Evolution In Pig Butchering Scams

Inevitable Evolution Of Crypto Pig Butchering Is Here – More Gifts From AI

An Editorial By Brad Gorka, Cybersecurity Professional, CISO, and Information Security Leader

About Brad Gorka: Provide Value and Be Valued. I do this by building exceptional teams. This means hiring the right people and nurturing everyone, from the most junior to the most senior. I believe that if you can build a great team that the security mission will be achieved along with the right executive support. ANALYZE. ORGANIZE. EXECUTE. That’s what I do. Oh, and I also love stopping bad guys from taking down your business or disrupting operations. I work with stakeholders throughout the business and IT to develop information security policies and controls that manage risk to acceptable levels. This must also take into consideration the overall strategy & goals of the business. I try to think out of the box to select controls that will have the least disruption upon the business yet still achieve required objectives.

Introduction:

I’ve spent lots of time on LinkedIn, says Brad Gorka. With some of this extra time I decided to write about the topic of Crypto Pig Butchering and some recent experiences. Shameless plug… I am looking for a new CISO opportunity. If you enjoy this content, I would be grateful if you Like, Repost, or Comment to help me out.

Summary: If its too good to be true, it probably is! Crypto pig butchers have started to use #AI to increase the legitimacy of their fake LinkedIn profiles and now appear to even be posting “original” high-quality content developed by AI and otherwise interacting with content on LinkedIn.

Recommendation:

Stop blindly accepting every LinkedIn invite. These fake profiles are incredibly easy to spot with minimal effort. Even if you don’t interact with them you are helping them by giving access to your network for lateral movement and increasing the profile legitimacy.

There is a heavy amount of activity on LinkedIn by so-called Crypto Pig Butchers. This scam was heavily publicized starting in 2022, including a thorough article here by Brian Krebs. It goes something like this: You get a random LinkedIn connection invitation from an attractive-looking person, usually a young Asian woman. Or in some cases, from an unsolicited/unconnected direct message (some of the profiles have LinkedIn Premium and have this capability). The profile headline usually says they work at an investment firm or are a business owner/leader. Bottom line – they want to look much smarter than you and more attractive too. This is basic Social Psychology stuff here folks.

They introduce themselves in a message claiming they want to interact with you to have intelligent conversation and exchange business/industry information for the common good blah blah blah – it really makes no sense at all because they have absolutely nothing to do with what you do so you really don’t have much to talk about in common anyway. If you accept the message or connection and respond they will give a brief intro and quickly suggest that you switch the conversation over to WhatsApp or Telegram. Eventually this leads to them suggesting you download a cryptocurrency investing app and sink your life savings into it, which will later be stolen from you.

I’ve been observing this activity for many months and what is interesting to me is how unsophisticated their attempts have been (up until recently). I have even joked to people that in 2023 they can do better. The profiles are obviously fake – with highly unusual school and work history and bizarre profile summaries that are all over the place, suggesting the “person” has skills you might find in someone with 5 graduate degrees from Harvard. It’s not a surprise if their profile actually says they went to Harvard. They will claim to be from some large US city (like New York City, Los Angeles, Washington DC, etc.) and their written English, while having correct word spelling, has very poor grammar, syntax, and word choice in conversation – but the writing on their Bio will look great, probably because it is copy & pasted.

Remember, if its too good to be true then it probably is. And plus, why would such an intellectual person want to converse with YOU of all people?

But something changed in the past week or two. I saw one of these profiles with two recent posts. This is weird because up to this point, I’ve never seen more than a post of a stock photo of a city skyline on a bogus account – but this time it was a real post discussing the water shortage issue in California, and it was very well written – too well-written. Because I know first-hand these scammers have poor English skills my mind immediately wondered if they used #ChatGPT to generate this content. I tested this theory by asking #ChatGPT questions to try and elicit a similar response to see how well the content matched up. While it did not have strong consistency there was a significant amount of overlap in some of the word choice and metrics/facts provided which may indicate the same reference information was used.

Brad Gorka Continues:

I used the OpenAI detection tool on this text but it indicated was probably not generated by ChatGPT. However, another AI detection tool called GPTZero suggested that some of the content was likely written by AI. So, while ChatGPT might not be the specific AI tool that was used it was likely to be something similar. This new technique of leveraging AI will help to improve the believability of fake profiles.

I used my super-Googling skills to try and find that quote from Tami McVay (above) and turned up with nothing identical, but I did find several similar quotes. I attempted to contact Tami McVay via email, asking her if she recalls ever saying that or could point me to the news article, but as of the time of publishing my story she has not responded (if she does, I will update). I have recently heard about AI (specifically, ChatGPT) “filling in the blanks” or embellishing some of its text output and curious if that is what happened here – it found other quotes and produced something similar-sounding.

Another recent and similar observation was a post by a “person” with a profile headline of “Demand Supply Planning Consultant” that posted a comment to someone else’s post about the medical condition atopic dermatitis. And wouldn’t you know it, a demand supply planning expert also happens to be an expert on dermatology! And still more unusual was that this content was in Simplified Chinese.

I clicked on the link to See Translation and got this:

I then copied that text in English and asked #GPTZero to analyze it and it returned Your text is likely to be written entirely by AI. What we don’t know is if AI authored the text in Simplified Chinese or if it was written in English and then the pig butcher ran it through a translator for Simplified Chinese. Either way it kind of makes no sense at all because the entire article and thread is in English so why even post a reply in Simplified Chinese?

And yet a third observation I had recently was the above pig butcher (the supply planning analyst who is a dermatology expert as a side hustle) commented on a post by one of my colleagues with the nonsense phrase “good luck with.” This was unusual to me because most of the profiles I have seen are quite passive and here we have one of them actually engaging with a target by commenting on the target’s LinkedIn content. This generates a lot more attention than the typical direct message approach they tend to use.

So, what can YOU do about all of this??? Stop clicking accept on these connection requests blindly and do not converse with them. You need to understand too that with the Premium features people can send you direct messages even if you two are not connected. Below I have pasted some more screenshots of what one of these profiles look like. If you see something similar and have reasonable confidence the profile is a pig butcher or otherwise a fake/malicious account, click the More button on the profile and select Report/Block. Select Report content on Profile, then Profile Information, and then pick Suspicious/Spam/Fake. This will report it to the LinkedIn police and usually the account will be deleted within 24 hours.

If you don’t follow Brett Johnson then you DEFINTELY SHOULD. He wasn’t always a good person but he certainly is today and I thank him for the collaboration on this article.

Brad Gorka’s Bonus Material:

Bonus material if you haven’t fallen asleep yet:

• Many of the profiles appear to be newly created/generated. When viewing someone’s LinkedIn profile main page, near the top, you can click the More button and then select About this Profile to see some basic information like when it was created, when they last updated contact info, and when the profile photo was updated. Many of these pig butcher profiles will show a Joined date of 3 months or less. What has been very consistent is profile photo updated within the past 3 months. Interestingly, some of the profiles I have analyzed show rather old Joined dates. This could indicate it was indeed a real account that was hijacked and is now being used by the perpetrator (I assume these accounts are cheap to buy on the dark web).
• The above details about the atopic dermatitis are from a profile that was created in 2011 (so probably it is account takeover, aka ATO) and a profile photo updated less than 3 months ago. The person has 190 connections in LinkedIn as of the time I am writing this. They could be real connections from the real victim or could be new ones from the fraudster. I did see the number tick up by +2 within a 24 hour period.
• I’ve used Open-Source Intelligence (OSINT) tools to conduct numerous reverse image searches on the profile pictures and cannot find exact matches. This leads me to believe the photos are synthetically created by AI and unique.
• LinkedIn Premium is a fantastic #osint tool. There is no doubt in my mind that fraudsters are abusing these enhanced features and #LinkedIn needs to do a much better job of policing these capabilities.

Additional profile pictures to help with awareness:

Conclusion:

Many of us predicted that AI would be coming to Social Engineering tactics and that day has come. Read up on how crypto pig butchers are operating and share with friends and relatives to help raise awareness on this terrible scam.

PLEASE SHARE SO OTHERS WILL KNOW