial controls, and public awareness to counter this transnational threat.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.