Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts

Group-IB researchers uncovered a widespread social-engineering campaign targeting users in the Middle East and North Africa that used fake Facebook accounts and a phishing-as-a-service (Sniper Dz) to route victims through link-aggregation platforms to pages that request browser notification permissions and employ back-button hijacking and tab-under redirects; once enrolled, victims are funneled via a traffic distribution system into monetization schemes including premium SMS subscriptions, premium-rate calls, and investment scams, with reuse of a VAPID key indicating shared infrastructure across campaigns.