Beware of free iPhone scams on Facebook and other social media sites

Free iPhone X scams are on the rise

Are you excited for the iPhone X’s release? Or maybe your dream phone is iPhone 8? If so, you might fall for one of “free iPhone” or “iPhone X giveaway” scams on social media websites like Facebook, Instagram or Twitter.

Scammers follow the traditional pattern and create numerous fake accounts on social media websites, entitling them with catchy phrases such as “free iPhone giveaway,” “iPhone 8 Official,” “free iPhone 8” “iPhone X giveaway” “win the new iPhone X” and similar.

Later, they share and, if they succeed, boost posts promising free mobile phones to “lucky” users who will decide to participate in the giveaway^[1]. Eye-catching promises to win the freshly released and quite pricey phone lure unsuspecting victims to click on a malicious link (which is usually a shortened one) which can lead to a website pushing malicious software to victims.

For example, some of the links noticed below fake YouTube videos announcing iPhone giveaways contained several shortened^[2] Adf.ly links which are known to show suspicious ads to the user before landing the victim on the final website.

Free iPhone scam used to build audience for fake Facebook or Instagram pages

Another trick used by scammers is to invite people to comment, like and share (or repost) the giveaway post on Facebook or Instagram in order to enter the “giveaway” and get a chance to win the free iPhone. Such scams do not require any special efforts, and potential victims unknowingly promote the scam while expecting to become the “lucky” ones one day.

In the majority of cases, these fake giveaway posts urge victims to like the scam page on Facebook or follow it on Instagram to increase the chances of becoming the chosen one. This guarantees a quick growth of likes on the scam page.

Later on, scammers can rename the page and use it for another social engineering attack^[3]. In a different scenario, such page can appear on dark web forums for sale so that other criminals could use it for evil purposes. There is no surprise why Facebook virus^[4] or Instagram virus is a thing nowadays – these social media platforms are perfect places to search for potential victims.^[5]

Scammers seek to collect victims’ personal information

Speaking of dark web forums, personal information is also a marketable commodity. Therefore, scammers might promote links that lead to scam survey pages asking to “validate that you are not a robot” and providing a bunch of suspicious surveys to complete. Once the victim “completes the offer,” another pop-up appears on the screen and asks to fill in required information so that the “prize” could be sent to him/her.

Usually, such fake forms ask to enter personally identifiable information such as full name, email and home address. Collected data can be sold on the dark web or used in a future social engineering attack.

Providing full name and email address as well as your address for criminals is enough to allow fraudsters compose convincing malware-laden emails and trick you into opening them. This way, you can be tricked into opening a phishing email that ostensibly comes from a nearby shop or your work and launching malicious attachment that comes with it.

It is an easy way for cybercriminals to push ransomware or similar malware to you. We suggest staying vigilant and bypass free iPhone scams as following scammers’ commands can pose a threat to your security and privacy.