CampaignPublished 26 Aug 2025

Boxing Clever: Uncovering a $1M Task Scam Cluster Exploiting Major Brands

Source AlienVault OTX General

Description

A sophisticated task scam cluster has been discovered, exploiting major brands like Delta Airlines, AMC Theatres, and Universal Studios. The scam uses API-driven templates and cryptocurrency payments, with over $1 million in attributable transactions. Victims are lured into 'earning' money by completing tasks such as booking flights. The scam requires initial cryptocurrency deposits to become a 'VIP' member. The infrastructure utilizes domains registered through Dominet, Alibaba Cloud's registrar, with a distinct registrant pattern. Multiple wallet addresses across different cryptocurrencies have been identified. The scam's configuration files reveal its adaptability across various brands and industries.

Impact

For European organizations, particularly those in the travel, entertainment, and hospitality sectors, this scam poses reputational and operational risks. Brand impersonation can erode customer trust and lead to increased customer service burdens as victims seek remediation or report fraud. Although the scam targets individuals rather than corporate systems directly, European companies whose brands are impersonated may face indirect impacts including brand dilution, customer confusion, and potential legal liabilities if customers are harmed. Additionally, the use of European-registered domains or infrastructure could implicate local regulatory frameworks such as GDPR, requiring organizations to respond to data misuse or fraudulent activities involving their brand. The financial losses primarily affect individual victims; however, the broader economic impact includes increased fraud-related costs and potential regulatory scrutiny. The scam's use of cryptocurrency complicates recovery efforts and law enforcement intervention within Europe, where cryptocurrency regulations vary but are generally evolving to address such abuses. Organizations may also face increased phishing attempts or social engineering attacks inspired by this campaign, necessitating heightened vigilance.

Defensive guidance

European organizations should implement targeted brand protection strategies including continuous monitoring of domain registrations and online mentions of their brand names to detect and takedown fraudulent domains rapidly. Collaboration with domain registrars like Dominet and cloud providers such as Alibaba Cloud to enforce stricter domain registration verification can help disrupt scam infrastructure. Enhancing customer awareness through proactive communication campaigns that educate users about the scam’s modus operandi, emphasizing that legitimate companies do not require cryptocurrency deposits for membership or earnings, is critical. Deploying advanced email and web filtering solutions that detect and block phishing attempts leveraging these scam domains will reduce victim exposure. Organizations should also engage with law enforcement and financial regulators to track and freeze associated cryptocurrency wallets where possible. Internally, companies should prepare incident response plans for brand impersonation and fraud cases, including legal and PR strategies. Finally, sharing threat intelligence with industry groups and CERTs across Europe will improve collective defense against such adaptable scams.

Indicators of compromise

Domains 7

all-accorli.com
amblinil.com
amctheatreilu.com
deltaairlineivip.com
epicrecorlvip.com
fp40.com
universalstudioworksite.com

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Aug 2025, 19:04 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Domains 7

Community reviews

Related threats