A seller on a cybercrime forum is offering a ready-made scam kit for $500, complete with an admin panel that tracks victims, checks their crypto wallets for value, and inflates fake balances to squeeze out more money, Malwarebytes found.
Researchers discovered the scam project on May 16 and described it as an example of how social engineering, phishing, and financial fraud can be combined into a single operation.
The account behind the kit goes by xrep. It has been active on the forum since March 2026 and has built a reputation there, with other cybercriminals leaving positive feedback on its threads.
Xrep’s specialty is packaged tools built around X. Instead of making buyers write their own code or set up their own servers, xrep hands over something close to a finished product.
“It is a complete scam-in-a-box,” Malwarebytes said. “The technical infrastructure, phishing functionality, fake investment dashboard, victim tracking, and administrative controls are bundled together into a ready-to-use package.”
Scammers use fake $TSLA presale to steal cryptocurrency
The kit Malwarebytes examined builds a fake presale page for a token called $TSLA, styled to look like it comes from Tesla. It supports several languages and works on phones as well as desktops.
Scam project screenshot (Source: Malwarebytes)
The scam starts with a fake “eligibility check” that asks visitors for their X username, then pulls their profile photo to make the offer feel tailored to them. From there the page piles on pressure. A progress bar climbs on its own, a countdown clock ticks down, and warnings claim the token price is about to rise, all built to make people move fast and skip questions.
Once someone believes the offer is genuine, the site gives them two ways to lose their money.
One asks them to connect a crypto wallet to claim a bonus. The form that opens up asks for a 12-word recovery phrase, the words that control everything in a wallet. Whoever has that phrase can empty it.
