How scammers use faked news articles to promote coronavirus 'cures' that only defraud victims

It's the latest effort to separate anxious web users from their hard-earned cash.

Scammers are relying on fabricated news articles about the COVID-19 pandemic in an attempt to trick readers into signing up for bunk coronavirus cures.

A network of content farm websites — the kind of sites that typically publish false hyperpartisan articles — are masquerading as legitimate news sites as part of an attempt to scam Americans, according to research published Wednesday by RiskIQ. By posting what appeared to be inflammatory news articles with headlines like “One Mom Has Found a Solution to Fight Back Coronavirus,” fraudsters aim to bring a would-be victim to their website, then inundate them with ads for expensive, and fake virus cures.

“Our research found that several of the advertisements loaded on these fake news sites lead to subscription traps,” the report states. “A subscription trap works by offering a free or deeply discounted trial of a product while hiding clauses in the terms of service that sign victims up for costly payments remitted on a repeated basis, usually monthly.”

A content farm run by media company Bytesignal functioned as an origin point for the subscription trap, researchers found. One site that RiskIQ tied to Bytesignal was coronaoutbreakmap[.]com, which traffics in unfounded right-wing conspiracies, such as the idea that the coronavirus was a human-engineered bioweapon, or the idea that philanthropist Bill Gates would endorse police tracking over proper nutrition.

Hundreds of similar sites deployed similar tactics, including some with names like 2020conservative[.]com and patriotnationpress[.]com, RiskIQ said. Numerous sites also were hosted on the same IP address, an apparent indication that a single computer was orchestrating at least a fraction of the fraud effort. Bytesignal also appears to be behind a network of social media pages that broadcast right-wing memes to thousands of followers, and have sent more than 43,000 tweets since 2016. (Bytesignal did not respond to a request for comment Tuesday.)

Some of the articles were accompanied by advertisements provided by the Newsmax Feed Network, a targeted advertising firm promising to connect publishers and advertisers that BuzzFeed News has previously identified as a publisher of fake news.

One ad situated at the bottom of a fabricated news story is dressed up under the headline “One Mom Has Found a Solution to Fight Back Coronavirus.” Clicking that article triggers a page meant to resemble a Fox News story that is, in fact, a long advertisement for a CBD oil that falsely promised to “disinfect any surface including your skin.”

At the bottom of the page, the ad encouraged readers to redeem an offer to get a 40% discount. Language buried in the offer, though, notes that recipients will be charged $89.95 for the initial bottle of CBD, and an additional $89.95 for each month until they cancel.

A closer inspection of the fraud network indicated that the as many as 1,459 domains were used between Nov. 11, 2016 and Jan. 13, 2020 to hawk wellness products ranging from CBD oil and beauty creams to keto supplements and “nutraceuticals,” the dietary supplements marketed to boost health benefits.

Researchers tied the sales effort to a Utah-based marketing firm called Offer Space, a company called Immunity Blend CBD oil and Modernized Media, a Utah-based software company. Modernized Media did not respond to a request for comment from CyberScoop. Contact details for Immunity Blend CBD and Offer Space could not immediately be reached.

While researchers did not quantify sales figures generated by the fraud effort, RiskIQ determined “that sales of many questionable goods were carried out through LLCs, obscuring the connections between the products and the companies that produce them[.]”

These findings build on recent research from New York-based Graphika and other social media analysis firms that have determined how right-wing groups and conspiracy movements have seized on the coronavirus pandemic to spread their messaging, or try to monetize their efforts.

Far right gun advocates also have organized a series of websites and Facebook pages that urged municipalities throughout the U.S. to abandon shelter-in-place orders. In fact, a fundraising arm of the digital demonstration sent funds into a gun rights group without informing users about the true direction of the money.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure