Scammers are running professional-looking “AML checker” websites that pretend to screen crypto wallets for suspicious activity, but are designed to trick people into connecting their wallet and approving a malicious transaction. Many impersonate a legitimate service (AMLBot) and use fake progress bars, errors, and “Clean, Low Risk” results to look trustworthy. The scam ultimately relies on the victim approving something they didn’t expect or understand.
Scammers built professional looking websites that pose as AML (anti-money laundering) checkers for crypto wallets. Many of these sites copy the branding, layout, and language of AMLBot, a legitimate screening service, to appear trustworthy. Visitors are invited to choose their cryptocurrency, click a Check Wallet button, and connect their wallet to see results. Rather than performing a genuine compliance check, the site is built to get the victim to approve a transaction that the scammers have crafted, which can drain funds once approved.
To make the process feel legitimate, these sites use progress bar animations with messages like Checking wallet history and Verifying compliance. Regardless of what happens during the process, the sites return a reassuring Clean, Low Risk result and often offer a downloadable report. Some variants add a fake error partway through, claiming the wallet needs a small top-up to cover a fee before the check can finish, pressuring the victim into sending crypto or approving further access.
This scam works because it borrows the visual and procedural trust signals of real compliance tools: familiar branding, progress indicators, and official sounding language. Users who are accustomed to legitimate KYC or AML checks may not question a request to connect a wallet, especially when the workflow looks polished. The reassuring Clean, Low Risk outcome regardless of input reduces suspicion at the exact moment users should be most cautious.
Teams that use crypto wallets, including finance, treasury, and payments staff, should treat wallet-connection requests from screening tools as a hard stop. A real basic wallet check only requires a public address, not a connected wallet or a signed transaction. Employees should be trained to never approve a transaction they do not understand, and to know the recovery steps if they do interact with a suspicious site: disconnect the site, revoke token permissions, or move assets to a new wallet if a recovery phrase or private key was ever shared.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They mimic legitimate AML screening services and push victims to connect their wallet, then trick them into approving a transaction crafted by the scammers rather than performing a real check.
If the site asks you to connect your wallet or approve a transaction instead of simply entering a public address, treat that as a warning sign since a basic wallet check only needs the public address.
Disconnect the site from your wallet and revoke any token permissions it may have obtained; if you shared a recovery phrase or private key, treat the wallet as compromised and move assets to a new one.
Some variants display a fake error claiming the wallet needs a small top-up to cover a fee, which is a pressure tactic designed to get victims to send funds or approve unauthorized access.
You land on an AMLBot look‑alike site that says: “Choose your cryptocurrency, click Check Wallet, and connect your wallet to get your results.” Looks legit, right? But this fake AML checker is built to drain your wallet. The moment you connect, it pushes a transaction you weren’t expecting, then shows a slick progress bar: “Checking wallet history… Verifying compliance…” before flashing a comforting “Clean, Low Risk” result. Here’s the tell: a real basic check only needs your public address. It never needs you to connect your wallet, approve anything, or pay a little 'top‑up fee' after some fake error to finish the scan or download a report. If any 'AML checker' asks you to connect your wallet or approve a transaction, stop right there, close the tab, and don’t approve anything you don’t fully understand.
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Scammers are setting up lookalike websites that copy TikTok Shop’s design, trust badges, and wording to trick people into thinking they’re shopping inside TikTok. The main risk is entering payment (and sometimes loan-application) details into a site that has no real connection to TikTok, leading to…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
