{"id":7279,"date":"2024-09-11T13:34:56","date_gmt":"2024-09-11T08:04:56","guid":{"rendered":"https:\/\/shreshtait.com\/blog\/?p=7279"},"modified":"2024-10-16T23:15:09","modified_gmt":"2024-10-16T17:45:09","slug":"zerodha-users-targeted-with-a-pig-butchering-scam","status":"publish","type":"post","link":"https:\/\/shreshtait.com\/blog\/2024\/09\/zerodha-users-targeted-with-a-pig-butchering-scam\/","title":{"rendered":"Zerodha users targeted with a pig-butchering scam"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Threat researchers at Shreshta<\/a> have uncovered a pig-butchering scam targeting Zerodha users.<\/p>\n\n\n\n

The phishing websites are impersonating Zerodha, a reputed stockbroking and financial services company, duping investors into investing in fake crypto and investment schemes.<\/p>\n\n\n\n

What is a pig-butchering scam? <\/h2>\n\n\n\n
\"Image<\/figure>\n\n\n\n

A pig butchering scam, a.k.a. “Sha Zhu Pan” or Shazhupan, (Chinese: \u6740\u732a\u76d8), translated as Killing Pig Plate, is a type of long-term scam and investment fraud in which the victim is gradually lured into making increasing contributions, usually in the form of cryptocurrency, to a fraudulent cryptocurrency scheme.1<\/a><\/sup><\/p>\n\n\n\n

<\/div>\n\n\n\n

About Zerodha<\/h2>\n\n\n\n

Zerodha Broking Ltd.<\/a>, founded in 2010, is an Indian online brokerage firm.<\/p>\n\n\n\n

<\/div>\n\n\n\n

<\/p>\n\n\n\n

Executive Summary<\/h2>\n\n\n\n

We analyzed a large number of phishing websites targeting Zerodha users. Our analysis found that the phishing website appears to be part of a pig butchering scam campaign, as indicated by the investment plans, commissions from referrals, and an administrator managing deposits.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Motive<\/h2>\n\n\n\n

The motive of the threat actors is to lure investors into fake crypto and investment schemes for financial gains. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Technical analysis of pig-butchering scam targeting Zerodha users<\/h2>\n\n\n\n

In this section, we will examine one of the phishing website that is part of the pig-butchering scam. <\/p>\n\n\n\n

\"This<\/figure>\n\n\n\n

Figure 1 – The home page of the phishing website<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"The<\/figure>\n\n\n\n

Figure 2 – Registration page of the phishing website<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Page<\/figure>\n\n\n\n

Figure 3 – After registering, the system redirects the user to a completion page.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Login<\/figure>\n\n\n\n

Figure 4 – Login page of the phishing website<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Using<\/figure>\n\n\n\n

Figure 5 -Using the registration credentials, the system redirects the user to a dashboard page.<\/p>\n\n\n\n

The dashboard displays test as the username instead of the username provided by the user during registration.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Investment<\/figure>\n\n\n\n

Figure 6 – Investment page on the phishing website.<\/p>\n\n\n\n

The user is asked to deposit money to earn a specified percentage of profit.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Crypto<\/figure>\n\n\n\n

Figure 7 – The user is asked to enter the required information for the selected crypto account and continue with the payment.<\/p>\n\n\n\n

<\/div>\n\n\n\n


Figure 8 – After clicking Save, the user is asked to wait for an administrator’s response.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Image<\/figure>\n\n\n\n

Figure 9 – The phishing website frequently displays pop-ups indicating other users are actively trading on the platform (Social Proof)<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Web<\/figure>\n\n\n\n

Figure 10 – Fake Crypto investment plans<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Phishing<\/figure>\n\n\n\n

Figure 11 – The phishing website is integrated with a chat<\/p>\n\n\n\n

<\/div>\n\n\n\n

Threat Indicators<\/h2>\n\n\n\n