Cybercriminals Steal PII from Jio Users via Fake Recharge Scam

Alpha Team has identified a new scam that lures Jio users into disclosing their Personally Identifiable Information (PII) in exchange for a free recharge, or prepaid account credit. Amidst the COVID-19 outbreak, cybercriminals continue to find ways to trick people with fraudulent offers. One such viral scam circulating across WhatsApp claims to offer ₹498 recharge benefits for free to every Jio customer who enrolls in the program, as well as unlimited voice calls and 4G data. It further claims that the free recharge is a limited-time offer, applicable only until March 31, 2020, and lures Jio users to visit the embedded link where they are prompted to enroll in the fake program.

Recommendations

Consider enabling the Cyber Attack Chatter rule to monitor developing threats to your organization
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities.
Refrain from visiting any sort of promotional links before verifying their authenticity
Continue monitoring the Alpha Team Tab for reports related to the dark web and threat actor activities
For further assistance, reach out to [email protected]

Details

Reliance Jio Infocomm Limited, also known as Jio, is one of the largest telecommunications company in India with over 370 million customers across the country. On March 25, 2020, India began a 21-day lockdown to combat the coronavirus spread in the country. With an increased number of users staying at home, demand for the Internet has spiked and many telecom providers are offering benefits to support their users. Similarly, scam offerings have begun circulating on social media platforms, including WhatsApp. One such scam offer is this free recharge benefit of ₹498. The message detailing this fraudulent offer started circulating soon after the announcement of the lockdown on March 24th, 2020.

Figure 1. WhatsApp message advertising the fraudulent offer

The link in the post directs users to jiofree[.]online where they are prompted to enter their name, mobile number, and state of residence. Additionally, the users are also required to agree to the terms and conditions of the offer. In a span of 3 days, 5 similar structured sites have been registered. At the time of posting the domain jiofree.online is no longer actively hosting content. However, the site redirects users to any of the active sites listed below.

jionewoffer[.]online
jio-offer[.]online
jiofreerecharge[.]xyz
jiofreerecharges[.]online
jiorecharge[.]xyz

These similar sites are still actively hosting malicious content and continue to be circulated.

Figure 2. Homepage of the fake Jio site

Figure 3. Users are prompted to enter their details

Upon submitting the required details, the website displays a popup message to the users, instructing them to share the message advertising the recharge offer to 5 of their friends/contacts via WhatsApp to take advantage of the free offer.

Figure 4. Popup asking users to forward the message to 5 people

Conclusion

Scams of all kinds continue to circulate during the lockdown and attackers are not shying away from taking advantage of these difficult times. Scams like this one tend to create a false sense of urgency, to better trick victims into falling for limited-time offers. The PII harvested by this scam could be used for a variety of attacks, including SIM swaps, where social engineering techniques are used to convince a mobile provider to switch a victim’s phone number to an attacker-controlled SIM card. This kind of attack has become increasingly popular, as it can be used to gain access to linked accounts by resetting passwords on platforms that do this via an SMS code. As always, anything that looks too good to be true is likely a false promise. To reduce your risk of falling victim to scams like this one, Alpha Team recommends applying the recommendations given above.