Record crypto-fraud losses rise with AI-driven impersonation
Trend
Summary
Hide ▲
Show ▼
Cryptocurrency fraud is surging as scammers use AI chatbots and brand impersonation to widen victim reach and raise payout sizes. A Malwarebytes Labs analysis found a fake "Google Coin" presale site that mimics Google Gemini and pushes users to send irreversible crypto payments for nonexistent crypto. The broader pattern now includes trusted-brand lookalikes, polished sales pressure, and AI-assisted social engineering across the 2025–2026 timeframe.
Related Happenings
Indirect prompt-injection web campaigns targeting AI agents
Campaign
H score37
First: 06.07.2026 18:00
Last: 06.07.2026 18:00
Sources 1
About this happening:
**Two real-world campaigns** are using **indirect prompt injection** and **SEO poisoning** to steer **AI agents** into fraudulent actions and false legitimacy judgments. The lures...
Indirect prompt-injection web campaigns targeting AI agents
CampaignAbout this happening: **Two real-world campaigns** are using **indirect prompt injection** and **SEO poisoning** to steer **AI agents** into fraudulent actions and false legitimacy judgments. The lures...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score69
First: 12.06.2026 21:59
Last: 12.06.2026 21:59
Sources 1
About this happening:
The **Outsider Enterprise** is a **Chinese phishing-as-a-service** operation that used **Telegram**, **AI**, and distributed phishing kits to run large-scale brand-impersonation c...
Outsider Enterprise-Outsider-Chinese cybercrime alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: The **Outsider Enterprise** is a **Chinese phishing-as-a-service** operation that used **Telegram**, **AI**, and distributed phishing kits to run large-scale brand-impersonation c...
Outsider Telegram-run smishing campaign targeting Americans
Campaign
H score53
First: 12.06.2026 21:59
Last: 12.06.2026 21:59
Sources 1
About this happening:
The **Outsider Enterprise** happening is a **phishing-as-a-service** campaign tied to a **Chinese cybercrime network** that used **AI** and distributed phishing kits to impersonat...
Outsider Telegram-run smishing campaign targeting Americans
CampaignAbout this happening: The **Outsider Enterprise** happening is a **phishing-as-a-service** campaign tied to a **Chinese cybercrime network** that used **AI** and distributed phishing kits to impersonat...
Latest development: 14.06.2026 17:36
The FBI, working with Google and Black Lotus Labs, dismantled Outsider Enterprise, a Chinese phishing-as-a-service operation that used AI and distributed phishing kits to impersonate trusted brands in texts sent through AT&T, T-Mobile and Verizon. The takedown included seizures of administration servers, a Shopify e-commerce storefront, a testing account, around $100,000 USDT and a Telegram bot linked to the service, while Google pursued civil action and coordinated with carriers to block fraudulent messages.
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor Meta
H score42
First: 05.06.2026 10:01
Last: 05.06.2026 10:01
Sources 1
About this happening:
A **FIFA-themed phishing-as-a-service market** is selling **ready-made scam kits** and **ticket-buying bots**, lowering the barrier for fraud operators and making takedowns less e...
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor MetaAbout this happening: A **FIFA-themed phishing-as-a-service market** is selling **ready-made scam kits** and **ticket-buying bots**, lowering the barrier for fraud operators and making takedowns less e...
Lucifer DaaS’s evolution into a commission-based drainer service platform
Threat Actor Meta
H score19
First: 21.05.2026 17:00
Last: 21.05.2026 17:00
Sources 1
About this happening:
**Lucifer DaaS** has evolved into a **structured underground drainer platform**, shifting wallet theft from isolated phishing pages to a commission-based service model that scales...
Lucifer DaaS’s evolution into a commission-based drainer service platform
Threat Actor MetaAbout this happening: **Lucifer DaaS** has evolved into a **structured underground drainer platform**, shifting wallet theft from isolated phishing pages to a commission-based service model that scales...
Timeline
-
14.01.2026 12:00 3 articles · 5mo ago
Chainalysis discloses record crypto-fraud losses driven by AI and impersonation
Initial DisclosureChainalysis reported record cryptocurrency fraud losses, saying at least $14bn in digital currency reached criminals last year and expecting $17bn in 2025 as more illicit wallets are identified. The analysis said individual scam payments rose 253% year-on-year to $2764, impersonation volume grew 1400% year-on-year, related payments increased over 600%, and AI-linked scams extracted $3.2m per operation versus $719,000 for operations without an AI vendor link. It cited the E-ZPass phishing campaign tied to the Smishing Triad and a multimillion-dollar Coinbase operation as examples of the expanding fraud pattern.
Show sources
- Impersonation Fraud Drives Record $17bn in Crypto Losses — www.infosecurity-magazine.com — 14.01.2026 12:00
- Impersonation Fraud Drives Record $17bn in Crypto Losses — www.infosecurity-magazine.com — 14.01.2026 12:00
- Scam Abuses Gemini Chatbots to Convince People to Buy Fake Crypto — www.darkreading.com — 18.02.2026 23:47