Groupon, Allrecipes get caught in Snapchat spam

Last month a group of security researchers exploited a weakness in mobile photo sharing app Snapchat’s systems, stole usernames and telephone numbers for 4.6 million Snapchat users and posted them online in the process.

Turns out Snapchat, which was criticized for its cavalier attitude in the weeks that followed, has not been especially effective in thwarting spammers on the service since. On Tuesday, Snapchat was hacked again.

“Yesterday a small number of our users experienced a spam incident where unwanted photos were sent from their accounts,” a Snapchat spokesperson wrote in an email to Digiday. “Our security team deployed additional measures to secure accounts. We recommend using unique and strong passwords to prevent abuse.”

This time the hack also involved former startup wonder Groupon, possibly through its affiliate program. Snapchat users — including this reporter — have recently reported receiving a spammy photo of a smoothie that also included an advertisement for frootsnap.com.

photo

As of last night, frootsnap.com was directing users to a webpage made to a look like one of Groupon’s signature daily deals. The URL, groupon-claim.me, was different from Groupon’s actual groupon.com domain, however, and Groupon claimed it had no hand in sending the Snapchat or in making the sham Groupon website.

But following the Snapchat spam trail leads back to Groupon’s doorstep:

Screenshot 2014-02-11 22.48.52

When Web users interacted with the lookalike Groupon page, they were directed to the following dietary supplement website.

Screenshot 2014-02-11 22.48.27

Filling out the personal information on the website’s right rail resulted in users being sent an email made to look like a Groupon daily deal email. Again, the URL for the email sender — in this case r.groupon.com — differed from Groupon’s domain.

Screenshot 2014-02-12 12.04.54

Clicking on that email directed recipients to Groupon’s actual domain, however, and asked users for their gender and activity preferences.

Screenshot 2014-02-12 11.49.35

“This website is in no way associated with Groupon and should be ignored. We’re aware of it, and we are working to have it shut down,” a Groupon spokesperson said this morning in an email.

Groupon has been running an affiliate program for years, through which it pays publishers 10 percent of the sales they drive to it. It’s possible this spam is the result of one of its partners employing some unscrupulous tactics.

The frootsnap.com URL does not direct users to the fake Groupon page any more, but it still active. As of this writing, frootsnap.com sent users to an Allrecipes.com page for a Berry Delicious fruit smoothie recipe.

Allrecipes had no involvement of the hack, according to its vp of brand marketing Esmee Williams. Still, the Berry Delicious page has nonetheless seen a significant spike in traffic as a result of the hack.

allrecipes_snapchat_spam

https://digiday.com/?p=64493

More in Media

The Independent bets big on individual talent-led verticals with the launch of Independent Studio

The U.K.-based digital news publisher has signed YouTube creator Alan Clery as creative director to kick off the launch of Independent Studios, a unit that will produce a new crop of individual talent-led videos, newsletters and podcasts.

Creators are ditching Substack over ideological shift in 2025

The writers who left Substack in early 2025 represent a second wave after an initial burst of Substack creators left the platform in January 2024.

How Dotdash Meredith enlisted OpenAI to boost its contextual ad product, with Lindsay Van Kirk

Dotdash Meredith’s gm of D/Cipher discussed the publisher’s OpenAI deal in a live recording of the Digiday Podcast at last week’s Digiday Publishing Summit.