A Day in the Life of a Prolific Voice Phishing Crew
Summary: Krebs on Security reports that a voice phishing group called Crypto Chameleon, whose phishing kit is run by a Telegram administrator known as "Perm," abuses legitimate Apple and Google services to generate genuine account notifications and emails to targets. Leaked tutorials from a former partner named "Stotle" show crews splitting roles into caller, operator, drainer and owner, calling Apple's real support line 800-275-2273 with a spoofed victim number to trigger an Apple Account Confirmation prompt, and using Coinbase's public newsletter signup to send emails from coinbase.com.
What you should know: The phishers' credibility comes from your own vendors' infrastructure: a real Apple prompt or a real email from coinbase.com defeats the advice to trust only official channels, and the group's target lists are built from the 2022 and 2024 Trezor breaches and autodoxer tools that pull full Social Security numbers and rank targets by home value.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026