The Brazillian DeepWeb. How Brazilian fraud groups work on Telegram and WhatsApp

The speaker, who leads cyber threat intelligence work at a Brazilian company, argues that scams in Brazil run mostly through WhatsApp, Telegram and similar apps rather than the deep web. These groups mix social engineering with fake messaging accounts, fake websites, deepfakes that defeat identity checks, account takeovers and bank accounts used for money laundering. Suspects often sit in other countries, and police with limited staff and tools struggle to trace them.

To study the groups, the research posed as buyers of fake money and sellers of stolen-looking databases, then shared links that logged each visitor's IP address, browser, operating system and user agent. Some pages also asked for location permission or a selfie, which revealed more detail. Most visitors showed no VPN or proxy. A small share used VPNs or cloud hosting, and a few VPN users still exposed their real location through the permission prompt. Comparing the same links across Latin American groups showed more VPN use. The talk also described how a phone number tied to a Brazilian bank account could be linked to a person's name and other details through leaked data.

The main takeaway for investigators is to check their own operational security, including DNS leaks and VPN leaks, because one slip can expose the investigator. The speaker also stressed that public and private sectors need to share information more closely, and that carrier data requests can take months to return results, by which time a suspect may have moved on.