Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone number so a “support representative” can call and pressure them into sharing credentials, seed phrases, or MFA codes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Do you hold cryptocurrency? Have you gotten an IRS letter pushing a “Digital Asset Compliance Portal” with a QR code? Here’s the scam: the letter says you must urgently enroll before time runs out. You scan the QR, land on a fake IRS.gov lookalike, and it asks where you keep your crypto, how much you hold, then your phone number to “get verified” by a support rep. A so-called IRS support rep then calls, using your answers to sound legit, and pressures you for passwords, recovery or seed phrases, or 2FA codes so they can drain your accounts. Your move: if a letter or site pushes a “Digital Asset Compliance Portal,” don’t scan, don’t click, go to IRS.gov yourself in a fresh browser tab and check there instead.
Scammers are mailing physical letters that mimic official IRS notices and pressure cryptocurrency holders to “enroll” in a fake Digital Asset Compliance Portal. Victims are driven to scan a QR code, enter details about their exchange and holdings, and provide a phone number for a follow-up call.…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
The FBI warned that scammers are impersonating IC3 leadership using AI-generated (deepfake) videos and spoofed IC3 websites to trick prior fraud victims into sharing more personal and financial information. In one example, victims are contacted on Facebook Messenger by someone posing as an FBI…
