Scammers are mailing physical letters that mimic official IRS notices and pressure cryptocurrency holders to “enroll” in a fake Digital Asset Compliance Portal. Victims are driven to scan a QR code, enter details about their exchange and holdings, and provide a phone number for a follow-up call. The phone call is used to trick people into giving up one-time codes, passwords, seed phrases, or moving funds to an attacker-controlled “safe” wallet.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an IRS letter at home about your crypto, with a notice number, tax years, a deadline, and a big QR code. It tells you to enroll in a ‘Digital Asset Compliance Portal.’ Scanning the QR lands on a site that looks like a U.S. government portal, asking which exchange you use, your holdings, and your phone number for a representative to call. Here’s the trap: Coinbase says the phone call is the real attack. The so-called support rep asks for one-time codes, passwords, seed phrases, or tells you to move funds into a new ‘safe’ wallet they control. Aha moment: the IRS does not operate a Digital Asset Compliance Portal. If you get a letter like this, ignore the QR and any phone numbers, go to IRS.gov or your exchange’s app yourself and verify there.
Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Google reports UNC6671 is still actively compromising organizations by calling employees and pretending to be IT helpdesk staff running an urgent security migration. Victims are pushed to visit lookalike login pages that steal passwords and MFA codes, which then enables data theft and extortion…
A researcher says North Korean operators used fake high-salary job offers to trick software developers into downloading an “interview test” program that installed malware. He reports evidence that 1,640 organizations across 57 countries were impacted, with hundreds suffering serious intrusions,…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
