CryptoChameleon
CryptoChameleon, also tracked as UNC5356, is a financially motivated threat actor associated with phishing and credential-harvesting operations, particularly against cryptocurrency users, cryptocurrency platforms, financial institutions, and related sectors. Reporting in the provided content also describes CryptoChameleon as an advanced phishing kit distributed via phishing-as-a-service platforms, enabling rapid and scalable attacks. The group is repeatedly linked to social-engineering activity including SMS phishing, phone phishing, and multi-channel phishing. The actor has been attributed to multiple campaigns impersonating LastPass in 2024 and 2025. In an October 2025 campaign, CryptoChameleon abused LastPass’s inheritance/emergency access feature by sending phishing emails claiming a family member had requested vault access after submitting a death certificate. Victims who clicked were taken to fake LastPass pages designed to steal master passwords and, in some cases, passkeys. Some targets also received follow-up phone calls from attackers impersonating LastPass support. The campaign also targeted credentials for cryptocurrency services including Binance, Coinbase, Kraken, and Gemini, and the phishing kit could generate fake sign-in pages for services such as Okta, Gmail, iCloud, and Outlook. The content states no malware deployment was observed in that campaign; it relied on social engineering and credential theft. The content also notes LastPass impersonation campaigns in 2024 and 2025, including an April 2024 campaign involving phone calls followed by phishing emails, and a January 2026 LastPass-themed phishing campaign where LastPass referenced prior CryptoChameleon activity. Google assessed with high confidence that a portion of COINBAIT-related activity overlaps with UNC5356. COINBAIT is described as an AI-assisted phishing kit masquerading as a major cryptocurrency exchange for credential harvesting. Additional reporting says some activity linked to UNC5356 is known for SMS and phone phishing. CryptoChameleon is mentioned as overlapping or aligning in some reporting with Scattered Spider and PoisonSeed, and as an adjacent cluster associated with the SLH alliance; however, the provided content does not establish these as the same group. Known alias: UNC5356.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Group associated with SMS and phone phishing; linked in the report to activity around the COINBAIT phishing kit (crypto-exchange credential theft).
Financially motivated cluster assessed to overlap with activity involving the CoinBait phishing kit (credential-harvesting kit masquerading as a cryptocurrency exchange), reportedly accelerated by AI code generation tools.
Financially motivated cluster linked to aspects of COINBAIT activity (AI-generated phishing kit masquerading as a cryptocurrency exchange for credential harvesting).
Referenced as a possible match for the TTPs in a credential-phishing campaign leveraging compromised email-service infrastructure (SendGrid) and CAPTCHA-gated redirection to credential-harvesting sites.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.