Researchers uncovered hybrid cryptocurrency investment scams that combine malvertising-driven acquisition with messaging-app-based pig butchering, primarily targeting users in Japan and broader Asia and leveraging more than 23,000 RDGA-generated and lookalike domains. The campaigns use shared website frameworks, lookalike domains (e.g., youtubefind[.]top), and AI/automated chatbots inside legitimate messaging apps to socially engineer victims into sending funds. #RDGA #youtubefind_top
Keypoints
- Investigators found a hybrid scam model that combines malvertising for mass acquisition with messaging‑app‑centric pig butchering for prolonged social engineering and monetization.
- More than 23,000 domains were associated with the ecosystem, many generated via RDGAs and registered in bulk to enable rapid scaling and domain rotation.
- Lookalike and dictionary-based domains (e.g., googlenames[.]top, youtubefind[.]top) were used to increase credibility and prolong domain longevity, while random-character RDGA domains were cycled faster.
- Structurally similar lure websites and overlapping advertising flows, analytics IDs, and messaging patterns indicate a shared enablement layer or off‑the‑shelf kit supporting multiple operators.
- Actors redirected victims from ads to legitimate messaging apps (LINE, KakaoTalk, WhatsApp) where AI/automated chatbots impersonated experts or assistants and ran scripted group/one‑on‑one interactions to solicit escalating payments.
- Campaigns heavily targeted Japan and other Asian markets but have expanded to English, German, and Spanish audiences, suggesting global reuse and localization of the model.
- Reported individual losses reached up to ¥10 million (~US$63,000), demonstrating significant financial impact on victims who were ultimately asked to pay a final “release fee” for nonexistent profits.
MITRE Techniques
- No MITRE ATT&CK technique identifiers were explicitly mentioned in the article.
Indicators of Compromise
- [Domain ] Campaign lure and hosting examples – youtubefind[.]top, googlenames[.]top, and 23,000+ other RDGA-associated domains.
- [Domain ] Sample campaign-specific domains and regional context – aopmbxeqax[.]click (Japanese campaign abusing Takaaki Mitsuhashi), fhysgth[.]sbs (Japanese campaign), and other examples such as 7973268[.]top and 8jz2x[.]icu.
- [TLD ] Frequently observed top-level domains used by the ecosystem – .sbs, .icu, .top, .click, .buzz (each tied to campaigns across Japan, South Korea, United States, and other regions).