Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Sniper Dz MENA fake Facebook phishing and monetization campaign

Campaign
First reported
Last updated
Happening score
H score 30
1 unique sources, 1 articles

Summary

Hide ▲

A Sniper Dz fraud campaign is targeting users across the Middle East and North Africa with fake Facebook accounts that impersonate politicians, public figures, and trusted organizations. The lures push free mobile internet, financial compensation, and government subsidy offers, then steer victims through intermediary sites into phishing and traffic monetization infrastructure. The operation abuses browser notification permissions, back-button hijacking, and tab-under redirects to keep victims inside attacker-controlled pages. The same ecosystem has also been linked to telecom impersonation and investment scams across multiple regions, pointing to a broader monetization network.

Related Happenings

Sniper Dz free PhaaS ecosystem rebranded to scale phishing operations

Threat Actor Meta
H score43 First: 12.06.2026 11:52 Last: 12.06.2026 11:52 Sources 1

How related: The Singapore-headquartered cybersecurity company has these campaigns to Sniper Dz, a turnkey phishing-as-a-service (PhaaS) platform that was taken down last month in an INTERPOL-led operation.

About this happening: A long-running **Sniper Dz** ecosystem operated as a **free phishing-as-a-service (PhaaS)** platform that repeatedly rebranded, lowering the barrier for large-scale credential the...

Latest development: 15.06.2026 09:30

Fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations targeted users across the Middle East and North Africa with fake offers for free mobile internet packages, financial compensation, and government subsidy programs, then routed victims through Linkbio and Linktree decoy pages into Sniper Dz phishing and traffic monetization infrastructure that abuses browser notification permissions, back-button hijacking, tab-under redirections, premium SMS subscriptions, premium-rate calls, and investment scams.

Open Happening

Interpol Operation Ramz cybercrime crackdown in MENA

Law Enforcement
H score20 First: 18.05.2026 17:00 Last: 18.05.2026 17:00 Sources 1

How related: The Singapore-headquartered cybersecurity company has these campaigns to Sniper Dz, a turnkey phishing-as-a-service (PhaaS) platform that was taken down last month in an INTERPOL-led operation.

About this happening: **INTERPOL**-led **Operation Ramz** disrupted **Sniper Dz**, a decade-long **phishing-as-a-service (PhaaS)** platform, during **October 2025-February 2026**. Authorities in **13 M...

Open Happening

AccountDumpling Google AppSheet Facebook phishing campaign

Campaign
H score33 First: 01.05.2026 21:09 Last: 01.05.2026 21:09 Sources 1

About this happening: A **Vietnamese-linked** operation dubbed **AccountDumpling** is using **Google AppSheet** as a phishing relay to steal **Facebook** credentials, enabling account takeover at scale...

Open Happening

Meta rolls out anti-scam protections and AI scam detection across WhatsApp, Facebook, and Messenger

Security Tool/Service
H score10 First: 11.03.2026 15:29 Last: 11.03.2026 15:29 Sources 1

About this happening: Meta is rolling out **anti-scam protections** across **WhatsApp, Facebook, and Messenger**, using warnings and AI detection to block scams before users engage. The updates target...

Open Happening

Jinkusu's Starkiller phishing-as-a-service ecosystem commoditizes account takeover

Threat Actor Meta
H score39 First: 20.02.2026 22:00 Last: 20.02.2026 22:00 Sources 1

About this happening: A new phishing-as-a-service operation tied to **Jinkusu** is proxying real login pages through attacker infrastructure, making **MFA bypass** and account takeover easier for low-s...

Open Happening

Timeline

  1. 15.06.2026 09:30 2 articles · 2h ago

    Fake Facebook offers funnel MENA users into Sniper Dz scams

    Initial Disclosure

    Cybersecurity researchers disclosed a fraud campaign targeting users across the Middle East and North Africa with fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations. The lures advertised free mobile internet packages, financial compensation, and government subsidy programs, then redirected victims through intermediary sites such as Linkbio and Linktree into phishing and traffic monetization infrastructure associated with Sniper Dz. The same ecosystem used browser notification abuse, back-button hijacking, and tab-under redirections to keep victims inside attacker-controlled content.

    Show sources
    Open in new tab