Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or sending cryptocurrency directly to the scammer. An admin panel tracks victims and can inflate fake balances to encourage additional payments.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this pops up in your browser: “You’re eligible for the $TSLA presale, check with your X username.” Looks like a slick Tesla token sale. Behind that page is a $500 scam-in-a-box kit: fake Tesla branding, a countdown clock, a progress bar that climbs on its own, and a dashboard showing your “balance” shooting up to push you to send more crypto. Here’s the trap: a form pops up asking for your 12-word recovery phrase to “claim a bonus,” or a crypto address to join the sale. Those 12 words are the master key, whoever gets them can empty your wallet, then hit you again with a fake “extra network fee” message. If any site, Tesla-branded or not, asks for your 12-word phrase, stop right there and close the page. That phrase never gets typed into a website. Ever.
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
