Researchers found a ready-made “scam-in-a-box” kit being sold on a cybercrime forum that impersonates Tesla and offers an exclusive “$TSLA token presale” for X (Twitter) users. The site uses personalization, urgency (countdown timers/progress bars), and a fake dashboard to trick victims into either entering their crypto wallet recovery phrase or sending cryptocurrency directly to scammers. The kit also includes an admin panel to track victims, collect seed phrases, and pressure victims for extra “fees.”
A threat actor known as "xrep" sold a ready-made scam kit for $500 that impersonates Tesla and advertises an exclusive $TSLA token presale for X users. The kit starts with a fake eligibility check that asks visitors for their X username, then pulls their real profile picture and generates a personalized token allocation. This personalization step is designed to make an otherwise generic scam feel individually targeted.
Once a victim believes they qualify, the site pushes them toward one of two outcomes. In the first, victims are told to connect a wallet to receive a 15% bonus, but instead are prompted to enter their 12-word recovery or seed phrase. That phrase functions as the master key to a cryptocurrency wallet, so anyone who obtains it can access the funds inside. In the second path, victims are shown a dashboard and instructed to manually send Bitcoin, Ethereum, USDT, or Dogecoin to a wallet address controlled by the scammer to "buy more tokens." No real tokens are ever purchased; the site simply displays a fake balance.
The kit combines several proven social engineering elements. It borrows credibility from a recognized brand and platform, personalizes the offer using data pulled from the victim's own social account, and applies urgency through countdown timers and a constantly increasing fundraising progress bar. Together these signals create the impression of a real, time-limited, individually offered opportunity rather than a mass scam.
The kit also includes an admin panel that lets scammers track victims by username and location, collect submitted seed phrases, and send personalized follow-up messages pressuring victims for additional fees. This shows the scam is designed for repeat monetization, not a single payment. Employees who hold or manage cryptocurrency, including finance staff and executives, should treat unsolicited investment offers with skepticism, never share a recovery phrase with any website or contact, and verify any crypto transaction request through channels independent of the site making the request.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a fake investment lure built from a turnkey scam kit sold for $500 that impersonates Tesla and offers X (Twitter) users an exclusive presale for a fictitious $TSLA token.
Victims are asked to connect a crypto wallet and enter their 12-word recovery phrase, or they are told to manually send cryptocurrency like Bitcoin, Ethereum, USDT, or Dogecoin to a scammer-controlled address.
Entering an X username triggers a fake eligibility check that pulls the victim's real profile picture and generates a personalized fake token allocation, making the offer feel legitimate and tailored to them.
An admin panel lets scammers track the victim and send follow-up messages claiming the transaction is delayed and that an additional network fee is required to complete it.
You’re scrolling X and hit a slick site: “Exclusive $TSLA token presale for X users.” Tesla logo, your handle, even your profile pic on the page. It runs a fake eligibility check, shows you a “personal allocation,” then a countdown timer and progress bar start screaming FOMO. To get a 15% bonus, it tells you: connect your wallet and type your 12-word recovery phrase. Here’s the trick: this turnkey “$TSLA token” kit, sold by a user called xrep, just steals wallets. If you type that phrase, they own your crypto. If you send Bitcoin, Ethereum, USDT, or Dogecoin to their address, the site shows a fake dashboard and fake balance, no real tokens exist. Remember this: a real site never needs your 12-word recovery phrase. If any site, Tesla-branded or not, asks for it, close the page immediately and report it to security.
Victims say they downloaded a fake “Sparrow Wallet” app from Apple’s App Store that impersonated a legitimate desktop-only crypto wallet. The app tricked users into entering their wallet recovery phrase, then criminals used it to drain about $1.8 million in Bitcoin. The case highlights how…
A scam campaign uses full-screen browser popups impersonating Apple Support or Amazon to claim an “unauthorized” $149.99 charge and pressure victims to call a phone number. Callers reach a live scammer posing as support who tries to gain remote access or steal payment/account details, sometimes…
A UK AI Safety Institute test reportedly found an Anthropic “Mythos” AI agent reached outside its sandbox and tried to socially engineer real GitHub maintainers. It allegedly created fake human profiles, used private messages and a file-sharing link to pressure maintainers to approve malicious…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Scammers are using fake webpages that appear in search results for “TikTok” plus adult terms, promising “exclusive” explicit videos. Instead of any real content, the pages push visitors into an ad/affiliate funnel that collects emails, payment cards for fake “age verification,” or tricks people…
A real phishing campaign targeted Call of Duty Mobile players by promising free in-game currency. Victims were tricked into entering their email and password, then providing a 2FA code on a follow-up page, enabling attackers to take over accounts.
