In 2024 alone, U.S. consumers lost a staggering $5.7 billion to investment scams—enough to fund five Mars rover missions. These losses didn’t stem from reckless spending but from people trying to secure their financial future, only to be manipulated by highly sophisticated cybercriminals.
New research from Infoblox Threat Intel reveals the dark operations of two major scam groups: Reckless Rabbit and Ruthless Rabbit. Both groups use advanced registered domain generation algorithms (RDGAs) to run large-scale fraudulent campaigns disguised as legitimate investment opportunities.
Reckless Rabbit: The Facebook Ad Faker
This threat actor uses fake Facebook ads, often featuring phony celebrity endorsements, to promote fraudulent investment platforms. They create thousands of lookalike domains that respond to any subdomain query, making it harder for cybersecurity systems to detect real scam pages. With localized content, they target victims across the globe.
Ruthless Rabbit: The News Spoofer
Focusing mainly on Eastern Europe, Ruthless Rabbit operates a sophisticated cloaking service to validate user profiles and avoid detection. They impersonate trusted news websites and brands like WhatsApp or Meta to lure victims. Their constantly changing URL paths make tracking their scams extremely challenging.
The Psychology Behind the Scam
These scams thrive on chaos and trust. When economic conditions are unstable, people are more likely to fall for promises of quick returns. Scammers exploit this vulnerability by mimicking trusted sources, creating urgency and a fear of missing out.
As scam actors become more creative and organized, experts urge consumers to remain cautious, verify investment platforms, and report suspicious ads. With trust as their weapon, Reckless and Ruthless Rabbit continue to exploit people’s hopes—for now.
