Since the summer of 2023, more than a dozen scam sites have appeared on RuNet that claim to provide key production services. Links to these resources are often posted in announcements placed at building entrances. This information comes from Sergey Trukhachev, deputy director of the Solar AURA external digital threat monitoring center at RTK-Solar, an organization known for developing tools and monitoring information security.
According to the expert, scammers frequently rely on classic psychological tricks to draw victims to the site and persuade them to order keys. For example, messages may claim that the entrance intercom system will soon be replaced. To make the offer seem more convenient for potential customers, these advertisements are accompanied by a QR code that leads to a malicious site.
“Advertising lets attackers reach a broad audience with minimal cost, because people who idly flip through a bunch of keys while waiting for an elevator are less likely to suspect danger when they see messages on behalf of the management company,” Trukhachev noted.
The fraudulent sites identified by RTK-Solar researchers are strikingly minimal in design. They typically feature a simple login form requesting a delivery address and the number of keys needed, priced at 300 rubles per key. Occasionally, a phone number field is added to the form. Payments are made by transferring funds to a bank card. To enhance credibility, the fake sites imitate real companies that handle intercom maintenance and related services.
“Because these sources are not branded and do not appear in mass phishing campaigns, they often slip past many security systems and can exist for a long period, generating profits for their operators,” Trukhachev explained.
Experts advise staying vigilant to avoid falling for this scam. If an advertisement promises work or services with a link to a website, it is best not to click and certainly not to enter any personal information or make payments. Instead, individuals should contact their building management company directly to verify the legitimacy of the information in the notices or brochures.
Earlier reports warned Russians about another scam pattern involving a call center agent named Lyudmila who interacts with potential victims over the phone, highlighting the diversity of social engineering techniques used to exploit trust and extract money or sensitive data.