It shows up as a sponsored post on Facebook or Instagram — clean graphics, friendly wording, a promise of a reward, government support, or some extra balance on your wallet. All you have to do is “verify” your account through ZainCash, Orange Money, or UWallet. You tap the link, land on a login page that looks exactly like your wallet, and type in your number, your password, and the OTP that arrives a second later.

And just like that, your balance is gone — pulled out through CliQ before you even understand what happened.

I probably would’ve scrolled past it like everyone else. But then people close to me started getting hit. So I decided to find out who was behind it.

Collecting the pieces 🔍

I started by saving every version of the campaign I could find on Facebook. Over that stretch I counted 15 of them — different names, different graphics, same trap.

I opened them one by one. All fake login pages, as expected. But when I started reading the page source, something stood out: the code was stuffed with instructions and comments, the kind of thing you see when a page is generated by AI. The graphics and the copywriting had that same synthetic feel. So now I knew what I was looking at — an AI-driven phishing campaign.

Then I did the obvious thing: opened one of the fake pages, typed in junk data, and fired up Burp Suite to watch where it went.

The login form wasn’t talking to a wallet. It was talking to a Telegram bot — and the request had the bot token and chat ID sitting right there in the open. I saved them, sent the request through, and let Telegram answer back. It handed me a surprising amount of juicy info: the bot’s name, its username, and the admin’s name and handle.

I repeated this for all 15 links, then used tools like Matkap and TeleTracker to pull the admin usernames behind each bot. Then I opened Telegram and went through the accounts one by one, hoping one would slip and lead me to a real person.

Almost all of them were garbage names — “Hero,” random strings like sskhhhibapxx. All except one, which carried a real Jordanian family name and a display photo of an actual face. I grabbed the name, searched Instagram, and found a public account that matched. I pulled his public info and started mapping it out — but something felt off. My gut said this wasn’t the guy. This was a stolen identity, planted as a decoy. Classic misdirection.

Hitting a wall 💀

I went back to the bots. Telegram’s API has an endpoint, getUpdates, that lets you read a bot’s recent messages — so I started scrolling through the history. Mostly it was a river of stolen credentials. But right at the beginning of the log, I found screenshots.

One was a CliQ alias from the Ahli Bank app. Another was a CliQ name inside a ZainCash wallet — with the phone number clearly visible.

I resolved the CliQ aliases into full four-part names through the bank app, ran the phone number through caller-ID apps like TrueCaller, and got a name back. Then I dropped everything into a single diagram in Obsidian so I could actually see the connections.

And here’s where I got stuck.

Staring at that map — the names, the numbers, the accounts — it was obvious these were all just victims, or people whose identities had been borrowed. And I started doubting my biggest assumption: that the scammer was even inside Jordan.

Think about it:

• Who risks sending stolen money to a wallet registered in their own name?
• Who puts their personal phone number on a wallet collecting drained balances?
• Who uses a country’s own symbols and the names of its national institutions to scam its own people?

The one mistake they made

While I was sitting there frustrated, half-scrolling Facebook, a brand-new campaign popped up — one I hadn’t seen before. Without really thinking, I opened the link, pulled the bot’s credentials, and checked its messages.

Nothing yet. Not a single victim had hit it.

That was the moment things got interesting. 😁

I’ll be honest that what came next was improvised — me reacting in the moment, not following some clean playbook. The bot was fresh and empty, so I sent it a fake error message, the kind that would make its owner think the link was broken on their end and that a technical glitch was why no victims were coming through. Tucked inside that message was a link that would quietly log whoever opened it — a legitimate Telegram link wrapped in an IP logger, then wrapped again in a trusted URL shortener so it looked clean.

API Connection/Response Failure: [short link]

Then I waited. An hour. Two hours. Nothing. I went to sleep.

The next morning I opened my laptop, checked the logger — and there it was. A click. 👀

My eyes went straight to the Country field:

📍 Casablanca, Morocco 🇲🇦

Along with the public IP, local IP, ISP, browser, OS, device info, screen resolution, and language. From the public IP I could see an open port, and from there even the router — a home Huawei unit (Shodan is wonderful).

The guy running a “Jordanian” scam had been sitting in Morocco the whole time.

Taking it down 💣

Once I had what I needed, the question shifted from who to how do I kill this before more people get hurt.

I didn’t have the access to revoke the bots, so in the heat of the moment I did the crude thing: I pointed Burp Suite’s Intruder at the bot and buried it under thousands of fake submissions — random numbers, random passwords — so that any real victim data would drown in the noise and be useless to sort through. It bought time, but the real fix was never going to be me alone hammering a bot.

So I built a proper report, with screenshots proving this was phishing and credential harvesting, and sent it everywhere it needed to go:

• Facebook, where the ads were running
• Google, since some pages were hosted on Blogger
• Vercel, which hosted others
• Telegram, where the stolen data was being collected

I wrote it hard. Within 48 hours, a big chunk of the operation was down.

What I want you to take from this

• More campaigns will come. This kind of scam loves occasions — New Year, national holidays, anything that gives it a reason to offer you “a gift.” The only real defense is awareness.
• This is probably Phishing-as-a-Service (PhaaS) — not one clever person, but a kit someone rents and points at a new country.
• Everything I collected was already publicly exposed by the attackers themselves. I didn’t publish anyone’s identity. This is strictly for awareness.
• If you ever get caught by a scam like this, don’t stay quiet. Go to the Cybercrime Unit and file an official report.

Stay safe — and guard your wallets.

This post is about understanding and defending against these weaknesses. It does not include working bypass prompts or instructions for producing harmful output.

Reported vulnerabilities

Prompt injection and information leakage

DeepSeek-R1 has been reported to be vulnerable to prompt injection, where crafted input overrides the instructions the application intended the model to follow. In a tool that feeds untrusted text to the model — a chatbot summarizing a web page, say — this can lead to unintended behavior or leakage of context the model was supposed to keep private.

Generation of harmful content

Independent testing has found the model comparatively easy to push into producing harmful content, including insecure or outright malicious code. One widely cited red-team evaluation reported a high success rate at eliciting unsafe code. For a defender, the takeaway isn’t the headline number; it’s that a cheap, capable model with weak guardrails lowers the cost of generating attack tooling.

Data-sourcing and legal questions

There are also open questions about the model’s training data and originality, including claims that it may have incorporated output from other models. Those raise intellectual-property and data-privacy concerns that are worth keeping in mind before putting it anywhere near sensitive data.

Why this matters for security work

The same properties that make these weaknesses a risk also make the model worth studying:

• Threat modeling. If you ship a product that calls an LLM, prompt injection is now part of your attack surface. Testing how a model behaves under adversarial input tells you what controls you need around it — input/output validation, least-privilege tool access, and not trusting model output as if a human wrote it.
• Research and defense. The model being open means researchers can study its failure modes directly and build better detections and guardrails, rather than guessing at a black box.
• Awareness. For teams adopting AI, these reports are a useful reminder that a model’s capability and its safety are separate things. A capable model with weak alignment is not a safe default.

Conclusion

DeepSeek-R1 is a capable model with a genuinely weak safety posture, at least as shipped. That combination is exactly what makes it interesting to study and risky to deploy carelessly. If you’re building with it, treat its output as untrusted, wrap it in real controls, and keep sensitive data away from it. The broader lesson holds for every model on this curve: capability is arriving faster than alignment, and that gap is where the security work is.