Mystery Shopper: Beware of Frauds

Offers to work as a mystery shopper are a common trick used by fraudsters. They give you a chance to work in your free time, and if you agree, they send you a fake check with a huge sum of money, which is supposed to compensate the costs of goods and research. Any remaining money left over after the work is returned to the fraudsters. When the bank annuls the check as a fake, the secret shopper is left out of pocket.

But as users become more aware of online dangers, scammers have had to resort  to various types of tricks to achieve their goals, such as disguising scammer mailings as a mailing from a large company specializing in working with secret shoppers. The message, sent on behalf of Mystery Shopper Inc., prompted the user to look at a description of the vacancy, but the attached link led to another resource that also specializes in this type of market research.

The real address of the scammer’s page was revealed after clicking the attached link. Obviously, it had nothing to do with Mystery Shopper Inc. official resources.

The fraudulent site described the benefits of working as a “mystery shopper”. To get the job the user was asked to fill in a form with personal data (full name, age, postal address and email).

I filled it in and in response received a message with a detailed guide about the research activity as a “mystery shopper”. The message ended with a promise that a check for all the costs would be sent to the stated address. The biggest giveaway that this was a fraud was the free mailbox stated in the contact information, and not the email of the company who had supposedly sent the message.

Avoid this sort of scam by following some simple rules: ignore letters from resources you’re not registered to, and carefully study the addresses in the attached links. If you do that there will be little temptation to pay lots of money for a fake check.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.