Loading story…
Serbia’s National CERT warned that fraudsters are using the OKEGreen platform and related domains including okegreen.com, okaiv.com, and okegreen.cc to lure victims with promises of quick profits from cryptocurrency-linked investments and easy online earnings. The scheme is promoted heavily through social media ads that collect phone numbers, after which supposed brokers, assistants, mentors, or investment advisers contact targets and steer them into fake investment activity, referral programs, assigned tasks, and bogus claims that simple clicks can help train artificial intelligence tools for payment.
A similar warning from CERT-MU in Mauritius described fake online trading and investment scams in which callers impersonate crypto and forex traders, persuade victims to hand over money and identity or banking documents, and display fabricated trading dashboards showing false gains before demanding extra payments such as taxes to release withdrawals. Both alerts emphasize that the operations rely on impersonation, false profit claims, and document harvesting, with Serbian authorities urging affected users to contact police and replace submitted identity documents, while Mauritian authorities advised victims to notify regulators, police, and their banks.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
CERT-MU issued a high-severity warning about fake online trading and investment scams targeting Mauritian users. The scams involved unsolicited calls from fraudsters posing as cryptocurrency and forex traders, fake account gains, and demands for extra tax payments before withdrawals.
Serbia’s National CERT warned of a new wave of online fraud tied to the OKEGreen platform, promoted through social media ads and follow-up contact from supposed brokers, assistants, advisors, or mentors. The notice identified okegreen.com, okaiv.com, and okegreen.cc as active platform domains and advised affected users who submitted identity documents to contact police and seek replacement documents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Securities and Exchange Commission (SEC) has charged three purported crypto asset trading platforms—Morocoin Tech Corp., Berge Blockchain Technology Co. Ltd., and Cirkor Inc.—along with four investment clubs—AI Wealth Inc., Lane Wealth Inc., AI Investment Education Foundation Ltd., and Zenith Asset Tech Foundation—for orchestrating a fraudulent scheme that targeted retail investors through social media. According to the SEC, these entities misappropriated over $14 million by luring victims with advertisements and group chats that promised profits from AI-generated investment tips, ultimately convincing them to invest in fake crypto trading platforms where their funds were stolen. The operation used sophisticated tactics, including the use of automated trading bots to generate massive volumes of fake transactions, creating the illusion of legitimate trading activity. This enforcement action is part of a broader regulatory crackdown on crypto-related fraud, with the SEC imposing a record $4.98 billion in cryptocurrency penalties in 2024 alone. The case highlights the growing threat of social media-driven investment scams and the SEC's commitment to pursuing securities fraud that harms retail investors. The agency's complaint details how the fraudsters built trust in online group chats, posed as financial professionals, and systematically exploited individuals interested in cryptocurrency investments, underscoring the need for heightened vigilance among potential investors and continued regulatory oversight in the digital asset space.
Jun 29, 2026
The FBI warned that criminals behind cryptocurrency investment scams are increasingly sending in-person couriers to collect cash from victims when banks or financial institutions block suspicious transfers. In these schemes, fraudsters typically contact targets through social media, dating platforms, or messaging apps, build trust through so-called **pig butchering** or **romance baiting**, and then direct them to fake investment platforms where money is stolen instead of invested. According to the FBI, scammers may claim a victim’s account has been flagged and arrange a cash handoff authenticated with a pre-arranged password or a specific U.S. dollar bill serial number. After the pickup, victims are shown fabricated gains in virtual wallets and pressured to send more money for bogus taxes or penalties. The bureau urged people to research crypto platforms, avoid sharing home addresses or meeting unknown individuals, watch for **love bombing** behavior, and report incidents with detailed evidence; the FBI’s 2025 Internet Crime Report said U.S. victims lost nearly **$21 billion** to cyber-enabled crime in 2025, including **$8.6 billion** tied to investment scams.
Jun 29, 2026
Threat actors are running cryptocurrency investment scams across Asia—**heavily targeting Japan**—that blend **malvertising** (paid ads on platforms such as Facebook and Instagram) with **pig butchering**-style long-con social engineering. Infoblox reported identifying large clusters of suspicious domains (including domains consistent with **registered domain generation algorithms (RDGAs)**) disproportionately queried by users in Japan; victims are funneled from fake ads impersonating financial experts or “AI-driven” trading systems to lure sites that push them into messaging apps (e.g., **LINE**, WhatsApp, KakaoTalk) via links or QR codes. Once in chats, victims are engaged by **AI bots** posing as experts/assistants, fed fabricated success stories, and nudged from small “test” deposits to larger transfers; when victims attempt withdrawals, scammers demand additional payments such as a **“release fee.”** Reported losses tied to this activity have reached **up to ¥10 million** per victim. A related pattern shows scammers using **AI chatbots as high-pressure sales agents** for fake crypto offerings: Malwarebytes documented a live “**Google Coin**” presale site using a chatbot impersonating Google’s **Gemini** branding to provide tailored investment projections and steer victims toward **irreversible cryptocurrency payments**; Google does not have a cryptocurrency. While this “Google Coin” case is a separate scam instance from the Japan-focused malvertising/pig-butchering operation, it reinforces the same operational shift highlighted by Infoblox: **automation and AI-driven conversational tooling** are increasingly replacing human operators to scale persuasion, maintain consistent scam personas, and accelerate victim conversion from initial interest to payment.
Jun 29, 2026