The National Cyber Security Agency (NCSA), operating under the Ministry of Digital Development and Transport, has detected six websites imitating payment systems and the accounts promoting them during monitoring conducted via open sources.
elchi reports this citing the agency.
Specifically, during the monitoring, six fake internet resources using the names “AzərPay”, “Express Pay”, “ExpersPay”, “KonturPay”, “million”, and “PulPay” were identified. These resources use the names and logos of mobile operators “Azercell”, “Bakcell”, and “Nar” to offer discounted internet and talk packages. The fake pages do not provide real payment services; instead, they require users to enter their bank card details.
NCSA’s investigation revealed that the mentioned resources were created based on the same approach. Along with the fake websites, accounts were created on the “TikTok” platform to promote them, and posts from these accounts were distributed via paid advertising. The presence of “Ad”, “Learn more”, and “Shop now” sections in the promotional materials indicates the use of a paid promotion mechanism. The investigation determined that the advertising materials used on the fake resources were also prepared based on the same template and structure. The materials used logos of various mobile operators, package tables, and seasonal phrases such as “Summer campaign” and “Autumn campaign”, with only brand elements and colors being changed. One of the fake resources also used the name and visual style of the bank brand “Expressbank”.
According to NCSA’s assessment, the detected cases are not isolated incidents but elements of a single phishing network built on the same template and advertising mechanism. For this reason, blocking individual domains may not completely stop the network’s operations. Thus, it is possible to create new domains and accounts with the same approach to replace the existing resources.
NCSA advises citizens to verify offers related to internet and mobile communication packages only through the official internet resources and social media accounts of the respective companies, and not to share bank card details on links they do not recognize.