Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims

Unit 42 uncovered a widespread campaign that creates and distributes thousands of fraudulent crypto investment websites and Android apps which impersonate reputable brands and offer unrealistic returns; the platforms operate Ponzi-style multi-level affiliate schemes, are promoted via social media and large Telegram channels targeting East African and Asian users, and leverage domain fronting, automated domain registration, shared hosting, and a common toolkit to scale—IoCs include numerous domains, Telegram channels, APK hashes, and download URLs.