July 10, 2025

Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

Darktrace’s latest research reveals that an evolving social engineering campaign continues to target cryptocurrency users through fake startup companies. These malicious operations impersonate AI, gaming, and Web3 firms using spoofed social media accounts and project documentation hosted on legitimate platforms like Notion and GitHub.

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Tara Gould

Malware Research Lead

Jul 2025

Overview

Continued research by Darktrace has revealed that cryptocurrency users are being targeted by threat actors in an elaborate social engineering scheme that continues to evolve. In December 2024, Cado Security Labs detailed a campaign targeting Web 3 employees in the Meeten campaign. The campaign included threat actors setting up meeting software companies to trick users into joining meetings and installing the information stealer Realst disguised as video meeting software.

The latest research from Darktrace shows that this campaign is still ongoing and continues to trick targets to download software to drain crypto wallets. The campaign features:

Threat actors creating fake startup companies with AI, gaming, video meeting software, web3 and social media themes.
Use of compromised X (formerly Twitter) accounts for the companies and employees - typically with verification to contact victims and create a facade of a legitimate company.
Notion, Medium, Github used to provide whitepapers, project roadmaps and employee details.
Windows and macOS versions.
Stolen software signing certificates in Windows versions for credibility and defense evasion.
Anti-analysis techniques including obfuscation, and anti-sandboxing.

To trick as many victims as possible, threat actors try to make the companies look as legitimate as possible. To achieve this, they make use of sites that are used frequently with software companies such as Twitter, Medium, Github and Notion. Each company has a professional looking website that includes employees, product blogs, whitepapers and roadmaps. X is heavily used to contact victims, and to increase the appearance of legitimacy. Some of the observed X accounts appear to be compromised accounts that typically are verified and have a higher number of followers and following, adding to the appearance of a real company.

Figure 1: Example of a compromised X account to create a “BuzzuAI” employee.

The threat actors are active on these accounts while the campaign is active, posting about developments in the software, and product marketing. One of the fake companies part of this campaign, “Eternal Decay”, a blockchain-powered game, has created fake pictures pretending to be presenting at conferences to post on social media, while the actual game doesn’t exist.

Figure 2: From the Eternal Decay X account, threat actors have altered a photo from an Italian exhibition (original on the right) to make it look like Eternal Decay was presented.

In addition to X, Medium is used to post blogs about the software. Notion has been used in various campaigns with product roadmap details, as well as employee lists.

Figure 3: Notion project team page for Swox.

Github has been used to detail technical aspects of the software, along with Git repositories containing stolen open-source projects with the name changed in order to make the code look unique. In the Eternal Decay example, Gitbook is used to detail company and software information. The threat actors even include company registration information from Companies House, however they have linked to a company with a similar name and are not a real registered company.

Figure 4: From the Eternal Decay Gitbook linking to a company with a similar name on Companies House.

Figure 5: Gitbook for “Eternal Decay” listing investors.

Figure 6: Gameplay images are stolen from a different game “Zombie Within” and posted pretending to be Eternal Decay gameplay.

In some of the fake companies, fake merchandise stores have even been set up. With all these elements combined, the threat actors manage to create the appearance of a legitimate start-up company, increasing their chances of infection.

Each campaign typically starts with a victim being contacted through X messages, Telegram or Discord. A fake employee of the company will contact a victim asking to test out their software in exchange for a cryptocurrency payment. The victim will be directed to the company website download page, where they need to enter a registration code, provided by the employee to download a binary. Depending on their operating system, the victim will be instructed to download a macOS DMG (if available) or a Windows Electron application.

Figure 7: Example of threat actor messaging a victim on X with a registration code.

Windows Version

Similar to the aforementioned Meeten campaign, the Windows version being distributed by the fake software companies is an Electron application. Electron is an open-source framework used to run Javascript apps as a desktop application. Once the user follows directions sent to them via message, opening the application will bring up a Cloudflare verification screen.

Figure 8: Cloudflare verification screen.

The malware begins by profiling the system, gathering information like the username, CPU and core count, RAM, operating system, MAC address, graphics card, and UUID.

Figure 9: Code from the Electron app showing console output of system profiling.

A verification process occurs with a captcha token extracted from the app-launcher URL and sent along with the system info and UUID. If the verification is successful, an executable or MSI file is downloaded and executed quietly. Python is also retrieved and stored in /AppData/Temp, with Python commands being sent from the command-and-control (C2) infrastructure.

Figure 10: Code from the Electron app looping through Python objects.

As there was no valid token, this process did not succeed. However, based on previous campaigns and reports from victims on social media, an information stealer targeting crypto wallets is executed at this stage. A common tactic in the observed campaigns is the use of stolen code signing certificates to evade detection and increase the appearance of legitimate software. The certificates of two legitimate companies Jiangyin Fengyuan Electronics Co., Ltd. and Paperbucketmdb ApS (revoked as of June 2025) were used during this campaign.

MacOS Version

For companies that have a macOS version of the malware, the user is directed to download a DMG. The DMG contains a bash script and a multiarch macOS binary. The bash script is obfuscated with junk, base64 and is XOR’d.

After decoding, the contents of the script are revealed showing that AppleScript is being used. The script looks for disk drives, specifically for the mounted DMG “SwoxApp” and moves the hidden .SwoxApp binary to /tmp/ and makes it executable. This type of AppleScript is commonly used in macOS malware, such as Atomic Stealer.

Figure 12: AppleScript used to mount the malware and make it executable.

The SwoxApp binary is the prominent macOS information stealer Atomic Stealer. Once executed the malware performs anti-analysis checks for QEMU, VMWare and Docker-OSX, the script exits if these return true. The main functionality of Atomic Stealer is to steal data from stores including browser data, crypto wallets, cookies and documents. This data is compressed into /tmp/out.zip and sent via POST request to 45[.]94[.]47[.]167/contact. An additional bash script is retrieved from 77[.]73[.]129[.]18:80/install.sh.

Figure 13: Additional Bash script ”install.sh”.

Install.sh, as shown in Figure 13, retrieves another script install_dynamic.sh from the server https://mrajhhosdoahjsd[.]com. Install_dynamic.sh downloads and extracts InstallerHelper.app, then sets up persistence via Launch Agent to run at login.

Figure 14: Persistence added via Plist configuration.

This plist configuration installs a macOS LaunchAgent that silently runs the app at user login. RunAtLoad and KeepAlive keys are used to ensure the app starts automatically and remains persistent.

The retrieved binary InstallerHelper is an Objective-C/Swift binary that logs active application usage, window information, and user interaction timestamps. This data is written to local log files and periodically transmits the contents to https://mrajhhoshoahjsd[.]com/collect-metrics using scheduled network requests.

List of known companies

Darktrace has identified a number of the fake companies used in this scam. These can be found in the list below:

Pollens AI
X: @pollensapp, @Pollens_app
Website: pollens.app, pollens.io, pollens.tech
Windows: 02a5b35be82c59c55322d2800b0b8ccc
Notes: Posing as an AI software company with a focus on “collaborative creation”.

Buzzu
X: @BuzzuApp, @AI_Buzzu, @AppBuzzu, @BuzzuApp
Website: Buzzu.app, Buzzu.us, buzzu.me, Buzzu.space
Windows: 7d70a7e5661f9593568c64938e06a11a
Mac: be0e3e1e9a3fda76a77e8c5743dd2ced
Notes: Same as Pollens including logo but with a different name.

Cloudsign
X: @cloudsignapp
Windows: 3a3b13de4406d1ac13861018d74bf4b2
Notes: Claims to be a document signing platform.

Swox
X: @SwoxApp, @Swox_AI, @swox_app, @App_Swox, @AppSwox, @SwoxProject, @ProjectSwox
Website: swox.io, swox.app, swox.cc, swoxAI.com, swox.us
Windows: d50393ba7d63e92d23ec7d15716c7be6
Mac: 81996a20cfa56077a3bb69487cc58405ced79629d0c09c94fb21ba7e5f1a24c9
Notes: Claims to be a “Next gen social network in the WEB3”. Same GitHub code as Pollens.

KlastAI
X: Links to Pollens X account
Website: Links to pollens.tech
Notes: Same as Pollens, still shows their branding on its GitHub readme page.

Wasper
X: @wasperAI, @WasperSpace
Website: wasper.pro, wasper.app, wasper.org, wasper.space
Notes: Same logo and GitHub code as Pollens.

Lunelior
Website: lunelior.net, Lunelior.app, lunelior.io, lunelior.us
Windows: 74654e6e5f57a028ee70f015ef3a44a4
Mac: d723162f9197f7a548ca94802df74101

BeeSync
X: @BeeSyncAI, @AIBeeSync
Website: beesync.ai, beesync.cc
Notes: Previous alias of Buzzu, Git repo renamed January 2025.

Slax
X: @SlaxApp, @Slax_app, @slaxproject
Website: slax.tech, slax.cc, slax.social, slaxai.app

Solune
X: @soluneapp
Website: solune.io, solune.me
Windows: 22b2ea96be9d65006148ecbb6979eccc

Eternal Decay
X: @metaversedecay
Website: eternal-decay.xyz
Windows: 558889183097d9a991cb2c71b7da3c51
Mac: a4786af0c4ffc84ff193ff2ecbb564b8

Dexis
X: @DexisApp
Website: dexis.app
Notes: Same branding as Swox.

NexVoo
X: @Nexvoospace
Website: nexvoo.app, Nexvoo.net, Nexvoo.us

NexLoop
X: @nexloopspace
Website: nexloop.me

NexoraCore
Notes: Rename of the Nexloop Git repo.

YondaAI
X: @yondaspace
Website: yonda.us

Traffer Groups

A “traffer” malware group is an organized cybercriminal operation that specializes in directing internet users to malicious content typically information-stealing malware through compromised or deceptive websites, ads, and links. They tend to operate in teams with hierarchical structures with administrators recruiting “traffers” (or affiliates) to generate traffic and malware installs via search engine optimization (SEO), YouTube ads, fake software downloads, or owned sites, then monetize the stolen credentials and data via dedicated marketplaces.

A prominent traffer group “CrazyEvil” was identified by Recorded Future in early 2025. The group, who have been active since at least 2021, specialize in social engineering attacks targeted towards cryptocurrency users, influencers, DeFi professionals, and gaming communities. As reported by Recorded Future, CrazyEvil are estimated to have made millions of dollars in revenue from their malicious activity. CrazyEvil and their sub teams create fake software companies, similar to the ones described in this blog, making use of Twitter and Medium to target victims. As seen in this campaign, CrazyEvil instructs users to download their software which is an info stealer targeting both macOS and Windows users.

While it is unclear if the campaigns described in this blog can be attributed to CrazyEvil or any sub teams, the techniques described are similar in nature. This campaign highlights the efforts that threat actors will go to make these fake companies look legitimate in order to steal cryptocurrency from victims, in addition to use of newer evasive versions of malware.

Indicators of Compromise (IoCs)

Manboon[.]com

https://gaetanorealty[.]com

Troveur[.]com

Bigpinellas[.]com

Dsandbox[.]com

Conceptwo[.]com

Aceartist[.]com

turismoelcasco[.]com

Ekodirect[.]com

https://mrajhhosdoahjsd[.]com

https://isnimitz.com/zxc/app[.]zip

http://45[.]94[.]47[.]112/contact

45[.]94[.]47[.]167/contact

77[.]73[.]129[.]18:80

Domain Keys associated with the C2s

YARA Rules

rule Suspicious_Electron_App_Installer

{

meta:

description = "Detects Electron apps collecting HWID, MAC, GPU info and executing remote EXEs/MSIs"

date = "2025-06-18"

strings:

$electron_require = /require$['"]electron['"]$/

$axios_require = /require$['"]axios['"]$/

$exec_use = /exec$.*?$/

$url_token = /app-launcher:\/\/.*token=/

$getHWID = /(Get-CimInstance Win32_ComputerSystemProduct).UUID/

$getMAC = /details\.mac && details\.mac !== '00:00:00:00:00:00'/

$getGPU = /wmic path win32_VideoController get name/

$getInstallDate = /InstallDate/

$os_info = /os\.cpus\[0\]\.model/

$downloadExe = /\.exe['"]/

$runExe = /msiexec \/i.*\/quiet \/norestart/

$zipExtraction = /AdmZip\(.*\.extractAllTo/

condition:

(all of ($electron_require, $axios_require, $exec_use) and

3 of ($getHWID, $getMAC, $getGPU, $getInstallDate, $os_info) and

2 of ($downloadExe, $runExe, $zipExtraction, $url_token))

}

‍

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Written by

Tara Gould

Malware Research Lead

Malware Research Lead

•

January 13, 2026

Adam Stevens

Senior Director of Product, Cloud | Darktrace

Watch the NIS2 Webinar

Blog

January 13, 2026

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Introduction: Shifting focus from prevention to runtime

Cloud security has spent the last decade focused on prevention; tightening configurations, scanning for vulnerabilities, and enforcing best practices through Cloud Native Application Protection Platforms (CNAPP). These capabilities remain essential, but they are not where cloud attacks happen.

Attacks happen at runtime: the dynamic, ephemeral, constantly changing execution layer where applications run, permissions are granted, identities act, and workloads communicate. This is also the layer where defenders traditionally have the least visibility and the least time to respond.

Today’s threat landscape demands a fundamental shift. Reducing cloud risk now requires moving beyond static posture and CNAPP only approaches and embracing realtime behavioral detection across workloads and identities, paired with the ability to automatically preserve forensic evidence. Defenders need a continuous, real-time understanding of what “normal” looks like in their cloud environments, and AI capable of processing massive data streams to surface deviations that signal emerging attacker behavior.

Runtime: The layer where attacks happen

Runtime is the cloud in motion — containers starting and stopping, serverless functions being called, IAM roles being assumed, workloads auto scaling, and data flowing across hundreds of services. It’s also where attackers:

Weaponize stolen credentials
Escalate privileges
Pivot programmatically
Deploy malicious compute
Manipulate or exfiltrate data

The challenge is complex: runtime evidence is ephemeral. Containers vanish; critical process data disappears in seconds. By the time a human analyst begins investigating, the detail required to understand and respond to the alert, often is already gone. This volatility makes runtime the hardest layer to monitor, and the most important one to secure.

What Darktrace / CLOUD Brings to Runtime Defence

Darktrace / CLOUD is purpose-built for the cloud execution layer. It unifies the capabilities required to detect, contain, and understand attacks as they unfold, not hours or days later. Four elements define its value:

1. Behavioral, real-time detection

The platform learns normal activity across cloud services, identities, workloads, and data flows, then surfaces anomalies that signify real attacker behavior, even when no signature exists.

2. Automated forensic level artifact collection

The moment Darktrace detects a threat, it can automatically capture volatile forensic evidence; disk state, memory, logs, and process context, including from ephemeral resources. This preserves the truth of what happened before workloads terminate and evidence disappears.

3. AI-led investigation

Cyber AI Analyst assembles cloud behaviors into a coherent incident story, correlating identity activity, network flows, and Cloud workload behavior. Analysts no longer need to pivot across dashboards or reconstruct timelines manually.

4. Live architectural awareness

Darktrace continuously maps your cloud environment as it operates; including services, identities, connectivity, and data pathways. This real-time visibility makes anomalies clearer and investigations dramatically faster.

Together, these capabilities form a runtime-first security model.

Why CNAPP alone isn’t enough

CNAPP platforms excel at pre deployment checks all the way down to developer workstations, identifying misconfigurations, concerning permission combinations, vulnerable images, and risky infrastructure choices. But CNAPP’s breadth is also its limitation. CNAPP is about posture. Runtime defense is about behavior.

CNAPP tells you what could go wrong; runtime detection highlights what is going wrong right now.

It cannot preserve ephemeral evidence, correlate active behaviors across domains, or contain unfolding attacks with the precision and speed required during a real incident. Prevention remains essential, but prevention alone cannot stop an attacker who is already operating inside your cloud environment.

Real-world AWS Scenario: Why Runtime Monitoring Wins

A recent incident detected by Darktrace / CLOUD highlights how cloud compromises unfold, and why runtime visibility is non-negotiable. Each step below reflects detections that occur only when monitoring behavior in real time.

1. External Credential Use

Detection: Unusual external source for credential use: An attacker logs into a cloud account from a never-before-seen location, the earliest sign of account takeover.

2. AWS CLI Pivot

Detection: Unusual CLI activity: The attacker switches to programmatic access, issuing commands from a suspicious host to gain automation and stealth.

3. Credential Manipulation

Detection: Rare password reset: They reset or assign new passwords to establish persistence and bypass existing security controls.

4. Cloud Reconnaissance

Detection: Burst of resource discovery: The attacker enumerates buckets, roles, and services to map high value assets and plan next steps.

5. Privilege Escalation

Detection: Anomalous IAM update: Unauthorized policy updates or role changes grant the attacker elevated access or a backdoor.

6. Malicious Compute Deployment

Detection: Unusual EC2/Lambda/ECS creation: The attacker deploys compute resources for mining, lateral movement, or staging further tools.

7. Data Access or Tampering

Detection: Unusual S3 modifications: They alter S3 permissions or objects, often a prelude to data exfiltration or corruption.

Only some of these actions would appear in a posture scan, crucially after the fact.
Every one of these runtime detections is visible only through real-time behavioral monitoring while the attack is in progress.

The future of cloud security Is runtime-first

Cloud defense can no longer revolve solely around prevention. Modern attacks unfold in runtime, across a fast-changing mesh of workloads, services, and — critically — identities. To reduce risk, organizations must be able to detect, understand, and contain malicious activity as it happens, before ephemeral evidence disappears and before attacker's pivot across identity layers.

Darktrace / CLOUD delivers this shift by turning runtime, the most volatile and consequential layer in the cloud, into a fully defensible control point through unified visibility across behavior, workloads, and identities. It does this by providing:

Real-time behavior detection across workloads and identity activity ‍
Autonomous response actions for rapid containment ‍
Automated forensic level artifact preservation the moment events occur ‍
AI-driven investigation that separates weak signals from true attacker patterns ‍
Live cloud environment insight to understand context and impact instantly

Cloud security must evolve from securing what might go wrong to continuously understanding what is happening; in runtime, across identities, and at the speed attackers operate. Unifying runtime and identity visibility is how defenders regain the advantage.

[related-resource]

About the author

Adam Stevens

Senior Director of Product, Cloud | Darktrace

Blog

Network

January 12, 2026

Maduro Arrest Used as a Lure to Deliver Backdoor

maduro arrest used as lure to deliver backdoor

Introduction

Threat actors frequently exploit ongoing world events to trick users into opening and executing malicious files. Darktrace security researchers recently identified a threat group using reports around the arrest of Venezuelan President Nicolàs Maduro on January 3, 2025, as a lure to deliver backdoor malware.

Technical Analysis

While the exact initial access method is unknown, it is likely that a spear-phishing email was sent to victims, containing a zip archive titled “US now deciding what’s next for Venezuela.zip”. This file included an executable named “Maduro to be taken to New York.exe” and a dynamic-link library (DLL), “kugou.dll”.

The binary “Maduro to be taken to New York.exe” is a legitimate binary (albeit with an expired signature) related to KuGou, a Chinese streaming platform. Its function is to load the DLL “kugou.dll” via DLL search order. In this instance, the expected DLL has been replaced with a malicious one with the same name to load it.

Once the DLL is executed, a directory is created C:\ProgramData\Technology360NB with the DLL copied into the directory along with the executable, renamed as “DataTechnology.exe”. A registry key is created for persistence in “HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Lite360” to run DataTechnology.exe --DATA on log on.

Figure 2. Registry key added for persistence.

Figure 3: Folder “Technology360NB” created.

During execution, a dialog box appears with the caption “Please restart your computer and try again, or contact the original author.”

Figure 4. Message box prompting user to restart.

Prompting the user to restart triggers the malware to run from the registry key with the command --DATA, and if the user doesn't, a forced restart is triggered. Once the system is reset, the malware begins periodic TLS connections to the command-and-control (C2) server 172.81.60[.]97 on port 443. While the encrypted traffic prevents direct inspection of commands or data, the regular beaconing and response traffic strongly imply that the malware has the ability to poll a remote server for instructions, configuration, or tasking.

Conclusion

Threat groups have long used geopolitical issues and other high-profile events to make malicious content appear more credible or urgent. Since the onset of the war in Ukraine, organizations have been repeatedly targeted with spear-phishing emails using subject lines related to the ongoing conflict, including references to prisoners of war [1]. Similarly, the Chinese threat group Mustang Panda frequently uses this tactic to deploy backdoors, using lures related to the Ukrainian war, conventions on Tibet [2], the South China Sea [3], and Taiwan [4].

The activity described in this blog shares similarities with previous Mustang Panda campaigns, including the use of a current-events archive, a directory created in ProgramData with a legitimate executable used to load a malicious DLL and run registry keys used for persistence. While there is an overlap of tactics, techniques and procedures (TTPs), there is insufficient information available to confidently attribute this activity to a specific threat group. Users should remain vigilant, especially when opening email attachments.

Credit to Tara Gould (Malware Research Lead)
Edited by Ryan Traill (Analyst Content Lead)

Indicators of Compromise (IoCs)

172.81.60[.]97
8f81ce8ca6cdbc7d7eb10f4da5f470c6 - US now deciding what's next for Venezuela.zip
722bcd4b14aac3395f8a073050b9a578 - Maduro to be taken to New York.exe
aea6f6edbbbb0ab0f22568dcb503d731 - kugou.dll

References

[1] https://cert.gov.ua/article/6280422

[2] https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor

[3] https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan

[4] https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan

About the author

Tara Gould

Malware Research Lead

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

Overview

Windows Version

MacOS Version

List of known companies

Traffer Groups

Indicators of Compromise (IoCs)

Domain Keys associated with the C2s

YARA Rules

Maduro Arrest Used as a Lure to Deliver Backdoor

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Enjoying the blog?

More in this series

Blog

January 13, 2026

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Introduction: Shifting focus from prevention to runtime

Runtime: The layer where attacks happen

What Darktrace / CLOUD Brings to Runtime Defence

1. Behavioral, real-time detection

2. Automated forensic level artifact collection

3. AI-led investigation

4. Live architectural awareness

Why CNAPP alone isn’t enough

Real-world AWS Scenario: Why Runtime Monitoring Wins

1. External Credential Use

2. AWS CLI Pivot

3. Credential Manipulation

4. Cloud Reconnaissance

5. Privilege Escalation

6. Malicious Compute Deployment

7. Data Access or Tampering

The future of cloud security Is runtime-first

Blog

Network

January 12, 2026

Maduro Arrest Used as a Lure to Deliver Backdoor

Introduction

Technical Analysis

Conclusion

Indicators of Compromise (IoCs)

References