Search: “crypto-scam”

Crypto customers targeted by scammers after email marketing provider breach

Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.

An attacker exploited a flaw in Brevo's SAML SSO handling to access 138 customer accounts on September 10; six accounts were used to send phishing emails and contacts were exported from 43 accounts. Crypto firms Trezor, CoinTracking, and BitBox confirmed customers received phishing emails, with Trezor warning roughly 347,000 newsletter subscribers. The Trezor-themed email cited a fabricated STM32 microcontroller entropy bug and urged recipients to enter wallet backups through a malicious link. Exported contact lists could fuel future targeted phishing attacks.

Malwarebytes Labs·Sep 11, 15:01 UTC · 4d agoData breach in the wild 6 sources

Fake Law Firms Scam Victims Crypto

Fraudsters posed as fake law firms to scam victims into paying fees in cryptocurrency.

Scammers impersonated law firms to persuade victims to pay bogus legal fees, likely in cryptocurrency. Crypto-based legal-fee scams typically pressure targets with urgent payment demands, and cryptocurrency transfers are hard to reverse once sent. Victim counts and loss amounts are not stated in the headline.

Infosecurity Magazine·Aug 16, 00:00 UTC · Aug 16, 2026Phishing & fraud

Ready-made $500 kit puts a crypto scam within anyone's reach

A $500 ready-made scam kit sold on a cybercrime forum builds fake Tesla $TSLA presale pages that harvest wallet recovery phrases and cryptocurrency deposits.

Malwarebytes found a $500 scam-in-a-box kit by seller xrep on a cybercrime forum, bundling a fake Tesla-style $TSLA presale site, a victim-tracking admin panel, and controls to inflate fake balances. The kit harvests 12-word wallet recovery phrases via wallet-connection prompts or accepts direct transfers in Bitcoin, Ethereum, USDT, or Dogecoin. The admin panel lets operators check stolen wallets' value before draining them, raise displayed balances to encourage further deposits, and send follow-up messages demanding fake network fees.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Phishing & fraud

What’s the Scam?

Bruce Schneier reports AI-generated fake thank-you replies to his newsletter confirmations from throwaway Gmail accounts; the scam's goal is unclear.

Bruce Schneier describes receiving a burst of AI-generated, one-line praise emails replying to Crypto-Gram newsletter confirmation messages, sent from random-character Gmail addresses. None of the senders actually subscribed, and they did not respond when he replied, weakening a pig-butchering theory. The campaign appears automated, but its objective has not been identified.

Schneier on Security·Sep 1, 17:36 UTC · 14d agoPhishing & fraud

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 Blog·Aug 17, 11:29 UTC · Aug 17, 2026Phishing & fraud

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023

FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.

FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.

The Record·Sep 10, 21:15 UTC · 5d agoPhishing & fraud 4 sources

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes Labs·Sep 15, 08:40 UTC · 1d agoPhishing & fraud

Fake IRS letters direct crypto holders to bogus compliance portal

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026Phishing & fraud

Fraudsters steal $6 million from Tectonic crypto platform after inflating token price

Attackers inflated Tectonic's Tonic token price 100x in 20 minutes and borrowed $74 million against it, stealing $6 million before Cronos halted activity.

Attackers manipulated the price of Tectonic's thinly traded Tonic token, raising it more than 100-fold in 20 minutes, then used the inflated tokens as collateral to borrow assets in an attempted $74 million theft. About $6 million left the platform; Cronos halted blockchain activity and later restored roughly $69 million in frozen funds via an on-chain rollback. Tectonic plans a phased reopening and a postmortem. TRM Labs says market manipulation now accounts for one in eight crypto hacks, with 32 incidents in 2026, and compares the case to the 2022 Mango Markets manipulation that led to a criminal conviction.

The Record·Aug 31, 19:42 UTC · 15d agoPhishing & fraud

Party’s Over for Crypto Scammers Who Went on a Spending Spree After a $240 Million Bitcoin Theft

Malone Lam's plea hearing approaches in the $240 million bitcoin social engineering theft; the case highlights surging crypto fraud and limited enforcement.

Malone Lam, accused of organizing a social engineering attack that stole over $240 million in bitcoin (4,100+ BTC) from a Washington, D.C. resident in August 2024, has a plea agreement hearing set. Callers impersonating Google and Gemini staff tricked the victim into revealing security codes. Lam and 17 co-defendants spent lavishly before FBI arrests; crypto investment fraud complaints to the FBI rose nearly 50% in 2025 while DOJ disbanded its crypto crimes unit.

SecurityWeek·Sep 8, 13:00 UTC · 7d agoPolicy & legal

Party’s over for scammers who went on spending spree after $240M bitcoin theft

AP report on scammers' spending spree after a $240 million bitcoin social engineering theft, as ringleader Malone Lam nears a plea agreement.

DataBreaches.net syndicates AP reporting on the $240 million bitcoin theft from a Washington, D.C. resident via social engineering calls impersonating Google and Gemini. Alleged ringleader Malone Lam, 22, faces a plea hearing; the scam network spent stolen funds on cars, jets, and mansions before FBI arrests. Crypto investment fraud complaints to the FBI rose nearly 50% in 2025.

DataBreaches.net·Sep 8, 11:32 UTC · 8d agoPolicy & legal

Scammer behind $245 million crypto heist pleads guilty to RICO charges

Malone Lam, leader of a social engineering ring that stole over $245 million in cryptocurrency, pleaded guilty to US RICO charges.

Singaporean national Malone Lam, 22, pleaded guilty to RICO conspiracy charges for leading the 'Social Engineering Enterprise,' which stole more than $245 million in cryptocurrency. The group posed as Apple and Google customer support, tricked victims into installing remote desktop software, and even burgled homes to steal hardware wallets, including $263 million from a single Washington, D.C. victim. At least nine others have already pleaded guilty; Lam faces a December 8 sentencing hearing and a possible 7-to-20-year term.

The Record·Sep 8, 20:52 UTC · 7d agoPhishing & fraud

Violent Physical Crypto Thefts Surge to $30m in Losses

Infosecurity Magazine·Aug 6, 12:00 UTC · Aug 6, 2026Data breach

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.

Researchers from BCA LTD, NorthScan and ANY.RUN built a fake DeFi protocol called Ballena Azul and hired three suspected Famous Chollima operatives through a real recruiting pipeline. The hires submitted inconsistent or AI-processed identity documents, including a driver's license whose metadata showed Google Gemini processing and a SynthID watermark. On day one the workers profiled their assigned VMs, checked their egress country, and one installed Chrome Remote Desktop and logged into GitHub. The findings were presented at DEF CON 34 and align with a July 31 joint government alert on DPRK IT worker schemes.

The Hacker News·Aug 11, 12:48 UTC · Aug 11, 2026Threat actor

ClickFix Moves into the Browser to Steal Cryptocurrency

Cisco Talos details a ClickFix campaign injecting browser JavaScript via Google Sheets to skim crypto deposits, stealing at least ~0.159 BTC since October 2025

Cisco Talos reported a months-long ClickFix campaign that shifted from OS command execution to injecting JavaScript through Chrome's address bar or the Tampermonkey extension into sessions on two cryptocurrency trading sites. Since March 2026 the operators fetch obfuscated payloads via the Google Visualization API from public Google Sheets, replacing displayed deposit addresses and amounts and overriding the fetch API, and the campaign survived two disruption attempts. Talos observed 49 Bitcoin addresses with 24 receiving at least 0.159 BTC (~$10,000) by early August, with proceeds routed through roughly 30 wallets and more than 3,000 addresses in apparent mixing. Lures posed as leaked vulnerability reports describing non-existent API flaws at crypto swap services, promising payouts up to 38% higher.

Infosecurity Magazine·Sep 9, 13:45 UTC · 6d agoPhishing & fraud in the wild

Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.

Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.

Cyber Security News·Sep 9, 10:57 UTC · 7d agoPhishing & fraud in the wild

Revolut handed customer data to fraudsters using government email account

Revolut handed sensitive KYC data of high-net-worth crypto customers to fraudsters submitting fake emergency data requests from a compromised government email domain.

Revolut confirmed it disclosed sensitive customer data—including passport and driver's license copies, verification selfies, bank statements, IBANs, and Bitcoin transaction histories—to attackers who submitted fraudulent emergency data requests from a legitimate government agency email account, apparently an Italian domain. Targets were high-net-worth individuals involved in crypto, including Marc Karpelès and entrepreneur Marc Zeller. A Telegram account claiming responsibility posted stolen data as proof and demanded an extortion payment; the account has since been suspended. Revolut says only a limited number of customers were affected and has alerted the relevant government agency, law enforcement, and regulators. The technique mirrors 2021-2022 Lapsus$-linked fraudulent emergency data request scams against Apple, Meta, and Discord.

The Record·Sep 14, 12:00 UTC · 2d agoData breach

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.

Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.

GBHackers·Sep 9, 06:22 UTC · 7d agoPhishing & fraud in the wild

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco Talos·Sep 8, 10:00 UTC · 8d agoPhishing & fraud in the wild

Singaporean Ringleader of $245 Million Cryptocurrency Racketeering Enterprise Pleads Guilty in Washington D.C.

Singaporean Malone Lam pleaded guilty in Washington D.C. to leading a social-engineering conspiracy that stole and laundered over $245 million in cryptocurrency.

Malone Lam, a 22-year-old Singaporean citizen residing in Miami, pleaded guilty in U.S. District Court in Washington D.C. for his role as ringleader of an international cybercrime conspiracy. The group used social engineering to steal cryptocurrency valued at more than $245 million and launder the proceeds. U.S. Attorney Jeanine announced the plea, which marks a major milestone in the prosecution of the crypto theft ring.

DataBreaches.net·Sep 8, 18:04 UTC · 7d agoPolicy & legal

Scammers are getting smarter about where they target you

Malwarebytes data shows scammers tailor fraud by platform: 90% of toll scams arrive via email/SMS and MrBeast is now the most impersonated person.

Malwarebytes threat research analyzed global scam data from April 15 to July 14, 2026, across more than 20 scam types, finding each type favors a specific channel such as email, SMS, phone, or social media. Roughly nine in ten toll scams arrive by email or text, about half of IRS scams come by phone, and MrBeast is impersonated in about 30% of impersonation scams. The most impersonated brands are Google, Microsoft, Apple, Roblox, and Amazon, and Malwarebytes blocks around 500,000 phishing websites daily. Gaming scams on Roblox, Steam, Discord, and Minecraft increasingly carry losses of $1,000 or more, with 15-19% activity spikes in mid-2026.

Malwarebytes Labs·Sep 2, 12:45 UTC · 13d agoPhishing & fraud

LLM-Based Social Engineering Scams

OpenAI disrupted a Cambodia-based ChatGPT-powered scam network running romance, crypto-investment, gambling, and fake law-enforcement fraud campaigns.

OpenAI disrupted a social engineering network operating from Cambodia that used ChatGPT to run multiple scam types simultaneously. Operators built trust with fake dating personas before pitching fraudulent cryptocurrency and spot gold investments, posed as gambling platforms offering fake bonuses, or impersonated law enforcement agencies demanding fine payments. The network also generated images of forged documents including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

Schneier on Security·Aug 27, 09:57 UTC · 20d agoAI safety & security in the wild

$245 million in stolen crypto funded racketeering crew’s lavish lifestyle

Malone Lam pleaded guilty in D.C. federal court to a racketeering conspiracy that stole and laundered over $245 million in cryptocurrency via social engineering.

Malone Lam, a 22-year-old Singapore citizen, pleaded guilty in Washington D.C. federal court to running a racketeering conspiracy that stole and laundered more than $245 million in cryptocurrency. The operation ran from at least October 2023 through May 2025, grew out of online gaming platforms, and relied on social engineering to trick victims into surrendering wallet access, sometimes including break-ins to victims' homes. Lam was arrested on September 18, 2025 in Miami; prosecutors said members spent lavishly on nightclubs, private jets, and exotic cars priced from $100,000 to $3.8 million.

Help Net Security·Sep 9, 12:11 UTC · 6d agoPhishing & fraud

Scammers have figured out the best time to text you

Malwarebytes threat data shows scammers tailor platforms per scam, with the web as top channel, Friday midday peaks, and MrBeast the most impersonated person.

Malwarebytes analyzed its threat data from April 15 to July 14, 2026 across more than 20 scam categories, finding scammers match platforms to scam types: job scams via email, romance scams via social media, and tech support scams via phone. The web is the top delivery channel ahead of email and SMS, and Malwarebytes says it blocks about 500,000 phishing sites a day. Scam texts peak at 12:00 pm ET, roughly 874% above the quietest hour, with volume peaking on Fridays about 50% higher than the start of the week. MrBeast (Jimmy Donaldson) appears in about 30% of impersonation scams, and the most impersonated brands are Google, Microsoft, Apple, Roblox and Amazon.

Help Net Security·Sep 4, 00:00 UTC · 12d agoPhishing & fraud in the wild