Scammers have launched a new wave of attacks targeting children and teenagers by promising free in-game currency for popular titles including Roblox, Brawl Stars, and Standoff 2. Instead of delivering rewards, the criminals hijack accounts in popular messengers. The scheme was identified by specialists from F6.
The bait is distributed through short videos on YouTube. Video creators, sometimes posing as popular bloggers, promote daily giveaways of Robux, gems, and gold. Viewers are instructed to follow a link from the creator’s profile, which leads directly into a phishing operation.
One of the fraudulent sites is styled as the brand NovaDrop. Users first select a messenger and a game, read fabricated positive reviews, and then reach a roulette page. The wheel predictably awards a large prize of 25,000 coins. To collect the winnings, the child is asked to prove they are human by providing a phone number and entering a six-digit code.
In reality, the code is used to complete authentication in the selected messenger. Attackers thereby gain full access to the account. They can read private conversations, view documents, photographs, videos, and contact lists, then quietly send messages to the victim’s friends. In some cases the owner continues using the account without noticing the intrusion, while in others the account is fully taken over.
According to F6, the criminals are intensifying efforts to steal existing profiles because of growing difficulties in purchasing new Russian accounts for their fraudulent campaigns.
