Ramadan Cyber Threat: AI-Powered Scams Target Religious Sentiments

Cybercriminals are increasingly exploiting religious sentiments during Ramadan with sophisticated social engineering attacks, prompting cybersecurity experts to urge vigilance and caution when engaging with online links and donation requests.

These attacks, leveraging advanced artificial intelligence (AI) techniques, target the human element by manipulating emotions rather than directly breaching technical systems, cybersecurity specialists warn.

Phishing campaigns are becoming more sophisticated, employing AI to generate convincing content that mimics legitimate sources, making it difficult for individuals to distinguish between genuine and malicious links.

One common tactic involves domain spoofing, where attackers register domain names that closely resemble official websites, differing by only a single character, according to security reports from the SANS Institute. For example, "ehsan.sa" might become "ehssan.sa."

Attackers also use URL shortening services like bit.ly or cutt.ly to mask the final destination of a link, preventing messaging applications from immediately identifying suspicious websites.

Some malicious links not only request donations but also install cookies to hijack browser sessions and gain access to open banking accounts.

Microsoft's Digital Defense Report indicates that seasonal attacks can increase by up to 30% during major events, with Ramadan-themed attacks often involving visual identity theft, where attackers copy the CSS code and colors of legitimate platforms to create convincing replicas.

These fake websites are then linked to fraudulent payment gateways that record credit card numbers and CVV codes instead of processing actual payments.

The International Telecommunication Union (ITU) and national cybersecurity centers recommend adhering to strict verification protocols, including ensuring websites use HTTPS for data encryption.

Enabling two-factor authentication significantly reduces the risk of banking account breaches, even if a password is compromised through a fake link, according to the Open Web Application Security Project (OWASP).

Experts also advise using tools like VirusTotal to scan links before opening them, comparing them against global threat databases.

AI-powered Endpoint Detection and Response (EDR) systems can analyze link behavior, identifying suspicious activity such as unreasonable browser permission requests.

Digital awareness remains the first line of defense, with cybersecurity agencies recommending regular software updates, monitoring of bank accounts, and avoiding the disclosure of sensitive data through unofficial channels to ensure donations reach their intended recipients safely.