Cybercriminals are exploiting ongoing fuel shortages and long queues at gas stations by deploying sophisticated phishing campaigns that trick users into surrendering access to their messenger accounts. Security researchers at F6 have discovered more than 60 fraudulent websites designed to look like official gas station locator services, game platforms, marketplaces, and video hosting sites.
How the Scam Operates
The attackers promise victims practical help such as real-time maps showing where gasoline is available, electronic fuel coupons, or bonus rewards in popular games. To “activate” these offers, users are asked to enter their phone number and then confirm it by inputting a one-time code sent via SMS. This simple step hands the attackers control over the victim’s messenger account.
Once inside, the criminals can read private conversations, download photos, videos, and documents, browse contact lists, and send messages while impersonating the account owner. In many cases, the legitimate user retains partial access and may not immediately notice the intrusion, allowing the attackers to operate undetected for extended periods.
Convincing Fake Interfaces
The phishing pages are built to appear authentic. Visitors are invited to choose fuel type and region; the site then claims to have located several stations. Instead of displaying the list, however, a “phone confirmation” form appears. In another variant, the criminals clone the design of legitimate services and require messenger authorization to receive a nonexistent electronic coupon.
Targeting Children and Additional Disguises
The same network also targets younger users. Under the guise of the popular game Brawl Stars, children are offered free loot boxes and in-game currency after logging in through their messenger. More than half of the identified sites impersonate marketplace brands, while 19 percent pose as social platforms. The remaining pages mimic gas station maps, video services, games, and classified advertisement boards.
Domain Patterns and Response
Most of these malicious pages are hosted on the domain zones .site, .click, .shop, .lol, and .xyz. F6 has already submitted the discovered domains for blocking, yet new addresses continue to appear as the campaign evolves.
