0

I've been really dumb and clicked a phishing link.

The link arrived via WhatsApp and consists of:

A Nubank está fazendo aniversário e quem ganha o presente é você!. São 2.000 convites para um novo cartão com até R$ 12.000,00 de limite, e o melhor, sem consulta ao SPC/Serasa. Eu já fiz o meu, corra fazer o seu, restam poucos convites! Para resgatar seu convite acesse 👉
[redacted link]

(Roughly translated, it offers a new credit card or an upgrade to your current one).

The redacted link opens this which redirects to this.

I've opened the link on my mobile browser (Chrome 72.0.3626.121 on Android 6.0.1, latest Chrome for Android according to Wikipedia) and didn't initially realized it was a phishing campaign.

It shows a generic "landing page", but didn't ask for personal data, just 3 apparently innocuous questions.

I answered the questions and it then it instructed me to share a link to my WhatsApp contacts.

I got suspicious and quit. Then I called my card provider and they assured me they don't do campaigns on messenger apps and the links were not legitimate.

Questions

What do they want?

What's the point of this campaign if they don't ask for personal data or passwords? They seem to go from the "capture" to the "replication" stage without the actual action in-between.

Here's what the whole process looks like:

  • Receive the previously stated message from a trusted WhatsApp contact.
  • Click on the link, it opens a sort of "landing page".
  • The page cointains some jQuery code and a button with a yes / no question. You pick an answer, it shows another yes/no question, 3 in total ("Do you onw a "x brand" card / "Would you like a new one with a $12k limit" / "Do you prefer mastercard or visa").
  • From a very quick glance on the code, it looks like they don't even send that data anywhere, as there is no <form> element).
  • Now the page asks to "share this with your WhatsApp contacts" and shows a link.
  • Clicking this link opens the real, actual WhatsApp app in a sharing screen asking you to pick a contact (I stopped here and closed WhatsApp without picking a contact).
  • If you pick a contact, it sends them the very same message that brought me to this very page (I didn't actually sent anyone anything and inferred this from logic as well as from the code, as the message I received is hard-coded on the source code).

Something must be happening on that page, but it isn't capturing private info; at least, not ones inputted by the user. It looks like all they want is for exponential sharing to happen and then... what?

Is there an exploit or other kind of payload here?

Has my browser or OS been compromised?

I have cleared all my cookies and site data from Chrome. Is there any other action I should perform?

It would be really inconvenient to reset my device to factory state, and even more to flash a retail ROM. I only want to do it if absolutely necessary.

2

The point is to draw you into their web of interactions. The more you tell them non-private info, the more likely you are to answer with private info when they ask. Also, the link itself might try to infect your browser/device.

Clearing your cookies and data is not going to do anything. I'd make sure your Chrome was already up-to-date (there was a major security patch this week), and run scans on your device.

  • Yes, but what web of interactions? How would I provide them private info if they don't ask? The whole process is click link from whatsapp -> open phishing page with 3 buttons -> share same page to WhatsApp contacts. Something must be happening on that page, but it isn't capturing private info; at least, not ones inputted by the user. – That Brazilian Guy Mar 9 at 16:28
  • Also, what kind of scans should I run on my device? So far I've always heard consistently that Android antiviruses are more or less snake oil. I know it's a whole different question so if there are good links on that I'd appreciate. – That Brazilian Guy Mar 9 at 16:29
  • You mean that you completed the full interaction chain on the site? – schroeder Mar 9 at 16:57
  • The full interaction chain seems to be receive whatsapp message with link -> arrive on site -> click on 3 buttons with questions that apparently (I glanced at the code, might be wrong) are ignored -> "now click here to share this to your whatsapp contacts" -> whatsapp sharing screen opens. I stopped here and didn't send the link to anyone else. – That Brazilian Guy Mar 9 at 16:59
  • We can't really provide you with recommended anti-virus. – schroeder Mar 9 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.