Scammers are conducting a phishing campaign leveraging the SpaceX IPO hype by deploying fake investment portals that impersonate SpaceX, Elon Musk, and well-known financial brands. These portals simulate legitimate investment procedures, including tax form submission, to deceive victims into depositing cryptocurrency funds (Bitcoin, Ethereum, USDT) into attacker-controlled wallets. The campaign infrastructure includes numerous randomized and SpaceX-themed domains designed to appear authentic. This campaign resembles tactics used by threat actor TA2730 but is focused on direct cryptocurrency theft rather than stealing credentials.

Victims of this campaign risk losing cryptocurrency funds sent to attacker-controlled wallets. The campaign has already resulted in at least one Bitcoin wallet receiving approximately $8,700. There is no indication of credential theft or other forms of compromise beyond financial loss through fraudulent investment deposits.

No official patch or fix applies as this is a phishing and fraud campaign. Defenders should block and monitor the listed malicious domains and educate users about the risks of fake investment portals, especially those impersonating high-profile events like IPOs. Users should be advised to verify investment opportunities through official channels and avoid sending cryptocurrency to unverified wallets. Since this is a social engineering campaign, technical controls such as domain blacklisting and email filtering are recommended.