Understanding how these campaigns operate requires looking at the technical pipeline that moves an unverified rumor from a social media comment section to a malicious endpoint.
| Distribution Stage | Observed Vector | User Danger Level | Primary Operator Motive |
|---|---|---|---|
| Phase 1: Social Baiting | X bots, Instagram spam comments, misleading hashtags | Low | Algorithmic amplification & comment farming |
| Phase 2: Rerouting | Link-shortening hubs, intermediate landing blogs | Moderate | Pay-per-click ad impressions ($2, $8 CPM) |
| Phase 3: The Funnel | Restricted Telegram groups requiring channel follows | Moderate to High | Channel subscriber inflation for resale |
| Phase 4: Exploitation | Fake cloud-storage APKs, deceptive OAuth login prompts | Critical | Credential theft, spyware installation |
