Over 2,000 fake job postings were directed at Arabic speakers in the Middle East and Africa in 2022, according a recent industry report.
According to the study by Group-IB, scammers intend to infiltrate the victims’ social media accounts, obtain their passwords, and subsequently gain access to their bank accounts.
From January 2022 to January 2023, Group-IB’s Threat Intelligence and Research Center in Dubai evaluated more than 2,400 fake job postings on social media networks, which replicated firms from 13 nations in the Middle East and Africa region.
The perpetrators impersonated over 40 of the region’s largest establishments and issued fake job openings in Arabic, advertising attractive salaries, a tactic designed to lure victims into engaging with the post.
“This particular scam case is significant as it targets individual internet users in the Middle East and North Africa on Facebook, a highly popular social network in the region,” said Sharef Hlal, Head of Group-IB’s Digital Risk Protection Analytics Team, MEA.
He also pointed out that these scammers are “targeting job seekers, to steal their credentials and potentially cause them financial loss.”
The ultimate goal of the scammers was to obtain the victim’s login credentials for their social media account through a social engineering ploy. To achieve this, the scammers included links to fraudulent pages in the publications posted on bogus social media profiles. These deceitful sites were connected to phishing pages that coaxed the victim to input their login credentials and passwords.
During the scam campaign, Group-IB analysts discovered internet users who speak Arabic are the primary targets, as all of the job adverts are posted solely in that language.
The perpetrators most frequently targeted companies in Egypt, accounting for 48 percent of all counterfeit profiles established on Facebook. In addition, organidations from Saudi Arabia (23 percent of all fraudulent pages), Algeria (16 percent), Tunisia (7 percent), and Morocco (4 percent) were also commonly replicated. The scam campaign began in January 2022 and attained its peak activity in August of the same year, when 609 new scam pages were generated.
