Proofpoint reports a rise in cryptocurrency fraud that impersonates brands via job scams, marking a shift from traditional Pig Butching to work-from-home lure schemes. These scams use brand recognition and psychological manipulation on social media and messaging apps to persuade victims to invest in fake job platforms, leading to significant financial losses.
#DaptoneRecords #Temu #TikTok #HotelAssociationOfCanada #OutlierVentures #Proofpoint #PigButcher #daptonerecordsmusicalbums
#DaptoneRecords #Temu #TikTok #HotelAssociationOfCanada #OutlierVentures #Proofpoint #PigButcher #daptonerecordsmusicalbums
Keypoints
- There is an increase in cryptocurrency fraud delivered via job scams that impersonate various organizations.
- Fraudsters exploit recognizable brands to attract victims and lend credibility to the scam.
- Scams are initiated through social media, SMS, and messaging apps such as WhatsApp and Telegram, often as work-from-home opportunities.
- Victims are guided through fake job sites, including registration and profile sharing, to enable fraud workflows.
- Significant sums are stolen, with wallets tied to fake sites accumulating tens of thousands to hundreds of thousands of dollars (e.g., over $300K linked to Daptone Records site; $275K+ to Temu-workbench; $95K to Outlier Ventures app; $80K+ to TikTok-Advance).
- Proofpoint highlights protective guidance: stay vigilant against unsolicited offers and never pay for job opportunities.
MITRE Techniques
- [T1566] Phishing – Fraudsters lure victims through social media and messaging platforms with fake job offers. “Fraudsters use social media and messaging platforms to lure victims with fake job offers.”
- [T1003] Credential Dumping – Victims may be tricked into providing sensitive information during the registration process on fake job sites. “Victims may be tricked into providing sensitive information during the registration process on fake job sites.”
- [T1537] Account Manipulation – Scammers manipulate victims’ accounts by instructing them to send cryptocurrency to recover fake losses. “Scammers manipulate victims’ accounts by instructing them to send cryptocurrency to recover fake losses.”
Indicators of Compromise
- [Domain] context – hotelassociationseogp.com, temu-workbench.com, tiktok-advance.com, outlierventures-app.com, and other domains (as listed in the report)
- [BTC Wallet] context – 3K2t5GuZrZRByvVC1LuHUKrJ5LtKGJF7Mv, bc1qg9sz72jg3mptpmmqavjmqwq4dm3j5txpk0w0fu, and other wallets linked to identified fake sites
- [ETH Wallet] context – 0x2E65f3E0492e0a429D897521597bcc7Ec1CC4C9d, 0x404c7c72e8869af9c617ad428fd2d2652f1cf298, 0x3D2C12420D829D8AFc166C1632a4c54e7798F4fd