Scammers Target Remote Workers with Fake Compensation for Home Internet and Devices
Russian remote workers are facing targeted attacks from fraudsters who pose as employers, government agencies, or corporate IT departments. One common lure involves promises of compensation for home internet expenses and personal computer use. To claim these nonexistent payments, victims are directed to phishing sites for identity verification or asked to share SMS codes, according to Alexander Lunev, head of the information security training group at Yandex.
Instead of receiving funds, employees may unknowingly provide login credentials or payment information to attackers. The promised compensation turns out to be entirely remote, never reaching the victim's bank account. A separate scenario starts with emails claiming to come from a company's IT service, urging immediate renewal of system access, account confirmation, or installation of updates through provided links.
The sense of urgency is designed to prompt quick action before the recipient questions why a corporate administrator is contacting them from an unfamiliar address. Home networks add another layer of vulnerability, as users are responsible for their own router configurations unlike protected office setups. Multiple devices including work laptops, smartphones, cameras, smart TVs, and speakers often share the same router, meaning a single compromise can expose the entire household ecosystem.
Yandex specialist Alexander Lunev advises replacing default router and Wi-Fi passwords, applying firmware updates, and disabling quick device connection features. Smart devices should be moved to an isolated guest network separate from work computers. Any urgent requests should be verified through independent channels such as known phone numbers or corporate messengers. Legitimate companies, banks, and agencies never request passwords or SMS codes over the phone.
Related articles
How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover
Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.
Silent Call Answering on Android: Defeating Phone Spam by Removing Human Attention
A detailed proposal suggests abandoning traditional spam call blocking in favor of allowing all incoming calls to connect automatically while keeping them invisible to the user. The approach uses Android's Telecom Framework and InCallService to answer calls silently without ringing, notifications, or screen activation. This breaks the economic model of mass dialing systems by inflating answered call metrics with empty connections that contain no human. The concept separates the technical establishment of a call from delivering user attention, forcing spammers to detect real people after the connection is made. Implementation requires the app to hold the ROLE_DIALER role and selectively invoke Call.answer() based on custom rules instead of always showing the incoming call UI. The author argues this shifts the detection burden onto robocall platforms and reduces the value of every successful connection.
Telegram Scam Bot Exposed by Fixed Timer and Deleted Messages in Telethon Userbot Analysis
A detailed investigation into a romance scam attempt on Telegram revealed an AI-driven userbot masquerading as a woman named Maria from Yaroslavl. The bot maintained consistent 4-5 minute response delays regardless of message length or time of day, responded to deleted messages, and accumulated multiple inputs before replying in batches. It refused out-of-character requests using repetitive phrases like "I am not a..." and handed off media or confusing inputs to a human operator. The bot failed to react to a nonexistent city name and ignored voice messages containing silence, leading to delayed human intervention. The chat was later deleted from the scammer side after testing, and the account ignored messages from a second profile. The analysis includes a full reconstruction of the bot's logic using the Telethon library, highlighting prompt protections against jailbreaks and reliance on fixed delays.