The high-profile news about the listing of Kyivstar’s parent company (Kyivstar Group Ltd.) on the American NASDAQ stock exchange last year and the constant discussions about the launch of 5G networks have become the perfect basis for a new wave of cybercrime. Fraudsters are successfully combining hot infomercials with citizens' financial ignorance, offering "easy passive income" during the war.
The high-profile news about the listing of Kyivstar’s parent company (Kyivstar Group Ltd.) on the American NASDAQ stock exchange last year and the constant discussions about the launch of 5G networks have become the perfect basis for a new wave of cybercrime. Fraudsters are successfully combining hot infomercials with citizens' financial ignorance, offering "easy passive income" during the war.
The editorial staff of dev.ua, together with the Ukrainian Interbank Association of Payment System Members (EMA), figured out how this scheme works, how many similar sites appear every month, and why "investing" in Kyivstar for 5,000 hryvnias is a guaranteed loss of money.
The scheme is based on the creation of one-day websites that completely copy the operator’s official identity. Such resources place loud calls to invest in the "innovative 5G infrastructure of the Ukrainian telecom leader", which "has just conquered the American NASDAQ exchange".
To appear credible, potential victims are shown fake graphs of "crazy profits" and promised quick enrichment.
Criminals intentionally simplify the entry threshold as much as possible. While real investments in the American stock market require complex legal procedures, opening foreign exchange accounts, and strict compliance, scammers offer to start "earning" in a few clicks with a minimum deposit of 5,000 hryvnias. This makes the trap accessible to a wide range of gullible citizens looking for easy passive income.
In most cases, the Cyber Security Center of the National Bank of Ukraine (CSIRT-NBU) detects and actually blocks phishing sites. The work of the Cyber Police Department of the NBU also plays a role in this area.
At the request of law enforcement officers, the National Technical Center of Ukraine of the State Special Communications Administration issued an order on February 10, 2026 to block another domain at the hosting provider level—technology-5G-connect[.]net.
As the dev.ua editorial team found out, this site called for investing in 5G infrastructure with a minimum contribution of UAH 5,000. The domain turned out to be completely fresh — it was registered only on February 6, 2026, that is, it existed for only 4 days before the ban.
This is far from the first case. On January 26, the State Service for Special Communications, using a similar procedure, blocked a similar domain — kyivstar-5G-invest[.]com.
According to the Ukrainian Interbank Association of Payment System Members of the EMA, dozens of similar clones have appeared in the last 3 months alone: .5g-in-ukraine.com, .connect-5g-future.com, .invest-kyiv-5g.net, *.investinkyiv.net, *.kyivinvest-5g.com, .future-connect-5g.com, *.5g-boost-connect.com, .5g-connect-ukr.com, *.5g-connect-ukraine.com, *.5g-inform-network.com, *.5g-invest-boost.com, *.5g-ukraine-connect.com, *.5g-ukrconnect.com, .connect-5g-now.com, *.5g-infrastruktura.com, *.5g-kaz-connect.com, *.5g-ukr-connect.com, *.5ginformation-concept.com, *.kyiv4invest.com, *.kyivinvest365.com and *.telecommunication5g.com.
Let us emphasize: in Ukraine it is impossible to directly invest in stocks traded on NASDAQ .
Ukrainians can buy stocks on American stock exchanges only through foreign licensed brokers, as Ukrainian exchanges do not have direct access to US markets. Criminals take advantage of the fact that most people do not know how this system works and believe in the ability to "buy stocks through a form on the website."
Experts from the Ukrainian Interbank Association of Payment Systems Members (EMA) warn against hasty decisions and remind of the basic rules of financial security:
Check sub-licenses and brokers. Purchase of shares of foreign companies always takes place through officially registered brokers with appropriate licenses. No company collects investments through direct transfers to cards or dubious payment forms.
Critically evaluate promises. Guaranteed high returns without risks is a major sign of fraud. Investments are always risky, and no legitimate company offers a "100% income guarantee."
Analyze the age and name of the site. Fraudsters use freshly registered one-day domains (their lifespan often ranges from a few days to a couple of weeks). The age of a domain can be easily checked through open WHOIS services. And to check sites for fraud , use the free service CheckMyLink .
Don’t trust overly simplified procedures. Real investment activity requires going through the KYC procedure (identity verification, provision of documents, verification of sources of income). If you are offered to "invest" only by phone number, it is a trap.
Check information on official resources. Any investment programs, promotions, or partnerships are always announced on the company’s official website (in this case, kyivstar.ua) and its verified pages on social networks.
And test your skills in recognizing phishing sites — to do this, defeat the scammer — One-Eyed X10 .
