Loading story…
A cryptocurrency theft campaign used at least nine YouTube tutorials purporting to teach users how to create Claude-powered arbitrage bots. The videos directed viewers to counterfeit compiler websites styled after Remix, which silently substituted the displayed benign smart-contract code with Ethereum drainer code. From February 12 through August 11, 224 wallets deployed and funded 234 malicious contracts, sending 274.60 ETH—about $517,205 at the time of transfer—to six operator-controlled collection addresses.
The fraud bypassed common wallet protections because victims themselves deployed the contracts and authorized the transfers, rather than signing conspicuous malicious approvals or interacting with phishing domains. Operators used AI-generated presenters and voices, near-identical scripts, fabricated testimonials, and fake error messages to make the tutorials credible and encourage additional deposits. TRM Labs traced stolen funds through decentralized swaps, cross-chain bridges, and at least one mixer; it found no centralized exchange in the observed outbound flow. Earlier versions of the scheme used ChatGPT branding, indicating a reusable AI-themed lure.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
As of September 2026, the nine identified YouTube videos remained online and had accumulated 310,474 views; the videos used near-identical tutorials and directed viewers to operator-controlled compiler sites.
The latest identified theft occurred on August 11. Across the February-to-August period, 224 victim wallets funded 234 malicious contracts, which transferred 274.60 ETH to six operator-controlled collection addresses.
The earliest of the nine identified YouTube tutorials promoting purported Claude-powered arbitrage bots was posted in April 2026.
The earliest identified theft in the Claude-branded campaign occurred when a victim-funded malicious contract forwarded deposited ETH to an operator-controlled collection address.
Earlier versions of the smart-contract theft scheme used ChatGPT branding as the lure while retaining the same underlying mechanism of inducing victims to deploy and fund malicious contracts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026
Researchers reported that the long-running **ClearFake/EtherHiding** campaign is using compromised legitimate websites, fake **Google reCAPTCHA** pages, and **ClickFix** social-engineering lures to deliver malware through **BNB Smart Chain testnet** smart contracts rather than conventional staging servers. Analysis from Trend Micro and Censys found the attackers embedded obfuscated JavaScript and `ethers.js` on hacked sites, performed browser and OS checks, and retrieved victim-specific payload logic from on-chain contracts tied to a single deployer wallet. The infrastructure included contracts for anti-analysis dispatching, separate Windows and macOS delivery, and victim tracking, making traditional takedowns and URL blocking far less effective. The campaign delivered **SectopRAT** and **ACRStealer** to steal passwords, cookies, browser sessions, credit card data, and cryptocurrency wallet information, while macOS infections also used dynamic resolver techniques through external web services to locate command-and-control endpoints and collect host data. A related stealer campaign described by Gurucul used software-search redirection, fake MEGA Transfer pages, a Go-based loader, and an **Ethereum dead-drop resolver** to obtain command-and-control infrastructure, underscoring a broader shift toward blockchain-backed malware delivery and resilient C2. Defenders were advised to monitor for unexpected `ethers.js` usage, fake CAPTCHA assets, clipboard-driven execution prompts, and access to BSC testnet JSON-RPC services, while training users to avoid fraudulent CAPTCHA and ClickFix prompts.
Jun 29, 2026
Threat actors are running cryptocurrency investment scams across Asia—**heavily targeting Japan**—that blend **malvertising** (paid ads on platforms such as Facebook and Instagram) with **pig butchering**-style long-con social engineering. Infoblox reported identifying large clusters of suspicious domains (including domains consistent with **registered domain generation algorithms (RDGAs)**) disproportionately queried by users in Japan; victims are funneled from fake ads impersonating financial experts or “AI-driven” trading systems to lure sites that push them into messaging apps (e.g., **LINE**, WhatsApp, KakaoTalk) via links or QR codes. Once in chats, victims are engaged by **AI bots** posing as experts/assistants, fed fabricated success stories, and nudged from small “test” deposits to larger transfers; when victims attempt withdrawals, scammers demand additional payments such as a **“release fee.”** Reported losses tied to this activity have reached **up to ¥10 million** per victim. A related pattern shows scammers using **AI chatbots as high-pressure sales agents** for fake crypto offerings: Malwarebytes documented a live “**Google Coin**” presale site using a chatbot impersonating Google’s **Gemini** branding to provide tailored investment projections and steer victims toward **irreversible cryptocurrency payments**; Google does not have a cryptocurrency. While this “Google Coin” case is a separate scam instance from the Japan-focused malvertising/pig-butchering operation, it reinforces the same operational shift highlighted by Infoblox: **automation and AI-driven conversational tooling** are increasingly replacing human operators to scale persuasion, maintain consistent scam personas, and accelerate victim conversion from initial interest to payment.
Jun 29, 2026