In Montenegro, users of Meta social media platforms have been targeted by misleading advertisements promoting various cryptocurrency platforms. These ads, appearing as boosted posts on several Facebook pages, are designed to resemble reputable local media- cdm.me and vijesti.me. The “Doppelganger” media share 'breaking news' stories alleging that local public figures, such as the mayor of Kotor, Vladimir Jokić, or MP, Andrija Nikolić, have been arrested or murdered for exposing information about cryptocurrency software. The software claims to generate nearly €2,000 in daily profits. At Debunk, we investigated this so-called 'investment' and, while we did not achieve any profits, we uncovered a significant amount of misleading and false content designed to scam people out of their money.
In August and September, an unidentified group or individual targeted Meta’s social media users in Montenegro, with false ads for dubious cryptocurrency platforms. The advertisements appear on several Facebook pages as boosted posts in the format of ‘breaking news’ informing about the alleged arrest or implying the death of different local public figures.
A social media user who overlooks the often laughably bad photo edits of supposed arrests or the clumsy use of the local language—reminiscent of a week’s worth of Duolingo practice—might click on a link only to encounter a drama fit for both Hollywood and Bollywood. The story typically involves a local public figure allegedly being arrested, sued, or surviving an attempted murder after supposedly leaking information about a cryptocurrency software 'powered' by AI, promising guaranteed profits ranging from several hundred to nearly €2,000 a day.
The 'full interview', where this supposed 'leak' allegedly occurred, is then 'republished' alongside information about the misfortune that reportedly befell the public figure. Similar to the ‘breaking news’ information about the misfortune, the ‘interview’ is a product of the author's imagination. Most of the efforts in this scam have been put into mimicking the look of reputable media, such as vijesti.me and cdm.me and some of the links even feature authentic pictures of interviews. Still, everything else seems to be the work of a lazy scammer. The number of mistakes made is staggering - the journalists from made-up interviews are being misgendered, the names of journalists next to the pictures are wrong, and sometimes different people have allegedly given the same interview. There is also a touch of irony in the fact that a lot of posts have been made with links that do not work, meaning that someone paid for boosting posts that take you nowhere.
In the ads, the “miracle-working” websites have several names but all have the same ad content structure, logos, colour schemes and potential profits. Although a promise of several hundred to a couple of thousand Euros profit a day seems tempting, the answer to the dilemma - whether the money is real if everything else is false - is obvious.
This is what this scam looks like in the ABCDE framework.
The ABCDE is designed to help organize reports and conduct analysis and assessment clearly and logically. It breaks down disinformation incidents into five key elements: Actor, Behavior, Content, Degree and Effect.
A - ACTOR
The threat actor(s) of this campaign remains anonymous. It is also not confirmed if the same individuals are behind boosting the posts and developing the allegedly money-making platform.
Even though who is behind the network is yet to be responded, we have a pretty good idea of where they are based. The pages sharing the scam's sponsored content have made some contact details available. However, all of the data that the page administrators provided seems fake. The contact details and addresses published are worldwide (from Vietnam to the USA, though none are in Montenegro where the ads are run). Still, according to the data Facebook provided about the administrator of pages most are based in Lithuania and/or the USA.
Although there are no restrictions on Facebook for a person to run a sponsored campaign in another country (except for the campaigns targeting political and social issues), this can explain the poor command of the local language in the posts.
B - BEHAVIOUR
The ads are being placed on Meta social media platforms specifically targeting 18+ year-olds in Montenegro. The sample of the content we analyzed has been collected on Facebook but according to the publicly available data from the Facebook Ad libraries of the analyzed pages, ads have been boosted on Messenger, Instagram, and Whatsapp as well.
PLAN | PREPARE | EXECUTE |
TA01: Plan Strategy: T0073: Determine Target Audiences TA13: Target Audience Analysis: T0072.001: Geographic Segmentation T0072.002:Demographic Segmentation | TA06: Develop Content: T0019: Generate information pollution T0084.003: Deceptively Labeled or Translated T0085:Develop Text-based Content T0085.003: Develop Inauthentic News Articles T0086: Develop Image-based Content T0086.003: Deceptively Edit Images (Cheap fakes) TA15: Establish Social Assets T0007: Create Inauthentic Social Media Pages and Groups T0013: Create inauthentIc websites TA16: Establish Legitimacy T0099: Prepare Assets Impersonating Legitimate Entities TA05: Microtarget T0016: Create Clickbait T0018: Purchase Targeted Advertisements T0101: Create Localized Content TA07:Select Channels and Affordances T0104.001: Mainstream Social Networks | TA09: Deliver Content: T0114.001: Social media |
C - CONTENT
Most of the efforts in this scam have been put into mimicking the look of the local media cdm.me and vijesti.me - the “doppelganger” outlets even feature the headers and special tabs with the news dedicated to the Olympics 2024 (which are not visible currently at the authentic website). However, any possible dilemma if the sites are related to the media is resolved by simply taking a look at the domain and those have nothing to do with the local outlets.
Scammers are counting on the fact that the attention span on social media is very modest and that the association does the rest. However, overseeing the amount and scale of mistakes is almost impossible.
The level of local language skills in the posts and boosted content indicate that it was produced by non-native speakers. The visuals used are both altered and authentic. The author didn’t put a lot of effort into photo edits, and even when the pictures are authentic the mistake is made in the name of the journalist.
Different public figures are included - activists, journalists and politicians. There seem to be no other criteria except for aiming for faces familiar to the audience with no political agenda.
D - DEGREE
The true degree is hard to assess. The analyzed sample was collected throughout August and September, but the campaigns are still ongoing. Another pattern was noticed—the Facebook pages that share boosted ads do not seem to be interconnected (except for the location of the administrators), and the ads they run are always set to a couple of days, making it harder to establish the true degree.
In the sample, we have analysed more than 10 Facebook pages that have shared over 50 different boosted posts with made-up stories about at least 10 different prominent figures in Montenegro- politicians and journalists.
E - EFFECT
It is unknown how many of these apps have been downloaded/used in Montenegro or how much money was lost. No official reports have been made about this scam yet. In several “interviews”, or more precisely deceptive ads 245 Euro are being mentioned as the “initial capital”.
Conclusion
This is where the ad content analysis stopped, but the curiosity didn’t. Attempts to additionally research and double-check the platforms/apps crushed the hopes of earning a fortune. Otherwise, this would not be the topic.
Simply searching for the three mentioned platforms will not get you anywhere. There are no domains that can be attributed directly to them. Reviews are scarce and those who claim this is not a scam seem not genuine - among other things, the links they provide for the platforms do not work. In addition to that, names of the supposedly wonder-making software, seem to correspond or partially overlap with some authentic platforms, making it even harder to distinguish them.
However, the names of the advertised platforms, same as in other similar scams seem to be of lesser importance to avoid being tricked. Learning and recognising the fraudulent patterns is of bigger importance than actually learning the names of the platforms (or any dubious product) - names can be changed easily and require very little effort to do so.
There are two more recommendations:
- always pay attention to the URL and domain - this will help you avoid falling for cheap tricks of impersonating reputable media and always bear in mind
- if it is too good to be true, it probably is.