The dark prescription: inside the infrastructure of illegal online pharmacies

The dark prescription: inside the infrastructure of illegal online pharmacies

Speakers: Lubos Bever (Threat Researcher, Gen Digital), Jan Rubín (Threat Research Team Lead, Gen Digital)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=ZXZzXg9IMII

Overview

The internet, a boundless source of information and commerce, has unfortunately become a fertile ground for illicit activities, prominently including the proliferation of illegal online pharmacies. In their compelling talk at Virus Bulletin, Lubos Bever and Jan Rubín from Gen Digital peeled back the layers of a sophisticated, global operation they've dubbed Medifantom, exposing a massive infrastructure dedicated to peddling counterfeit and unapproved medications. This isn't merely a tale of cybercrime; it's a critical public health crisis, where the stakes are quite literally life and death.

Bever and Rubín's research illuminates how Medifantom leverages an intricate web of thousands of domains, cloned storefronts, and shared payment gateways to ensnare unsuspecting victims. Their methods range from sophisticated search engine poisoning to impersonating legitimate brands and even exploiting the burgeoning trust in AI chatbots. The talk serves as a stark warning, urging both cybersecurity professionals and the general public to recognize the grave dangers posed by these illicit enterprises, which often sell products containing toxic chemicals or no active ingredients at all.

The presentation meticulously details Medifantom's operational tactics, from victim acquisition to payment processing and the underlying infrastructure that enables their global reach. It underscores the urgent need for enhanced awareness, robust defensive strategies, and collaborative efforts across the cybersecurity industry, regulatory bodies, and the public to combat an adversary that preys on vulnerability and manipulates digital trust for dangerous profit.

Background

▶ Watch: Introduction & spotting a fake online pharmacy (0:00)

The journey into the dark underbelly of online pharmacies began with Gen Digital's ongoing research into fake e-shops. What initially appeared as a random assortment of scams soon coalesced into discernible clusters, revealing a single, massive infrastructure rather than dozens of isolated incidents. This initial observation was corroborated by external data; the National Association of Boards of Pharmacy (NABP), a US non-profit organization dedicated to patient safety, reported that at least 40,000 online pharmacies fail to meet safety standards. Alarmingly, the NABP estimates that up to 95% of all online pharmacies operate illegally, flooding the internet with everything from counterfeit drugs to unapproved prescriptions.

This pervasive issue stems from a fundamental dichotomy in the online pharmacy space: a mix of highly trusted, legitimate providers and highly deceptive actors. Legitimate pharmacies adhere to stringent safety and operational standards, verifiable by national authorities such as the FDA in the US or BfArM in Germany. However, many users lack the knowledge or tools to verify this legitimacy, creating an easy target for threat actors. These illicit operators cultivate a false sense of legitimacy by employing fake badges and logos of national authorities or even antivirus companies. They entice victims with promises of cheap pills, no prescription required, and overwhelmingly positive, albeit fabricated, customer reviews, ultimately funneling transactions through fake payment gateways.

Medifantom's targets are often individuals grappling with sensitive or intimate health conditions, who, out of frustration or discretion, turn to online searches rather than traditional medical consultation. The group actively monitors social media platforms and public spaces to identify individuals seeking high-demand medications, particularly those that are prescription-only or temporarily unavailable. Common bestsellers for these illicit pharmacies include erectile dysfunction medications, powerful antibiotics for sexually transmitted infections, and, notably, Ivermectin, aggressively pushed during the COVID-19 pandemic amidst misinformation about its efficacy. Despite continuous attempts by governments and the private sector to curb illegal online pharmacies—with advertising platforms like Google, Bing, and TikTok implementing policies to prevent their promotion—Medifantom has adapted, developing sophisticated techniques to circumvent these restrictions and reach their target victims.

Key Findings

▶ Watch: Medifantom's victim targeting and delivery methods (5:10)

The core discovery of this research is the identification and detailed profiling of Medifantom, a single, highly organized, and global threat actor behind a vast network of illegal online pharmacies. This operation is far from a collection of isolated scams; it represents a unified, massive infrastructure designed for maximum reach and deception.

Key findings related to Medifantom's operation include:

• Massive Scale and Infrastructure: Medifantom operates thousands of domains, many featuring cloned storefronts, all pointing back to a shared, centralized infrastructure. Over 5,000 unique domains were detected, exhibiting an exponential growth rate, though often accompanied by rapid domain rotation to evade detection.
• Sophisticated Victim Acquisition: The group employs both active and passive methods to reach victims. Active methods include running spam campaigns and managing dedicated fake review platforms. The most impactful, however, are passive methods that capitalize on victims' active search for medications, including extensive Search Engine Optimization (SEO) poisoning and direct brand impersonation.
• Search Engine Manipulation: Medifantom compromises legitimate domains and injects malicious content, leading to immediate redirects to fake pharmacies or embedding promotional content disguised as doctor recommendations with direct links. This manipulation ensures their illicit sites appear among the top search results, even confusing search engine crawler bots.
• AI Chatbot Poisoning: A particularly alarming finding is the ability of Medifantom to poison AI chatbots. In one instance, a user's query about Cialis prices returned a link to a known fake pharmacy from an AI chatbot, highlighting a new frontier for malicious link injection.
• Advanced Payment and Communication Systems: The operation features more than 60 unique, attacker-controlled fake payment gateways operating on separate domains. These gateways often demand unusual information like date of birth and offer suspicious incentives, such as a 10% discount for cryptocurrency payments. Crucially, they integrate fully functional live chat systems and dedicated phone numbers, both manned by real human operators, not chatbots, to guide victims through the scam.
• Robust Attribution Methodology: Despite the use of diverse SSL certificates and hosting providers (OVH cloud, Cloudflare, Russian providers), attribution to Medifantom was achieved by identifying unique, shared artifacts. The identical JavaScript code used for live chats and the verbatim reuse of specific phone numbers across multiple fake e-shops and their corresponding payment gateways provided irrefutable links to a single, controlling entity.
• Global Reach and Localization: The operation targets a global audience, with at least 25 different language localizations for user convenience. Geographically, Europe (especially Switzerland, Greece, Austria, France, Spain), Japan, Australia, the US, and Canada are most affected, likely due to stricter prescription regulations or higher medication costs in these regions.
• Detection Capabilities: The research demonstrates that detection is feasible through a combination of static analysis of web page source code (JavaScript, CSS, image names/paths, HTML templates, brand impersonation) and network-based analysis, particularly by tracking referrals from known malicious payment gateways to identify associated malicious e-shop domains.

Technical Deep Dive

▶ Watch: Fake payment gateways and human call centers (13:00)

Medifantom’s operation is characterized by a multi-layered technical and social engineering approach, meticulously designed to create a façade of legitimacy while efficiently drawing in and defrauding victims. The technical infrastructure supporting this global scam is both extensive and cleverly disguised.

The initial phase of victim acquisition often begins with Medifantom actively monitoring public spaces and social media platforms for individuals expressing a need for high-demand, prescription-only, or temporarily unavailable medications. Common targets include erectile dysfunction drugs, powerful antibiotics for STIs, and, notably, Ivermectin, which was aggressively marketed during the COVID-19 pandemic with misleading claims of efficacy. Once potential victims are identified, Medifantom employs a dual strategy of active and passive methods to deliver links to their fake pharmacy websites.

Passive Methods: The Apex of Deception

While active methods like spam campaigns and managing fake review platforms exist, the most significant and insidious techniques are passive methods, which exploit a victim's natural online behavior:

• Search Engine Optimization (SEO) Poisoning: This is a cornerstone of Medifantom's strategy. The group compromises legitimate, often high-ranking, domains and injects malicious content. When a victim searches for a medication, they might click a seemingly legitimate link in the search results, only to be immediately redirected to a fake pharmacy. Alternatively, they might land on a compromised legitimate site featuring promotional content—often disguised as a doctor's recommendation from a reputable-looking "surgery center"—with an embedded link to an illicit pharmacy. This technique creates a powerful illusion of legitimacy, as the initial search result appears credible. The speakers noted that crawler bots could also be confused, indexing descriptions of the malicious destination rather than the original legitimate domain.
• Brand Impersonation: Medifantom actively monitors local pharmacies, particularly those that do not offer online services. They then create entirely new, full-fledged fake pharmacy websites impersonating these real-world brands. An example cited was a local Czech pharmacy, "Learn Potrani," for which Medifantom fabricated an online presence, complete with a convincing design. This tactic preys on users who might be searching for a local, trusted provider online, only to be redirected to a fraudulent site.
• AI Chatbot Poisoning: A particularly alarming development is Medifantom's ability to manipulate AI chatbots. The researchers observed a scenario where a user seeking pricing information for Cialis via an AI chatbot was provided with a link to a frequently observed fake pharmacy. This demonstrates a dangerous evolution in distribution, as users are increasingly relying on AI for information, lending an unearned sense of authority to malicious links.

Payment and Communication Infrastructure

Once a victim lands on a fake pharmacy website and proceeds through the typical shopping workflow (selecting medication, adding to cart), they are directed to a payment gateway. These gateways are critical components of the scam, operating on domains separate from the fake pharmacies but fully under the attackers' control. Key suspicious characteristics include:

• Unusual Data Requirements: Payment gateways often demand non-standard information, such as the victim's date of birth, which is irrelevant for a standard payment transaction.
• Cryptocurrency Incentives: A clear red flag is the offer of a 10% discount for payments made via cryptocurrency, a common tactic used by illicit operations to facilitate irreversible transactions and obscure financial trails.
• Human-Operated Communication Channels: Perhaps the most sophisticated aspect is the integration of fully functional communication channels. Phone numbers and live chat links are prominently displayed on both the fake e-shops and payment gateways. The research revealed that these channels are manned by real people, not automated chatbots or Large Language Models (LLMs). Attackers leverage dedicated call centers and live chat operators to guide victims through the purchasing process, answer questions, and build trust, ultimately ensuring the scam's success. This human element significantly increases the social engineering effectiveness of the operation.

Attribution and Detection

Attributing such a vast and dynamic operation to a single threat actor, Medifantom, was a significant challenge. While elements like SSL certificates (Let's Encrypt, Sectigo, Google Trusted Services) and hosting providers (OVH cloud, Cloudflare, various Russian-based providers) were too diverse to be reliable indicators, the researchers identified crucial shared artifacts:

• Identical JavaScript for Live Chats: The same, unique JavaScript code used to power the live chat functionality was consistently found across different fake e-shops and their associated payment gateways. This identical codebase served as a strong link, indicating a common origin.
• Reused Phone Numbers: Similarly, the exact same phone numbers (as string values) were observed on both the fake e-shop domains and their corresponding payment gateways. This is a highly improbable scenario for legitimate third-party payment processors, unequivocally pointing to the same actor controlling both ends of the transaction.

By clustering these intertwined artifacts, the researchers were able to confirm that the seemingly disparate operations belonged to a single group, Medifantom.

Detection Methodology

The research outlined a two-pronged approach to detection:

• Static Analysis: This involves analyzing the source code of web pages, focusing on JavaScript, CSS, images (including their names and paths), and HTML templates. The presence of specific JavaScript code for live chats, particular phone number strings, and patterns indicative of brand impersonation or HTML template reuse are key indicators.
• Network-Based Analysis: Once a malicious payment gateway is identified and classified, network analysis can track referrals. By examining which domains redirect users to these malicious gateways, security systems can identify and block the originating fake e-shops. This allows for the extraction of Indicators of Compromise (IoCs) and their integration into detection pipelines.

The sheer scale (over 5,000 domains, 60+ payment gateways, 25+ localizations) and the technical sophistication of Medifantom underscore the persistent and evolving threat posed by illegal online pharmacies.

Demo / Proof of Concept

▶ Watch: Attributing scams to Medifantom via shared infrastructure (17:50)

The talk did not include a live demonstration or proof-of-concept in the traditional sense. Instead, the speakers presented numerous real-world examples and screenshots throughout their presentation, illustrating compromised legitimate websites, fake pharmacy storefronts, fraudulent payment gateways, and the interaction with human operators via live chat. These visual aids served to concretely demonstrate Medifantom's methods and the appearance of their illicit infrastructure.

Defensive Implications

▶ Watch: Key takeaways: Public health, sophistication, user education (22:15)

The detailed exposé of Medifantom's infrastructure and tactics highlights several critical defensive implications for both individual users and the broader cybersecurity community. Addressing this public health crisis requires a multi-faceted approach.

For Individual Users and the Public:

• Enhanced Awareness and Education: The most crucial defense is knowledge. Users must be educated on how to distinguish legitimate online pharmacies from fraudulent ones. This includes verifying national authority badges (e.g., FDA, BfArM), which should be clickable and lead to official verification pages, not just static images.
• Skepticism Towards "Too Good to Be True" Offers: Be highly suspicious of pharmacies offering medications without a prescription, at unusually low prices, or with incentives like discounts for cryptocurrency payments. Legitimate pharmacies adhere to strict pricing and prescription regulations.
• Verify Communication Channels: If an online pharmacy offers a live chat or phone number, exercise caution. While legitimate businesses use these, the presence of human operators guiding users through suspicious payment processes is a major red flag.
• Trust Local Providers and Prescriptions: The speakers emphasized that prescriptions are in place for a reason. Users should trust their local, established healthcare providers and pharmacies, and adhere to proper prescription protocols rather than seeking shortcuts online.
• Beware of Search Engine and AI Chatbot Results: Do not blindly trust the top results from search engines or links provided by AI chatbots, especially for sensitive medical queries. Cross-reference information with official health organization websites.

For Security Vendors and Defenders:

• Implement Advanced Detection Mechanisms: Leverage the research's findings on static and network-based analysis. Develop and deploy solutions that can:
• Perform static analysis of website source code, specifically looking for JavaScript patterns unique to Medifantom's live chats, reused HTML templates, and specific phone number strings.
• Conduct network-based analysis to track referral chains from malicious payment gateways back to the originating fake e-shops, enabling broader IoC extraction.
• Proactively monitor for brand impersonation by analyzing newly registered domains against known legitimate pharmacy brands.
• Focus on Shared Infrastructure Artifacts: Prioritize detection capabilities that identify the specific, unique artifacts used for attribution, such as identical JavaScript code for live chats and reused phone numbers across different components of the scam. This allows for more effective clustering and blocking of the entire operation, not just individual domains.
• Combat Search Engine Poisoning: Collaborate with search engine providers to identify and delist compromised legitimate domains being used for redirection or content injection.
• Address AI Chatbot Vulnerabilities: Work with AI developers to implement robust filtering and validation mechanisms for links provided by chatbots, preventing the injection of malicious pharmacy links.
• Rapid Domain Takedowns: Given the frequent domain rotation employed by Medifantom, security vendors must develop agile processes for identifying newly registered domains and initiating rapid takedown procedures.

For Platform Providers (Search Engines, Social Media, AI Developers):

• Strengthen Content Policies and Enforcement: Continuously update and rigorously enforce policies against the advertising and promotion of illegal online pharmacies.
• Improve Anomaly Detection: Enhance algorithms to detect unusual website behavior, sudden content changes on legitimate sites, and patterns indicative of SEO poisoning.
• AI Safety Research: Invest more in research and development to make AI models more resilient to poisoning and less likely to propagate harmful content or links.

The fight against operations like Medifantom requires collective action, recognizing that this is not just a cybersecurity issue, but a profound threat to public health and safety.

Key Takeaways

• Public Health Crisis: The proliferation of illegal online pharmacies is a severe public health crisis, directly linked to patient harm and even death, extending far beyond typical cybercrime.
• Sophisticated Global Operation: Medifantom is a highly organized, technically and socially sophisticated global threat actor, employing a massive infrastructure of thousands of domains and human-operated call centers/live chats.
• Advanced Deception Tactics: Attackers leverage sophisticated methods like SEO poisoning, legitimate brand impersonation, and even AI chatbot manipulation to ensnare victims and create a false sense of legitimacy.
• User Vigilance is Paramount: Individuals must be highly skeptical of "too good to be true" offers, no-prescription policies, and verify the legitimacy of online pharmacies through official channels, trusting local providers and prescription processes.
• Effective Detection is Possible: Security solutions can detect these operations through static analysis of shared code artifacts (e.g., live chat JavaScript) and network-based analysis of referral patterns to malicious payment gateways.
• Awareness and Education are Crucial: Raising public awareness and educating individuals on how to identify and avoid illegal online pharmacies is fundamental to mitigating this pervasive threat.

About the Speaker(s)

Lubos Bever is a Threat Researcher on the Threat Intelligence Team at Gen Digital. His current work focuses on analyzing scams, with a particular emphasis on fake e-shops. Prior to this, he was involved in research concerning PDF threats. Outside of his professional life, Lubos is an avid fan of steam racing.

Jan Rubín serves as a Threat Research Team Lead at Gen Digital. His expertise lies primarily in the analysis and reverse engineering of information stealers. He also leads a specialized team dedicated to combating data theft in general. Beyond his research, Jan is actively involved in mentoring and is a guest lecturer for a reverse engineering course at the Czech Technical University in Prague. In his free time, he is also a musician.