Threat Intel
Fake Celine Dion Ticket Scam Targets Fans via Social Media and Impersonating Sites
Group‑IB uncovered a multi‑layered phishing scheme selling counterfeit Celine Dion concert tickets. The attack uses social‑network messages and spoofed distributor sites to lure buyers. Defenders should block malicious domains, monitor for ticket‑related phishing, and educate users.
What Happened
Group‑IB identified a coordinated phishing operation that sells fake Celine Dion concert tickets through social‑network posts and counterfeit distributor websites. The attackers use legitimate‑looking URLs and branded imagery to appear as official ticket sellers.
Who Is Affected
Fans attempting to purchase tickets for Celine Dion’s upcoming tour, especially those who rely on social‑media links or unfamiliar third‑party sites, are at risk of financial loss and credential theft.
Impact
Victims may lose money, provide personal data to fraudsters, and expose their devices to malware embedded in fake ticket PDFs or download links.
Mitigation Steps
- Block domains and URLs identified in the Group‑IB report using web‑filtering or DNS sinkholing.
- Enable email and messaging filters to flag or quarantine ticket‑sale messages that contain suspicious links.
- Educate users to verify ticket purchases only through official distributor sites or the artist’s verified social‑media accounts.
- Monitor for credential compromise and reset passwords if any suspicious activity is detected.
- Deploy endpoint protection to detect and quarantine malware delivered via fake ticket attachments.
“Always confirm the seller’s authenticity before completing a transaction.”
Related articles
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing
Black Axe Syndicate Leaders Extradited to U.S. on Wire Fraud and Money Laundering Charges
Five alleged leaders of the notorious Black Axe cybercrime gang were flown from South Africa to the United States on September 11 to face wire‑fraud, money‑laundering and aggravated identity‑theft charges. Prosecutors say the group ran a decade‑long romance‑scam scheme that tricked U.S. victims into sending money, using social‑media profiles, dating sites and VoIP calls. The extradition follows a global operation that saw 58 arrests across 22 countries, highlighting the U.S. commitment to bring transnational fraudsters to justice.
Read briefing
BTMOB Android RAT: Phishing, Fake App Stores, and Accessibility Exploit
BTMOB is an Android RAT that spreads via phishing sites and counterfeit app stores, then abuses Accessibility Services to gain full device control. The malware is sold with an APK‑builder, enabling rapid, code‑free payloads. Defenders should block malicious domains, disable unknown accessibility services, and enforce app‑store vetting.
Read briefing
ClickFix Campaign Compromises Ukrainian Sites, Deploys Psychedelic Stealer via Fake Cloudflare Verification
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites, tricking visitors into running an MSI installer that delivers the Psychedelic stealer. The malware harvests credentials, cryptocurrency wallet data, and establishes persistence via scheduled tasks. Defenders should block the attacker domains, detect MSI executions, and harden web applications against iframe injection.
Read briefing