A seller on a cybercrime forum is offering a ready-made scam kit for $500, complete with an admin panel that tracks victims, checks their crypto wallets for value, and inflates fake balances to squeeze out more money, Malwarebytes found.
Researchers discovered the scam project on May 16 and described it as an example of how social engineering, phishing, and financial fraud can be combined into a single operation.
The account behind the kit goes by xrep. It has been active on the forum since March 2026 and has built a reputation there, with other cybercriminals leaving positive feedback on its threads.
Xrep’s specialty is packaged tools built around X. Instead of making buyers write their own code or set up their own servers, xrep hands over something close to a finished product.
“It is a complete scam-in-a-box,” Malwarebytes said. “The technical infrastructure, phishing functionality, fake investment dashboard, victim tracking, and administrative controls are bundled together into a ready-to-use package.”
Scammers use fake $TSLA presale to steal cryptocurrency
The kit Malwarebytes examined builds a fake presale page for a token called $TSLA, styled to look like it comes from Tesla. It supports several languages and works on phones as well as desktops.
Scam project screenshot (Source: Malwarebytes)
The scam starts with a fake “eligibility check” that asks visitors for their X username, then pulls their profile photo to make the offer feel tailored to them. From there the page piles on pressure. A progress bar climbs on its own, a countdown clock ticks down, and warnings claim the token price is about to rise, all built to make people move fast and skip questions.
Once someone believes the offer is genuine, the site gives them two ways to lose their money.
One asks them to connect a crypto wallet to claim a bonus. The form that opens up asks for a 12-word recovery phrase, the words that control everything in a wallet. Whoever has that phrase can empty it.
The other skips wallets and just asks for a transfer, in Bitcoin, Ethereum, USDT, or Dogecoin, sent straight to an address the scammer owns.
“Victims may believe they have made a legitimate investment, but no real tokens are being purchased. Instead, the scammer simply receives the cryptocurrency while the victim sees a fake balance displayed on the website,” researchers noted.
Admin panel gives scammers control over victims
“What makes this operation particularly concerning is the level of control provided to the scammer,” researchers noted.
Beyond watching victims move through the site and pulling in their X usernames, locations, and any recovery phrases they enter, the panel lets the operator check whether a stolen wallet is worth draining further before bothering to chase it. And the fake balance a victim sees isn’t set once and left alone. The operator can raise it whenever they want, so the investment looks like it’s paying off and the victim sends more.
The panel also lets the scammer manage fake purchase orders and message victims directly. If someone has already sent money, the operator can follow up claiming there’s a delay and that an extra network fee is needed to release the funds, a second attempt at the same wallet.
“Someone who may not have the skills to build a phishing website, develop an administration system, or create convincing investment interfaces can potentially purchase the kit and begin targeting victims with minimal effort,” Malwarebytes concluded.