Recent Cryptocurrency Cyber Attacks

Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…

Hackers claimed to have breached crypto swap platform Wagyu.xyz, and researchers reviewed an unverified dataset that allegedly links cryptocurrency trades, Monero wallet addresses and IP addresses. While no follow-on scam has been confirmed, the data could let criminals send highly convincing fake…

ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…

U.S. authorities sanctioned people supporting a real North Korean scheme that placed workers in legitimate U.S. businesses using false identities and fabricated job applications. The workers reportedly used AI to tailor resumes and cover letters, create profile photos, and even conceal their…

U.S. prosecutors indicted six people over a Madagascar-based scam operation that allegedly stole more than $516,000 from U.S. victims. The group reportedly used dating sites, posed as attractive women, and persuaded victims to connect cryptocurrency wallets to fraudulent NFT websites, then…

Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond…

Attackers used paid Google ads to direct people to fake Claude download pages hosted on Anthropic’s real claude.ai website. The pages used a ClickFix trick: they told Mac and Windows users to paste a command into their device, installing password- and cryptocurrency-stealing malware. Because the…

ICMacOS is a commercially sold Mac malware kit that uses fake websites to convince victims to paste a command into Terminal. The command installs malware and displays a fake macOS password prompt, putting browser credentials, cloud access, developer secrets, and cryptocurrency wallets at risk. The…

Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible.…

U.S. authorities allege that Zheng Zhao and co-conspirators used relationship-building scams to persuade at least 174 Americans to invest in fake cryptocurrency platforms. The group contacted victims through social media, dating sites, calls, and text messages, then showed false investment growth…

INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including…

Interpol's Serengeti III operation led to 1,462 arrests across Africa and the recovery of more than $105 million linked to cybercrime. In Uganda, fraud rings used call-center scripts, fake trading platforms, and fraudulent websites to persuade pensioners in Asia to invest in fictional…

Alongside the Railway credential-exposure incident, the article describes a real phishing campaign that used sponsored Google Search ads to send people looking for Google Cloud services to a fake Google login page. The attackers stole account credentials and MFA codes, then used overly broad cloud…

INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…

The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…

This weekly recap describes a task scam in which victims were paid to create fake sales and reviews, then told they had a “negative balance” and needed to deposit their own money to receive payment. One fraudster reportedly lost more than $4.8 million after proceeds from this scam were placed into…

Attackers hijacked two official Irish police X/Twitter accounts and used the trusted accounts to promote a fake cryptocurrency airdrop. The posts directed followers to a link that could trick them into giving up cryptocurrency-wallet keys, allowing criminals to drain their funds.

Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if…

Researchers report a real-world macOS malware operation (ICMacOS) being sold as a service and delivered through “ClickFix” social-engineering pages. Victims are pushed to copy/paste Terminal commands and then shown fake macOS system dialogs that trick them into entering their login password,…

Researchers found 16 malicious Firefox browser extensions pretending to be Rabby or OKX crypto wallets. When a user imports a wallet, the fake add-ons capture the recovery phrase/private key and send it to attacker-controlled Cloudflare Workers, enabling wallet takeover and theft.