{"id":55496,"date":"2026-03-26T05:47:09","date_gmt":"2026-03-26T09:47:09","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=55496"},"modified":"2026-03-26T05:47:09","modified_gmt":"2026-03-26T09:47:09","slug":"spammers-use-yandex-polls-for-scam-and-phishing","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/spammers-use-yandex-polls-for-scam-and-phishing\/55496\/","title":{"rendered":"Survey-based scams"},"content":{"rendered":"

Spammers are constantly seeking new ways to reach the widest audience possible while dodging email filters \u2014 all to ensure their \u201ctempting\u201d offers land in your inbox rather than the spam folder. To pull this off, bad actors are increasingly pivoting to legitimate platforms, dreaming up sophisticated ways to weaponize them for their own gain.<\/p>\n

We\u2019ve previously covered scam attacks using Google Forms<\/a>, where fraudulent emails were sent directly from Google\u2019s mail servers. In those cases, links were shielded by the reputable forms.gle<\/em> domain, allowing them to breeze past spam filters. Now, a similar tactic has been implemented using Yandex Surveys. Here\u2019s a look at how this new scam works, and how you can stay safe.<\/p>\n

Everything looks fine at first glance\u2026<\/h2>\n

Online survey tools are fairly common these days. Marketing professionals use them to gather feedback, HR departments use them for employee engagement, and researchers use them to study target audiences. But how are scammers getting in on the action?<\/p>\n

They create a survey, embed links to fraudulent websites within the body, and blast out emails containing the survey link to their mailing lists. Standard anti-spam filters see URLs like yandex.com\/poll\/\u2026<\/em> as legitimate. Recipients often have the same reaction, reasonably assuming, \u201cIt\u2019s a link to a well-known service \u2014 what could go wrong?\u201d<\/p>\n

Our experts have tracked a massive spike in these emails. In January, Kaspersky Premium<\/a>\u00a0blocked just over 2200 of these messages; by February, that number soared to over 32\u00a0000. We\u2019re looking at aggressive scaling here \u2014 nearly a 15-fold increase in just one month.<\/p>\n

\"A<\/a>

Here\u2019s a survey page containing a scam message and link. The visible portion features a well-known crypto exchange logo and an active link to the attackers\u2019 site. At the bottom, you\u2019ll notice a couple of dots \u2014 more on these later<\/p><\/div>\n

Spammers distribute these survey links through their own channels, often hijacking website feedback forms that lack sender verification. The fact that the message originates from a legitimate network provides yet another green flag for anti-spam filters to let these emails slide right through.<\/p>\n

\"A<\/a>

A crypto scam email in English sent through a feedback form on a Greek website<\/p><\/div>\n

The most popular themes for this type of spam currently involve crypto scams \u2014 promising users a windfall in digital currency \u2014 and links to sketchy dating sites.<\/p>\n

How scammers exploit Yandex Surveys<\/h2>\n

To build a survey that doesn\u2019t actually look like one, attackers take advantage of the platform\u2019s extended survey mode.<\/p>\n

Yandex Surveys allows users to swap out a simple question for a text block, which can include descriptions, images, or videos. This is exactly where scammers embed their pitch and the link to their phishing site. They use the built-in \u201cUpload media\u201d feature to add official-looking logos and other embellishments that sell the illusion.<\/p>\n

To make sure the victim doesn\u2019t see the \u201cNext\u201d button or the standard disclaimer \u2014 which warns that surveys are created by third parties and that Yandex isn\u2019t responsible for the content \u2014 the scammers pad the space below the scam block with invisible characters. For instance, they might add dozens of lines of transparent emojis; you can\u2019t see them, but they still take up screen real estate. Further down, past the point where most people would stop scrolling, they simply drop in punctuation marks, one per line.<\/p>\n

\"Transparent<\/a>

To understand how these surveys are built, we used a test survey to retrace the scammers\u2019 steps. Transparent emojis are used to create dead space under the scam block, followed by punctuation marks further down where few users are likely to scroll<\/p><\/div>\n

The result? The user sees nothing but the fraudulent offer and the link, while everything else is pushed off-screen. It\u2019s the same technique we\u2019ve seen used with Google Forms.<\/p>\n

Beyond the benefit of using legitimate URLs, another perk for the scammers is that this method doesn\u2019t cost them a dime. They aren\u2019t paying the service for promotion, or using the built-in targeting tools; they simply blast the link to their own database. In this scenario, the service is essentially being used as good-reputation web page hosting.<\/p>\n

To top it off, the scammers can jump into the \u201cStatistics\u201d section of the survey to track click-through rates in real-time and then export the data into a spreadsheet. This is basically a turnkey analytics suite.<\/p>\n

Once a victim clicks the link in the survey and lands on the attackers\u2019 website, they are greeted by a professional-looking site running a classic \u201cprize giveaway\u201d scheme.<\/p>\n

\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"A\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tA popular scam involving a prize draw. First, you have to enter your name\u2026 \n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\u2026Then,\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\u2026Then, you pick one of the boxes containing a potential prize\u2026\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\u2026And\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\u2026And you \u201cwin\u201d nearly an entire Bitcoin! But to claim it you have to \u201ccontact the operator\u201d\u2026\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"\u2026Provide\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\u2026Provide your Bitcoin wallet address\u2026\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl>
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\"...And\n\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t...And pay a $47 \u201cfee\u201d, handing the scammers both your money and your payment credentials in the process\n\t\t\t\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t<\/dl><\/div>\n

How to avoid taking the bait:<\/p>\n