# MA-977.102023: MyCERT Alert - Fake Midvalley Shopping Mall Facebook Message Containing a Fake Website

**Date:** 30 Oct 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-977.102023  
**Advisory ID:** MA-977.102023

---

**1.0 Introduction**
MyCERT observed lately that there’s been a surge of scam ads promoting various products and promotions on the popular social media platform by Meta, Facebook.
The ads are created by various Facebook pages impersonating legitimate individuals and brand names claiming to run discounted sales and promotions. One recent observed ad is impersonating Mid Valley Megamall, a popular shopping mall in Malaysia and is claiming to run a promotion for Dior Sauvage perfumes.
The ads typically lead to a different website which asks you to complete a survey, fill in delivery address, or sensitive banking details.
The concerned phishing Facebook ad 
The modus operandi used by the Threat Actor is shown below:
1. A potential victim will saw an advertisement in their Facebook account.
2. From the tempting online offer, victim will click the phishing link (hXXp[:]//www.midvalleymy[.]website/diorsauvagebigsale).
3. On the phishing site, once the victim clicked on Buy Now, they are require to fill in delivery address.
4. The phishing site claimed that Order is Confirmed, delivery will be made within 3-5 days, and victim require to make payment upon receipt.
5. By this stage, the threat actor has obtained personal data, or Personally Identifiable Information (PII) – which is an information connected to a specific individual that can be used to uncover individual’s identity.
6. Below are screenshots of different phishing sites, (hXXp[:]//www.diorofficial[.]online/missdiorbigsale) and (hXXp[:]//www.diorofficial[.]online/diormenssummer) but with the same modus operandi.
7. As of writing, the phishing sites are still active. MyCERT has notified the hosting provider to investigate and take appropriate action towards the phishing sites.
The modus operandi used by the Threat Actor is shown below:
1. A potential victim will saw an advertisement in their Facebook account.
2. From the tempting online offer, victim will click the phishing link (hXXp://www[.]machinesofficial[.]online/pavilion-kl.sale).
3. On the phishing site, once the victim clicked on Buy Now, they are require to fill in delivery address.
4. The phishing site claimed that Order is Confirmed, delivery will be made within 4-10 days, and victim require to make payment upon receipt.
5. By this stage, the threat actor has obtained personal data, or Personally Identifiable Information (PII) – which is an information connected to a specific individual that can be used to uncover individual’s identity.
6. As of writing, the phishing sites are still active. MyCERT has notified the hosting provider to investigate and take appropriate action towards the phishing sites.
**2.0 Impact**
Disclosure of banking information, name, address, and phone number to third parties or attackers and potential financial loss to victims.
**3.0 
Below are references to similar incidents:
- [MA-976.102023: MyCERT Alert - Telegram Phishing Impersonate MyKasih Sumbangan Asas Rahmah (SARA)](https://www.mycert.org.my/portal/advisory?id=MA-976.102023)
- [MA-975.102023: MyCERT Alert - MyBayar PDRM Phishing Website](https://www.mycert.org.my/portal/advisory?id=MA-975.102023)
- [MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
- [MA-843.072022: MyCERT Alert - Security Best Practices on Safe Online Transaction and Safeguarding Banking Information](https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=e68d78b0-c2fd-475c-bcd9-7c82cad079ca)
**4.0 Recommendations**
The phishing attack is meant to retrieve banking credentials and other information from victims, which could be used for other malicious purposes.  MyCERT highly recommends the following:
- Maintain a watchful eye: When an online deal seems too good to be true, exercise caution to shield yourself from potential online scams.
- Do not click any suspicious URLs sent through social media posts or ads, SMS, email, or any messaging services.
- Use different password variations for each online account and adhere to the best password management practices. This step should protect you in the future because no other account should be affected if one account is breached.
- Quickly file a police report if they encounter or fall victim to such scams.
- If you suspect unauthorised bank transactions in your account, immediately report to your bank by calling the bank's hotline, which normally operates 24x7.
- You can also call the Malaysian National Scam Response Centre (NSRC) hotline at 997 within 24 hours or as soon as possible. The hotline number operates daily, including on public holidays, between 8 a.m. and 8 p.m.
- The public can also contact the Royal Malaysia Police (PDRM) via the CCID Infoline at 013-211 1222 or the CCID Scam Response Centre at 03-2610 1559 or 03-2610 1599.
- Contact relevant authorities such as Cyber999 for any inquiries and assistance 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://mycert.org.my/portal/advisory?id=MA-975.102023>
- <https://mycert.org.my/portal/advisory?id=MA-834.052022>
- <https://mycert.org.my/portal/advisory?id=MA-843.072022>
- <https://soyacincau.com/2023/01/30/facebook-scam-ads-promoting-rm9-philips-lattego-4300-coffee-machines/>
- <https://soyacincau.com/2023/05/12/mcmc-calls-for-intervention-to-punish-platforms-that-allow-scam-ads-in-malaysia/>