A new "turnkey" scam kit, priced at $500, has been discovered on a cybercrime forum, offering a comprehensive package designed to facilitate cryptocurrency investment fraud. The kit, marketed by a threat actor known as "xrep," provides a ready-made website and backend infrastructure, significantly lowering the technical barrier for individuals looking to launch sophisticated scams.
The specific scam project identified by the Malwarebytes research team on May 16 is themed around a fake "exclusive $TSLA token presale" for users of X (formerly Twitter). The website is professionally designed, impersonating the Tesla brand with its logo and supporting multiple languages and device types. It incorporates various social engineering tactics to deceive victims.
The scam begins with a fake eligibility check, prompting visitors to enter their X username. The site then retrieves the user's real profile picture to generate a fictional token allocation, making the offer appear personalized. Psychological pressure is applied through a continuously increasing fake fundraising progress bar, a countdown timer creating urgency, and warnings about impending token price increases, all designed to induce "fear of missing out" (FOMO).
Victims are presented with two primary methods for losing funds or access to their cryptocurrency wallets. The first is a phishing attack, where users are encouraged to connect their cryptocurrency wallet for a supposed 15% bonus. Instead of a legitimate connection, they are prompted to enter their 12-word recovery phrase (seed phrase), which grants the scammer full access to their wallet's contents.
The second method involves direct payments. After navigating the fake wallet process, victims are redirected to a convincing personal dashboard displaying a fabricated token balance. They are then encouraged to purchase additional "TSLA tokens" by manually sending cryptocurrencies such as Bitcoin, Ethereum, USDT, or Dogecoin to an address controlled by the scammer. While victims believe they are making a legitimate investment, no real tokens are purchased, and the scammer simply receives the funds.
A key feature of the kit is an administrative panel that provides the scam operator with extensive control. This panel allows the operator to monitor victims, view their X usernames and locations, track activity, and collect stolen recovery phrases. It also enables checking if a compromised wallet contains valuable cryptocurrency, helping identify high-value targets.
The administrative panel further allows scammers to manipulate the fake token balance displayed to victims, potentially increasing it to encourage further investment. Operators can also manage fake purchase orders and send personalized messages, such as notifications about delayed transactions requiring additional "network fees," creating further opportunities to extract money.
The discovery highlights a trend towards "scam-in-a-box" solutions, where complete technical infrastructure, phishing capabilities, fake investment dashboards, victim tracking, and administrative controls are bundled into a single, easy-to-deploy package. This significantly reduces the technical expertise required to conduct complex cryptocurrency scams.
Users are advised that a professional-looking website does not guarantee the legitimacy of an investment opportunity. Tactics like personalized offers, countdown timers, rapidly increasing fundraising figures, and promises of exclusive access are common red flags. Crucially, no legitimate investment should ever require a user to disclose their cryptocurrency wallet's recovery phrase. Compromising this phrase can lead to irreversible financial losses, as cryptocurrency transactions are typically impossible to reverse.
