How are cyber criminals rolling in 2025?

[fckgw]

I've noticed on some scam forums and subreddits I frequent that scammers have been using target site's own support searches to redirect users to scam phone numbers.

On both Ticketmaster and Facebook, and many other sites, when you perform a search on their support site it spits back your query in big letters at the top of the page. If you craft the correct search and then buy Google Ads pretending to be Ticketmaster, then you can redirect users to your call center and scam them. And because they link for your ad actually links to Ticketmaster the ad passes validation and appears to be a legit link in the eyes of Google.

Example of a crafted search term: https://help.ticketmaster.com/hc/en-us/search?utf8=%E2%9C%93...

[lifeisstillgood]

So, I craft a search where the search query is “call 1 800 scam”, then I buy a google ad with key word of “ticketmaster help”, the ad links to real ticketmaster with my query, and google shows that ad to someone having trouble and hey presto they call my scam line at 4 quid a minute from their mobile?

Yuck all round. I mean ticketmaster is just a sin eater for greedy popstars but yuck ..

[Cyphase]

I've been seeing similar scams via PayPal. The scammers apparently add the target email address as a forwarding address on a compromised or created-for-purpose email account. And that bouncer email address is signed up for PayPal. So the scam email is actually from PayPal, bounced through some other inbox. The To name and address is of the bouncer email address PayPal sent it to.

One version involves sending money to someone with the PayPal account (so the target might think it was sent from their own account) with a "note" to the transaction recipient, which the target sees, which says PayPal has detected unusual activity and please call this phone number to request a refund.

Another involves a "Your ITEM NAME order is on its way" email where the item being ordered is called something like, "Some Company, Inc: Don't recognize the seller? Call us at SOME PHONE NUMBER".

A third is like the second, except it's a "You paid CURRENCY to SELLER" email. This one has the PayPal user's name at the top, so not as convincing perhaps.

[temp0826]

A family member fell for this while trying to recover their hacked fb account. I was around and caught wind of the call and some of the absurd steps (absurd to me, anyways) they were proposing and pulled the plug on the "support" call. The phone number was in what seemed to be a cached result of a bad search or something. '"Call us at xxx-xxxx..." not found' is what I saw. (Finding a real support number is either difficult or impossible, which makes this a good trap)

[pnw]

FWIW I sent this to a friend on the dev team at Ticketmaster and they escalated it.

[madacol]

This one is even more believable

    https://help.ticketmaster.com/hc/en-us/search?utf8=%E2%9C%93&query=help%22%20%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%E2%A0%80%20Need+Ticketmaster+Support%3F+Call+this+phone+number+-%3E+1-888-BIG-SCAM.

[levocardia]

Wow. Programmatic SEO and its consequences. Genius...

[redeux]

I found and removed one of these from my company's forums. When I Googled the number I could see it was on a ton of other support forums.

[RGamma]

How desperate one has to be...

[SoftTalker]

Among the common vulnerabilities listed:

> Outdated Wordpress plugins and CMS systems

No surprise, having worked in edu the following scenario was very common:

1) Researcher gets a grant for a project

2) Grad student sets up a Drupal site for the project

3) Things are maintained and updated for a couple of years

4) Grant runs out, project wraps up, student graduates, everyone forgets about the server which sits unattended and unmaintained.

Still happens, but most universites have really clamped down on the ability to just stand up a web server on the network. Many are requiring everything to be on a centrally managed enterprise CMS which is a PITA but that's the fallout for too much sloppy administration.

[semi-extrinsic]

At my old university ~15 years ago, all IPs of all computers were public IPV4 addresses. Any computer plugged in to any ethernet port on campus was given such a "quasi-static" IP address. All normal ports were open - ssh, http(s), you name it. It was the OG zero trust architecture.

[kevin_thibedeau]

The low friction solution is to serve public_html from a home dir and direct users to generate static sites.

[notyourwork]

Yep, I remember having ssh access to production servers from a non-work machine at a well known university.

We could also get external ips and connectivity without much supervision. Core security needs to be prioritized to avoid this from happening.

[leftcenterright]

> Norton, Kaspersky, Zscaler, F-secure, NordVPN, Virustotal, Palo Alto: all of them marked these links as safe.

This is sad to see, these tools are forced down so many companies in name of "compliance" while totally not worth the maintenance and cost overhead. Apparently they haven't got any better in the last decade.

[markbeare]

I work for a cybersecurity company, and I think that the method they used to check these links with the mentioned security companies was not a reflection of how they detect. I'm sure that many of these companies do not have these domains in their DBs of bad sites but if you were to run these products and then visit the site then heuristic detection would have likely flagged the sites.

[Muromec]

Well, that's exactly the difference between complience and security

[charcircuit]

I'm curious if the link inside the pdf would have been detected.

[DyslexicAtheist]

john wick site:europa.eu https://www.google.com/search?q=john+wick+site%3Aeuropa.eu&h...

gta 5 site:europa.eu https://www.google.com/search?q=gta+5+site%3Aeuropa.eu&hl=en

Watch full site:europa.eu https://www.google.com/search?q=Watch+full+site%3Aeuropa.eu&...

[leftcenterright]

could someone with legal/data-privacy expertise comment if this would be something they have to disclose under data breach disclosure laws?

Technically it might not be a "data leak", but it very well could result in one if arbitrary content (including js?) can be uploaded to these webpages?

[b0m]

When clicked, all show: page not found

So, fixed now?

[superkuh]

These days most "cyber" crimes are commited by corporations against their customers/users (just like most theft is wage theft). These small fish/phish putting sites on exploited servers are a drop in the bucket. It is sad when some university resource gets shut down because they didn't mantain it after the grad student that set it up graduates though. We really need to teach the people that set up these things to use .html pages instead of dynamic languages and databases.

[neffy]

Sure. Corporations commit ransomware attacks all the time.

[3abiton]

>

I have been advised not to disclose specific vulnerabilities since the parties involved are not most friendly and transparent in handling security reports. While most of these got reported and some even got fixed, I can only disclose high-level details of the compromise path. Some just ghosted me after conveniently fixing the flaws, and one even gave me a phone call, which was somewhat scary and perhaps not worth the adrenaline.

What an unprofessional sysadmin move, borderline infuriating.

[wood_spirit]

They create meme coins etc?

[tim333]

It's the way forward but not actually a crime. In the future we'll live by selling meme coins to each other while AIs do the actual work.

[kazinator]

https://i.ibb.co/7NZR08TL/Screenshot-2025-05-06-at-5-05-39-P...

[yapyap]

Honestly you are always (half) a step behind and that’s for the worst cyber criminals cause the state sponsored ones are multiple steps ahead.

It’s very interesting to look at from the outside, thanks for sharing.

[ValdikSS]

Once upon a time I typed something like `r57shell gov` and got a PHP webshell on *.gov.br

[mhuffman]

I am surprised no one mentioned using LLMs to spell and grammar check their emails and vibe-code bank landing-pages to continue a more polished version of scamming elderly people out of their life savings.

[curiousgal]

The misspellings/shitty grammar are on purpose.

[Alex-Programs]

Is it just me or is cybersecurity... Calming down? I feel like a few years ago there was constant news of ransomware, intrusions, vulnerabilities, etc, but more recently the defensive side seems to have the upper hand.

[candiddevmike]

You only hear about the offensive side winning when the company can't prevent it from leaking. Rest assured, the only thing "calming down" in cybersecurity is the nihilism that nothing involving a human will ever be secure.

[chelmzy]

Not particularly. The only thing I have noticed in the past decade is the decline of the "American Hacker". Most groups are foreign but will partner with younger Americans for social engineering (ex. Scattered Spider). You just don't have people like Albert Gonzalez/Stephen Watt in America now. However, I suspect that many American hackers have shifted to targeting overseas countries that are not friendly with the US.

[pjc50]

There's a lot of other stuff in the news.

[gitroom]

damn, i remember seeing old servers just getting dusty and full of holes after the student left. kinda crazy how much messy stuff is hiding in corners like that lol