{"id":4788,"date":"2024-01-04T13:17:07","date_gmt":"2024-01-04T13:17:07","guid":{"rendered":"https:\/\/shreshtait.com\/blog\/?p=4788"},"modified":"2025-09-30T12:55:00","modified_gmt":"2025-09-30T07:25:00","slug":"flipper-zero-india-phishing-scam","status":"publish","type":"post","link":"https:\/\/shreshtait.com\/blog\/2024\/01\/flipper-zero-india-phishing-scam\/","title":{"rendered":"Phishing scam aimed at Flipper Zero India enthusiasts"},"content":{"rendered":"\n

Executive Summary<\/strong><\/h2>\n\n\n\n

Shreshta threat intelligence<\/a> team has uncovered a phishing scam aimed at Flipper Zero India enthusiasts interested in buying a Flipper Zero. The phishing websites lure users with fake flipper zero discount code offers. <\/p>\n\n\n\n

Do you believe threat actors limit their focus solely to non-technical users? Think again! Infosec community and enthusiasts are also excellent preys. <\/p>\n\n\n\n

Exactly a year ago, BleepingComputer<\/a> had shared of a similar phishing scam aimed at Flipper Zero enthusiasts. <\/p>\n\n\n\n

The shortage of Flipper Zero devices has encouraged threat actors to exploit the situation by creating phishing campaigns. The economics of supply and demand play an essential role in cybercrime.<\/p>\n\n\n\n

What this outlines is that threat actors do not limit their exploits only to the average Internet user but also target Infosec and technical users as well. <\/p>\n\n\n\n

About Flipper Zero<\/strong><\/h2>\n\n\n\n

Flipper Zero<\/a> Flipper Zero is a portable Tamagotchi-like multi-functional device developed for interaction with access control systems.[1] The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, iButton, and digital access keys, along with a GPIO interface.1<\/a><\/sup><\/p>\n\n\n\n

Motive<\/strong><\/h2>\n\n\n\n

The phishing websites lure users with fake flipper zero discount code offers. <\/p>\n\n\n\n

We can share with moderate confidence that the motive of the threat actors is to harvest the Personally Identifiable Information (PII) of the user, specifically, the user\u2019s name and address and their credit card details. <\/p>\n\n\n\n

Aside from financial motive, the PII of users can be sold on the dark web.
<\/p>\n\n\n\n

Technical analysis<\/strong><\/h2>\n\n\n\n

Phishing scam website is powered by Shopify. <\/h4>\n\n\n\n
\"Phishing<\/figure>\n\n\n\n

Figure 1 – The home page of the phishing website<\/em><\/p>\n\n\n\n


The phishing scam website contains links to the official Flipper Zero website, to make it appear legitimate. <\/p>\n\n\n\n

Availability of Flipper Zero in India<\/strong><\/h2>\n\n\n\n

The availability of an item plays an important role in the economics of supply and demand. Unfortunately, if you are based in India, the official distributors do not ship the Flipper Zero to India. <\/p>\n\n\n\n

\"Legitimate<\/figure>\n\n\n\n

Unfortunately, this also gives an opportunity to threat actors to setup fake stores and phishing scam websites supposedly selling the items. <\/p>\n\n\n\n

<\/p>\n\n\n\n

Flipper Zero device available for purchase on the phishing scam website<\/strong> <\/h2>\n\n\n\n
\"Phishing<\/figure>\n\n\n\n

Figure 2 – The user is redirected to another page as they click on the product.<\/em><\/p>\n\n\n\n


Flipper Zero enthusiasts and infosec users the primary target<\/strong><\/h2>\n\n\n\n
\"Phishing<\/figure>\n\n\n\n

Figure 3 – Shopping cart of the phishing website<\/em><\/p>\n\n\n\n

<\/p>\n\n\n\n

The website displays the selected product and the total amount.<\/p>\n\n\n\n

\"Phishing<\/figure>\n\n\n\n

Figure 4 – Clicking checkout prompts the user for their personal information and credit card details.<\/em><\/p>\n\n\n\n

Harvesting credit card details<\/strong><\/h2>\n\n\n\n
\"Phishing<\/figure>\n\n\n\n

Figure 5 – After entering false details, it displays an error stating that the card details couldn’t be verified.<\/em><\/p>\n\n\n\n

<\/p>\n\n\n\n

\"Phishing<\/figure>\n\n\n\n

Figure 6 – Clicking on Google Pay, the website prompts the user for their personal and credit card details.<\/em><\/p>\n\n\n\n

<\/p>\n\n\n\n

Indicators of Compromise<\/h2>\n\n\n\n

flipperzerobrasil[.]com<\/p>\n\n\n\n

flipperzerostore[.]com<\/p>\n\n\n\n

<\/p>\n\n\n\n

Safety Recommendations<\/strong><\/h2>\n\n\n\n
    \n
  1. Purchase products directly from the official website of the brand or from recommended authorized retailers<\/li>\n\n\n\n
  2. Research the seller before purchasing the product<\/li>\n\n\n\n
  3. Be cautious of purchasing products from websites offering prices significantly lower than those on the official website, or offering free devices.<\/li>\n\n\n\n
  4. If you become a victim of cybercrime, particularly financial crime, call the national (India) cybercrime helpline 1930 or file a complaint at https:\/\/cybercrime.gov.in\/<\/a> <\/li>\n\n\n\n
  5. Shreshta Protective DNS<\/a> blocks phishing, malware, newly registered domain names and other malicious communication in real-time. For enterprises, please email info@shreshtait.com for a free 30-day trial. <\/li>\n<\/ol>\n\n\n\n

    Conclusion<\/strong><\/h2>\n\n\n\n

    By using Shopify as the store front for the phishing website, the threat actor has replicated the legitimate Flipper Zero website design and feel. <\/p>\n\n\n\n

    While the Flipper Zero device is back in stock, the official distributors of Flipper Zero do not ship the device to all countries. This creates an opportunity for threat actors to launch phishing campaigns targeting infosec users and enthusiasts interesting in purchasing a Flipper Zero.<\/p>\n\n\n\n

    We reached out to the Flipper Zero staff and have reported the phishing website.
    <\/p>\n\n\n\n

    Free 30-day trial of our threat intelligence<\/strong><\/h2>\n\n\n\n

    Threat actors constantly optimise and evolve their attacks to steal credentials and data and infiltrate networks. Our threat intelligence feeds are highly actionable and curated to protect against phishing, malware, C2 and newly registered domain names. <\/p>\n\n\n\n

    Interested? Please send us an email to info@shreshtait.com for a free 30-day trial. <\/p>\n\n\n\n

    References<\/strong><\/h2>\n\n\n\n

    A few other campaigns we’ve uncovered that you might be interested in,<\/p>\n\n\n\n

    \n
    The rise of phishing attacks targeting Adobe users in India<\/a><\/blockquote>