Loading story…
A threat actor using the handle xrep is advertising a ready-made cryptocurrency scam kit on a cybercrime forum for about $500, packaging phishing, social engineering, and payment fraud into a turnkey service. Researchers said the kit impersonates Tesla and promotes a fake $TSLA token presale aimed at X users through a polished multilingual website, personalized prompts, countdown timers, scarcity messaging, and a fake investment dashboard designed to pressure victims into sending cryptocurrency.
The package reportedly includes an administrative panel that lets operators track victims, capture X usernames and geolocation data, check wallet values, harvest 12-word recovery phrases, and divert payments to attacker-controlled wallet addresses. It can also falsify account balances to encourage larger deposits and support follow-on fraud such as bogus network-fee requests, giving low-skill criminals a professional scam-in-a-box that can quickly launch convincing crypto investment campaigns.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
The seller behind the scam kit, using the handle xrep, had been active on the underground forum since March 2026 and built a positive reputation there. The account specialized in packaged scam tools related to X.
Malwarebytes researchers discovered the Tesla-themed $TSLA scam project on a high-profile cybercrime forum on May 16. The offering was a $500 turnkey kit combining phishing, social engineering, and fraudulent payment flows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026
North Korea-linked **Lazarus Group**, including the **TraderTraitor** cluster, targeted cryptocurrency exchanges, blockchain firms, and developers with social-engineering lures that delivered trojanized Python projects, fake code-evaluation repositories, malicious open-source packages, and compromised applications. Reporting tied the activity to campaigns that tricked victims into running files such as `StockInvestSimulator-main.zip` and `MonteCarloStockInvestSimulator-main.zip`, abusing unsafe `PyYAML` deserialization for remote code execution, while newer intrusion chains used heavily obfuscated Python and a six-stage flow that added **TSUNAMI/TSUNAMIKit** tooling beyond Lazarus’s previously observed Python-based payloads. Once inside, the attackers backdoored systems, stole credentials, SSH keys, browser wallet data, cloud credentials, and AWS session tokens, then moved laterally into internal services and wallet infrastructure to transfer digital assets. The activity was also linked to deployment of **AnyDesk**, keylogging, and **XMRig** cryptominers, and to broader cloud and SaaS tampering that redirected cryptocurrency transactions; public attributions have connected the cluster to major thefts including the **DMM Bitcoin** and **Bybit** heists, underscoring an ongoing campaign against crypto-sector development and production environments.
Aug 15, 2026
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026