Start with the clue you already have, then move into verification, reporting, or recovery.
Check domains, web pages, and impersonation risk.
Use this for invoices, restriction emails, and fake support messages.
Use this for Telegram, WhatsApp, and investment groups.
Check community reports and impersonation patterns.
Start here for on-chain transfers, wallet addresses, and contracts.
Move directly into the victim action plan and next steps.
Check whether a site looks safe before you visit, pay, or sign in
Check wallets and token contracts before you send or approve crypto
Check if a token is a honeypot or rug pull
Check suspicious calls before you call back, share codes, or move money
Verify who you are dealing with before you sign, pay, or share documents
Detect lookalike address scams
AI wallet profiling & risk analysis
Check whether a suspicious email is pushing you into a fake login, payment, or callback
Check chats and DMs for scam pressure, fake support, or investment pitches
Browse flagged domains and addresses
See important scam cases, warnings, and records in one place
Interpol, FBI, OFAC wanted and sanctioned entities
Read scam takedowns, arrests, and new tactics that may match your case
Known scam compound locations worldwide
Search names, companies, domains, wallets, and sanctioned entities in one place
Get a plain-language roundup of major scam cases and warning trends
Open suspicious links safely and reveal hidden redirects before you continue
Report a suspicious website and preserve the evidence for others
Report a suspicious wallet, address, or crypto payment path
Get a step-by-step action plan if you already paid, replied, or shared data
Generate a freeze request if your USDT was stolen
Find verified lawyers, investigators & forensic accountants
Escalate complex cases when you need deeper answers before you trust or pay
Corporate background check from $7.99
Trace cryptocurrency transaction flows
Trace 2-100 wallets in one transaction with volume pricing.
This is a standalone intelligence detail page built for indexing and citation, with the summary, linked domains, and next verification paths in one place.
Quick Answer
Threat actors abuse legitimate OpenAI and Google domains in a ClickFix-style campaign to distribute Remote Access Trojans (RATs). Users are deceived through malicious custom GPTs, exploiting trust in legitimate platforms to deliver malware.
dark reading
Source
MEDIUM
Importance
2
Linked Domains
0
Linked Addresses
Threat actors abuse legitimate OpenAI and Google domains in a ClickFix-style campaign to distribute Remote Access Trojans (RATs). Users are deceived through malicious custom GPTs, exploiting trust in legitimate platforms to deliver malware.
If your case resembles this story, continue by checking the website, email, chat, or formal reporting path with a more practical step-by-step guide.
Website Check
If the story involves websites, landing pages, or impersonation, move into the website checker next.
Email / Chat
Many intelligence stories eventually surface as fake support, fake notices, or chat-driven funnels.
Formal Reporting
If your case mirrors this pattern closely, move straight into reporting and victim action planning.
Continue with similar incidents to judge whether this is an isolated case or part of a broader fraud pattern.
Technical
A year-old Chinese ransomware threat actor operating under the name Warlock targets large organizations in Spain and Portugal. The group exhibits characteristics of both cybercriminal gangs and state-associated APT activities, employing sophisticated attack methods against organizations in geographically unexpected regions.
Technical
A major Polish online invoicing platform experienced a cyberattack resulting in a data breach. The incident exposed personal information of platform users, their customers, and business partners. The breach impacts multiple stakeholder groups across Poland's business sector.
Technical
Google researchers report vulnerability disclosures have doubled to over 10,000 per month, driven by AI-enabled exploitation techniques. The surge indicates accelerating cybercrime exploitation velocity and represents significant threat landscape evolution.