Loading story…
Fraudulent cryptocurrency “AML checker” websites are impersonating legitimate wallet screening services and luring users into connecting wallets, approving token access, signing transactions, or sending funds. The scam relies on professional-looking pages, fake progress indicators, fabricated errors, and reassuring results such as “Clean, Low Risk” to make the checks appear credible, while some sites mimic known brands including AMLBot or use generic names such as “AML Check.”
The operation abuses a key difference between real and fake screening: a legitimate AML wallet check only needs a public wallet address and should never require a wallet connection, transaction approval, recovery phrase, or private key. Victims who interacted with these sites are being urged to disconnect the malicious dApps, revoke token approvals, move assets to a new wallet if compromise is suspected, and ignore follow-on “recovery” scams that promise to retrieve stolen funds.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers described a cryptocurrency theft scam using fake AML wallet-checking websites that impersonate legitimate screening services such as AMLBot and trick users into connecting wallets, approving access, signing transactions, or sending funds. The reporting also identified associated domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026
Law enforcement agencies in the **U.S., U.K., and Canada** launched **Operation Atlantic** to disrupt cryptocurrency fraud schemes based on **approval phishing**, in which victims are tricked into authorizing malicious wallet permissions through fake alerts, pop-ups, or spoofed service messages. Once a victim approves access, attackers can drain assets from the wallet, and recovery is difficult because blockchain transactions are generally irreversible. Authorities said the campaign responds to a broader rise in crypto-enabled fraud, with Chainalysis estimating at least **$14 billion** in on-chain scam revenue in 2025 and warning the total could rise as more illicit wallets are identified. The operation builds on earlier anti-fraud efforts including **Project Atlas**, which identified more than **2,000 compromised wallets** across **14 countries**, disrupted roughly **$70 million** in potential fraud, and froze about **$24 million** in stolen cryptocurrency. The same threat pattern is reflected in phishing lures impersonating platforms such as **OpenSea**, where fake offer alerts, account verification notices, and token airdrop messages attempt to push users into connecting wallets to malicious sites. Those examples illustrate the social-engineering tactics now commonly used in approval-phishing campaigns, alongside increasingly sophisticated content and phishing-as-a-service infrastructure.
Jun 29, 2026