Kaspersky: Top scammers target digital thieves with fake crypto wallet keys to steal funds

Cybersecurity firm Kaspersky has uncovered a unique scam targeting crypto thieves. The scheme lures would-be opportunists with seemingly loaded crypto wallets, only to siphon their funds when they attempt to access the bait. This inventive ploy demonstrates the growing sophistication of cybercriminals in the digital asset space.

According to Kaspersky, top scammers are posing as naïve crypto users by publicly sharing seed phrases, the keys required to access crypto wallets, in YouTube comments. These comments, posted by newly created accounts, often include a plea for assistance in transferring funds from a wallet supposedly holding significant assets. 

“Scammers have invented a new trick…They post crypto wallet seed phrases in YouTube comments using newly created accounts,” Kaspersky analyst Mikhail Sytnik detailed in a recent blog post.

There’s no honor among thieves – How the private key scam works

One wallet observed by Kaspersky contained approximately $8,000 in USDT on the Tron network. To access these funds, a thief would first need to send TRX, the blockchain’s native token, to cover network fees. 

The scheme primarily preys on individuals looking to exploit the supposedly “foolish” mistake of others. Once inside the bait wallet, these digital thieves find it filled with USDT, a TRC20 token tied to the US dollar. 

Since the wallet lacks sufficient TRX for withdrawals, they are prompted to send funds from their own wallets. This action triggers the “siphon,” diverting the TRX to the scammer’s address.

The scammers have rigged the system, and as soon as the TRX is sent, it is immediately redirected to a separate wallet controlled by the attackers, leaving the thief empty-handed.

Kaspersky’s analysis likened the scammers to digital Robin Hoods, targeting unethical actors in the crypto space. However, the ultimate victims remain those who let their greed outweigh their caution. 

The security company is urging crypto users to be cautious of the repeated use of identical seed phrases across multiple comments. This could be a well-planned and coordinated operation to steal their assets.

Scamming campaigns targeting crypto users

Kaspersky’s findings extend beyond seed phrase scams. In August, the company’s Global Emergency Response Team (GERT) has identified a larger fraud campaign aimed at Windows and macOS users worldwide. 

This operation employs polished fake websites to mimic legitimate services, such as crypto platforms, online role-playing games, and AI tools. These sophisticated imitations are designed to lure victims into sharing sensitive information or downloading malware.

“The correlation between different parts of this campaign and their shared infrastructure suggests a well-organized operation, possibly linked to a single actor or group with specific financial motives,” stated Ayman Shaaban, Head of Incident Response at Kaspersky’s GERT.

Dubbed “Tusk,” Kaspersky’s investigation revealed that the campaign includes various sub-operations targeting crypto, gaming, and AI-related topics. The malicious infrastructure also extends to 16 other themes, either retired sub-campaigns or new ones yet to be launched. 

Strings of malicious code uncovered during the investigation showed communication between the attackers’ servers in Russian, with references to the term “Mammoth” (“Мамонт”), slang for “victim” among Russian-speaking threat actors. This linguistic clue contributed to the campaign’s name.

The Tusk campaign employs info-stealer malware such as Danabot and Stealc, as well as clipboard-monitoring clippers, some of which are open-source variants written in Go. Info-stealers extract credentials, wallet details, and other sensitive information, while clippers intercept cryptocurrency wallet addresses copied to clipboards, replacing them with malicious addresses controlled by the attackers.

From Zero to Web3 Pro: Your 90-Day Career Launch Plan