A cybercrime forum vendor is offering a comprehensive scam kit for $500, enabling individuals with minimal technical skills to execute sophisticated cryptocurrency fraud. The kit, discovered by Malwarebytes researchers on May 16, provides a complete "scam-in-a-box" solution, integrating social engineering, phishing, and financial fraud into a single, ready-to-use package.
The vendor, operating under the alias "xrep" since March 2026, has established a positive reputation on the forum for delivering packaged tools. This particular kit includes all necessary technical infrastructure, phishing functionalities, a fake investment dashboard, victim tracking, and administrative controls.
The scam leverages a fabricated presale page for a cryptocurrency token named "$TSLA," designed to mimic an offering from Tesla. The page is multilingual and optimized for both desktop and mobile devices. It initiates with a fake eligibility check, requesting the visitor's X (formerly Twitter) username and then pulling their profile picture to personalize the scam.
The site employs various psychological manipulation tactics, including a self-advancing progress bar, a countdown timer, and urgent warnings about impending price increases, all designed to pressure victims into making hasty decisions. Once a victim believes the offer is legitimate, the site presents two methods for them to lose their funds. One method prompts users to connect a crypto wallet to claim a bonus, then requests a 12-word recovery phrase, which grants the scammer full control over the wallet. The alternative method bypasses wallet connection and directly requests transfers in Bitcoin, Ethereum, USDT, or Dogecoin to an address controlled by the scammer.
Malwarebytes researchers noted that victims are led to believe they are making a legitimate investment, but no actual tokens are purchased. Instead, the scammer receives the cryptocurrency, and the victim sees a fabricated balance displayed on the website.
A key feature of the kit is its sophisticated admin panel, which provides the scammer with extensive control over the operation. This panel allows the operator to monitor victims' navigation through the site, retrieve their X usernames, locations, and any entered recovery phrases. It also enables the scammer to assess the value of a stolen wallet before deciding whether to drain it further.
The fake balance displayed to victims is not static; the operator can inflate it at will, creating the illusion of a profitable investment and encouraging victims to send more funds. The admin panel further facilitates the management of fake purchase orders and direct communication with victims. Scammers can follow up with victims who have already sent money, claiming delays and demanding additional "network fees" to release funds, effectively attempting a second extraction from the same wallet.
Malwarebytes concluded that the availability of such a comprehensive kit significantly lowers the barrier to entry for cybercriminals. Individuals lacking the expertise to build phishing websites, develop administration systems, or create convincing investment interfaces can now purchase this kit and target victims with minimal effort.
