Since learning of the Cancer Girl scam, Avast researchers have blocked all of the related domains that they were able to find and protected almost 1,000 users in just 48 hours.

The past decade has seen a rise in personal crowdfunding, with people raising money online for everything from school supplies to medical bills to funeral expenses. The appeals go out on social media, imploring friends, families, and acquaintances to help. And, like so many other things online, some of these appeals are scams.

The Avast Threat Labs team recently identified one such scam circulating on YouTube. In a heartbreaking video ad, a little girl sits in a hospital gown. She appears with her head shaved and she’s crying as she speaks into the camera. She tells the viewer that she has cancer and that her family can’t afford treatment.

“The treatment costs a lot of money and my parents don’t have much money,” she cries. “Please help me get well. Please! I don’t want to die.”

The video is highly emotive and asks viewers to donate to the young girls’ cancer treatment via a linked donation fundraising page. If you want to save “Alexandra,” (or Ariela, Ksenia, or Barbara, depending on the video), you can contribute right away.

“While there’s no way to know who this little girl actually is or what her situation or her family’s circumstances are, we do know for sure that this is a scam and the more than $640,000 already raised will not go toward treatment,” Pavel Novak, Threat Operations Analyst at Avast, says. “Our research uncovered an entire series of videos which feature the same little girl, with appeals in Arabic, French, Portuguese, Spanish, and Hebrew. We also found videos making similar appeals, but with different little girls.”

Overall, the Cancer Girl scam videos have been viewed more than 10 million times. Threat Labs research also found:

• All of the domains were registered very recently.
• The videos use anonymous email addresses, like [email protected], [email protected]
• “Alexandra” and “Ariela” have the same email contact addresses, despite videos of two different girls in what one can assume are very different geographies.
• The address can be traced to a residential complex in Jerusalem.

The videos also use hyperbolic claims, including the fact that Cancer Girl’s cancer has spread throughout her entire body. They ask for donations to treat said cancer, but if a cancer has spread that far then it’s likely too late for medical intervention. The lack of specificity is a common red flag in online scams.

“This scam, like so many, takes advantage of the altruistic impulses that humans have to help each other,” Novak says. “It’s especially malicious and unethical because it is potentially taking advantage of a real child, sick or not, whose video was either stolen for the scam or who is being forced to act out this scene. It also erodes peoples’ trust in personal crowdfunding and charity and siphons money away from real causes and institutions.”

Since learning of the Cancer Girl scam, Avast researchers have blocked all of the related domains that they were able to find and protected almost 1,000 users in just 48 hours. They also reported the videos to YouTube, and the scam to the Israel Cyber Emergency Response Team (CERT), where the domains appear to be registered to. 

Finally, there appear to be similar scams circulating via email. Avast researchers do not suspect the two campaigns to be related, despite such campaigns using the same scenario, however, teams like ours can only do so much — it’s up to each individual to treat everything they see online with a critical eye and pause before hitting that “donate” button.