# PhishDestroy — 100k-returned-malvertising ================================================================ Title: Fake Ad Partnership Stealer: $100K+ Recovered | PhishDestroy Canonical: https://phishdestroy.io/100k-returned-malvertising Published: 2025-08-12 Author: PhishDestroy Research Schema: Organization, ImageObject, ContactPoint, WebSite, SearchAction, EntryPoint, NewsArticle, CreativeWork, BreadcrumbList, ListItem, WebPage, SpeakableSpecification OG image: https://phishdestroy.io/assets/images/covers-v4/100k-returned-malvertising.webp ## SUMMARY ---------------------------------------------------------------- We detected a Russian malvertising operation using stealer malware, restored wallet access, and returned $100K+ to victims. ## KEY FACTS ---------------------------------------------------------------- In short: A crypto project received a fake advertising partnership offer; during video calls the attackers had staff install a “workplace viewer” that was stealer malware, and funds were moved. PhishDestroy confirmed the compromise, restored wallet access, secured the attacker's receiving wallet for the victim team and recovered over $100,000. The offered reward was declined and redirected to @_SEAL_Org. - Funds recovered: over $100,000 (source: https://phishdestroy.io/100k-returned-malvertising; as of 2025-08) - Attack vector: Stealer malware disguised as a “workplace viewer” (source: https://phishdestroy.io/100k-returned-malvertising; as of 2025-08) - Reward: Declined; surplus directed to @_SEAL_Org (source: https://phishdestroy.io/100k-returned-malvertising; as of 2025-08) - Key rule: If a workflow from unknown parties requires a special client/viewer/updater, assume hostility by default (source: https://phishdestroy.io/100k-returned-malvertising; as of 2025-08) ## STRUCTURE ---------------------------------------------------------------- - $100K Returned — Malvertising Scam Foiled - In short - Overview - What You Need to Know - How the Scam Operated - Response Actions Taken - Post-Incident Hardening - Device Security - Operational Setup - Forensics Preparation - Understanding "Adverting" - The Reward and Independence - Core Principles - Practical Recommendations - For Projects & Teams - For the Community - Conclusion - Quick Links - Need Urgent Help? - Share This Investigation - Related Investigations - Explore this topic ## CONTENT ---------------------------------------------------------------- Investigation • 5–7 min read $100K Returned — Malvertising Scam Foiled Russian scammers impersonated a crypto project via malvertising and stealer malware. We detected the operation, restored wallet access, and returned over $100K. The extra recovered funds were donated to @_SEAL_Org. Below: breakdown, IOCs, and lessons. 4 min read· Published 2025-08-12· Updated 2026-10-21· PhishDestroy Research In short A crypto project received a fake advertising partnership offer; during video calls the attackers had staff install a “workplace viewer” that was stealer malware, and funds were moved. PhishDestroy confirmed the compromise, restored wallet access, secured the attacker's receiving wallet for the victim team and recovered over $100,000. The offered reward was declined and redirected to @_SEAL_Org. Listen to this article 0:00 / --:-- Download the official report (PDF) On this page01 / 10 Originally published on PhishDestroy's Medium [https://phishdestroy.medium.com/100k-returned-adverting-scam-foiled-464fcfc03d90] Overview A cryptocurrency project fell victim to a social engineering attack disguised as a legitimate advertising partnership. PhishDestroy restored wallet access and recovered over $100,000 in compromised funds, then redirected the offered reward to an external organization to maintain independence. What You Need to Know The wallet was already compromised; funds had already been moved. Access was restored and $100K+ was prevented from remaining with the attacker. The project offered a reward, which was declined and directed to @_SEAL_Org [https://twitter.com/_SEAL_Org] instead. This work is conducted independently as an operator effort, not as paid employment. How the Scam Operated Victim received a partnership/advertising proposal for a crypto game. Attack appeared credible: professional website, established X (Twitter) presence, legitimate-seeming video calls. During calls, attackers requested installation of a "workplace viewer" to access materials. The "viewer" was stealer malware. Attackers withdrew funds, swapped tokens across chains, and moved assets to their own wallet. Response Actions Taken Confirmed compromise and halted further movement. Restored wallet access for the rightful owner. Secured and reassigned control of attacker's receiving wallet to victim team. Coordinated follow-up steps to reduce residual risk. Result: Access restored, control returned, attacker locked out. Post-Incident Hardening Device Security Step-by-step guidance for handling infected devices safely Network isolation, session revocation, credential/key rotation, clean rebuild plan Operational Setup New, clean workstation dedicated to wallet operations Fresh OS, vendor-only downloads, hardware wallet, minimal extensions, separate browser profile, 2FA Forensics Preparation Disk snapshots and system/app log collection guidance Evidence preservation for potential legal investigation Understanding "Adverting" Adverting is business-style social engineering where criminals imitate normal workflows (ad buys, partnerships, PR) to trick installation of malicious "clients." Common warning signs: "Install our ad manager/helper to sync creatives" "Use our custom Zoom/Telegram client for the call" "Open our media kit/NDA via a secure viewer" Key rule: If a workflow from unknown parties requires a special client/viewer/updater, assume hostility by default. Use only official vendor downloads. The Reward and Independence The project offered a reward because recovery exceeded the initial loss. PhishDestroy declined to keep the reward. The entire surplus was directed to @_SEAL_Org [https://twitter.com/_SEAL_Org]. This keeps PhishDestroy independent, with no funding streams or obligations. Core Principles Independence only: no budgets or strings attached. Results-focused approach over discussion. Opposition to any "special clients" or unverified software. Selective disclosure that helps victims, not threat actors. Direct pressure on attacker infrastructure. Practical Recommendations For Projects & Teams Never install workplace viewers/clients/updaters from unverified third parties. Obtain Zoom/Telegram only from official vendor sites. Avoid sponsored links for wallets, bridges, airdrops. Prefer hardware wallets with offline seed storage. If compromised: revoke sessions, move funds, rotate keys, re-issue secrets, seek help immediately. For the Community Report suspicious activity via our Telegram bot [https://t.me/PhishDestroy_bot]. Access critical action guidance and resources at phishdestroy.io/critical-action. Conclusion Despite funds already being moved, PhishDestroy restored access and made sure the attacker could not retain the stolen assets. By declining the reward and directing surplus funds elsewhere, the organization maintains its unpaid, independent operational model focused on rapid, effective incident response. Quick Links Report via Telegram bot [https://t.me/PhishDestroy_bot] Critical Action: what to do if hacked Anatomy of a Takedown Crypto Security Guide If your wallet is compromised: revoke sessions, rotate keys, contact us immediately. Need Urgent Help? Telegram Bot [https://t.me/PhishDestroy_bot]contact@phishdestroy.io #Adverting#WalletRecovery#StealerMalware#SocialEngineering#CryptoSecurity Share This Investigation X / Twitter [https://twitter.com/intent/tweet?text=%24100K%20Returned%3A%20Malvertising%20Crypto%20Scam%20Dismantled&url=https%3A//phishdestroy.io/100k-returned-malvertising] Telegram [https://t.me/share/url?url=https%3A//phishdestroy.io/100k-returned-malvertising&text=%24100K%20Returned%3A%20Malvertising%20Crypto%20Scam%20Dismantled] Reddit [https://reddit.com/submit?url=https%3A//phishdestroy.io/100k-returned-malvertising&title=%24100K%20Returned%3A%20Malvertising%20Crypto%20Scam%20Dismantled] LinkedIn [https://www.linkedin.com/sharing/share-offsite/?url=https%3A//phishdestroy.io/100k-returned-malvertising] Related Investigations DEEP INVESTIGATION Anatomy of Crypto Phishing: 8 Real Seed Phrase Stealers Reverse-Engineered INVESTIGATION $0 Takedowns: How We Disrupt Phishing Infrastructure INVESTIGATION Scammers Exposed: 4 Scam Backends Dissected ## EXTERNAL REFERENCES ---------------------------------------------------------------- t.me (6 mentions) github.com (3 mentions) twitter.com (3 mentions) gitlab.com (2 mentions) phishdestroy.medium.com (2 mentions) reddit.com (1 mention) www.linkedin.com (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) phishdestroy.eth.limo (1 mention) huggingface.co (1 mention) analyze.destroy.tools (1 mention) api.destroy.tools (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/100k-returned-malvertising If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.