Currently, users throughout Asia are the target of a sophisticated cryptocurrency scam campaign that heavily and specifically targets Japan. Malvertising and "pig butchering," two different fraud models, are combined in this operation to create a single, extremely potent attack vector. Cybercriminals are effectively stealing enormous sums of money from unwary investors by fusing the psychological manipulation of long-term social engineering with the widespread reach of malicious advertising.

According to recent reports, individual victims have fallen for these complex schemes and lost up to ¥10 million. Malvertising and pig butchering combined (Source: Infoblox) Malvertising, in which threat actors post convincingly phony ads on social media sites like Facebook and Instagram, is the first step in the attack sequence.

To entice victims, these advertisements usually pose as well-known financial professionals or advertise proprietary "AI-driven" investment algorithms. Users are taken to fake "lure" websites that imitate trustworthy investment portals when they click on these advertisements. In order to obtain "special" instructions, these websites eventually ask the victim to scan a QR code and join a chat group on messaging apps like LINE, WhatsApp, or KakaoTalk.

After noticing a large cluster of dubious domains that were disproportionately queried by Japanese users, Infoblox analysts were able to identify the malware ecosystem. After victims sign up for the messaging apps, they are probably contacted by sophisticated AI-driven bots rather than human operators. As assistants, these automated agents converse with victims continuously to foster trust.

They promote modest initial investments that seem to yield large returns and spread false success stories. Victims are eventually convinced to send bigger amounts. The scammers demand a "release fee" when they try to withdraw their money, which further damages their finances before they disappear.

Automated Infrastructure and Engagement This campaign's reliance on automation to expand operations internationally is a crucial component. Registered Domain Generation Algorithms (RDGAs) are used by the attackers to quickly create thousands of new domains. They can quickly rotate infrastructure thanks to this technique, which makes it challenging for security teams to successfully block the scam. This ecosystem has been connected to more than 23,000 domains, many of which use lookalike names to seem authentic.

Our "LINE" messaging app displays three campaigns' worth of scam groups and chats (Source: Infoblox). Additionally, the chat interactions show obvious indications of AI support, including smooth language switching and 24/7 instant responses. Because of this automation, scammers are able to continue producing high-quality social engineering attacks without being constrained by the labor requirements of conventional fraud models.

The infrastructure proposes a "service" model that allows several actors to use the same tools to launch attacks at the same time. Suggestions Before you believe social media advertisements, make sure to check the official accounts of financial professionals. Any investment opportunity that makes unrealistic or guaranteed returns should be viewed with extreme skepticism. Refrain from scanning QR codes or clicking links from unreliable sources.

Don't send cryptocurrency to people you've only met through online chat rooms.

Set ZeroOwl as a Preferred Source in Google and use X, LinkedIn, and LinkedIn to receive more real-time updates.