Hackers Exploit SniperDz PhaaS for Brand Spoofing and Browser Hijacking

Group-IB reports a large and sophisticated phishing ecosystem called SniperDz targeting MENA users: actors use fake social accounts and link-aggregation pages to funnel victims through multistage redirects into ready-made phishing templates and a centralized backend that reuses a VAPID public key for push-notification-based persistence; tradecraft includes cloaking, browser-history manipulation, tab-under redirects, and dynamic monetization via premium calls/SMS and affiliate offers.