New turnkey kit makes it easy for anyone to become a scammer

In 2026, online scams have unfortunately become part of the new normal. They can appear almost anywhere, from social media and messaging apps to search results, websites, and online communities, and they can target anyone. Sometimes, all it takes is a moment of curiosity and a convincing offer.

Among the most devastating scams are so-called “get-rich-quick” schemes. These scams promise something that’s difficult for people to resist: the chance to make a lot of money, quickly and with little or no effort. It may come in the form of an investment opportunity, a new cryptocurrency project, or an exclusive chance to get in early before everyone else.

However, behind the promises of easy money can be carefully designed operations built to gain trust, collect deposits, and ultimately leave victims with significant financial losses. In some cases, scammers go to considerable lengths to make their projects appear legitimate, creating professional-looking websites, social media profiles, and convincing stories designed to attract as many victims as possible.

This is the story of one such project: a crypto scam discovered on a cybercrime forum, where the people behind it appeared to openly discuss and promote their operation.

What we found provides a glimpse into how modern online scams are built, promoted, and potentially used to target everyday consumers.

Meet “xrep”

The threat actor known as xrep has been active in the cybercrime underground since March 2026. It appears that xrep has already built a positive reputation among customers, receiving favorable feedback for the services and solutions they provide.

In general, xrep specializes in ready-to-use solutions related to X, formerly known as Twitter. Rather than requiring customers to build their own infrastructure or develop the necessary tools, xrep offers what can essentially be described as a full turnkey solution for scammers.

This approach significantly lowers the barrier to entry for scammers looking to conduct malicious activities. By providing a ready-made package that requires little technical expertise to deploy, xrep enables individuals with limited skills to potentially launch scams with considerably less effort.

$TSLA scam: A crypto investment opportunity designed to steal

The scam project, discovered on May 16 by the Malwarebytes research team on a high-profile cybercrime forum, is a good example of how modern scams combine social engineering, phishing, and financial fraud into a single operation.

The product, priced at just $500, is essentially a ready-made website designed to look like a legitimate cryptocurrency presale. The supposed opportunity is presented as an exclusive $TSLA token presale for users of X, creating the impression that visitors have been personally selected for an early investment opportunity.

The website is designed to look professional and trustworthy, clearly impersonating the Tesla brand name and company logo. It supports multiple languages and is optimized for both computers and mobile devices. But the most important part is what happens behind the scenes.

The scam begins with a fake “eligibility check.” Visitors are asked to enter their X username. The screenshots below are taken from the $TSLA token scam site.

The website then retrieves their real profile picture and uses it to generate a fictional token allocation. This makes the offer appear personalized, giving the victim the impression that they have been specifically chosen to participate.

The site also uses classic psychological pressure tactics. A fake fundraising progress bar continuously increases, a countdown timer creates a sense of urgency, and warnings suggest that the token price will increase soon. These features are designed to create FOMO (fear of missing out) and encourage victims to act before they have time to question whether the investment is legitimate.

Once a victim is convinced, the scam offers two ways to lose money or access to their cryptocurrency wallet.

The first is a classic phishing attack. Victims are encouraged to connect their cryptocurrency wallet to receive a supposed 15% bonus. Instead of connecting a legitimate wallet, they are prompted to enter their 12-word recovery phrase, also known as a seed phrase.

This phrase is effectively the master key to a cryptocurrency wallet. Anyone who obtains it may be able to access the funds stored in that wallet.

The second method involves direct payments. After going through the fake wallet process, victims are redirected to a convincing-looking personal dashboard. There, they can see a fabricated token balance and are encouraged to purchase additional $TSLA tokens.

The victim is instructed to manually send cryptocurrency, such as Bitcoin, Ethereum, USDT, or Dogecoin, to an address controlled by the scammer.

Key Takeaways

• A new turnkey kit lowers the barrier for anyone to become a scammer.
• Get-rich-quick schemes remain devastating by promising easy money with little effort.
• Modern scams use professional websites and social media to appear legitimate.