Cybercrime has shifted to social media, with attack volume reaching an all-time high.

Siggi Stefnisson, Chief Technology Officer of Gen Company's cybersecurity department, said: 'We continue to witness threats related to fraud becoming more dangerous, sometimes brazenly hidden in all aspects of our digital lives. This quarter, we saw them exploit people's emotions in attacks, such as budget shopping during holidays, the desire to find love at the end of the year, and the expectation for change during government elections. Unfortunately, this has led to people continuing to lose money and lose control over their personal information. It is expected that these risks will only increase further in 2025, as the rise of artificial intelligence systems and devices will become a new frontier for cybercrime.

The dark side of social media

In the fourth quarter of 2024, phishing attacks increased by 14%, as cybercriminals used website building platforms like Wix to create realistic fake websites and carry out fraud through counterfeit Apple iCloud invoices. Malicious advertisements remain the main attack method, accounting for 41% of all intercepted threats this quarter, providing a breeding ground for fraud and malware spread.

As 2024 approaches its end, social media platforms remain the primary targets of attacks. Facebook is at the top, accounting for 56% of all identified social media threats. YouTube follows closely behind with 24%, X with 10%, Reddit and Instagram each with 3%. On messaging platforms, despite the larger user base of WhatsApp, Telegram has become a high-risk environment, facing six times the network threats as WhatsApp. Scammers are increasingly utilizing the platform's enhanced privacy features to make their activities more difficult to trace by authorities.

The way scammers use social media varies depending on different demographics and platform usage. Researchers have found that the main ways of fraud on social media include:

Deceptive online advertisements (malicious ads) (27%):These fraudulent advertisements spread malware to devices or redirect users to similarly malicious websites.
Fake online stores (23%):People are tricked into fraudulent online stores, exposing personal and financial data.
Phishing attacks (18%):Scams aimed at stealing sensitive information such as credit card numbers or passwords.

Social media is rapidly becoming a paradise for scammers, who use platform algorithms, artificial intelligence, and personalized interactions to attack at an unprecedented speed and scale.

Surge in financial fraud

October to December is the most active quarter for financial fraud, with mobile phones becoming the main attack vector. Here are the most prominent cases of this quarter:

The largest deepfake cryptocurrency scam:The notorious CryptoCore organization is known for hijacking YouTube accounts to promote cryptocurrency scams. They took advantage of the US election to steal over $7 million from victims using deepfake videos of celebrities such as Elon Musk. This was the largest attack of its kind.

Mobile banking trojans:In the fourth quarter of 2024, a new batch of mobile banking trojan applications aimed at stealing bank information were launched. This includes DroidBot, which uses remote access features to obtain bank information and encrypted wallets. Another is ToxicPanda, disguised as Visa, dating apps, and Chrome. The infection rate of the famous BankBot trojan increased by 236% compared to the third quarter of 2024.

Spyware and SpyLoans:This quarter, malicious applications that promise quick access to high-interest loans with predatory repayment plans have surged. Once installed, these applications request access to SMS, photos, and other sensitive information, thus monitoring the victims. Weeks later, the victims face ransom unless they pay the ransom, or their private data will be publicly disclosed. A spyware disguised as a BMI calculator spread through the Amazon app store, reflecting the trend of an increasing number of official Android app stores.

Risk of personal data

The loss of personal data continues to pose a high risk to consumers, potentially leading to identity theft and privacy breaches. Self-harm scams, such as ClickFix and FakeCaptcha, are rapidly growing. In the fourth quarter, Gen Company intercepted attacks targeting 4.2 million people, a 130% increase from the previous quarter. These activities use psychological manipulation to trick people into copying and executing malicious code, which could lead to financial fraud, account takeover, or malware infection.

Reference source: