Cybersecurity firm Malwarebytes has discovered a phishing kit being sold for $500 on a cybercrime forum, according to a report from Cryptopolitan. The kit allows users with virtually no technical background to stand up a fake presale site for Tesla's $TSLA token.
The scam flow is deceptively elaborate. When a visitor enters their X username on the page, the site pulls up their real profile picture, creating the illusion of a personal invitation. Countdown timers and price-increase warnings pile on additional urgency.
If the victim selects the option labeled “15% bonus link wallet,” they are prompted to enter a 12-word recovery phrase, which drains their wallet. If they instead choose to “invest” directly, they are told to send crypto assets to an address controlled by the scammers. After that, they only see a bogus balance displayed on a fake dashboard.
The kit's control panel gives the operator real-time visibility into victims, collects their recovery phrases, and even lets the scammer pre-check a wallet's balance before deciding whether to proceed. Malwarebytes reported detecting the tool on May 16. In a related wave of phishing activity, both IRS and Ledger users have recently been targeted with similar attacks.