U.S. prosecutors say a group led by Malone Lam ran social engineering scams that stole over $245 million in cryptocurrency. The scammers allegedly called crypto holders while pretending to be customer support from Apple or Google, talked victims into handing over key account details, and in at least one case persuaded a victim to install remote desktop software to enable theft.
Prosecutors said a group led by Malone Lam ran social engineering scams that stole more than $245 million in cryptocurrency. The core method was straightforward: members called crypto holders and pretended to be customer service representatives from Apple or Google. Through these calls, they convinced victims to hand over key account details that enabled the actual theft of funds.
In at least one documented incident, the scam went further. Instead of simply extracting information verbally, the caller convinced the victim to download a remote desktop program. Once installed, the group used that remote access to directly steal account information, bypassing the need to talk the victim through each step.
The operation was not opportunistic. It relied on specialized roles, including database hackers, target identifiers, callers, money launderers, and even residential burglars who targeted hardware wallets. This division of labor let the group scale the scam and refine each stage.
Targeting was also data-driven. The group gained access to databases of information about people with large amounts of cryptocurrency, allowing callers to focus on victims likely to have significant funds worth stealing. This combination of credible-sounding impersonation and pre-existing knowledge about a victim's holdings made the calls more convincing than a random cold call would be.
This case illustrates how phone-based impersonation, combined with targeted victim data and a willingness to install remote software, can result in large financial losses even without any technical exploit of the underlying crypto platforms.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers called crypto holders while posing as customer service or representatives from Apple and Google, convincing victims to hand over key account details that enabled crypto thefts.
In at least one incident, the group convinced a victim to download a remote desktop program, then used that access to steal account information.
The group used access to databases containing information about people with large amounts of cryptocurrency to identify targets.
Treat the call as suspicious, hang up, and contact the company using an official number looked up independently, rather than sharing any account details.
Someone calls saying, “This is Apple support, your account’s at risk.” For some people, that call ended with $245 million in crypto gone. Prosecutors say Malone Lam’s crew used stolen “who-has-money” data, then called crypto holders pretending to be Apple or Google reps, walking them through ‘verification’ to hand over login and recovery details. The worst step is when they say, “I’ll secure it for you, just install this remote desktop app.” One victim did that, let them in, and they quietly browsed his accounts and emptied his crypto. Aha test: if support calls you out of the blue about crypto, you hang up. Then you call Apple or Google back using a number you look up yourself. That’s the move that saves your wallet.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
