Fake government sites lure Central Asians with cash offers

According to Recorded Future News, cybercriminals have built hundreds of fake government and news websites aimed at people in Uzbekistan, Belarus and Tajikistan. The sites promise cash payments or passive income through government-backed programs that do not exist.

Researchers at cybersecurity firm F6 traced more than 360 fraudulent domains tied to the campaign, as Recorded Future News reports. The group behind the campaign has not been identified, and it is not known how many people have lost money to it.

How the approach lands

The scam starts with trust in a government program. In Uzbekistan, fake sites promise residents weekly payments of 15 million Uzbek sums, about $1,300. Some pages are plain landing forms. Others copy the look of regional news outlets, publishing fake stories about assistance programs before steering readers to a questionnaire.

The first ask is small. A visitor gives a name and a phone number, nothing more. That single step is what the whole scheme depends on, because it converts a passing visitor into a lead the scammers can call back.

What happens after the form

Once the details are submitted, someone calls, posing as a personal manager for the program. From there the requests escalate. Some victims are asked to pay a commission or processing fee before the promised money can be released. Others are pushed to hand over more personal information, or to install a mobile application described as necessary for registering or verifying identity.

That application is malware. F6 says it can give attackers control over the device and, from there, access to the victim's accounts. In other cases, victims are asked to send passport scans as part of a supposed verification step. Those scans do not verify anything; they become material for further fraud, including loans taken out in the victim's name or new phishing attempts against them.

The tell

Every layer of this scam depends on the first one working. No form, no phone call. No phone call, no malware install, no passport scan. The sites are built to look like government portals and local news because that resemblance is what gets someone to type in a phone number in the first place; the fraud downstream, the fee, the app, the document request, only becomes possible once that first form is filled in.

The visual copying is the disguise, but the phone number is the asset. A fake headline about a benefits program is not the theft; it is the bait that produces a callback list. What the F6 report does not settle is how those numbers are being harvested at scale, how much money has moved through the fake commission requests, or which of the 360 domains have already been taken down.