Cybersecurity researchers at Group-IB have disclosed a fraudulent campaign dubbed "Sniper Dz" that targets users across the Middle East and North Africa (MENA). The operation relies on a network of fake Facebook accounts impersonating local politicians, public figures, and trusted organizations to lure victims.
These malicious profiles promote a range of bogus offers, including free mobile internet packages, financial compensation, and government subsidy programs. The primary goal is to steer users toward phishing pages or browser-based alert scams designed to harvest credentials or install malware.
Technical details remain sparse, but the attack vector hinges on social engineering rather than exploiting software vulnerabilities. Once a user clicks on a promoted link, they are presented with convincing browser alerts that mimic legitimate service notifications, prompting them to enter sensitive information or download malicious payloads.
As of now, no specific patches or security updates are available, as this is a purely social-engineering scam. Mitigation relies entirely on user awareness: verifying the authenticity of Facebook offers, avoiding unsolicited links, and enabling multi-factor authentication on social media accounts.
The broader threat landscape in the MENA region continues to see an uptick in credential-harvesting campaigns, with Sniper Dz representing a targeted evolution of these tactics. Attribution is not currently tied to any known state-sponsored group, suggesting criminal rather than political motives.