Fake AML Checkers Drain Crypto Wallets with Unauthorized Transactions
Crypto investors are falling prey to fake anti-money laundering (AML) screening websites that are stealing from them. These sites prompt users to connect their wallet and sign a transaction, which is not required for any genuine AML check.
According to Malwarebytes, the attacker's kit is being rebranded and resold under different names and logos. The $500 turnkey kit available on a cybercrime forum creates a fake TSLA presale and scans each visitor's wallet for valuable assets.
The malicious sites use a similar approach to phish for the 12-word recovery phrase by offering a 15% bonus. In May, Solana Floor analysts spotted a scheme that flooded Solana wallets with fake CJUP tokens impersonating Jupiter Exchange's Jupuary airdrop.
CoinDCX has detected over 1,212 fake websites impersonating its platform between April 2024 and January 2026. Malwarebytes advised that anyone who only connected their wallet should disconnect the site and check for unfamiliar permissions and revoke them if necessary.