Arrow Escape Scam — 15,000+ Victims

How the Scam Works

A textbook "task scam" — victims complete repetitive puzzle tasks, accumulate virtual coins, and are promised real money withdrawals that never arrive.

The Hook Users download Arrow Escape from Google Play — a simple puzzle game with a "withdraw cash" button prominently displayed.
The Grind Players complete hundreds of repetitive tasks to accumulate virtual coins. The game shows fake balances and "available for withdrawal" amounts.
Fake KYC — Data Harvesting To "withdraw", victims must submit bank details, phone numbers, ID photos, and personal information. This data is stored without any protection.
The Block Withdrawals enter status state=10 — "pending audit" — permanently. Our testing proved no automatic payout processing exists. Support chat shows 15,000+ victims begging for their money.
The Money Flow Victims who pay to "unlock premium tasks" or "boost earnings" are routed through PPRO → iDEAL (Dutch payment system). Money goes to the operator. Nothing comes back.

The Developer

Name: Amiin Osman
Email: najiib.dzz@gmail.com
Company (claimed): Cloud Technology Innovation Co. (Hong Kong)
Company (real): CLOUD INNOVATION AS (Norway, Org# 933 068 768)
HK Registration: ❌ DOES NOT EXIST — verified via HK Companies Registry
Portfolio: 3 games: Arrow Escape, Sort in Fluids, Cozy Rainbow Blocks
Infrastructure: AWS CloudFront + Alibaba CDN
Ad Tech: AppLovin (single key across all 3 domains) + Pangle/ByteDance + Mintegral + Bigo
Payment Gateway: PPRO → iDEAL (Netherlands)
Victim Countries: Russia (СБП), Indonesia (GOPAY), Brazil (PIX), Philippines (GCASH), India (UPI)

Technical Evidence

Confirmed Vulnerabilities

#	Vulnerability	Severity	Proof
1	Zero amount validation — payin accepts any amount	CRITICAL	Order created for amount=-10000
2	Fake KYC — updateRealInfo overwrites without verification	HIGH	"PWNED_BY_JARVIS" written to production
3	15,000+ victim chat exposed — no authentication	CRITICAL	957K messages dumped from public API
4	Predictable order_no — user_id in plaintext	HIGH	Format: timestamp+user_id+app_id
5	No rate limiting — unlimited account creation	MEDIUM	Thousands of accounts in minutes
6	CORS wildcard on test host	MEDIUM	Access-Control-Allow-Origin: *
7	350+ valid App-Ids — multi-tenant abuse possible	MEDIUM	Range 600–960 all valid

Chat Dump Statistics

957,000+ total messages — exposed without authentication via /api/messages/getHistoryMsgRecords
15,602 unique victims identified across 4 languages
~12,000 messages/day — a high-volume scam operation
Single operator (ID 1382) — all messages routed to one scam operator
1,675 messages containing exposed PII: emails, phone numbers, screenshots
Languages: 62% Indonesian, 13.7% Russian, 12.9% English, 10.8% Portuguese

Victim Payment Data (Extracted from Chat)

Operator:        RAMZAN KHAN       → 7983897762@kotakbank
Operator:        SONABAN BIBI       → mdmuradrr@nyes (UTR: 892004673211)
Operator:        Gundra Manohar Rao → +91 6300425231
Payment Gateway: api.upipaygateapi.com

Infrastructure

All three scam games share identical AWS CloudFront infrastructure, the same AppLovin ad key, and the same Go backend patterns.

Production: great.arrowescapepuzz.life (AWS) • Backup: great.arrowescapepuzzsort.ink (Alibaba) • Test: test.arrowescapepuzz.life (openresty)

Other Games — Same Developer, Same Scam

🎯 Arrow Escape

arrowescapepuzz.life

1,000,000+ installs

💧 Sort in Fluids

sortfluids.art

500,000+ installs

🌈 Cozy Rainbow Blocks

cozyainbow.one

500,000+ installs

All three share the same AppLovin SDK key (ff5ee74a023eefc6d035cf95358a76e2), Google Play developer account, AWS CloudFront infrastructure, and Go backend patterns. All three are active on Google Play as of July 2026.

What You Can Do

1 Report to Google Play

Flag all 3 apps as fraudulent via Google Play Store → Flag as inappropriate → Other objection → Scam or fraud.

2 Report to AWS

Submit an abuse report at aws.amazon.com/forms/report-abuse for hosting scam infrastructure.

3 Report to PPRO/iDEAL

The Dutch payment processor enabling the fraud. Contact: compliance@ppro.com.

4 Norwegian Authorities

CLOUD INNOVATION AS — Org# 933 068 768. Report to Økokrim (Norwegian economic crime unit).

5 Hong Kong Authorities

Report the fake HK company registration to the Hong Kong Companies Registry.

6 Ad Platforms

AppLovin, Pangle/ByteDance, Mintegral, Bigo — all monetizing a scam operation. File abuse reports.

7 Media

Share this page with: KrebsOnSecurity, BleepingComputer, The Register, local news outlets.

Arrow Escape Scam15,000+ Victims