A WhatsApp message with a phishing link (a website that lures users to reveal their personal information) is advertising Norwegian scholarship opportunities to interested applicants in Ghana.
The message claims fully-funded scholarships purportedly sponsored by the Government of Norway are available for interested applicants at different stages of their educational pursuit including: undergraduate, Masters degree, and PhD levels.
The message reads; “FULLY FUNDED SCHOLARSHIP IN NORWAY 2024. The Norwegian Scholarship is a yearly program which is aimed at Undergraduates, Masters and PhD Students who want to study in NORWAY” and further states some requirements and benefits of the scholarship programme.
A screenshot of the message circulating on WhatsApp
What happens when you click on the link
Once a user clicks on the application link, they are redirected to a homepage with the Norwegian coat of arms alongside information about the scholarship. Also, on the homepage are two green buttons that lead interested applicants to apply for a scholarship or a visa. When a user scrolls down, the scholarship’s eligibility criteria are published.
A screengrab of a web page
Upon clicking to apply for the scholarship, a page opens that asks for information such as name, address, email address, and phone number.
The phishing link asking for the bio data of gullible applicants
Upon filling in the demanded information, the applicant is directed to another page where applicants choose their current level of education and then subsequently the applicant is asked to share information about their age range and the region of Norway they hope to study.
Screenshots of some of the web pages
On the last page, the user is asked to share the message with 5 WhatsApp groups or 15 contacts to qualify for a visa application.
A screenshot of a web page
Upon clicking the invitation link, a pop-up menu appears asking to redirect the application to “Whatsie” – a mimic of the well-known messaging app, WhatsApp, with a request to download “Whatsie” which GhanaFact has detected to be a Malware.
GhanaFact ran the link -kikiloans.com- through WHOIS to gather data on the creators of the link and found that it was created by a domain privacy organisation called 123-Reg Limited in August 2022 and is set to expire in the same month in 2024.
Information gleaned about the actors behind the phishing link
Using Virustotal – a website that allows users to scan documents and links for malicious content, GhanaFact scanned the link and found 9 security vendors have labelled it as malicious.
