Looking for Gasoline? Hand Over Your Account: Scammers Launch Fake Gas Station Card Phishing Sites Targeting Fuel Shortages
Cybercriminals are exploiting ongoing fuel shortages and long queues at gas stations by deploying sophisticated phishing campaigns that trick users into surrendering access to their messenger accounts. Security researchers at F6 have discovered more than 60 fraudulent websites designed to look like official gas station locator services, game platforms, marketplaces, and video hosting sites.
How the Scam Operates
The attackers promise victims practical help such as real-time maps showing where gasoline is available, electronic fuel coupons, or bonus rewards in popular games. To “activate” these offers, users are asked to enter their phone number and then confirm it by inputting a one-time code sent via SMS. This simple step hands the attackers control over the victim’s messenger account.
Once inside, the criminals can read private conversations, download photos, videos, and documents, browse contact lists, and send messages while impersonating the account owner. In many cases, the legitimate user retains partial access and may not immediately notice the intrusion, allowing the attackers to operate undetected for extended periods.
Convincing Fake Interfaces
The phishing pages are built to appear authentic. Visitors are invited to choose fuel type and region; the site then claims to have located several stations. Instead of displaying the list, however, a “phone confirmation” form appears. In another variant, the criminals clone the design of legitimate services and require messenger authorization to receive a nonexistent electronic coupon.
Targeting Children and Additional Disguises
The same network also targets younger users. Under the guise of the popular game Brawl Stars, children are offered free loot boxes and in-game currency after logging in through their messenger. More than half of the identified sites impersonate marketplace brands, while 19 percent pose as social platforms. The remaining pages mimic gas station maps, video services, games, and classified advertisement boards.
Domain Patterns and Response
Most of these malicious pages are hosted on the domain zones .site, .click, .shop, .lol, and .xyz. F6 has already submitted the discovered domains for blocking, yet new addresses continue to appear as the campaign evolves.
Related articles
Cordial Spider Deploys Work Panel Platform for Tech Support Scams Against Corporate Identities
A criminal platform called Work Panel is turning fake technical support calls into structured operations aimed at taking over corporate accounts. The service combines target research, page cloning, telephony, and credential capture within a single control panel. It is linked to the group tracked as O-UNC-045, also known as Cordial Spider. Campaigns target users of multiple identity providers and combine telephone social engineering with fake authentication pages. Operators research names, job titles, corporate emails, phone numbers, and professional profiles before calling to impersonate help-desk staff. While one operator keeps the victim on the line, a manager monitors the phishing session in real time. Captured credentials are sent only to operation managers via Telegram, reducing internal theft risks among the criminals themselves.
Scammers Deploy Fake Russian Defense Ministry Websites to Harvest Data from Relatives of Fallen Soldiers
Russian threat intelligence firm F6 has uncovered a phishing campaign that used counterfeit Ministry of Defense portals to target relatives of participants in the special military operation. The attackers registered lookalike domains and populated them with official logos, coats of arms, and navigation menus copied from the legitimate mil.ru site, leaving only the registration form under their control. Victims were invited to register for state awards ceremonies and asked to supply full name, phone number, passport details, SNILS, and INN; an additional “Add guest” button collected the same information for accompanying persons. The stolen data can be used to reset access to government services, apply for microloans, or launch follow-on social-engineering attacks against military families. F6 analysts noted that the fraudulent pages were likely generated with a large language model, evidenced by an unhandled JSON error that appeared only after data submission. Although the discovered domains have been blocked inside Russia, the low technical barrier means new clones can be stood up quickly.
Russia to Launch Unified Payment Card Registry in 2026 to Combat Dropper Fraud Schemes
Starting September 1, 2026, Russia will introduce a single nationwide system for recording all payment cards issued by domestic banks. The registry will include every card regardless of the payment system used, covering existing Visa and Mastercard products as well as expired cards that banks continue to service. The measure is designed to give banks visibility into the total number of cards held by any individual across multiple institutions, thereby disrupting dropper schemes that rely on multiple accounts for laundering stolen funds. No immediate mass closure of cards will occur; instead, the first year will focus on data collection and preparation. From September 1, 2027, a hard limit of 20 cards per person will apply to new issuances only, while existing cards above the limit will remain operational. The policy grants individuals time to decide which cards they truly need before the issuance restriction takes effect.
Scammers Launch Fake Cyberpolice Russia Telegram Bot to Steal Accounts and Sell Fake Subscriptions
Fraudsters have created a counterfeit Telegram bot impersonating Russia's Cyberpolice, complete with official insignia and a convincing backstory. The bot promotes a paid subscription service for protection against cyber threats, essentially selling users defense against the scammers themselves. In a second attack vector, the bot requests a six-digit confirmation code, which grants attackers full access to the victim's Telegram account. Cyberpolice Russia has publicly stated that its units do not provide any paid services for threat notifications or protection. The legitimate bot operates under the exact handle cyberpolicerus_bot, and users are advised to verify the name character by character because scammers frequently alter letters or add symbols. Victims are reminded never to share six-digit Telegram codes with anyone, including entities claiming to represent law enforcement.