- Cofense uncovers IRS‑themed crypto scam with Elon Musk
- Fake IRS emails steal personal and banking data
- Victims lured into bogus “Dogecoin Initiative” requiring Bitcoin payments
Security researchers from Cofense have uncovered a new cryptocurrency scam that combines Elon Musk with the Internal Revenue Service (IRS).
The US is in peak tax season, which also means IRS-themed scams are reaching their zenith, and as with most fraud campaigns, this one also starts with an email.
Designed to look as if it were from the IRS, the email tells the recipient they’ve been selected to receive a $5,000 financial injection, courtesy of none other than Elon Musk.
Removing vulnerable apps
Those who don’t ask silly questions (for example, why would Elon Musk send random people money through the IRS?) and click on the buttons provided in the email, are redirected to a number of malicious landing pages, designed to steal all sorts of sensitive personal and banking information.
As part of the registration process, needed to receive Elon Musk’s refund, victims are told to share their full names, postal and email addresses, phone numbers, driver’s license numbers, names of their employers, and even their banking institutions.
They are also asked to upload a photo of their ID card and provide bank routing and account numbers.
“Using this information, the threat actors would be capable of much more sophisticated identity theft and social engineering attacks beyond the information exfiltrated from the credential phishing form,” the researchers said. “The threat actors would also be able to steal money directly from the victim’s bank account due to having access to the account and routing numbers.”
The scammers didn’t stop there. They also invited the victims to be part of a fake “ElonMusk Dogecoin Initiative”. They are told that if they purchase $10,000 in Bitcoin (from a fake exchange), and send it to Elon’s address, they’ll be reimbursed, and will get to keep $500 per transaction.
At the time Cofense wrote the report, Bitcoin wallet addresses belonging to the attackers showed no transactions, meaning no one took the bait. Hopefully, Cofense’s report raises enough awareness for it to stay that way.
