Loading story…
A financially motivated operation dubbed “American Patriot” or “Patriot Bait” used a fake online persona, AI-assisted content generation, and social engineering to target victims aligned with QAnon and MAGA communities. Trend Micro said the actor relied on legitimate remote administration software for access, including StellarMonSetup.exe to install GoToResolve for persistence, and used a fraudulent “import your wallet” feature to steal cryptocurrency seed phrases, leading to at least one fully compromised wallet. Researchers found the activity was aimed at fraud and monetization rather than political influence, despite some thematic overlap with partisan narratives.
The campaign also used frontier AI to streamline technical operations, including prompting Gemini 2.5 Flash to generate password mutations for WordPress brute-force attempts. Trend Micro said the actor successfully cracked 29 WordPress administrator accounts spanning multiple business sectors, illustrating how natural-language AI tools can reduce the skill and cost required for credential attacks, infrastructure management, and scam operations. The findings portray a long-running criminal enterprise that blended influence-style messaging with remote access abuse, credential compromise, and cryptocurrency theft.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro publicly released research detailing the five-year Patriot Bait operation, including its use of AI, social engineering, remote administration software, and cryptocurrency theft tactics.
In its report, Trend Micro assessed the activity as a financially motivated criminal fraud campaign rather than a nation-state influence operation, noting the absence of pro-Russian messaging despite some keyword overlaps.
In September 2025, the operator behind the @americanpatriotus Telegram persona reportedly shifted from running a MAGA/QAnon-themed influence channel to AI-assisted fraud, credential theft, and related cybercrime activity. The pivot marked the campaign's move into operational abuse of jailbroken Gemini tooling for password modeling, infrastructure management, and theft workflows.
Trend Micro describes the 'American Patriot' or 'Patriot Bait' operation as a financially motivated fraud and cybercrime campaign that ran for roughly five years, using fake personas, influence-style content, and social engineering to attract victims from a QAnon/MAGA-aligned audience.
Trend Micro said the bandcampro operation began on February 6, 2021, when a Russian-speaking actor started building the fake pro-American Telegram persona @americanpatriotus. The channel later grew to more than 17,000 subscribers and was monetized through cryptocurrency fraud.
Collected data showed that 29 WordPress administrator accounts were successfully cracked across multiple business sectors during the operation.
Researchers found the operator leveraged Google's Gemini 2.5 Flash to generate password mutations that supported WordPress brute-force activity, showing AI-assisted credential attack workflows in the campaign.
The operation used a fraudulent 'import your wallet' function to capture victims' seed phrases, and Trend Micro reports that at least one cryptocurrency wallet was fully compromised as a result.
As part of the campaign, the operator used a file named StellarMonSetup.exe to install the legitimate remote administration tool GoToResolve, giving persistent remote access to victim systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcecommunity.gurucul.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026
Threat actors used compromised legitimate websites—especially **WordPress** sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the **CLEARFAKE** campaign evolved from fake browser updates to a **ClickFix-style** technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar **DarkEngine** operation to at least **2,353** likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake **WP Engine** logins. The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including **EtherHiding**, which retrieves attacker-controlled code from the **BNB Smart Chain** through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed **MonsterV2** and could also deliver **StealC** or **Rhadamanthys**. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Aug 15, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026