u/binfraudin

I don’t think a lot of people are aware of how exactly AI is being used in fraud. I’m going to share my pipeline to kinda help people on how to prevent it. I’m not going to dive deep into how they use it in attacks because lol this is reddit but I am going to show you how I get my leads for said attacks. It might be simple but majority of people have no clue and overlook this route a lot.

[quick background] - I learned to code in like 18’-19’ started w Python moved to js / go / rust and currently learning C. I feel I learned at a prime time because it was prior to the whole AI take over and I basically had to learn from building my own projects and figuring out everything from YouTube tuts and stackoverflow. I’ve built OTP bots , pages , drainers etc prior to every using AI in my codebases just for reference.

1. FACEBOOK COMMENTS IN GROUPS/PAGES

Facebook is a great place to find targeted leads , groups and pages are probably the easiest to find people we look for. Built an app using Claude to drop in a page / group or search query and scrape all profiles from post comments / likes.

2. FACEBOOK PROFILE LOCATION

Majority of people who use Facebook have their “hometown” and “living in” filled out. Thats all I need name + location , and depending on how important the lead comes out to be I just need birthday to be super accurate before the next step. If your on facebook don’t use your real location , keep your profiles private. If you are in groups or pages dealing with high targeted things (crypto,banks,etc) post anonymously. I made AI build this for me.

3. PUBLIC DATA SCRAPE

This part is pretty simple as well , there are many free public data websites like Truepeoplesearch , my family tree , etc. these sites are very easy to scrape with a simple cloudflare bypass and rotating proxies or a vpn switcher you can scrape thousands and thousands of public data for free. All you need is Name + Location . I get that from the Facebook profiles. scrape the first 3 results majority of the time I get the lead phone, email , addy , family , friends , month and year of birth (verify with Facebook birthday post for more accuracy). And there you have it a full lead ready to be used in whatever kind of attack you want . How to prevent your data being scrapped is manually going to each website and opting out of these website. This prevents only public data not access to like TLOxp or places like that. I made AI build this for me

4. VERIFYING LEADS

Here’s the part where a lead becomes a HQ lead , I’m going to use CashApp for this example but it applies across a lot of other websites. Websites have certain vulnerabilities that are overlooked due to the fact they wouldn’t see exactly how people like me can target them. For CashApp , when you goto pay someone you can type in email or phone# and they literally tell you if they have a cashapp and what their cashapp tag is example shown in image that’s considered a HQ lead. A lot of other vulnerabilities I’ve been discovering is Sign Up pages. if your email or phone number is registered in their db they tell you the email has already been used or some kind of error. The way they try preventing this , is just handling everything on the backend but if you just look at the network request and cross reference that between a successful request there are key differences on the response that most of the time can tell you why it returned the way it did. How to prevent this in my opinion is using different emails that are solely for that account and not crossing emails between other platforms. The only reason there are public databases of all of our information is because everytime you open your phone data starts getting sent out , anytime you enter a form it’s getting tracked and sold legally. The public data is legal , what people do with it isn’t obv lol.

All these tools I used I made with AI , prompting only , fixing slight mistakes here and there but 90% to AI. No it won’t tell you a breakdown of how you can obtain these kind of leads but if you already know and have a target bypassing the very light rail guards they have is really easy. Making a phishing page use to take me a day or 2 now it takes me 20mins with a few screenshots with black boxes over logos / words and a prompt.

Understand this is base level btw , this is just lead generation. AI has built me a C2 that bypass’s windows security , actually found me vulnerabilities inside Google Chrome to extract passwords silently. Fully functional P1 bot , email / sms senders , using local fine tuned models trained ontop of specific attacks. I’m not going to get into more because I’m going off track , I’m only posting this because I don’t target low net ppl. I don’t think I’m doing good but I’m just letting people be aware of how things are actually working from someone in the mix and how fast it’s progressing. And somewhat can protect yourself , minimize your social fingerprint as much as possible because I everyone is accessible on the internet now.

If this gets deleted my bad I’m not trynna harm yall just more of a warning / information to how we are able to get your information.