Nov 23, 2023

The large-scale scam attack also exploits well-known Lithuanian and foreign personalities. Part II

In Lithuania, online scammers are creating copies of major news portals and fake Facebook accounts, and inviting people to invest in fake investment platforms in order to swindle money from citizens of Lithuania and neighbouring countries. In order to attract more people's attention, the advertisements offering quick financial success also use recognisable faces such as performers, journalists, politicians and influencers.

Unidentified persons are exploiting the brands of LRT, LNK, Delfi, InfoTV, the Estonian national broadcaster, ERR, the Estonian newspaper, Eesti Päevaleht, as well as Ignitis and Orlen Lietuva by creating fake copies of their accounts, which show fake ads under the name of these brands.

Part I of the investigation:

https://www.debunk.org/the-largest-disinformation-and-scam-attack-ever-recorded-in-lithuania-part-i

The main objective of the ads is to trick Facebook users using fake Facebook accounts into participating in fake investment schemes.

It should be noted that online scammers use fake or cloned accounts that lead Facebook users to websites with articles that replicate the visual elements of well-known Lithuanian news portals (e.g., easily recognisable logos, website-specific fonts, brand-unique website structure, etc.).

FAKE FACEBOOK ADS INCLUDE WELL-KNOWN LITHUANIAN PERSONALITIES

To grab users’ attention, besides the scandalous criminal events, scammers are also exploiting well-known Lithuanian and foreign personalities, such as journalists, politicians, athletes, influencers, etc.

Scammers are using their pictures, distorting true stories or inventing completely fictitious stories that promise supposed financial success. Fake ads are always reinforced with shocking statements, for example:

· “Anužis is in deep trouble for his statements on air”

· “Stop throwing your money at idiots! Just repeat this...”

· “Mildažytė’s reputation is done”

· “The outcome for G. Deksnys doesn’t look good...”

· “After an interview with Gitanas Nausėda, thousands of people went to ATMs and the banks were surprised”

· “Marijonas Mikutavičius spoke about his income on a show and freaked out after receiving a phone call from a bank after which he demanded to stop the show”

Criminal context is often doctored into some of the pictures used in fake articles (for example, depicting well-known persons supposedly apprehended by the police).

„Facebook“ puslapis, vedantis į netikrą naujienų portalą — Facebook page leading to a fake news portal

Doctored pictures as well as videos are being used in these ads. For example, scammers doctored in a fictitious investment ad into the speech of Mateusz Morawiecki, prime minister of Poland, using deepfake technology:

This is not the first time where scammers have abused the deepfake technology. For example, scammers are using video images generated by AI which replicate the image and voice of Martin Lewis, a well-known financial consultant from Great Britain. M. Lewis took Facebook to court in 2018 over the fake ads using his image to promote fictitious investment schemes. On that occasion Facebook settled, promised to take care of the issue and donated GBP 3 million to a non-governmental organisation that helps people who suffered from a scam attack. However, this year one Great Britain resident lost all her life savings and was mired in thousands of pounds of debt after she fell victim to a crypto-scam advertised on Facebook. The advertisement falsely claimed that it was endorsed by Martin Lewis.

Some ads are being launched from Facebook pages that are not pretending to be the news portals but the pictures in the articles they promote contain the logo of a news portal, for example:

At least 20 well-known Lithuanian and foreign personalitiesare being exploited in fake ads (listed in alphabetical order).

1. Artūras Anužis, TV3 news presenter

Netikras „Facebook“ puslapis „LNK“, apsimetantis LNK ir vedantis į netikrą „Delfi“ portalą — A fake LNK page in Facebook, pretending to be LNK and leading to a fake Delfi website.

Netikras „Facebook“ puslapis „Info Dienraštis“, apsimetantis „Info TV“ ir vedantis į netikrą „Delfi“ portalą — A fake Info Dienraštis page in Facebook, pretending to be Info TV and leading to a fake Delfi website.

2. Vidas Bareikis, singer

3. Gintaras Deksnys, LNK news presenter

Netikras „Facebook“ puslapis „LNK.lt“, apsimetantis LNK ir vedantis į netikrą „Delfi“ portalą — A fake LNK.lt page in Facebook, pretending to be LNK and leading to a fake Delfi website.

4. Andrzej Duda, President of Poland

5. Kaja Kallas, Prime Minister of Estonia

6. Alar Karis, President of Estonia

„Facebook“ puslapiai, vedantys į netikrą „Delfi“ naujienų portalą ir „Ignitis“ apsimetančią investavimo platformą — Facebook pages, leading to a fake Delfi news portal and an investment platform pretending to be Ignitis.

Netikras „Delfi“ naujienų portalas su straipsniu, vedančiu į „Ignitis“ apsimetančią investavimo platformą — A fake Delfi news portal with an article leading to an investment platform, pretending to be Ignitis.

7. Darius Maikštėnas, CEO at Ignitis Group

8. Edita Mildažytė, journalist

9. Marijonas Mikutavičius, singer

Netikras „Facebook“ puslapis, vedantis į netikrą „Delfi“ portalą — A fake Facebook page, leading to a fake news portal.

10. Darius Mockus, CEO at MG Baltic Group

11. Mateusz Morawiecki, Prime Minister of Poland

„Facebook“ puslapis, vedantis į netikrą naujienų portalą, naudoja suklastotą vaizdo įrašą — A fake Facebook page, leading to a fake news portal.

12. Gitanas Nausėda, President of Lithuania

13. Edgars Rinkēvičs, President of Latvia

14. Viktorija Siegel, influencer

15. Deividas Šemberas, football player

Netikras „Facebook“ puslapis „Lietuvos naujienos“, apsimetantis „Delfi“ ir vedantis į netikrą „Delfi“ portalą — A fake Lietuvos naujienos page in Facebook, pretending to be Delfi and leading to a fake Delfi website.

16. Ingrida Šimonytė, Prime Minister of Lithuania

17. Andrius Tapinas, journalist, public figure

18. Ott Tänak, Estonian rally driver

Netikras „Facebook“ puslapis „ERR Live.ee“, apsimetantis ERR ir vedantis į netikrą „Delfi“ portalą — A fake ERR Live.ee page in Facebook, pretending to be ERR and leading to a fake Delfi website.

19. Greta Thunberg, climate activist

20. Donald Tusk, former president of the European Council

FACEBOOK PAGES AND WEBSITE PRETENDING TO BE REAL MEDIA OUTLETS

Ads promoting fake articles that exploit well-known personalities are being published by Facebook accounts pretending to be media outlets. They lead to cloned websites that replicate the design of real portals.

For example, an account Lietuvos naujienos, pretending to be DELFI TV and using a Delfi logo, was first registered on 20 March 2023 and was called Distant chillax. On 25 September of the same year, it was renamed to Lietuvos naujienos.

Sukčių naudojama netikra paskyra pasivadinusi „Lietuvos naujienos“ apsimeta „Delfi“. Kelis kartus keitė pavadinimą. — A fake account Lietuvos naujienos used by the scammers, pretending to be Delfi. The name was changed several times.

Sukčių naudojama netikra paskyra pasivadinusi „Lietuvos naujienos“ apsimeta „Delfi“. — A fake account Lietuvos naujienos used by the scammers, pretending to be Delfi.

Scammers also created copies of Info TV. Over the period of October–September 2023 16 similar Facebook pages were created: Info Žinios, Info Dienraštis, INFO 24 Naujienlaiškis, INFO Žurnalas, INFO Diena, and Info RU, which was in Russian.

Sukčių naudojama netikra paskyra pasivadinusi „Info Dienraštis“ apsimeta „InfoTV“. — A fake account under the name Info Dienraštis used by the scammers, pretending to be Info TV.

Scammers also created many copies of fake LNK pages in Facebook, a part of which are already blocked, while the latest one was created on 1 September 2023 and is still accessible.

Sukčių naudojama netikra paskyra pasivadinusi „LNK“ apsimeta „LNK“. — A fake account under the name of LNK used by the scammers, pretending to be LNK.

Lithuania was not the only target, there were Facebook pages created in Estonian as well: ERR 24Live, ERR Live, ERR.ee

Sukčių naudojama netikros paskyros pasivadinusios „ERR 24 Live, ERR Live, EER.ee“ apsimeta Estijos nacionaliniu transliuotoju „ERR“.

Sukčių naudojami domenų pavadinimai, kurias apsimetama naujienų portalais — Scammers are using domains that pretend to be new portals.

EXAMPLES OF COPIES OF MAJOR NEWS PORTALS

Sukčių naudojama netikra „Elta“ kopija kurioje nuorodos veda į netikrą investavimo platformą „Bit Sprix Ai“ — Scammers are using a fake Elta website, which contains links to a fake investment platform Bit Sprix Ai.

Sukčių naudojama netikra „Delfi“ kopija kurioje nuorodos veda į netikrą investavimo platformą pavadinta „Oil pump“

Sukčių naudojama netikra „Delfi“ kopija kurioje nuorodos veda į netikrą investavimo platformą pavadinta „Oil trade“ — Scammers are using a fake Delta website, which contains links to a fake investment platform Oil Trade.

Sukčių naudojama netikra „Delfi“ kopija kurioje kviečiama registruotis netikrą investavimo platformą pavadinta „Oil profit“ — Scammers are using a fake Delfi website, which contains links to a fake investment platform Oil Profit.

EXAMPLES OF FAKE INVESTMENT PLATFORMS

Scammers are advertising the following fictitious investment platforms:

· Oil profit

· Oil trade

· Ignitis profit sense

· Pump Oil

· Oil Pump

· Kvantinė uždarbio sistema

· GPT App Definity

· Bitcoin Videx 4.0

· BitSoft360

A cloned Ignitis website (controlled by scammers): Ignitis profit sense

Sukčių naudojama netikra „Ignitis“ kopija kurioje kviečiama registruotis netikrą investavimo platformą pavadinta „Ignitis profit sense“ — Scammers are using a fake Ignitis website, which invites to register at a fake investment platform under the name of Ignitis profit sense.

The website is proposing a supposedly exclusive deal for traders in Lithuania that promises high returns on electricity and gas trading. The website is using Ignitis name and logo. The website also depicts fake comments and a countdown clock to artificially create a sense of urgency in order to convince users to register at the website advertising the investment scheme and deposit money.

Netikra investavimo platforma Bitsoft360 ir Bitcoin Videx 4.0 — Fake investment platforms Bitsoft360 and Bitcoin Videx 4.0.

2023 Netikra „Oil Trade“ platforma — 2023 Fake Oil Trade platform.

Netikra „Kvantine investavimo platforma“ — A fake investment platform Kvantine investavimo platforma.

The large-scale scam attack also exploits well-known Lithuanian and foreign personalities. Part II

FAKE FACEBOOK ADS INCLUDE WELL-KNOWN LITHUANIAN PERSONALITIES

FACEBOOK PAGES AND WEBSITE PRETENDING TO BE REAL MEDIA OUTLETS

EXAMPLES OF COPIES OF MAJOR NEWS PORTALS

EXAMPLES OF FAKE INVESTMENT PLATFORMS

Part of the study was carried out in cooperation with Ignitis Group.

Related Posts