Researchers described a real fraud operation that first verified which phone numbers were tied to cryptocurrency exchange accounts, then targeted confirmed owners. The attackers used phishing emails, vishing calls, and fake wallet apps while impersonating popular hardware/software wallet brands, making the outreach feel legitimate by referencing real-looking case numbers and verification codes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If you’ve got crypto, assume your number’s on a list. Researchers found a fraud ring using an exposed Asterisk phone system to test hundreds of thousands of numbers, then hit confirmed crypto owners with phishing emails, vishing calls, and fake wallet apps posing as Ledger, Trezor, and Exodus. Here’s the trick: you get a ‘Ledger’ or ‘Trezor’ security email, then a call that sounds legit because they drop a case number and a verification code, and push you to install a “recovery” app or follow a link to fix an urgent wallet issue. If you get any crypto ‘security’ email or call out of the blue, don’t tap links, don’t install apps, hang up and open your wallet or exchange app yourself to check for alerts.
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
Scammers are mailing official-looking “IRS” letters to cryptocurrency holders, urging them to scan a QR code and enroll in a fake “Digital Asset Compliance Portal.” The QR code leads to a fraudulent IRS-lookalike site that gathers wallet/exchange details and then prompts victims to provide a phone…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
A real malware campaign called OkoBot is infecting Windows PCs and then showing a fake “recovery phrase” prompt inside legitimate Ledger and Trezor desktop apps. Victims are tricked into typing their wallet seed phrase into a malicious page that looks like it came from the trusted app, allowing…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
