AntiMalware•July 12, 2026•🇷🇺Translated from Russian

Scammers Impersonate Neighbors to Lure Residents into Fake Bomb Shelter Chat Groups for Data Theft

Scammers have developed a new social-engineering tactic that capitalizes on heightened public concern over safety by pretending to be neighbors and inviting people to join chat groups about equipping residential buildings with bomb shelters.

According to reports from the Telegram channel “Lapsa Media” and the author channel “Bez obmana” run by Alexander Yelshevsky, the fraudsters call residents and claim that an urgent meeting of building occupants is being organized to discuss the creation of a bomb shelter. The caller introduces himself as a neighbor, stresses the importance of the gathering, and urges the recipient to be added to a common chat so they can participate.

How the Scam Unfolds

Instead of discussing the supposed shelter, the conversation quickly shifts to requests for personal data. Victims are asked to provide their name, phone number, or other identifying information under the pretext of being added to the attendance list. The scammers further claim that without joining the chat and appearing on the list, the person will be unable to attend the meeting.

The fundamental flaw in the story is that residents cannot simply vote to establish a bomb shelter. Such facilities must be created in accordance with official state requirements and safety regulations. Therefore, any claim of an urgent neighbor meeting that cannot be accessed without handing over personal information to a stranger over the phone is itself a strong indicator of fraud.

Second Stage of the Scheme

If the target continues the conversation, a follow-up stage often occurs. The victim may later receive calls from individuals posing as government officials who state that the victim’s data has fallen into the hands of criminals. These callers then pressure the person to transfer money or perform other actions under the guise of protecting their information or resolving the issue.

Recognizing and Avoiding the Scam

  • The caller avoids any suggestion of an in-person meeting and insists on continuing the discussion exclusively by phone.
  • The conversation rapidly moves away from the supposed shelter topic toward requests for personal data.
  • The caller pressures the victim to join an unknown chat immediately.

Security experts advise ending such calls at once. Personal information should never be shared with strangers over the phone. If the caller is genuinely a neighbor, any legitimate issue can be discussed face-to-face within the building.

Related articles

Habr•Fraud & Social Engineering

Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure

StackWorks has published the fourth installment in its investigative series on Aroshka Cloud, detailing how the cloud storage provider accused the studio of orchestrating a DDoS attack shortly after the third part appeared. The service published five posts claiming technical evidence linked StackWorks to the attack, including IP traces from Moscow, Ufa, and Stavropol, while asserting that its SOC 24/7 team mitigated a 3.5 Gbit/s assault within seconds. StackWorks responded with a pre-trial claim demanding removal of the posts and a public retraction, which Aroshka Cloud rejected within seven minutes. Analysis of the provider’s own Kwork job postings reveals requests for template-based support staff, a five-VDS server pool, and later up to eight NVIDIA H200 GPUs with InfiniBand, contradicting public statements about multi-country data centers and round-the-clock security engineers. Further inconsistencies include mismatched time zones in email headers, inflated user statistics, and reliance on the BeDrive script rather than custom development. The investigation continues with plans to involve law enforcement regarding suspicious visitor logs.

Habr•Fraud & Social Engineering

Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums

An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.

AntiMalware•Fraud & Social Engineering

Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams

Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.

Habr•Fraud & Social Engineering

SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing

The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.