The curious case of the effortful fraud

No matter what position you have, if you work in cybersecurity you will have to deal with phishing one way or another, be it messages, mails, or websites. And even if it's not your main professional task, after a while you're going to have a basic understanding of how phishing operations work, or at least what they are targeting.

Recently I dealt with a case that was vastly different from what I expected. It started with someone reaching out to me about a website purporting to be the official verification portal for government-issued visas for the Federal Republic of Austria:

Government-related phishing sites aren't anything new, they exists in a wide variety of themes and with a diverse end goal. From financially motivated fraud to state-controlled threat actors trying to steal credentials to sensitive systems, phishing sites like the one in this case are a fixture.

But as I started looking at it, it quickly became clear that this was a bit different than the usual stuff. To begin with, the design of the website looked generic. Most criminals are smart enough to just try to copy the visual identity of official government websites, using domain names that at least look like they could be official.

They also tend to try to make sure that the website is remotely believable, so that when a visitor clicks on one of the links or points in the site menu they are not immediately irritated by things not working.

The design of this site wasn't even remotely close to the one used by government websites in Austria, it was rather bland and generic. And whatever you clicked on on that site, except for the input mask, it was either a dead link or a redirect to the root of the page.

On top of that, instead of .at, or something that could be read as .at by some subdomain-trickery, it used a .com-domain, which no government entity in Austria would for official websites / business.

Please don't send me examples that debunk this statement if you encounter them. Knowing how governments often happen to work when it comes to digital infrastructure I'm well aware of the high likelihood of me having to swallow my words here..

Something about it felt off, different. The information about the infrastructure hosting the website didn't contain any surprises (or insight for that matter) - domain registered with name.com, DNS-services provided by nsone.net, hosting provided by AWS.

The IP-addresses the DNS-records resolved to hosted hundreds of other websites as well, and while not being able to confirm it, it very much looked like Amazon Lightsail (or whatever that specific offering of them is called now).

There was also nothing on that site that I could have potentially used to pivot in order to find other sites like it. I've rarely seen a phishing site operate entirely "independently". And in this case, when making a fraudulent site for visas for one country, why not create the same for other countries?

There was no favicon, no analytics ID, no relevant information in the certificate transparency log, no content fingerprint, no external resources I could try to link somehow .. I was unable to find anything that would have allowed me to link this site to a known threat actor or campaign, or even find similar sites like it.

At this point I gave up trying methods I was at least reasonably competent at employing, went ahead and looked at the source code - given my very, very limited fluency in Javascript (or anything "modern-web", really) I braced for the worst ..

.. which was the several hundred lines of inline CSS that all looked like this:

@media (max-width:900px){.topbar .wrap{align-items:center}.emblem{width:70px;height:70px}.ministry{font-size:28px}.ministry span{font-size:21px}.navarea .wrap{display:block;padding:20px 0}.brand h1{font-size:32px;letter-spacing:10px}.brand p{font-size:15px;letter-spacing:8px}.nav{margin-top:20px;overflow-x:auto;padding-bottom:6px;gap:28px}.hero{min-height:auto;background-position:center top}.hero .wrap{padding:70px 0 88px}.hero p{font-size:22px}.steps{margin-top:0;padding:24px 0 0}.stepgrid{grid-template-columns:repeat(2,1fr)}.form{grid-template-columns:1fr}.panel{padding:34px 24px}}

Other than that the code turned out to be remarkably readable - and also surprisingly useless. All of the code was entirely client-side. There were no calls to anything external, no data being sent to anywhere.

Note: The personal information in the following code snippets and screenshots has been censored for obvious reasons.

If you entered something in the input mask, the "verification" was merely a Javascript object lookup - against the following hardcoded object):

const visaRecords = {
  'AU*****|PD*****': {
    visa: 'AU*****',
    passport: 'PD*****',
    surname: 'U*****',
    givenName: 'U*****',
    dateOfBirth: '25 *** 20**',
    nationality: '*****',
    pdf: 'assets/AU******.pdf'
  },
  'AU*****|BJ*****': {
    visa: 'AU*****',
    passport: 'BJ*****',
    surname: 'R*****',
    givenName: 'S***** M*****',
    dateOfBirth: '24 *** 19**',
    nationality: '*****',
    pdf: 'assets/AU*****.pdf'
  }
};

If the entered "passport" and "visa" matched, the site played a "success" tone ..

function playTonkSound(){
  try{
    const AudioContext = window.AudioContext || window.webkitAudioContext;
    if(!AudioContext) return;
    const ctx = new AudioContext();
    const now = ctx.currentTime;

    const osc = ctx.createOscillator();
    const gain = ctx.createGain();

    osc.type = 'sine';
    osc.frequency.setValueAtTime(760, now);
    osc.frequency.exponentialRampToValueAtTime(230, now + 0.16);

    gain.gain.setValueAtTime(0.0001, now);
    gain.gain.exponentialRampToValueAtTime(0.45, now + 0.015);
    gain.gain.exponentialRampToValueAtTime(0.0001, now + 0.20);

    osc.connect(gain);
    gain.connect(ctx.destination);
    osc.start(now);
    osc.stop(now + 0.22);
    setTimeout(() => ctx.close && ctx.close(), 350);
  }catch(e){}
}

.. and showed a corresponding message of a visa allegedly being granted:

If one clicks on "Download PDF" the site returns the document, which is obviously not a legitimate document issued by the Federal Republic of Austria, from the hardcoded path above:

With all of this in mind this looks more like a site in support of an operation defrauding people who are looking to get an Austrian visa. It probably isn't unique, but it's definitely the first time I've seen something like it.

What I found especially intriguing is that the hardcoded data was for two individuals, no more. Which seems like a lot of effort for such a limited amount of potential victims - and as far as I was able to ascertain the site hasn't changed since it was put online in June of this year.

Unfortunately I lack the time to dig even deeper into this, which is a shame, because I still have many unanswered questions left - I'd be particularly interested in learning if the rest of the scam was conducted offline, by local(ized) criminals (maybe) targeting their own community, or if that was committed online as well.

Because in that case there's potentially more sites out there. The relevant points of contact to get this one taken offline have been reached out to. So far without success, unfortunately. <insert deep sigh here>

Note: If you are interested in looking at this site and into this 'case' yourself, please feel free to reach out. I'm happy to share the technical indicators I have gathered so far (as well as the original domain).