Loading story…
A cryptocurrency phishing operation has deployed at least 70 .xyz websites impersonating xStocks by Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, and NetNet. The cloned sites use fraudulent reward-distribution voting, token-claim, and points offers to make wallet-connection requests appear legitimate, exploiting the likelihood that users expect incentives from these projects.
The domains commonly use a sitemu prefix with random suffixes and share copied templates, identical wallet-connection dialogs, and reward-boost wording, indicating a centralized operation or reused phishing kit. Connecting a wallet reveals its public address, while subsequent signature requests, token-spending approvals, permits, or transfers can authorize attackers to drain assets; users should verify promotions only through official channels, reject unexplained requests, use low-balance wallets for interactions, and revoke approvals granted to suspicious sites.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A phishing operation used at least 70 sitemu*.xyz domains to impersonate xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, and NetNet. The cloned pages used fake rewards votes, token claims, points, and urgency lures to direct visitors to a common wallet-connection interface and potentially solicit malicious signatures or token approvals.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 70 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors targeted cryptocurrency and NFT communities with phishing messages and spoofed NFT project websites that impersonated legitimate services to trick users into downloading malware. One campaign used a fake Pixelmon site, `pixelmon[.]pw`, to mimic the real project and deliver ZIP archives containing Windows shortcut and script payloads that installed **Vidar** infostealer, which steals passwords, cryptocurrency wallet data, and sensitive files. Researchers found Vidar obtained command-and-control details through a Telegram channel and could fetch additional modules from its C2 infrastructure. A separate but related campaign tracked as **NFT-001** used Discord and similar forums to lure victims to decoy crypto sites, where a malicious installer deployed **Remcos RAT** and, in newer variants, **Eternity Stealer**. Morphisec reported the operators changed tooling from the **Babadeda** crypter to a staged downloader while keeping similar delivery infrastructure and some overlapping C2 elements. The newer downloader performed a UAC bypass, added `C:\` to Microsoft Defender exclusions, and retrieved follow-on payloads to improve evasion and credential theft, showing continued refinement of malware delivery against NFT and crypto users.
Aug 15, 2026
Fraudulent cryptocurrency “AML checker” websites are impersonating legitimate wallet screening services and luring users into connecting wallets, approving token access, signing transactions, or sending funds. The scam relies on professional-looking pages, fake progress indicators, fabricated errors, and reassuring results such as **“Clean, Low Risk”** to make the checks appear credible, while some sites mimic known brands including AMLBot or use generic names such as **“AML Check.”** The operation abuses a key difference between real and fake screening: a legitimate AML wallet check only needs a public wallet address and should never require a wallet connection, transaction approval, recovery phrase, or private key. Victims who interacted with these sites are being urged to disconnect the malicious dApps, revoke token approvals, move assets to a new wallet if compromise is suspected, and ignore follow-on “recovery” scams that promise to retrieve stolen funds.
Aug 19, 2026
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026