Bad Romance

Sean Gallagher, a principal threat researcher at Sophos, walks through pig butchering, a multi-billion-dollar crime pattern that blends romance and crypto investment scams. He explains how it grew from gambling-linked schemes in China into operations across Southeast Asia and beyond, split between front-office staff who run chats and video calls and back-office teams who build apps, personas, smart contracts and laundering routes. Victim stories range from small losses to hundreds of thousands of dollars, and generative AI and compromised social accounts make lures more convincing.

The middle of the talk follows how the scam apps evolved. Early lures pushed fake exchanges as iOS web clips and Android packages, then moved to TestFlight, enterprise profiles and modified MetaTrader configurations pointing at hostile servers. Scammers later slipped real apps past app store review by swapping in remote HTML after approval. Gallagher shows how shared site code lets one script reveal hundreds of related domains, and describes DeFi variants where a wallet's built-in browser grants attackers access to funds. He also covers infrastructure such as VoIP numbers, cloud hosting behind Cloudflare, and layered laundering through shell companies.

He closes with a tally of tracked scam groups, which together took roughly $2 million from about 100 victims, and with the growing obstacles to research as operators add invite codes, VPNs and anti-analysis checks. Practical takeaways include ignoring unsolicited texts, reporting lures to carriers, and educating older relatives, since victims are often targeted again.