"HP Laptop for 123 MKD" scam campaign stealing Personal and Card data

An active scam campaign is active on Facebook targeting Macedonian users with an offer of 2 year old HP laptops for only 123 MKD (approximately $2 USD).

The scam starts via Facebook, where attackers are impersonating Setec, a legitimate Macedonian technology retailer, to trick victims into providing personal data and  credit card information. The scam is being distributed as a fake Setec Facebook page is promoting "damaged packaging" laptops at the symbolic price of 123 MKD. 

• The post likely appears in users' feeds as sponsored content, then gets amplified via likes or shares from people who fall for the scam.
• Fake user accounts post supposed "success stories" with images of HP laptops they claim to have received. You will note completely illogical names for users from Macedonia, like "Claire Morel", "Amélie Dupont", "Bogdan Tomoiaga" and more. All these names are not of Macedonian native speakers, yet their comments are in Macedonian.
  • The AI bots that generated the comments are recycled for multiple ongoing scams on different languages. The profiles are the same, they jyst post in different languages.

If a victim clicks on the the linke in the Facebook Page, they are taken to Victims click on Facebook posts leading to a page on a site miracledat.com. Obviously, that site has nothing to do with Setec, and even more - the domain is registered on January 14, 2025 - only 99 days old. A company that exists for over 20 years won't be using a 3 months old site for a giveaway.

The site presents a fake "lottery" claiming the visitor was selected to win an HP 15 laptop and implies urgency through a countdown timer (common manipulation tactic)

The victims answer simple qualifying questions to indicate some sort of effort towards getting the laptop and a "filtering". In reality, the user can click on whatever they want, the result is always a success.

Then they're presented with an online game gift boxes to click, creating the illusion of a game. Reading through the source code, we found comments in Russian that describe that the "winning" box is always the third one. No matter which boxes are chosen, the victim always "wins" the laptop. 

// Gift box
let emptyBoxClicked = false; // флаг для отслеживания клика по пустой коробке
let twoEmptyBoxClicked = false; // флаг для отслеживания клика по второй пустой коробке
let modalShown = false; // флаг для отслеживания появления модального окна
   // если кликнули на закрытую коробку и нет других открытых коробок с призом
   // если кликнули на другую закрытую коробку, когда уже открыта пустая коробка, но модальное окно еще не появилось
   // если кликнули на закрытую коробку и нет других открытых коробок с призом
   // если кликнули на другую закрытую коробку, когда уже открыта пустая коробка, но модальное окно еще не появилось
   // если кликнули на другую закрытую коробку, когда уже открыта пустая коробка и модальное окно появилось
       $("#fullscreen_prize_visib").fadeIn(1000); //открытие картинки с продуктом на весь экран, после коробочек
       $(".picture_after_boxes").addClass("active"); //анимация прокручивания для картинки с продуктом
         $("#fullscreen_prize_visib").fadeOut(100); //скрыть показ картинки с продуктом перед модальным окном
         $("#visib_modal_third").fadeIn(1000); //открытие последнего модального окна с призом
//modal  window

Translated to English:

// Gift box
let emptyBoxClicked = false; // flag to track click on empty box
let twoEmptyBoxClicked = false; // flag to track click on second empty box
let modalShown = false; // flag to track modal window appearance
   // if clicked on closed box and no other prize boxes are open
   // if clicked on another closed box when an empty box is already open, but modal window hasn't appeared yet
   // if clicked on closed box and no other prize boxes are open
   // if clicked on another closed box when an empty box is already open, but modal window hasn't appeared yet
   // if clicked on another closed box when an empty box is already open and modal window has appeared
       $("#fullscreen_prize_visib").fadeIn(1000); //opening full screen product image after boxes
       $(".picture_after_boxes").addClass("active"); //scrolling animation for product image
         $("#fullscreen_prize_visib").fadeOut(100); //hide product image display before modal window
         $("#visib_modal_third").fadeIn(1000); //opening the final modal window with prize
//modal window

The victim is then requested to enter their name, surname, phone and address. After pressing 'submit' the browser is redirected through two web sites 

• the first one just saves the submitted data by the victim
• the second one is again given the submitted data but it returns an address of a third site
• on the third website a payment page appears requesting credit card details for a "small shipping fee" of 145 MKD

This redirect technique is used to avoid stopping the scam if the fake credit processing page is shut down. The second website can be configured to return a different address for the payment site, and the second website is not malicious by itself to be immediately blocked.

After entering card details, the payment site tries to charge money immediately. 

Stolen data includes

• Name, Address, Phone number
• Credit card numbers
• Expiration dates
• CVV security codes

The card data will be used to charge your card, or "pay for services" on other websites where criminals have set up businesses used to launder the money from stolen cards. The personal data will be used to target the victim with other scams, phising or phonecalls to try other theft techniques. Finally, all this data can and will be sold for profit to other criminals.

Red flags

1. Price too good to be true: HP laptops for 123 MKD (around $2) is absurdly low
2. Urgency tactics: Countdown timers, "limited quantities" warnings
3. Artificial social proof: Fake testimonials with stock profile photos
4. Domain inconsistency: Using miracledat.com instead of setec.com.mk (the legitimate company domain)
5. Recently registered domains: Both domains were created within the past year
6. Grammatical errors: While written in Macedonian, the text shows inconsistencies typical of scam operations
7. Theatrical interface: The gift box selection game is designed to create false engagement
8. Guaranteed winning: Everyone wins the prize, which is not how legitimate promotions work