Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims
Summary: Unit 42 researchers uncovered a campaign running thousands of fraudulent cryptocurrency investment platforms, each reachable through a website and an Android app that is not published on any app store. The sites promise returns such as $3 a day on an $11 investment - a 27% daily ROI, or at least 2,650% annually - and use multi-level affiliate programs that Unit 42 describes as telltale signs of a pyramid scheme.
What's compelling: The operation registered roughly 15 domains a day, 82% of them in Singapore under fake names like "Sophia" and "Abe," and 97% of hosting IPs sit behind a single cloud provider used for domain fronting - so blocking individual domains buys little against an actor building them at this rate. One associated Telegram channel alone had over 29,000 members, a ready-made pool of victims in East African and Asian markets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026