Impact of data breaches is fueling scam campaigns
Summary: Cisco Talos has tracked a cryptocurrency heist scam running since at least January 2024 in which scammers impersonate CySEC investigation officers, using vishing and spear phishing to contact people who were once Opteck trading platform users. The lure is a fake refund of a seized amount tied to Opteck, whose database was sold on raidforums in 2017 and whose user credentials Talos says are still sold on Russian dark markets today.
Why it matters: Talos traced four Ethereum wallets tied to the campaign with balances of roughly $1.2K, $12K, $90K and $3.5K, and the scam escalates from a promised 816 USDT wallet activation to a 10% 'Coinbase legal insurance fee' and then a further negotiation payment, none of which is ever refunded. The entry point is a breach from 2017 - seven years of stolen credentials still being weaponized against the people who once used the platform.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026