Since early 2023, researchers have identified ten active fraud affiliate programs coordinating owners and distributors of links to fraud and phishing sites targeting users in Russia. On average, each program generated about 4.3 million rubles in monthly revenue, according to a study provided to the publication by FAC.CT. A copy of that study is referenced as the source for this summary.
Affiliate programs enable scammers to scale illegal operations, attract more victims, and boost profits by dividing tasks such as traffic redirection, creation of phishing pages, and sending deceptive emails and messages. Fraudsters acquire ready-made phishing resources from specialized platforms, along with page templates, blocks, and payment forms, then channel traffic for a share of the stolen funds.
FAC.CT researchers examined the infrastructure of several affiliate networks in detail. By mid-summer, the platform supported an average of 156 active offers, with as many as 746 partners participating in a single bid. The scale reflects a robust ecosystem where multiple players synchronize to maximize impact.
In a typical month, participants in these programs extracted more than 17.4 million rubles from victims across 23,500 payments, with an average transaction around 740 rubles. One program launched in the second quarter of 2023 saw profits triple over the summer, rising from 908,000 rubles in June to 3,118,000 rubles in August.
The fraud schemes frequently deploy fake pages centered on lotteries with prize boxes, investments in cryptocurrencies, and seemingly lucrative promotions from marketplaces. These themes are designed to lure various audiences by promising easy wins and quick returns.
Earlier incidents, such as the Kievstar breach attributed to Russian hackers, turned out to be more damaging than initially anticipated, underscoring the real risk and scale of cybercrime operations linked to affiliate networks.